@wtfalch/foundry 0.17.1 → 0.18.0

package/dist/plan/executor.js

@@ -10,16 +10,16 @@ import { CHAT_REPO, CHAT_SERVICE_DOCKERFILE, CHAT_SERVICE_PORT, CHAT_SYNAPSE_DOC
 import { ensureCloudflaredConnector } from './cloudflared-connector.js';
 import { CORE_FILES_COLLECTION_NAME, FILES_CORE_COLLECTION_SCOPE_KEY, ZITADEL_FILES_PROJECT_SCOPE_KEY, } from './core-files.js';
 import { DEFAULT_AI_LIMIT_MICROS } from './diff.js';
-import { entryEdgeAppliedScopeKey, entryEdgeRetiredScopeKey, entryEdgeRouteIdScopeKey, entryEdgeRoutePatternScopeKey, entryEdgeRoutePendingScopeKey, entryEdgeRouteZoneScopeKey, entryEdgeUploadedScopeKey, } from './edge-worker.js';
 import { AI_ENTRY_RENEW_WINDOW_DAYS, entryAiAppliedScopeKey, entryAiClampedScopeKey, entryAiExpiresScopeKey, entryAiPendingExpiresScopeKey, entryAiRetiredScopeKey, entryAiUndeliveredScopeKey, entryAiUnrevokedScopeKey, entryAiWebhookPendingScopeKey, entryAiWrittenScopeKey, parseIdList, } from './entry-ai-key.js';
+import { EDGE_ENTRY_KEY_DAYS, EDGE_RESERVED_LABELS_APPLIED_SCOPE_KEY, ENTRY_EDGE_KEY_DELIVERY_ATTEMPTS, entryEdgeMintedAtScopeKey, entryEdgeRetiredScopeKey, entryEdgeUndeliveredScopeKey, } from './entry-edge-key.js';
 import { FILES_AGORA_KEY_SCOPE_KEY, FILES_AGORA_UNDELIVERED_SCOPE_KEY, FILES_KEY_DAYS, FILES_KEY_RENEW_WINDOW_DAYS, FILES_ORG_OWNER_SCOPE_KEY, FILES_ROOT_EXPIRES_SCOPE_KEY, FILES_ROOT_PREVIOUS_SCOPE_KEY, FILES_ROOT_UNDELIVERED_SCOPE_KEY, FILES_ROOT_UNREVOKED_SCOPE_KEY, entryFilesAppliedScopeKey, entryFilesExpiresScopeKey, entryFilesMinterScopeKey, entryFilesPendingExpiresScopeKey, entryFilesRetiredScopeKey, entryFilesUndeliveredScopeKey, entryFilesUnrevokedScopeKey, entryFilesWrittenScopeKey, filesOwnerUserId, parseIdList as parseFilesIdList, } from './entry-files-key.js';
-import { ENTRY_NAMES_KEY_DELIVERY_ATTEMPTS, NAMES_ENTRY_KEY_DAYS, NAMES_RESERVED_LABELS_APPLIED_SCOPE_KEY, entryNamesMintedAtScopeKey, entryNamesRetiredScopeKey, entryNamesUndeliveredScopeKey, } from './entry-names-key.js';
 import { appHostname, coolifyDomains, entryHostnames, tunnelDnsHostnames, tunnelIngressHostnames, } from './hostnames.js';
 import { LOGIN_BINDING_SCOPE_KEY, LOGIN_HOST_PENDING_REMOVAL_SCOPE_KEY, loginBindingState, loginHostClientIds, pendingRemovalHosts, pendingRemovalState, } from './login-host.js';
 import { MAIL_COPY_COMPLETED_SCOPE_KEY, MAIL_COPY_DONE_SCOPE_KEY, parseMailCopyCompleted, runMailCopyStep, } from './mail-copy.js';
 import { CALLS_MAS_APPLIED_IMAGE_TAG_SCOPE_KEY, CALLS_SYNAPSE_APPLIED_IMAGE_TAG_SCOPE_KEY, ORG_MAIL_APPLIED_APEX_SCOPE_KEY, ORG_MAIL_APPLIED_HOST_SCOPE_KEY, appDomainsAppliedScopeKey, appEnvAppliedScopeKey, appNameFor, appSettingsAppliedScopeKey, appSettingsOf, appStepKey, appliedAppDomains, appliedAppSettings, dbEnvAppliedScopeKey, resolveAppEnv, serviceDbEnvAppliedScopeKey, } from './platform-diff.js';
 import { PLATFORM_AUTH_BROKER_MAIL_KEY_REF } from './platform-providers.js';
 import { appLabelsAppliedScopeKey, entryLabelHash, entryLabelSpec, entryProxyLabels, sameLabelSets, } from './proxy-labels.js';
+import { entryWorkerAppliedScopeKey, entryWorkerExclusionsScopeKey, entryWorkerRetiredScopeKey, entryWorkerRouteIdScopeKey, entryWorkerRoutePatternScopeKey, entryWorkerRoutePendingScopeKey, entryWorkerRouteZoneScopeKey, entryWorkerUploadedScopeKey, } from './worker.js';
 /**
  * #274 fix round 4: bridges `@wtfalch/providers`' real `ZitadelClient.
  * listApps` -- a plain array, with no `loginBaseUri` or completeness signal
@@ -508,11 +508,21 @@ const CALLS_MAS_DB_SCOPE_KEY = 'coolify_calls_mas_database';
  * Synapse refuses to start against a database whose `LC_COLLATE`/`LC_CTYPE`
  * is not `C` (https://element-hq.github.io/synapse/latest/postgres.html);
  * Coolify's official postgres image otherwise creates one with `en_US.utf8`.
- * `postgres_initdb_args` is the only point this can be set -- it cannot be
- * migrated onto an existing database. MAS has no such requirement, so this
- * is passed for the Synapse database only. Not using Synapse's own
- * `allow_unsafe_locale` escape hatch: that trades a loud startup refusal for
- * silent index corruption after a future glibc upgrade.
+ * `createPostgresDatabase` forwards this to Coolify's own
+ * `postgres_initdb_args` field -- but Coolify stores that field and reads it
+ * back unchanged without ever handing it to `initdb`: its Postgres start
+ * action builds the container's env from `postgres_user`/`postgres_password`/
+ * `postgres_db` and runtime envs only
+ * (https://github.com/coollabsio/coolify/blob/main/app/Actions/Database/StartPostgresql.php).
+ * A database created this way still comes up `en_US.utf8` and crash-loops
+ * every Synapse app that reads it; live evidence and the real fix (not yet
+ * chosen) are tracked in #494. This constant and the field it feeds stay in
+ * place, inert, until that lands -- collation cannot be migrated onto an
+ * existing database under any of the candidate fixes either. MAS has no
+ * such requirement, so this is passed for the Synapse database only. Not
+ * using Synapse's own `allow_unsafe_locale` escape hatch regardless of
+ * which fix lands: that trades a loud startup refusal for silent index
+ * corruption after a future glibc upgrade.
  */
 const CALLS_SYNAPSE_DB_INITDB_ARGS = '--locale=C --encoding=UTF8';
 /**
@@ -678,10 +688,10 @@ export class FoundryStepExecutor {
                 return action.key.includes(':')
                     ? this.aiEntryKey(action, org, context)
                     : this.aiKey(action, org, context);
-            case 'names:key':
-                return this.namesEntryKey(action, org, context);
-            case 'names:reserved-labels':
-                return this.namesReservedLabels(action, org, context);
+            case 'edge:key':
+                return this.edgeEntryKey(action, org, context);
+            case 'edge:reserved-labels':
+                return this.edgeReservedLabels(action, org, context);
             case 'coolify:mail':
                 return this.coolifyMail(action, org, context);
             case 'coolify:mail-copy':
@@ -850,10 +860,10 @@ export class FoundryStepExecutor {
         return { resourceId: created.id };
     }
     /**
-     * `plan/diff.ts`'s `planEdgeWorkers` (#318, F8): deploys one entry's
-     * `edge` Worker and routes it on the org's own zone. Throws by name
+     * `plan/diff.ts`'s `planWorkers` (#318, F8): deploys one entry's
+     * `worker` Worker and routes it on the org's own zone. Throws by name
      * without a {@link WorkersPort}, the same `jobsRegistration` shape --
-     * `planEdgeWorkers` reports the step blocked instead while the host has
+     * `planWorkers` reports the step blocked instead while the host has
      * none, so this only fires against a stale plan. The route is checked
      * before upload: a foreign route already on the pattern is refused, never
      * adopted or replaced (`cloudflareAccess`'s own precedent for a foreign
@@ -879,24 +889,25 @@ export class FoundryStepExecutor {
         if (desired.mode === 'retire') {
             const recorded = context.recordedIds();
             const mainId = recorded[`cloudflare:worker:${action.key}`];
-            const scriptName = mainId || recorded[entryEdgeUploadedScopeKey(entryKey)];
-            await this.teardownEdgeWorker(entryKey, scriptName, recorded, workers, at);
-            context.recordScopeId(entryEdgeRouteIdScopeKey(entryKey), '');
-            context.recordScopeId(entryEdgeRouteZoneScopeKey(entryKey), '');
-            context.recordScopeId(entryEdgeRoutePatternScopeKey(entryKey), '');
-            context.recordScopeId(entryEdgeRoutePendingScopeKey(entryKey), '');
-            context.recordScopeId(entryEdgeAppliedScopeKey(entryKey), '');
-            context.recordScopeId(entryEdgeUploadedScopeKey(entryKey), '');
+            const scriptName = mainId || recorded[entryWorkerUploadedScopeKey(entryKey)];
+            await this.teardownWorker(entryKey, scriptName, recorded, workers, at);
+            context.recordScopeId(entryWorkerRouteIdScopeKey(entryKey), '');
+            context.recordScopeId(entryWorkerRouteZoneScopeKey(entryKey), '');
+            context.recordScopeId(entryWorkerRoutePatternScopeKey(entryKey), '');
+            context.recordScopeId(entryWorkerRoutePendingScopeKey(entryKey), '');
+            context.recordScopeId(entryWorkerExclusionsScopeKey(entryKey), '');
+            context.recordScopeId(entryWorkerAppliedScopeKey(entryKey), '');
+            context.recordScopeId(entryWorkerUploadedScopeKey(entryKey), '');
             // `runSteps` only ever writes the main recorded id from a truthy
             // `resourceId` (`plan-apply.ts`); this step returns none, so without
             // this marker the planner's "gone" scan would retire the same,
             // never-cleared id forever.
             if (mainId)
-                context.recordScopeId(entryEdgeRetiredScopeKey(entryKey), mainId);
+                context.recordScopeId(entryWorkerRetiredScopeKey(entryKey), mainId);
             return {};
         }
         if (!org.domain) {
-            throw new Error(`${at}: edge needs org.domain, and validateHosting already refuses it without one`);
+            throw new Error(`${at}: worker needs org.domain, and validateHosting already refuses it without one`);
         }
         const zone = await this.ports.cloudflare.findZoneByApex(org.domain);
         if (!zone) {
@@ -919,8 +930,8 @@ export class FoundryStepExecutor {
         // the same deterministic name) is foundry's own script to overwrite,
         // never a stranger's.
         const recordedBeforeUpload = context.recordedIds();
-        const everUploadedByFoundry = Boolean(recordedBeforeUpload[entryEdgeAppliedScopeKey(entryKey)] ||
-            recordedBeforeUpload[entryEdgeUploadedScopeKey(entryKey)] ||
+        const everUploadedByFoundry = Boolean(recordedBeforeUpload[entryWorkerAppliedScopeKey(entryKey)] ||
+            recordedBeforeUpload[entryWorkerUploadedScopeKey(entryKey)] ||
             recordedBeforeUpload[`cloudflare:worker:${action.key}`]);
         if (!everUploadedByFoundry && (await workers.scriptExists(name))) {
             throw new Error(`${at}: a Worker script named '${name}' already exists and foundry never created it; refuses to overwrite it`);
@@ -931,8 +942,8 @@ export class FoundryStepExecutor {
         // the `scriptExists` guard above. The retired marker clears here too,
         // not only on success: once a redeploy has touched the script, a later
         // undeclare must retire it even if this apply never finishes.
-        context.recordScopeId(entryEdgeUploadedScopeKey(entryKey), name);
-        context.recordScopeId(entryEdgeRetiredScopeKey(entryKey), '');
+        context.recordScopeId(entryWorkerUploadedScopeKey(entryKey), name);
+        context.recordScopeId(entryWorkerRetiredScopeKey(entryKey), '');
         await context.persistScopeIds();
         await workers.uploadScript({
             name,
@@ -941,9 +952,12 @@ export class FoundryStepExecutor {
             compatibilityDate: action.desired.compatibilityDate,
             bindings: bindings.length > 0 ? bindings : undefined,
         });
+        // Before the wildcard route exists, so a hostname foundry serves is never
+        // caught by the Worker, not even briefly.
+        await this.syncWorkerExclusions(entryKey, zone.id, org.domain, desired.exclusions ?? [], workers, context, at);
         const recorded = context.recordedIds();
-        const previousRouteId = recorded[entryEdgeRouteIdScopeKey(entryKey)];
-        const previousPending = recorded[entryEdgeRoutePendingScopeKey(entryKey)];
+        const previousRouteId = recorded[entryWorkerRouteIdScopeKey(entryKey)];
+        const previousPending = recorded[entryWorkerRoutePendingScopeKey(entryKey)];
         const zoneRecord = { id: zone.id, apex: org.domain };
         let routeId = existingRoute?.id;
         if (!routeId) {
@@ -951,7 +965,7 @@ export class FoundryStepExecutor {
             // never got to record is still found (`findRoute`) and deleted on
             // retire or destroy (#318 re-review).
             const pending = { ...zoneRecord, pattern: route, script: name };
-            context.recordScopeId(entryEdgeRoutePendingScopeKey(entryKey), JSON.stringify(pending));
+            context.recordScopeId(entryWorkerRoutePendingScopeKey(entryKey), JSON.stringify(pending));
             await context.persistScopeIds();
             const created = await workers.createRoute(zone.id, route, name);
             routeId = created.id;
@@ -961,30 +975,75 @@ export class FoundryStepExecutor {
         // own zone rather than left live beside the new one. A pending route
         // from an earlier, interrupted apply under a different pattern likewise.
         if (previousRouteId && previousRouteId !== routeId) {
-            const previousZone = await this.liveEdgeZone(recorded[entryEdgeRouteZoneScopeKey(entryKey)], at);
+            const previousZone = await this.liveWorkerZone(recorded[entryWorkerRouteZoneScopeKey(entryKey)], at);
             if (previousZone)
                 await workers.deleteRoute(previousZone, previousRouteId); // Idempotent.
         }
         if (previousPending) {
-            await this.deletePendingEdgeRoute(previousPending, routeId, workers, at);
+            await this.deletePendingWorkerRoute(previousPending, routeId, workers, at);
         }
-        context.recordScopeId(entryEdgeRouteIdScopeKey(entryKey), routeId);
-        context.recordScopeId(entryEdgeRouteZoneScopeKey(entryKey), JSON.stringify(zoneRecord));
-        context.recordScopeId(entryEdgeRoutePatternScopeKey(entryKey), route);
-        context.recordScopeId(entryEdgeRoutePendingScopeKey(entryKey), '');
-        context.recordScopeId(entryEdgeAppliedScopeKey(entryKey), JSON.stringify({
+        context.recordScopeId(entryWorkerRouteIdScopeKey(entryKey), routeId);
+        context.recordScopeId(entryWorkerRouteZoneScopeKey(entryKey), JSON.stringify(zoneRecord));
+        context.recordScopeId(entryWorkerRoutePatternScopeKey(entryKey), route);
+        context.recordScopeId(entryWorkerRoutePendingScopeKey(entryKey), '');
+        context.recordScopeId(entryWorkerAppliedScopeKey(entryKey), JSON.stringify({
             name,
             artifactUrl: desired.artifactUrl,
             artifactSha256: desired.artifactSha256,
             route,
             bindings: desired.bindings,
+            exclusions: desired.exclusions,
         }));
-        context.recordScopeId(entryEdgeUploadedScopeKey(entryKey), '');
+        context.recordScopeId(entryWorkerUploadedScopeKey(entryKey), '');
         // The retired marker was already cleared before the upload above: a
         // redeclare reuses this entry's deterministic script name, so a marker
         // left equal to the (identical) main id would read as already retired.
         return { resourceId: name };
     }
+    /**
+     * Makes the no-Worker routes recorded for an entry match `patterns`: deletes
+     * the ones no longer wanted (all of them if the zone changed), creates the
+     * missing ones without a script. A route already on a pattern that is bound
+     * to a Worker is foreign and refused; one with no script is adopted. Records
+     * and persists after each change.
+     */
+    async syncWorkerExclusions(entryKey, zoneId, apex, patterns, workers, context, at) {
+        const key = entryWorkerExclusionsScopeKey(entryKey);
+        const raw = context.recordedIds()[key];
+        let state = raw
+            ? JSON.parse(raw)
+            : { id: zoneId, apex, routes: {} };
+        const save = async () => {
+            context.recordScopeId(key, Object.keys(state.routes).length > 0 ? JSON.stringify(state) : '');
+            await context.persistScopeIds();
+        };
+        if (state.id !== zoneId) {
+            const oldZone = await this.liveWorkerZone(JSON.stringify({ id: state.id, apex: state.apex }), at);
+            if (oldZone) {
+                for (const id of Object.values(state.routes))
+                    await workers.deleteRoute(oldZone, id);
+            }
+            state = { id: zoneId, apex, routes: {} };
+            await save();
+        }
+        for (const [pattern, id] of Object.entries(state.routes)) {
+            if (patterns.includes(pattern))
+                continue;
+            await workers.deleteRoute(zoneId, id); // Idempotent.
+            delete state.routes[pattern];
+            await save();
+        }
+        for (const pattern of patterns) {
+            if (state.routes[pattern])
+                continue;
+            const found = await workers.findRoute(zoneId, pattern);
+            if (found?.script) {
+                throw new Error(`${at}: route '${pattern}' is already bound to Worker '${found.script}'; foundry does not replace it`);
+            }
+            state.routes[pattern] = found ? found.id : (await workers.createRoute(zoneId, pattern)).id;
+            await save();
+        }
+    }
     /**
      * The zone id a recorded route lives in, or `undefined` only when that
      * zone is *positively* gone -- its apex resolves to no zone, or to a
@@ -998,7 +1057,7 @@ export class FoundryStepExecutor {
      * live on the old one, the exact bug a recorded-per-route zone exists to
      * avoid (#318 re-review).
      */
-    async liveEdgeZone(recordedZone, at) {
+    async liveWorkerZone(recordedZone, at) {
         if (!recordedZone) {
             throw new Error(`${at}: a route is recorded but its zone is not, so foundry cannot tell which zone holds it; refuses to forget it`);
         }
@@ -1007,9 +1066,9 @@ export class FoundryStepExecutor {
         return zone && zone.id === id ? id : undefined;
     }
     /** Deletes the route an interrupted apply was creating, if `findRoute` shows it exists, points at that apply's script, and is not `keepRouteId`. */
-    async deletePendingEdgeRoute(pendingRaw, keepRouteId, workers, at) {
+    async deletePendingWorkerRoute(pendingRaw, keepRouteId, workers, at) {
         const pending = JSON.parse(pendingRaw);
-        const zoneId = await this.liveEdgeZone(JSON.stringify({ id: pending.id, apex: pending.apex }), at);
+        const zoneId = await this.liveWorkerZone(JSON.stringify({ id: pending.id, apex: pending.apex }), at);
         if (!zoneId)
             return;
         const found = await workers.findRoute(zoneId, pending.pattern);
@@ -1022,16 +1081,25 @@ export class FoundryStepExecutor {
      * zone, then any route an interrupted apply created but never recorded,
      * then the script. Records nothing -- the caller does.
      */
-    async teardownEdgeWorker(entryKey, scriptName, recorded, workers, at) {
-        const routeId = recorded[entryEdgeRouteIdScopeKey(entryKey)];
+    async teardownWorker(entryKey, scriptName, recorded, workers, at) {
+        const routeId = recorded[entryWorkerRouteIdScopeKey(entryKey)];
         if (routeId) {
-            const zoneId = await this.liveEdgeZone(recorded[entryEdgeRouteZoneScopeKey(entryKey)], at);
+            const zoneId = await this.liveWorkerZone(recorded[entryWorkerRouteZoneScopeKey(entryKey)], at);
             if (zoneId)
                 await workers.deleteRoute(zoneId, routeId); // Idempotent: a no-op if already gone.
         }
-        const pending = recorded[entryEdgeRoutePendingScopeKey(entryKey)];
+        const pending = recorded[entryWorkerRoutePendingScopeKey(entryKey)];
         if (pending)
-            await this.deletePendingEdgeRoute(pending, undefined, workers, at);
+            await this.deletePendingWorkerRoute(pending, undefined, workers, at);
+        const exclusions = recorded[entryWorkerExclusionsScopeKey(entryKey)];
+        if (exclusions) {
+            const state = JSON.parse(exclusions);
+            const zoneId = await this.liveWorkerZone(JSON.stringify({ id: state.id, apex: state.apex }), at);
+            if (zoneId) {
+                for (const id of Object.values(state.routes))
+                    await workers.deleteRoute(zoneId, id);
+            }
+        }
         if (scriptName)
             await workers.deleteScript(scriptName); // Idempotent: a no-op if already gone.
     }
@@ -4816,24 +4884,24 @@ export class FoundryStepExecutor {
         context.recordScopeId(listKey, JSON.stringify(ids));
     }
     /**
-     * F7 (#317): mints one entry's names key directly below the org (names
-     * takes no separate minter key id, unlike ai/files), writes `NAMES_URL`
-     * and `NAMES_API_KEY` to the entry's app env, then restarts it. Retires
-     * the key when `uses.names` is removed. Follows the "one mint" rule
+     * F7 (#317): mints one entry's edge key directly below the org (edge
+     * takes no separate minter key id, unlike ai/files), writes `EDGE_URL`
+     * and `EDGE_API_KEY` to the entry's app env, then restarts it. Retires
+     * the key when `uses.edge` is removed. Follows the "one mint" rule
      * (CLAUDE.md "Platform steps"): the id is recorded as undelivered and
      * persisted before delivery is attempted, so a crash or a failed write
-     * never leads to a second mint -- `planEntryNamesKeys` blocks instead.
+     * never leads to a second mint -- `planEntryEdgeKeys` blocks instead.
      */
-    async namesEntryKey(action, org, context) {
+    async edgeEntryKey(action, org, context) {
         const entryKey = action.key.slice(org.id.length + 1);
-        const at = `names:key for ${org.slug} entry '${entryKey}'`;
-        const names = this.ports.names;
-        if (!names)
-            throw new Error(`${at}: this executor was built without a NamesPort (#317)`);
+        const at = `edge:key for ${org.slug} entry '${entryKey}'`;
+        const edge = this.ports.edge;
+        if (!edge)
+            throw new Error(`${at}: this executor was built without an EdgePort (#317)`);
         const desired = action.desired;
         if (desired.mode === 'retire') {
             const recorded = context.recordedIds();
-            const mainId = recorded[`names:key:${action.key}`];
+            const mainId = recorded[`edge:key:${action.key}`];
             // A key minted but never delivered never gets a main id (the mint
             // step throws before `runSteps` sees a `resourceId`), so it can
             // coexist with a separate, already-delivered id from an earlier mint
@@ -4843,10 +4911,10 @@ export class FoundryStepExecutor {
             // here always picked A (truthy), leaving B live for up to 365 days
             // with nothing recorded (#317 re-review) -- both ids are revoked,
             // independently, whenever both are present.
-            const undeliveredId = recorded[entryNamesUndeliveredScopeKey(entryKey)];
+            const undeliveredId = recorded[entryEdgeUndeliveredScopeKey(entryKey)];
             const idsToRevoke = [...new Set([mainId, undeliveredId].filter((id) => !!id))];
             const keyId = mainId || undeliveredId;
-            // Revoke first: the key going dead in names is what retire is for,
+            // Revoke first: the key going dead in edge is what retire is for,
             // and the one thing that must still happen even when the entry's app
             // is itself already gone. Only once that has succeeded (or 404'd as
             // already gone) is the env cleanup attempted, itself tolerant of a
@@ -4856,7 +4924,7 @@ export class FoundryStepExecutor {
             // stranding a live key on every retry (#317 review).
             for (const id of idsToRevoke) {
                 try {
-                    await names.revokeKey(org.id, id);
+                    await edge.revokeKey(org.id, id);
                 }
                 catch (error) {
                     // A 404 means it is already gone -- recorded as retired below,
@@ -4871,7 +4939,7 @@ export class FoundryStepExecutor {
             const appId = recorded[`coolify:app:${action.key}`];
             if (appId) {
                 // A revoked key's env values are dead, not merely stale -- remove
-                // them so nothing reads a credential names has already revoked. A
+                // them so nothing reads a credential edge has already revoked. A
                 // 404 on either call means that app or that env is already gone:
                 // nothing to clean up there, and the key is already revoked above,
                 // so it is not a reason to fail the step. Each delete tolerates its
@@ -4887,7 +4955,7 @@ export class FoundryStepExecutor {
                     }
                 };
                 const envs = await tolerateNotFound(() => this.ports.coolify.listEnvs(appId), []);
-                for (const envKey of ['NAMES_URL', 'NAMES_API_KEY']) {
+                for (const envKey of ['EDGE_URL', 'EDGE_API_KEY']) {
                     const env = envs.find((e) => e.key === envKey && !e.is_preview);
                     if (env?.uuid) {
                         const uuid = env.uuid;
@@ -4895,21 +4963,21 @@ export class FoundryStepExecutor {
                     }
                 }
             }
-            context.recordScopeId(entryNamesUndeliveredScopeKey(entryKey), '');
-            context.recordScopeId(entryNamesMintedAtScopeKey(entryKey), '');
+            context.recordScopeId(entryEdgeUndeliveredScopeKey(entryKey), '');
+            context.recordScopeId(entryEdgeMintedAtScopeKey(entryKey), '');
             if (!keyId)
                 return {};
-            context.recordScopeId(entryNamesRetiredScopeKey(entryKey), keyId);
+            context.recordScopeId(entryEdgeRetiredScopeKey(entryKey), keyId);
             return {};
         }
-        const entry = org.hosting.entries.find((e) => e.key === entryKey && e.uses?.names);
+        const entry = org.hosting.entries.find((e) => e.key === entryKey && e.uses?.edge);
         if (!entry)
-            throw new Error(`${at}: the entry no longer declares uses.names`);
+            throw new Error(`${at}: the entry no longer declares uses.edge`);
         const appId = context.recordedIds()[`coolify:app:${action.key}`];
         if (!appId)
             throw new Error(`${at}: the entry's app is not recorded yet`);
         if (!org.domain) {
-            throw new Error(`${at}: names needs org.domain, and validateEntryNames already refuses it without one`);
+            throw new Error(`${at}: edge needs org.domain, and validateEntryEdge already refuses it without one`);
         }
         // A key left over from a previous mint whose delivery never succeeded
         // is revoked first, not left blocking every later apply forever:
@@ -4917,39 +4985,39 @@ export class FoundryStepExecutor {
         // (CLAUDE.md "No secret leaves"), so the only way to actually recover
         // is to revoke the stale id and mint a fresh one -- a 404 counts as
         // already revoked, same as any other retire (#317 re-review).
-        const staleUndelivered = context.recordedIds()[entryNamesUndeliveredScopeKey(entryKey)];
+        const staleUndelivered = context.recordedIds()[entryEdgeUndeliveredScopeKey(entryKey)];
         if (staleUndelivered) {
             try {
-                await names.revokeKey(org.id, staleUndelivered);
+                await edge.revokeKey(org.id, staleUndelivered);
             }
             catch (error) {
                 if (!isNotFoundError(error))
                     throw error;
             }
-            context.recordScopeId(entryNamesUndeliveredScopeKey(entryKey), '');
+            context.recordScopeId(entryEdgeUndeliveredScopeKey(entryKey), '');
             await context.persistScopeIds();
         }
-        const minted = await names.mintKey({
+        const minted = await edge.mintKey({
             organisationId: org.id,
             domain: org.domain,
             name: desired.name,
-            expiresDays: NAMES_ENTRY_KEY_DAYS,
+            expiresDays: EDGE_ENTRY_KEY_DAYS,
         });
-        context.recordScopeId(entryNamesUndeliveredScopeKey(entryKey), minted.id);
+        context.recordScopeId(entryEdgeUndeliveredScopeKey(entryKey), minted.id);
         await context.persistScopeIds();
         const envs = [
-            { key: 'NAMES_URL', value: desired.namesUrl, literal: true },
-            { key: 'NAMES_API_KEY', value: minted.secret, literal: true },
+            { key: 'EDGE_URL', value: desired.edgeUrl, literal: true },
+            { key: 'EDGE_API_KEY', value: minted.secret, literal: true },
         ];
         let lastError;
-        for (let attempt = 1; attempt <= ENTRY_NAMES_KEY_DELIVERY_ATTEMPTS; attempt++) {
+        for (let attempt = 1; attempt <= ENTRY_EDGE_KEY_DELIVERY_ATTEMPTS; attempt++) {
             try {
                 await this.ports.coolify.bulkUpsertEnvs(appId, envs);
                 await this.ports.coolify.restart(appId);
-                context.recordScopeId(entryNamesUndeliveredScopeKey(entryKey), '');
+                context.recordScopeId(entryEdgeUndeliveredScopeKey(entryKey), '');
                 // The only trace of this key's age, since nothing here renews it
                 // (#317 review's warning-row ask reads this to flag an expiring key).
-                context.recordScopeId(entryNamesMintedAtScopeKey(entryKey), new Date(context.now?.() ?? Date.now()).toISOString());
+                context.recordScopeId(entryEdgeMintedAtScopeKey(entryKey), new Date(context.now?.() ?? Date.now()).toISOString());
                 return { resourceId: minted.id };
             }
             catch (e) {
@@ -4957,21 +5025,21 @@ export class FoundryStepExecutor {
             }
         }
         // Names the key id only; the underlying error is dropped in case it echoes the secret.
-        throw new Error(`${at}: key ${minted.id} was minted but could not be written to the app's env after ${ENTRY_NAMES_KEY_DELIVERY_ATTEMPTS} attempts (${lastError instanceof Error ? lastError.name : 'error'}); the next apply revokes it and mints a fresh one automatically`);
+        throw new Error(`${at}: key ${minted.id} was minted but could not be written to the app's env after ${ENTRY_EDGE_KEY_DELIVERY_ATTEMPTS} attempts (${lastError instanceof Error ? lastError.name : 'error'}); the next apply revokes it and mints a fresh one automatically`);
     }
     /**
-     * F7 (#317): `plan/entry-names-key.ts`'s `planNamesReservedLabels` --
-     * tells the names service every label this org's own entries already
-     * hold, so names refuses a customer claiming one of them.
+     * F7 (#317): `plan/entry-edge-key.ts`'s `planEdgeReservedLabels` --
+     * tells the edge service every label this org's own entries already
+     * hold, so edge refuses a customer claiming one of them.
      */
-    async namesReservedLabels(action, org, context) {
-        const names = this.ports.names;
-        if (!names) {
-            throw new Error(`names:reserved-labels for ${org.slug}: this executor was built without a NamesPort (#317)`);
+    async edgeReservedLabels(action, org, context) {
+        const edge = this.ports.edge;
+        if (!edge) {
+            throw new Error(`edge:reserved-labels for ${org.slug}: this executor was built without an EdgePort (#317)`);
         }
         const labels = action.desired.labels;
-        await names.setReservedLabels(org.id, labels);
-        context.recordScopeId(NAMES_RESERVED_LABELS_APPLIED_SCOPE_KEY, JSON.stringify(labels));
+        await edge.setReservedLabels(org.id, labels);
+        context.recordScopeId(EDGE_RESERVED_LABELS_APPLIED_SCOPE_KEY, JSON.stringify(labels));
         return {};
     }
     /**
@@ -5375,7 +5443,7 @@ export class FoundryStepExecutor {
                     return;
                 }
                 case 'cloudflare:worker': {
-                    // #318: an entry's edge Worker (`<orgId>:<entry>`) and its route.
+                    // #318: an entry's Worker (`<orgId>:<entry>`) and its route.
                     // No port means no way to delete either -- thrown, not silently
                     // skipped, so it is reported blocked rather than left live with
                     // nothing recorded ids point at any more.
@@ -5388,20 +5456,20 @@ export class FoundryStepExecutor {
                     // never recorded, then the script -- the same teardown retire runs.
                     // `target.id` is `''` for a route-only partial deploy.
                     const entryKey = target.key.slice(org.id.length + 1);
-                    await this.teardownEdgeWorker(entryKey, target.id || undefined, recordedIds, workers, `cloudflare:worker '${target.key}' for ${org.slug}`);
+                    await this.teardownWorker(entryKey, target.id || undefined, recordedIds, workers, `cloudflare:worker '${target.key}' for ${org.slug}`);
                     return;
                 }
-                case 'names:key': {
-                    // F7 (#317): an entry's key (`<orgId>:<entry>`); names has no org-root key.
+                case 'edge:key': {
+                    // F7 (#317): an entry's key (`<orgId>:<entry>`); edge has no org-root key.
                     // No port means no way to revoke it -- thrown, not silently
                     // skipped, so the key is reported blocked rather than left live
                     // with nothing saying so.
-                    const names = this.ports.names;
-                    if (!names) {
-                        throw new Error(`names:key '${target.key}' for ${org.slug}: this executor was built without a NamesPort (#317); cannot revoke it`);
+                    const edge = this.ports.edge;
+                    if (!edge) {
+                        throw new Error(`edge:key '${target.key}' for ${org.slug}: this executor was built without an EdgePort (#317); cannot revoke it`);
                     }
                     try {
-                        await names.revokeKey(org.id, target.id);
+                        await edge.revokeKey(org.id, target.id);
                     }
                     catch (error) {
                         // Already gone -- the same already-retired key a retire step

package/dist/plan/index.d.ts

@@ -5,7 +5,7 @@ export { computePlanDetail, toPlan } from './diff.js';
 export type { StepSystem } from './step-system.js';
 export { stepSystemOf } from './step-system.js';
 export type { PlatformPlanDetail } from './platform-diff.js';
-export { planPlatform, toPlatformPlan, JOBS_SCHEDULER_KEY, PLATFORM_AI_KEY, PLATFORM_AI_INTERNAL_URL_SCOPE_KEY, PLATFORM_AI_MANAGEMENT_KEY_SCOPE_KEY, PLATFORM_AI_ORGANISATION_SCOPE_KEY, PLATFORM_AUTH_KEY, PLATFORM_FILES_KEY, PLATFORM_FILES_INTERNAL_URL_SCOPE_KEY, PLATFORM_FILES_ZITADEL_PROJECT_SCOPE_KEY, PLATFORM_MAIL_KEY, PLATFORM_MAIL_INTERNAL_URL_SCOPE_KEY, PLATFORM_MAIL_ZITADEL_PROJECT_SCOPE_KEY, PLATFORM_NAMES_KEY, PLATFORM_NAMES_KEY_REF, PLATFORM_NAMES_CLOUDFLARE_TOKEN_REF, } from './platform-diff.js';
+export { planPlatform, toPlatformPlan, JOBS_SCHEDULER_KEY, PLATFORM_AI_KEY, PLATFORM_AI_INTERNAL_URL_SCOPE_KEY, PLATFORM_AI_MANAGEMENT_KEY_SCOPE_KEY, PLATFORM_AI_ORGANISATION_SCOPE_KEY, PLATFORM_AUTH_KEY, PLATFORM_FILES_KEY, PLATFORM_FILES_INTERNAL_URL_SCOPE_KEY, PLATFORM_FILES_ZITADEL_PROJECT_SCOPE_KEY, PLATFORM_MAIL_KEY, PLATFORM_MAIL_INTERNAL_URL_SCOPE_KEY, PLATFORM_MAIL_ZITADEL_PROJECT_SCOPE_KEY, PLATFORM_EDGE_KEY, PLATFORM_EDGE_KEY_REF, PLATFORM_EDGE_CLOUDFLARE_TOKEN_REF, } from './platform-diff.js';
 export type { HeldKeyResolver, OrgPlatformReadiness } from './platform-org.js';
 export { DEFAULT_ORG_PLATFORM_READINESS, ORG_PLATFORM_KEY_REFS, agoraHostValuesFromPlatform, heldPlatformKeyRefs, orgPlatformReadinessFrom, } from './platform-org.js';
 export type { PlatformOrgClientFactories } from './platform-org-ports.js';
@@ -15,7 +15,7 @@ export { AdoptRefusedError } from './adopt.js';
 export type { AuditActor, AuditLog, AuthzGate, StepExecutor, StepDestroyer, DestroyTarget, StepExecutionContext, PlatformStepExecutor, PlatformStepExecutionContext, FoundryPlanApplyOptions, } from './plan-apply.js';
 export { FoundryPlanApply, DeclaredOrgNotFoundError, StalePlanError, ConfirmationRequiredError, NotAuthorizedError, NotATestOrgError, DeclaredPlatformNotFoundError, PlatformStalePlanError, PlatformConfirmationRequiredError, planNeedsConfirmation, } from './plan-apply.js';
 export { FoundryPlatformStepExecutor, ProvidersPlatformCloudflareReader, ProvidersPlatformCoolifyReader, PLATFORM_MAIL_ADMIN_KEY_DESCRIPTION, filesPublicHostsValue, filesShareDomains, } from './platform-providers.js';
-export type { PlatformAuthDeps, PlatformAuthRuntime, PlatformFilesDeps, PlatformFilesRuntime, PlatformNamesDeps, PlatformNamesRuntime, } from './platform-providers.js';
+export type { PlatformAuthDeps, PlatformAuthRuntime, PlatformFilesDeps, PlatformFilesRuntime, PlatformEdgeDeps, PlatformEdgeRuntime, } from './platform-providers.js';
 export type { PlatformMailDeps, PlatformMailAdminPort, PlatformMailRuntime, } from './platform-providers.js';
 export { FILES_INTROSPECTION_SECRET_REF, FILES_MANAGEMENT_ISSUER, FILES_MANAGEMENT_KEY_ID, FILES_MANAGEMENT_KEY_REF, PLATFORM_AUTH_INSTANCE_BEARER_REF, } from './platform-providers.js';
 export { AI_MANAGEMENT_ISSUER, AI_MANAGEMENT_KEY_ID, AI_SIGNING_KEY_REF, AiManagementKeyExistsError, createAiManagementKeyMinter, PLATFORM_AI_MANAGEMENT_KEY_REF, PLATFORM_AI_MANAGEMENT_PERMISSIONS, } from './platform-providers.js';

package/dist/plan/index.js

@@ -1,7 +1,7 @@
 export { readLiveResources, readLivePlatformResources } from './live.js';
 export { computePlanDetail, toPlan } from './diff.js';
 export { stepSystemOf } from './step-system.js';
-export { planPlatform, toPlatformPlan, JOBS_SCHEDULER_KEY, PLATFORM_AI_KEY, PLATFORM_AI_INTERNAL_URL_SCOPE_KEY, PLATFORM_AI_MANAGEMENT_KEY_SCOPE_KEY, PLATFORM_AI_ORGANISATION_SCOPE_KEY, PLATFORM_AUTH_KEY, PLATFORM_FILES_KEY, PLATFORM_FILES_INTERNAL_URL_SCOPE_KEY, PLATFORM_FILES_ZITADEL_PROJECT_SCOPE_KEY, PLATFORM_MAIL_KEY, PLATFORM_MAIL_INTERNAL_URL_SCOPE_KEY, PLATFORM_MAIL_ZITADEL_PROJECT_SCOPE_KEY, PLATFORM_NAMES_KEY, PLATFORM_NAMES_KEY_REF, PLATFORM_NAMES_CLOUDFLARE_TOKEN_REF, } from './platform-diff.js';
+export { planPlatform, toPlatformPlan, JOBS_SCHEDULER_KEY, PLATFORM_AI_KEY, PLATFORM_AI_INTERNAL_URL_SCOPE_KEY, PLATFORM_AI_MANAGEMENT_KEY_SCOPE_KEY, PLATFORM_AI_ORGANISATION_SCOPE_KEY, PLATFORM_AUTH_KEY, PLATFORM_FILES_KEY, PLATFORM_FILES_INTERNAL_URL_SCOPE_KEY, PLATFORM_FILES_ZITADEL_PROJECT_SCOPE_KEY, PLATFORM_MAIL_KEY, PLATFORM_MAIL_INTERNAL_URL_SCOPE_KEY, PLATFORM_MAIL_ZITADEL_PROJECT_SCOPE_KEY, PLATFORM_EDGE_KEY, PLATFORM_EDGE_KEY_REF, PLATFORM_EDGE_CLOUDFLARE_TOKEN_REF, } from './platform-diff.js';
 export { DEFAULT_ORG_PLATFORM_READINESS, ORG_PLATFORM_KEY_REFS, agoraHostValuesFromPlatform, heldPlatformKeyRefs, orgPlatformReadinessFrom, } from './platform-org.js';
 export { PlatformOrgBlockedError, PlatformOrgPorts } from './platform-org-ports.js';
 export { AdoptRefusedError } from './adopt.js';

package/dist/plan/live.d.ts

@@ -26,11 +26,11 @@ export interface LiveResource {
      * `platform-diff.ts`'s `planSfu` always plans its step when
      * `DeclaredPlatform.sfu.enabled` is true, rather than diffing against a
      * live resource the way every other system here does. It is still part of
-     * this union so `StepAction.system` (`diff.ts`) can name it. `'names'`
-     * (#317) is the same: a names key has no live lookup of its own, the same
+     * this union so `StepAction.system` (`diff.ts`) can name it. `'edge'`
+     * (#317) is the same: a edge key has no live lookup of its own, the same
      * shape `ai`/`files` entry keys already follow.
      */
-    system: 'zitadel' | 'coolify' | 'cloudflare' | 'files' | 'ai' | 'cms' | 'jobs' | 'sfu' | 'names';
+    system: 'zitadel' | 'coolify' | 'cloudflare' | 'files' | 'ai' | 'cms' | 'jobs' | 'sfu' | 'edge';
     kind: string;
     key: string;
     config: Record<string, unknown>;

package/dist/plan/plan-apply.d.ts

@@ -335,7 +335,7 @@ export interface FoundryPlanApplyOptions {
     broker?: boolean;
     /**
      * #318: true when the host's executor was built with a `WorkersPort`.
-     * Optional, and false without it: each entry's `edge` Worker is then
+     * Optional, and false without it: each entry's `worker` Worker is then
      * reported blocked instead of planned.
      */
     edgeWorkers?: boolean;
@@ -347,11 +347,11 @@ export interface FoundryPlanApplyOptions {
     filesOrganisation?: boolean;
     aiOrganisation?: boolean;
     /**
-     * #317: true when the host's executor was built with a `NamesPort`.
-     * Optional, and false without it: each entry's `uses.names` step is then
+     * #317: true when the host's executor was built with a `EdgePort`.
+     * Optional, and false without it: each entry's `uses.edge` step is then
      * reported blocked instead of planned to fail.
      */
-    names?: boolean;
+    edge?: boolean;
     /** Overridable for tests; defaults to `() => new Date()`. */
     now?: () => Date;
     /** #441: how long a mutation lease lasts before another caller may take it over. Defaults to 30 minutes. */
@@ -431,7 +431,7 @@ export declare class FoundryPlanApply implements PlanApply {
     private readonly edgeWorkers;
     private readonly hostFiles;
     private readonly hostAi;
-    private readonly hostNames;
+    private readonly hostEdge;
     private readonly now;
     private readonly leaseTtlMs;
     private readonly appliedVersions;
@@ -580,6 +580,7 @@ export declare class FoundryPlanApply implements PlanApply {
      * which only the plan can read.
      */
     private invalidHosting;
+    private platformServiceHostnames;
     /**
      * #177: an org's plan reads the shared platform's own addresses and
      * readiness through the very `platform` deps `planPlatform`/`applyPlatform`