@wtfalch/foundry 0.17.1 → 0.18.0

package/dist/plan/platform-providers.d.ts

@@ -132,11 +132,11 @@ export interface FoundryPlatformStepExecutorOptions {
      */
     ai?: PlatformAiDeps;
     /**
-     * #478: dependencies for `coolify:app` keyed {@link PLATFORM_NAMES_KEY} --
+     * #478: dependencies for `coolify:app` keyed {@link PLATFORM_EDGE_KEY} --
      * optional for the same reason as `auth`; a host that declares
-     * `platform.names.enabled` without it gets the step reported as blocked.
+     * `platform.edge.enabled` without it gets the step reported as blocked.
      */
-    names?: PlatformNamesDeps;
+    edge?: PlatformEdgeDeps;
     /**
      * #175: dependencies for `coolify:app` keyed {@link PLATFORM_ARCHON_KEY}
      * -- optional for the same reason as {@link auth}.
@@ -203,8 +203,8 @@ export interface FoundryPlatformStepExecutorOptions {
  * #172 adds `coolify:app` keyed {@link PLATFORM_AI_KEY}, the platform's AI
  * host ({@link provisionPlatformAi}), once a host passes {@link PlatformAiDeps}.
  *
- * #478 adds `coolify:app` keyed {@link PLATFORM_NAMES_KEY}, the names host
- * ({@link provisionPlatformNames}), once a host passes {@link PlatformNamesDeps}.
+ * #478 adds `coolify:app` keyed {@link PLATFORM_EDGE_KEY}, the edge host
+ * ({@link provisionPlatformEdge}), once a host passes {@link PlatformEdgeDeps}.
  *
  * #175 adds `coolify:app` keyed {@link PLATFORM_ARCHON_KEY}, Archon itself
  * ({@link provisionPlatformArchon}), once a host passes
@@ -225,7 +225,7 @@ export declare class FoundryPlatformStepExecutor implements PlatformStepExecutor
     private readonly integrations?;
     private readonly files?;
     private readonly ai?;
-    private readonly names?;
+    private readonly edge?;
     private readonly archon?;
     private readonly backup?;
     constructor(cloudflare: Pick<CloudflarePort, 'findZoneByApex' | 'createZone'>, declaredOrgStore: Pick<DeclaredOrgStore, 'findOrgIdForZone' | 'list' | 'get'>, options?: FoundryPlatformStepExecutorOptions);
@@ -236,7 +236,7 @@ export declare class FoundryPlatformStepExecutor implements PlatformStepExecutor
         files?: string;
         integrations?: string;
         ai?: string;
-        names?: string;
+        edge?: string;
         archon?: string;
         mail?: string;
         backupExecutorMissing?: boolean;
@@ -428,7 +428,7 @@ export interface PlatformArchonDeps {
     zitadelForInstance?: (issuerUrl: string) => PlatformArchonDeps['zitadel'];
     /**
      * Who the Cloudflare Access app in front of Archon lets through. Host
-     * config, not `DeclaredPlatform`: the platform record names services, not
+     * config, not `DeclaredPlatform`: the platform record edge services, not
      * people. Empty blocks the step (`blockedSteps`) rather than building an
      * Access app nobody can pass.
      */
@@ -822,7 +822,7 @@ export declare const FILES_MANAGEMENT_KEY_ID = "foundry-1";
 export declare const FILES_MANAGEMENT_KEY_REF = "files:platform:managementKey";
 /** The ref the files host's introspection client secret is delivered under. */
 export declare const FILES_INTROSPECTION_SECRET_REF = "zitadel:platform:files:introspection";
-export interface PlatformNamesRuntime {
+export interface PlatformEdgeRuntime {
     fetch?: typeof fetch;
     sleep?: (ms: number) => Promise<void>;
     now?: () => number;
@@ -831,17 +831,17 @@ export interface PlatformNamesRuntime {
     readyTimeoutMs?: number;
     readyIntervalMs?: number;
 }
-export interface PlatformNamesDeps {
+export interface PlatformEdgeDeps {
     coolify: Pick<CoolifyPort, 'findProjectByName' | 'createProject' | 'findOrCreateEnvironment' | 'listServers' | 'findApplicationByName' | 'getApplication' | 'requireGithubApp' | 'createGithubAppApplication' | 'createDockerfileApplication' | 'listDatabases' | 'createPostgresDatabase' | 'getDatabase' | 'bulkUpsertEnvs' | 'listEnvs' | 'updateApplication' | 'deploy' | 'deployAndWait' | 'raw'>;
     cloudflare: Pick<CloudflarePort, 'findZoneByApex' | 'findTunnelByName' | 'createTunnel' | 'putTunnelConfig' | 'getTunnelToken' | 'findDnsRecord' | 'createDnsRecord' | 'updateDnsRecord'>;
     deliverSecret: FoundryStepExecutorPorts['deliverSecret'];
     /**
-     * Reads the names service's own Cloudflare API token back, held under
-     * {@link PLATFORM_NAMES_CLOUDFLARE_TOKEN_REF} -- a human step (the issue's
+     * Reads the edge service's own Cloudflare API token back, held under
+     * {@link PLATFORM_EDGE_CLOUDFLARE_TOKEN_REF} -- a human step (the issue's
      * own "Human steps"), never minted here: foundry has no Cloudflare
      * account of its own to carve that token out of. Absent, or with nothing
      * held under that ref yet, is reported blocked by `blockedSteps`
-     * ({@link namesBlockedReason}), never planned to throw.
+     * ({@link edgeBlockedReason}), never planned to throw.
      */
     heldKeys?: {
         resolve(ref: string): Promise<string | null>;
@@ -853,7 +853,7 @@ export interface PlatformNamesDeps {
      */
     cloudflareAccountId?: string;
     /** Clock, sleep and fetch for the readiness wait and delivery retries; real ones by default. */
-    runtime?: PlatformNamesRuntime;
+    runtime?: PlatformEdgeRuntime;
 }
 /**
  * #174: everything {@link provisionPlatformIntegrations} needs beyond

package/dist/plan/platform-providers.js

@@ -7,7 +7,7 @@ import { ensureCloudflaredConnector } from './cloudflared-connector.js';
 import { waitForDeploymentFinished, waitForHealthyVersion, waitForNewDeployment, } from './deploy-health.js';
 import { ACCESS_POLICY_NAME, getDatabaseStarted, isNotFoundError, isRunningOrStarting, } from './executor.js';
 import { coolifyDomains, filesShareHostname } from './hostnames.js';
-import { AUTH_ZITADEL_RUN_OPTIONS, JOBS_SCHEDULER_KEY, PLATFORM_AI_APPLIED_GITREF_SCOPE_KEY, PLATFORM_AI_APPLIED_HOSTNAME_SCOPE_KEY, PLATFORM_AI_DEPLOY_PENDING_SCOPE_KEY, PLATFORM_AI_INTERNAL_URL_SCOPE_KEY, PLATFORM_AI_KEY, PLATFORM_AI_MANAGEMENT_KEY_CONFLICT_SCOPE_KEY, PLATFORM_AI_MANAGEMENT_KEY_SCOPE_KEY, PLATFORM_AI_MANAGEMENT_KEY_UNDELIVERED_SCOPE_KEY, PLATFORM_AI_MIGRATE_BLOCKED_SCOPE_KEY, PLATFORM_AI_ORGANISATION_SCOPE_KEY, PLATFORM_AI_SIGNING_KEY_SET_SCOPE_KEY, PLATFORM_AI_SIGNING_KEY_UNDELIVERED_SCOPE_KEY, PLATFORM_ARCHON_APPLIED_BROKER_SCOPE_KEY, PLATFORM_ARCHON_APPLIED_GIT_REF_SCOPE_KEY, PLATFORM_ARCHON_APPLIED_HOSTNAME_SCOPE_KEY, PLATFORM_ARCHON_APPLIED_OPERATOR_SCOPE_KEY, PLATFORM_ARCHON_APPLIED_ROLLING_UPDATE_SCOPE_KEY, PLATFORM_ARCHON_CONNECTOR_APP_SCOPE_KEY, PLATFORM_ARCHON_COOLIFY_READ_TOKEN_REF, PLATFORM_ARCHON_ENVS_DEPLOYED_SCOPE_KEY, PLATFORM_ARCHON_GATE_CLOSED_SCOPE_KEY, PLATFORM_ARCHON_INTEGRATIONS_KEY_SYNCED_SCOPE_KEY, PLATFORM_ARCHON_KEY, PLATFORM_ARCHON_MASTER_CLOUDFLARE_TOKEN_REF, PLATFORM_ARCHON_MASTER_COOLIFY_TOKEN_REF, PLATFORM_ARCHON_MASTER_COOLIFY_URL_REF, PLATFORM_AUTH_ADMIN_UNDELIVERED_SCOPE_KEY, PLATFORM_AUTH_ADMIN_USER_SCOPE_KEY, PLATFORM_AUTH_BROKER_DEPLOYED_SCOPE_KEY, PLATFORM_AUTH_BROKER_SCOPE_KEY, PLATFORM_AUTH_CONNECTOR_APP_SCOPE_KEY, PLATFORM_AUTH_INSTANCE_SCOPE_KEY, PLATFORM_AUTH_INSTANCE_UNDELIVERED_SCOPE_KEY, PLATFORM_AUTH_KEY, PLATFORM_AUTH_LOGIN_CLIENT_UNDELIVERED_SCOPE_KEY, PLATFORM_AUTH_LOGIN_CLIENT_USER_SCOPE_KEY, PLATFORM_AUTH_OWNER_INVITE_SCOPE_KEY, PLATFORM_AUTH_SMTP_SCOPE_KEY, PLATFORM_AUTH_ZITADEL_APPLIED_IMAGE_TAG_SCOPE_KEY, PLATFORM_AUTH_ZITADEL_RUN_OPTIONS_SCOPE_KEY, PLATFORM_BACKUP_DATABASE_SCOPE_KEYS, PLATFORM_BACKUP_SERVICE_KEYS, PLATFORM_FILES_APPLIED_GIT_REF_SCOPE_KEY, PLATFORM_FILES_APPLIED_HOSTNAME_SCOPE_KEY, PLATFORM_FILES_INTERNAL_URL_SCOPE_KEY, PLATFORM_FILES_INTROSPECTION_SCOPE_KEY, PLATFORM_FILES_INTROSPECTION_UNDELIVERED_SCOPE_KEY, PLATFORM_FILES_KEY, PLATFORM_FILES_MANAGEMENT_KEY_SCOPE_KEY, PLATFORM_FILES_MANAGEMENT_UNDELIVERED_SCOPE_KEY, PLATFORM_FILES_ZITADEL_PROJECT_SCOPE_KEY, PLATFORM_INTEGRATIONS_APPLIED_GITREF_SCOPE_KEY, PLATFORM_INTEGRATIONS_APPLIED_HOSTNAME_SCOPE_KEY, PLATFORM_INTEGRATIONS_KEY, PLATFORM_INTEGRATIONS_KEY_ID_SCOPE_KEY, PLATFORM_INTEGRATIONS_KEY_ROTATION_PREVIOUS_SCOPE_KEY, PLATFORM_INTEGRATIONS_KEY_ROTATION_REQUESTED_SCOPE_KEY, PLATFORM_INTEGRATIONS_KEY_ROTATION_UNDELIVERED_SCOPE_KEY, PLATFORM_INTEGRATIONS_KEY_SET_SCOPE_KEY, PLATFORM_INTEGRATIONS_KEY_UNDELIVERED_SCOPE_KEY, PLATFORM_INTEGRATIONS_RUNNER_KEYRING_DEPLOYED_SCOPE_KEY, PLATFORM_MAIL_ADMIN_KEY_SCOPE_KEY, PLATFORM_MAIL_ADMIN_UNDELIVERED_SCOPE_KEY, PLATFORM_MAIL_APPLIED_GIT_REF_SCOPE_KEY, PLATFORM_MAIL_APPLIED_HOSTNAME_SCOPE_KEY, PLATFORM_MAIL_CONNECTOR_APP_SCOPE_KEY, PLATFORM_MAIL_INTERNAL_URL_SCOPE_KEY, PLATFORM_MAIL_KEY, PLATFORM_MAIL_ZITADEL_PROJECT_SCOPE_KEY, PLATFORM_NAMES_APPLIED_GIT_REF_SCOPE_KEY, PLATFORM_NAMES_APPLIED_HOSTNAME_SCOPE_KEY, PLATFORM_NAMES_CLOUDFLARE_TOKEN_REF, PLATFORM_NAMES_KEY, PLATFORM_NAMES_KEY_REF, PLATFORM_NAMES_PLATFORM_KEY_SET_SCOPE_KEY, PLATFORM_NAMES_PLATFORM_KEY_UNDELIVERED_SCOPE_KEY, archonBootstrapOperator, parseBrokerDeployRecord, parseLoginClientRecord, platformMailMxHost, } from './platform-diff.js';
+import { AUTH_ZITADEL_RUN_OPTIONS, JOBS_SCHEDULER_KEY, PLATFORM_AI_APPLIED_GITREF_SCOPE_KEY, PLATFORM_AI_APPLIED_HOSTNAME_SCOPE_KEY, PLATFORM_AI_DEPLOY_PENDING_SCOPE_KEY, PLATFORM_AI_INTERNAL_URL_SCOPE_KEY, PLATFORM_AI_KEY, PLATFORM_AI_MANAGEMENT_KEY_CONFLICT_SCOPE_KEY, PLATFORM_AI_MANAGEMENT_KEY_SCOPE_KEY, PLATFORM_AI_MANAGEMENT_KEY_UNDELIVERED_SCOPE_KEY, PLATFORM_AI_MIGRATE_BLOCKED_SCOPE_KEY, PLATFORM_AI_ORGANISATION_SCOPE_KEY, PLATFORM_AI_SIGNING_KEY_SET_SCOPE_KEY, PLATFORM_AI_SIGNING_KEY_UNDELIVERED_SCOPE_KEY, PLATFORM_ARCHON_APPLIED_BROKER_SCOPE_KEY, PLATFORM_ARCHON_APPLIED_GIT_REF_SCOPE_KEY, PLATFORM_ARCHON_APPLIED_HOSTNAME_SCOPE_KEY, PLATFORM_ARCHON_APPLIED_OPERATOR_SCOPE_KEY, PLATFORM_ARCHON_APPLIED_ROLLING_UPDATE_SCOPE_KEY, PLATFORM_ARCHON_CONNECTOR_APP_SCOPE_KEY, PLATFORM_ARCHON_COOLIFY_READ_TOKEN_REF, PLATFORM_ARCHON_ENVS_DEPLOYED_SCOPE_KEY, PLATFORM_ARCHON_GATE_CLOSED_SCOPE_KEY, PLATFORM_ARCHON_INTEGRATIONS_KEY_SYNCED_SCOPE_KEY, PLATFORM_ARCHON_KEY, PLATFORM_ARCHON_MASTER_CLOUDFLARE_TOKEN_REF, PLATFORM_ARCHON_MASTER_COOLIFY_TOKEN_REF, PLATFORM_ARCHON_MASTER_COOLIFY_URL_REF, PLATFORM_AUTH_ADMIN_UNDELIVERED_SCOPE_KEY, PLATFORM_AUTH_ADMIN_USER_SCOPE_KEY, PLATFORM_AUTH_BROKER_DEPLOYED_SCOPE_KEY, PLATFORM_AUTH_BROKER_SCOPE_KEY, PLATFORM_AUTH_CONNECTOR_APP_SCOPE_KEY, PLATFORM_AUTH_INSTANCE_SCOPE_KEY, PLATFORM_AUTH_INSTANCE_UNDELIVERED_SCOPE_KEY, PLATFORM_AUTH_KEY, PLATFORM_AUTH_LOGIN_CLIENT_UNDELIVERED_SCOPE_KEY, PLATFORM_AUTH_LOGIN_CLIENT_USER_SCOPE_KEY, PLATFORM_AUTH_OWNER_INVITE_SCOPE_KEY, PLATFORM_AUTH_SMTP_SCOPE_KEY, PLATFORM_AUTH_ZITADEL_APPLIED_IMAGE_TAG_SCOPE_KEY, PLATFORM_AUTH_ZITADEL_RUN_OPTIONS_SCOPE_KEY, PLATFORM_BACKUP_DATABASE_SCOPE_KEYS, PLATFORM_BACKUP_SERVICE_KEYS, PLATFORM_EDGE_APPLIED_GIT_REF_SCOPE_KEY, PLATFORM_EDGE_APPLIED_HOSTNAME_SCOPE_KEY, PLATFORM_EDGE_CLOUDFLARE_TOKEN_REF, PLATFORM_EDGE_KEY, PLATFORM_EDGE_KEY_REF, PLATFORM_EDGE_PLATFORM_KEY_SET_SCOPE_KEY, PLATFORM_EDGE_PLATFORM_KEY_UNDELIVERED_SCOPE_KEY, PLATFORM_FILES_APPLIED_GIT_REF_SCOPE_KEY, PLATFORM_FILES_APPLIED_HOSTNAME_SCOPE_KEY, PLATFORM_FILES_INTERNAL_URL_SCOPE_KEY, PLATFORM_FILES_INTROSPECTION_SCOPE_KEY, PLATFORM_FILES_INTROSPECTION_UNDELIVERED_SCOPE_KEY, PLATFORM_FILES_KEY, PLATFORM_FILES_MANAGEMENT_KEY_SCOPE_KEY, PLATFORM_FILES_MANAGEMENT_UNDELIVERED_SCOPE_KEY, PLATFORM_FILES_ZITADEL_PROJECT_SCOPE_KEY, PLATFORM_INTEGRATIONS_APPLIED_GITREF_SCOPE_KEY, PLATFORM_INTEGRATIONS_APPLIED_HOSTNAME_SCOPE_KEY, PLATFORM_INTEGRATIONS_KEY, PLATFORM_INTEGRATIONS_KEY_ID_SCOPE_KEY, PLATFORM_INTEGRATIONS_KEY_ROTATION_PREVIOUS_SCOPE_KEY, PLATFORM_INTEGRATIONS_KEY_ROTATION_REQUESTED_SCOPE_KEY, PLATFORM_INTEGRATIONS_KEY_ROTATION_UNDELIVERED_SCOPE_KEY, PLATFORM_INTEGRATIONS_KEY_SET_SCOPE_KEY, PLATFORM_INTEGRATIONS_KEY_UNDELIVERED_SCOPE_KEY, PLATFORM_INTEGRATIONS_RUNNER_KEYRING_DEPLOYED_SCOPE_KEY, PLATFORM_MAIL_ADMIN_KEY_SCOPE_KEY, PLATFORM_MAIL_ADMIN_UNDELIVERED_SCOPE_KEY, PLATFORM_MAIL_APPLIED_GIT_REF_SCOPE_KEY, PLATFORM_MAIL_APPLIED_HOSTNAME_SCOPE_KEY, PLATFORM_MAIL_CONNECTOR_APP_SCOPE_KEY, PLATFORM_MAIL_INTERNAL_URL_SCOPE_KEY, PLATFORM_MAIL_KEY, PLATFORM_MAIL_ZITADEL_PROJECT_SCOPE_KEY, archonBootstrapOperator, parseBrokerDeployRecord, parseLoginClientRecord, platformMailMxHost, } from './platform-diff.js';
 import { applyCallsSfuPlatformStep } from './platform-sfu.js';
 import { CreateInstanceError, createZitadelInstance, generateSystemApiKeypair, instanceWithoutBearerMessage, systemApiUsersEnv, } from './zitadel-system-api.js';
 /** The key `runPlatformSteps` records the apex zone's id under (`system:kind:key`). */
@@ -94,8 +94,8 @@ const JOBS_SCHEDULER_REPO = 'wtfalch/jobs';
  * #172 adds `coolify:app` keyed {@link PLATFORM_AI_KEY}, the platform's AI
  * host ({@link provisionPlatformAi}), once a host passes {@link PlatformAiDeps}.
  *
- * #478 adds `coolify:app` keyed {@link PLATFORM_NAMES_KEY}, the names host
- * ({@link provisionPlatformNames}), once a host passes {@link PlatformNamesDeps}.
+ * #478 adds `coolify:app` keyed {@link PLATFORM_EDGE_KEY}, the edge host
+ * ({@link provisionPlatformEdge}), once a host passes {@link PlatformEdgeDeps}.
  *
  * #175 adds `coolify:app` keyed {@link PLATFORM_ARCHON_KEY}, Archon itself
  * ({@link provisionPlatformArchon}), once a host passes
@@ -116,7 +116,7 @@ export class FoundryPlatformStepExecutor {
     integrations;
     files;
     ai;
-    names;
+    edge;
     archon;
     backup;
     constructor(cloudflare, declaredOrgStore, options = {}) {
@@ -130,7 +130,7 @@ export class FoundryPlatformStepExecutor {
         this.integrations = options.integrations;
         this.files = options.files;
         this.ai = options.ai;
-        this.names = options.names;
+        this.edge = options.edge;
         this.archon = options.archon;
         this.backup = options.backup;
     }
@@ -217,14 +217,14 @@ export class FoundryPlatformStepExecutor {
             blocked.ai =
                 "the platform's AI host is blocked, not planned: its signing key is already pinned but the host built the platform executor without a held-key reader to read back its private half (PlatformAiDeps.heldKeys)";
         }
-        if (platform.names.enabled && !this.names) {
-            blocked.names =
-                'the names host is blocked, not planned: the host built the platform executor without its names dependencies';
+        if (platform.edge.enabled && !this.edge) {
+            blocked.edge =
+                'the edge host is blocked, not planned: the host built the platform executor without its edge dependencies';
         }
-        else if (platform.names.enabled && this.names) {
-            const namesBlocked = await namesBlockedReason(this.names);
-            if (namesBlocked)
-                blocked.names = namesBlocked;
+        else if (platform.edge.enabled && this.edge) {
+            const edgeBlocked = await edgeBlockedReason(this.edge);
+            if (edgeBlocked)
+                blocked.edge = edgeBlocked;
         }
         if (platform.archon.enabled) {
             if (!this.archon) {
@@ -375,11 +375,11 @@ export class FoundryPlatformStepExecutor {
             }
             return provisionPlatformAi(context, this.ai);
         }
-        if (action.system === 'coolify' && action.kind === 'app' && action.key === PLATFORM_NAMES_KEY) {
-            if (!this.names) {
-                throw new Error('platform:names needs FoundryPlatformStepExecutor to be constructed with its names dependencies (#478)');
+        if (action.system === 'coolify' && action.kind === 'app' && action.key === PLATFORM_EDGE_KEY) {
+            if (!this.edge) {
+                throw new Error('platform:edge needs FoundryPlatformStepExecutor to be constructed with its edge dependencies (#478)');
             }
-            return provisionPlatformNames(context, this.names);
+            return provisionPlatformEdge(context, this.edge);
         }
         if (action.system === 'coolify' &&
             action.kind === 'app' &&
@@ -5105,74 +5105,74 @@ shareDomains) {
     await record(PLATFORM_FILES_APPLIED_GIT_REF_SCOPE_KEY, gitRef);
     return { resourceId: runnerApp.appId };
 }
-/** https://github.com/wtfalch/names -- root Dockerfile, one `runner` target (see {@link provisionPlatformNames}'s own doc comment for why there is no `migration` target any more). */
-const NAMES_REPO = 'wtfalch/names';
-const PLATFORM_NAMES_PROJECT = 'platform';
-const PLATFORM_NAMES_DB_NAME = 'platform-names-db';
-const NAMES_APP_NAME = 'names';
+/** https://github.com/wtfalch/edge -- root Dockerfile, one `runner` target (see {@link provisionPlatformEdge}'s own doc comment for why there is no `migration` target any more). */
+const EDGE_REPO = 'wtfalch/edge';
+const PLATFORM_EDGE_PROJECT = 'platform';
+const PLATFORM_EDGE_DB_NAME = 'platform-edge-db';
+const EDGE_APP_NAME = 'edge';
 /** The app's fixed `custom_internal_name`, the way `platform:files`' runner names itself. */
-const NAMES_RUNNER_INTERNAL_NAME = 'platform-names';
+const EDGE_RUNNER_INTERNAL_NAME = 'platform-edge';
 /** The runner's port (its Dockerfile: `PORT=3000`, `EXPOSE 3000`). */
-const NAMES_PORT = '3000';
+const EDGE_PORT = '3000';
 /** The Postgres database name, and the owner role's name per the host's own `.env.example`. */
-const NAMES_DB = 'names';
-const NAMES_OWNER_ROLE = 'names_owner';
+const EDGE_DB = 'names';
+const EDGE_OWNER_ROLE = 'names_owner';
 /** The restricted runtime role `migrate.mjs`'s own `ensureRuntimeRole` creates or syncs at every boot. */
-const NAMES_RUNTIME_ROLE = 'names_rt';
-const NAMES_TUNNEL_NAME = 'platform-names-tunnel';
-/** #197: the one Coolify app that runs `cloudflared` for {@link NAMES_TUNNEL_NAME}. */
-const NAMES_CLOUDFLARED_APP_NAME = 'platform-names-cloudflared';
-const PLATFORM_NAMES_PROJECT_SCOPE_KEY = 'coolify_project_platform_names';
-const PLATFORM_NAMES_DB_SCOPE_KEY = 'coolify_platform_names_database';
-const PLATFORM_NAMES_APP_SCOPE_KEY = 'coolify_platform_names_app';
-const PLATFORM_NAMES_TUNNEL_SCOPE_KEY = 'cloudflare_platform_names_tunnel';
-const PLATFORM_NAMES_CONNECTOR_APP_SCOPE_KEY = 'coolify_platform_names_connector_app';
+const EDGE_RUNTIME_ROLE = 'names_rt';
+const EDGE_TUNNEL_NAME = 'platform-edge-tunnel';
+/** #197: the one Coolify app that runs `cloudflared` for {@link EDGE_TUNNEL_NAME}. */
+const EDGE_CLOUDFLARED_APP_NAME = 'platform-edge-cloudflared';
+const PLATFORM_EDGE_PROJECT_SCOPE_KEY = 'coolify_project_platform_edge';
+const PLATFORM_EDGE_DB_SCOPE_KEY = 'coolify_platform_edge_database';
+const PLATFORM_EDGE_APP_SCOPE_KEY = 'coolify_platform_edge_app';
+const PLATFORM_EDGE_TUNNEL_SCOPE_KEY = 'cloudflare_platform_edge_tunnel';
+const PLATFORM_EDGE_CONNECTOR_APP_SCOPE_KEY = 'coolify_platform_edge_connector_app';
 /**
  * Written only when absent, never overwritten -- the `PLATFORM_FILES_RUNNER_DEFAULTS`
  * convention, so an operator's own cap or rate survives every apply. Values
  * are the host's own `.env.example` defaults.
  */
-const PLATFORM_NAMES_RUNNER_DEFAULTS = [
+const PLATFORM_EDGE_RUNNER_DEFAULTS = [
     { key: 'MAX_CLAIMS_PER_ORGANISATION', value: '100' },
-    { key: 'NAMES_RATE_BURST', value: '10' },
-    { key: 'NAMES_RATE_PER_SECOND', value: '0.5' },
+    { key: 'EDGE_RATE_BURST', value: '10' },
+    { key: 'EDGE_RATE_PER_SECOND', value: '0.5' },
 ];
 /**
- * Why `coolify:app` keyed {@link PLATFORM_NAMES_KEY} cannot be planned yet,
- * or `null` when it can -- the host built no names dependencies (checked by
+ * Why `coolify:app` keyed {@link PLATFORM_EDGE_KEY} cannot be planned yet,
+ * or `null` when it can -- the host built no edge dependencies (checked by
  * the caller, `FoundryPlatformStepExecutor.blockedSteps`, before this is
  * even called), no Cloudflare API token held under
- * {@link PLATFORM_NAMES_CLOUDFLARE_TOKEN_REF} (CLAUDE.md's "Human steps"),
+ * {@link PLATFORM_EDGE_CLOUDFLARE_TOKEN_REF} (CLAUDE.md's "Human steps"),
  * or no Cloudflare account id supplied beside it.
  */
-async function namesBlockedReason(names) {
+async function edgeBlockedReason(names) {
     let token;
     try {
-        token = (await names.heldKeys?.resolve(PLATFORM_NAMES_CLOUDFLARE_TOKEN_REF)) ?? null;
+        token = (await names.heldKeys?.resolve(PLATFORM_EDGE_CLOUDFLARE_TOKEN_REF)) ?? null;
     }
     catch {
         token = null;
     }
     if (!token) {
-        return `the names host is blocked, not planned: no Cloudflare API token is held under ${PLATFORM_NAMES_CLOUDFLARE_TOKEN_REF} yet (the names service's own token, tunnel edit + DNS edit, never the platform's) -- a human step`;
+        return `the edge host is blocked, not planned: no Cloudflare API token is held under ${PLATFORM_EDGE_CLOUDFLARE_TOKEN_REF} yet (the edge service's own token, tunnel edit + DNS edit, never the platform's) -- a human step`;
     }
     if (!names.cloudflareAccountId) {
-        return 'the names host is blocked, not planned: the host supplies no Cloudflare account id (PlatformNamesDeps.cloudflareAccountId) for the token above';
+        return 'the edge host is blocked, not planned: the host supplies no Cloudflare account id (PlatformEdgeDeps.cloudflareAccountId) for the token above';
     }
     return null;
 }
 /**
- * #478: makes `coolify:app` keyed {@link PLATFORM_NAMES_KEY} true -- the
- * names host (https://github.com/wtfalch/names), its own database, and
- * foundry's own platform key, reached at `platform.names.hostname` through
+ * #478: makes `coolify:app` keyed {@link PLATFORM_EDGE_KEY} true -- the
+ * edge host (https://github.com/wtfalch/edge), its own database, and
+ * foundry's own platform key, reached at `platform.edge.hostname` through
  * a Cloudflare tunnel and DNS record (the public-service shape
  * {@link provisionPlatformMail}/{@link provisionPlatformAuth} use, not
- * `platform:files`' internal-only one -- `NAMES_URL` has to be reachable by
+ * `platform:files`' internal-only one -- `EDGE_URL` has to be reachable by
  * every org's own app, which runs outside this Coolify network, and by
  * Archon).
  *
  * One Coolify app only, unlike `platform:files`/`platform:ai`'s separate
- * `migrate` app: names' own Dockerfile dropped its `migration` target
+ * `migrate` app: edge' own Dockerfile dropped its `migration` target
  * (its own comment: no generated package's Coolify app ever built or ran
  * that stage, which once shipped `wtfalch/cms` with an empty database and
  * no runtime role). `apps/host/scripts/start.sh` now runs `migrate.mjs`
@@ -5188,27 +5188,27 @@ async function namesBlockedReason(names) {
  * restricted `names_rt` role is never created here -- `migrate.mjs`'s own
  * `ensureRuntimeRole` call creates or syncs it and sets its password from
  * `DATABASE_URL` at every boot, so this function only has to mint that
- * password once and reuse it (`ensureNamesRuntimeUrl`, the
+ * password once and reuse it (`ensureEdgeRuntimeUrl`, the
  * `ensureFilesRuntimeUrl` shape) -- never rotated, since the role's
  * password is set from it on every migration.
  *
  * The platform key follows `platform:files`' management-key discipline
  * (CLAUDE.md rule 1): a random secret is minted once, its id recorded
- * undelivered and persisted before {@link PlatformNamesDeps.deliverSecret}
+ * undelivered and persisted before {@link PlatformEdgeDeps.deliverSecret}
  * is even tried, and the guard recorded only once delivery AND the env
- * write (the SHA-256 hash, as `NAMES_PLATFORM_KEY_HASH`) both succeeded. The
+ * write (the SHA-256 hash, as `EDGE_PLATFORM_KEY_HASH`) both succeeded. The
  * secret itself is never written to the host's own env, logged, returned
  * or put in an error -- only its hash ever reaches names, and the full
- * value goes to {@link PlatformNamesDeps.deliverSecret} under
- * {@link PLATFORM_NAMES_KEY_REF} alone, for Archon's own `NamesPort` to read
- * back later when it mints or revokes an entry's own names key.
+ * value goes to {@link PlatformEdgeDeps.deliverSecret} under
+ * {@link PLATFORM_EDGE_KEY_REF} alone, for Archon's own `EdgePort` to read
+ * back later when it mints or revokes an entry's own edge key.
  *
  * `CLOUDFLARE_API_TOKEN`/`CLOUDFLARE_ACCOUNT_ID` on the runner are never
- * minted here either: they are the names service's own credential (never
- * Archon's), read back from {@link PlatformNamesDeps.heldKeys} under
- * {@link PLATFORM_NAMES_CLOUDFLARE_TOKEN_REF} once a human has put one there
+ * minted here either: they are the edge service's own credential (never
+ * Archon's), read back from {@link PlatformEdgeDeps.heldKeys} under
+ * {@link PLATFORM_EDGE_CLOUDFLARE_TOKEN_REF} once a human has put one there
  * (the issue's own "Human steps") -- `blockedSteps`
- * ({@link namesBlockedReason}) reports the step blocked, not planned, until
+ * ({@link edgeBlockedReason}) reports the step blocked, not planned, until
  * then.
  *
  * Every part is safe to run again after a throw partway, `platform:files`'
@@ -5220,49 +5220,49 @@ async function namesBlockedReason(names) {
  * app redeploys, with no new secret minted.
  *
  * Known gaps, left for review:
- * - `NAMES_MAX_QUEUE_DEPTH` (the host's `.env.example`) is not set; the host
+ * - `EDGE_MAX_QUEUE_DEPTH` (the host's `.env.example`) is not set; the host
  *   falls back to its own default.
- * - `NAMES_TRUST_CF_CONNECTING_IP` is always written `true` rather than
+ * - `EDGE_TRUST_CF_CONNECTING_IP` is always written `true` rather than
  *   left to the host's own default, since this step always puts the
  *   runner behind the Cloudflare tunnel it also creates.
  */
-async function provisionPlatformNames(context, deps) {
+async function provisionPlatformEdge(context, deps) {
     const { platform } = context;
-    const hostname = platform.names.hostname;
-    const gitRef = platform.names.gitRef;
+    const hostname = platform.edge.hostname;
+    const gitRef = platform.edge.gitRef;
     const recorded = context.recordedIds();
     const runtime = deps.runtime ?? {};
     const sleep = runtime.sleep ?? defaultSleep;
     const attempts = runtime.deliverAttempts ?? 3;
-    const cloudflareToken = await deps.heldKeys?.resolve(PLATFORM_NAMES_CLOUDFLARE_TOKEN_REF);
+    const cloudflareToken = await deps.heldKeys?.resolve(PLATFORM_EDGE_CLOUDFLARE_TOKEN_REF);
     if (!cloudflareToken || !deps.cloudflareAccountId) {
-        throw new Error(`platform:names needs the names service's own Cloudflare API token (held under ${PLATFORM_NAMES_CLOUDFLARE_TOKEN_REF}) and account id (PlatformNamesDeps.cloudflareAccountId); names never becomes healthy without them`);
+        throw new Error(`platform:edge needs the edge service's own Cloudflare API token (held under ${PLATFORM_EDGE_CLOUDFLARE_TOKEN_REF}) and account id (PlatformEdgeDeps.cloudflareAccountId); names never becomes healthy without them`);
     }
     // Never plan-and-throw (CLAUDE.md rule 2): the planner reports a lost
     // secret and plans nothing; this is the same rule for a caller that
     // reaches the step anyway.
-    const lostKey = recorded[PLATFORM_NAMES_PLATFORM_KEY_UNDELIVERED_SCOPE_KEY];
-    if (lostKey && !recorded[PLATFORM_NAMES_PLATFORM_KEY_SET_SCOPE_KEY]) {
-        throw new Error(`platform:names: the platform key (${lostKey}) was minted but never delivered; remove the recorded key ${PLATFORM_NAMES_PLATFORM_KEY_UNDELIVERED_SCOPE_KEY} to mint a new one`);
+    const lostKey = recorded[PLATFORM_EDGE_PLATFORM_KEY_UNDELIVERED_SCOPE_KEY];
+    if (lostKey && !recorded[PLATFORM_EDGE_PLATFORM_KEY_SET_SCOPE_KEY]) {
+        throw new Error(`platform:edge: the platform key (${lostKey}) was minted but never delivered; remove the recorded key ${PLATFORM_EDGE_PLATFORM_KEY_UNDELIVERED_SCOPE_KEY} to mint a new one`);
     }
     const record = async (key, id) => {
         context.recordScopeId(key, id);
         await context.persist?.();
     };
-    let projectUuid = recorded[PLATFORM_NAMES_PROJECT_SCOPE_KEY];
+    let projectUuid = recorded[PLATFORM_EDGE_PROJECT_SCOPE_KEY];
     if (!projectUuid) {
-        const found = await deps.coolify.findProjectByName(PLATFORM_NAMES_PROJECT);
+        const found = await deps.coolify.findProjectByName(PLATFORM_EDGE_PROJECT);
         projectUuid = found
             ? found.uuid
-            : (await deps.coolify.createProject(PLATFORM_NAMES_PROJECT)).uuid;
-        await record(PLATFORM_NAMES_PROJECT_SCOPE_KEY, projectUuid);
+            : (await deps.coolify.createProject(PLATFORM_EDGE_PROJECT)).uuid;
+        await record(PLATFORM_EDGE_PROJECT_SCOPE_KEY, projectUuid);
     }
     const { environment } = await deps.coolify.findOrCreateEnvironment(projectUuid, 'production');
     const server = await resolvePlatformServer(deps.coolify);
     // ---- database ----------------------------------------------------------
-    let dbId = recorded[PLATFORM_NAMES_DB_SCOPE_KEY];
+    let dbId = recorded[PLATFORM_EDGE_DB_SCOPE_KEY];
     if (!dbId) {
-        const found = (await deps.coolify.listDatabases()).find((db) => db.name === PLATFORM_NAMES_DB_NAME && db.environment_id === environment.id);
+        const found = (await deps.coolify.listDatabases()).find((db) => db.name === PLATFORM_EDGE_DB_NAME && db.environment_id === environment.id);
         if (found) {
             dbId = found.uuid;
         }
@@ -5272,20 +5272,20 @@ async function provisionPlatformNames(context, deps) {
                 server_uuid: server.uuid,
                 environment_name: environment.name,
                 environment_uuid: environment.uuid,
-                name: PLATFORM_NAMES_DB_NAME,
-                postgres_db: NAMES_DB,
-                postgres_user: NAMES_OWNER_ROLE,
+                name: PLATFORM_EDGE_DB_NAME,
+                postgres_db: EDGE_DB,
+                postgres_user: EDGE_OWNER_ROLE,
             });
             dbId = created.uuid;
         }
-        await record(PLATFORM_NAMES_DB_SCOPE_KEY, dbId);
+        await record(PLATFORM_EDGE_DB_SCOPE_KEY, dbId);
     }
     const db = await getDatabaseStarted(deps.coolify, dbId);
     if (!db.internal_db_url) {
-        throw new Error('coolify:app for the platform (names): the database has no internal_db_url yet -- retry this apply once Coolify reports one');
+        throw new Error('coolify:app for the platform (edge): the database has no internal_db_url yet -- retry this apply once Coolify reports one');
     }
     // ---- the app -------------------------------------------------------------
-    const app = await findOrCreatePlatformApp(deps.coolify, NAMES_APP_NAME, environment, async () => {
+    const app = await findOrCreatePlatformApp(deps.coolify, EDGE_APP_NAME, environment, async () => {
         const githubApp = await deps.coolify.requireGithubApp();
         return deps.coolify.createGithubAppApplication({
             project_uuid: projectUuid,
@@ -5293,41 +5293,41 @@ async function provisionPlatformNames(context, deps) {
             environment_name: environment.name,
             environment_uuid: environment.uuid,
             github_app_uuid: githubApp.uuid,
-            git_repository: NAMES_REPO,
+            git_repository: EDGE_REPO,
             git_branch: gitRef,
             build_pack: 'dockerfile',
-            name: NAMES_APP_NAME,
+            name: EDGE_APP_NAME,
         });
     });
     const appId = app.appId;
-    await record(PLATFORM_NAMES_APP_SCOPE_KEY, appId);
+    await record(PLATFORM_EDGE_APP_SCOPE_KEY, appId);
     // Set on every run, not only after a create: a throw right after the
     // create must not leave the app on the wrong target for good, and a
     // changed `gitRef` has to reach an app made on an earlier one.
     await deps.coolify.updateApplication(appId, {
         dockerfile_target_build: 'runner',
-        custom_internal_name: NAMES_RUNNER_INTERNAL_NAME,
+        custom_internal_name: EDGE_RUNNER_INTERNAL_NAME,
         git_branch: gitRef,
     });
-    const runtimeUrl = await ensureNamesRuntimeUrl(deps.coolify, appId, db.internal_db_url);
+    const runtimeUrl = await ensureEdgeRuntimeUrl(deps.coolify, appId, db.internal_db_url);
     // ---- the platform key, once ----------------------------------------------
     // The recorded `set` id *is* the hash (never read back from Coolify's own
     // env, which can be missing or stale on a re-apply): the hash is never
     // secret, so it doubles as both the undelivered id and the value the base
     // env below writes, with nothing extra to compute or a live read that
     // could fall back to a blank value.
-    let keyHash = recorded[PLATFORM_NAMES_PLATFORM_KEY_SET_SCOPE_KEY] ?? '';
+    let keyHash = recorded[PLATFORM_EDGE_PLATFORM_KEY_SET_SCOPE_KEY] ?? '';
     if (!keyHash) {
         const secret = randomBytes(32).toString('base64url');
         keyHash = createHash('sha256').update(secret).digest('hex');
-        await record(PLATFORM_NAMES_PLATFORM_KEY_UNDELIVERED_SCOPE_KEY, keyHash);
-        await deliverWithRetry(deps.deliverSecret, PLATFORM_NAMES_KEY_REF, secret, attempts, sleep, 'the names platform key', 'platform:names');
+        await record(PLATFORM_EDGE_PLATFORM_KEY_UNDELIVERED_SCOPE_KEY, keyHash);
+        await deliverWithRetry(deps.deliverSecret, PLATFORM_EDGE_KEY_REF, secret, attempts, sleep, 'the edge platform key', 'platform:edge');
         // Recorded as soon as delivery succeeds, before the env write below (the
         // base env block, further down, is what actually writes the hash) --
         // so a failed or crashed env write is simply retried on the next apply
         // instead of leaving an undelivered secret with no `set` partner and no
         // way to recover but a hand edit of the recorded ids.
-        await record(PLATFORM_NAMES_PLATFORM_KEY_SET_SCOPE_KEY, keyHash);
+        await record(PLATFORM_EDGE_PLATFORM_KEY_SET_SCOPE_KEY, keyHash);
     }
     // ---- base env, written on every run --------------------------------------
     await deps.coolify.bulkUpsertEnvs(appId, [
@@ -5336,18 +5336,18 @@ async function provisionPlatformNames(context, deps) {
         { key: 'APP_URL', value: `https://${hostname}` },
         { key: 'CLOUDFLARE_API_TOKEN', value: cloudflareToken },
         { key: 'CLOUDFLARE_ACCOUNT_ID', value: deps.cloudflareAccountId },
-        { key: 'NAMES_TRUST_CF_CONNECTING_IP', value: 'true' },
+        { key: 'EDGE_TRUST_CF_CONNECTING_IP', value: 'true' },
         { key: 'NODE_ENV', value: 'production' },
-        { key: 'NAMES_PLATFORM_KEY_HASH', value: keyHash },
-        ...(await missingEnvs(deps.coolify, appId, PLATFORM_NAMES_RUNNER_DEFAULTS)),
+        { key: 'EDGE_PLATFORM_KEY_HASH', value: keyHash },
+        ...(await missingEnvs(deps.coolify, appId, PLATFORM_EDGE_RUNNER_DEFAULTS)),
     ]);
     // ---- tunnel and DNS -------------------------------------------------------
-    const existingTunnel = await deps.cloudflare.findTunnelByName(NAMES_TUNNEL_NAME);
-    const tunnel = existingTunnel ?? (await deps.cloudflare.createTunnel(NAMES_TUNNEL_NAME));
-    await record(PLATFORM_NAMES_TUNNEL_SCOPE_KEY, tunnel.id);
+    const existingTunnel = await deps.cloudflare.findTunnelByName(EDGE_TUNNEL_NAME);
+    const tunnel = existingTunnel ?? (await deps.cloudflare.createTunnel(EDGE_TUNNEL_NAME));
+    await record(PLATFORM_EDGE_TUNNEL_SCOPE_KEY, tunnel.id);
     await deps.cloudflare.putTunnelConfig(tunnel.id, {
         ingress: [
-            { hostname, service: `http://${NAMES_RUNNER_INTERNAL_NAME}:${NAMES_PORT}` },
+            { hostname, service: `http://${EDGE_RUNNER_INTERNAL_NAME}:${EDGE_PORT}` },
             { service: 'http_status:404' },
         ],
     });
@@ -5356,16 +5356,16 @@ async function provisionPlatformNames(context, deps) {
         coolify: deps.coolify,
         cloudflare: deps.cloudflare,
         tunnelId: tunnel.id,
-        appName: NAMES_CLOUDFLARED_APP_NAME,
+        appName: EDGE_CLOUDFLARED_APP_NAME,
         projectUuid,
         environment,
         resolveServer: async () => server,
-        recordedConnectorAppId: recorded[PLATFORM_NAMES_CONNECTOR_APP_SCOPE_KEY] ?? null,
-        recordAppId: (connectorAppId) => record(PLATFORM_NAMES_CONNECTOR_APP_SCOPE_KEY, connectorAppId),
+        recordedConnectorAppId: recorded[PLATFORM_EDGE_CONNECTOR_APP_SCOPE_KEY] ?? null,
+        recordAppId: (connectorAppId) => record(PLATFORM_EDGE_CONNECTOR_APP_SCOPE_KEY, connectorAppId),
     });
     const zoneId = recorded[apexZoneKey(platform.apex)] ?? (await exactZone(deps.cloudflare, platform.apex))?.id;
     if (!zoneId) {
-        throw new Error(`platform:names: no Cloudflare zone for ${platform.apex} to put ${hostname} in`);
+        throw new Error(`platform:edge: no Cloudflare zone for ${platform.apex} to put ${hostname} in`);
     }
     const dnsTarget = `${tunnel.id}.cfargotunnel.com`;
     const [dnsRecord] = await deps.cloudflare.findDnsRecord(zoneId, hostname, 'CNAME');
@@ -5390,10 +5390,10 @@ async function provisionPlatformNames(context, deps) {
     // helper (deployment-record check, then the `/api/health` probe) can run
     // in one call -- unlike `platform:mail`, nothing here needs to happen
     // between the two phases.
-    await waitForNewDeployment(deps.coolify, appId, { kind: 'ready', url: `https://${hostname}/api/health` }, runtime, sleep, 'platform:names', `names stays at ${recorded[PLATFORM_NAMES_APPLIED_GIT_REF_SCOPE_KEY] ?? 'no recorded ref'}`);
+    await waitForNewDeployment(deps.coolify, appId, { kind: 'ready', url: `https://${hostname}/api/health` }, runtime, sleep, 'platform:edge', `edge stays at ${recorded[PLATFORM_EDGE_APPLIED_GIT_REF_SCOPE_KEY] ?? 'no recorded ref'}`);
     // Last: a run that failed anywhere above is planned again.
-    context.recordScopeId(PLATFORM_NAMES_APPLIED_HOSTNAME_SCOPE_KEY, hostname);
-    await record(PLATFORM_NAMES_APPLIED_GIT_REF_SCOPE_KEY, gitRef);
+    context.recordScopeId(PLATFORM_EDGE_APPLIED_HOSTNAME_SCOPE_KEY, hostname);
+    await record(PLATFORM_EDGE_APPLIED_GIT_REF_SCOPE_KEY, gitRef);
     return { resourceId: appId };
 }
 /**
@@ -5403,7 +5403,7 @@ async function provisionPlatformNames(context, deps) {
  * throws a message with no part of the URL in it, since the URL carries the
  * owner's password.
  */
-async function ensureNamesRuntimeUrl(coolify, appId, dbInternalUrl) {
+async function ensureEdgeRuntimeUrl(coolify, appId, dbInternalUrl) {
     const existing = (await coolify.listEnvs(appId)).find((e) => e.key === 'DATABASE_URL' && !e.is_preview && e.value);
     if (existing)
         return existing.value;
@@ -5414,10 +5414,10 @@ async function ensureNamesRuntimeUrl(coolify, appId, dbInternalUrl) {
         ({ host, pathname, search } = new URL(dbInternalUrl));
     }
     catch {
-        throw new Error("coolify:app for the platform (names): the database's internal_db_url could not be parsed to build the runtime DATABASE_URL");
+        throw new Error("coolify:app for the platform (edge): the database's internal_db_url could not be parsed to build the runtime DATABASE_URL");
     }
     const password = randomBytes(24).toString('base64url');
-    return `postgres://${NAMES_RUNTIME_ROLE}:${password}@${host}${pathname}${search}`;
+    return `postgres://${EDGE_RUNTIME_ROLE}:${password}@${host}${pathname}${search}`;
 }
 function aiKeys(deps) {
     const keys = deps?.keys;

package/dist/plan/step-system.js

@@ -4,7 +4,7 @@ const PLATFORM_APP_SYSTEMS = {
     'platform:mail': 'stalwart',
     'platform:files': 'files',
     'platform:ai': 'ai',
-    'platform:names': 'names',
+    'platform:edge': 'edge',
 };
 /** The system `action` touches. The one place that decides it, so no planner sets it by hand. */
 export function stepSystemOf(action) {