@wtfalch/foundry 0.17.1 → 0.18.0

package/dist/plan/{edge-worker.d.ts → worker.d.ts}

@@ -1,24 +1,24 @@
-import type { DeclaredOrg, EdgeConfig, HostingEntry } from '../org.js';
+import type { DeclaredOrg, HostingEntry, WorkerConfig } from '../org.js';
 import type { DraftStep } from './diff.js';
 /**
  * F8 (#318): one plain Cloudflare Worker per hosting entry that declares
- * `edge`, deployed from a built artifact that entry's own repo publishes
+ * `worker`, deployed from a built artifact that entry's own repo publishes
  * (estate DECISIONS.md, 2026-10-04: foundry fetches and verifies it, never
  * checks it out or bundles it). Unlike `planEntryAiKeys`/`planFilesKeys`,
  * there is no renewal window -- a Worker script has no expiry -- so a step
  * is planned again only while the entry's own declared config (`route`,
  * `bindings` or, crucially, `artifactSha256`) differs from what was last
- * applied (recorded as that config's JSON, `edgeAppliedScopeKey`):
+ * applied (recorded as that config's JSON, `workerAppliedScopeKey`):
  * `artifactSha256` is itself the declared signal that the built bytes
  * changed, so a rebuild under an unchanged URL still redeploys as soon as
  * the entry declares the new digest. "Blocked, not failing" (CLAUDE.md): a
  * host whose executor carries no `WorkersPort` reports every entry's step
  * (apply or retire) as blocked, not planned to a step that would throw.
  */
-export declare const entryEdgeAppliedScopeKey: (entryKey: string) => string;
-export declare const entryEdgeRouteIdScopeKey: (entryKey: string) => string;
+export declare const entryWorkerAppliedScopeKey: (entryKey: string) => string;
+export declare const entryWorkerRouteIdScopeKey: (entryKey: string) => string;
 /** The route pattern the recorded route id above was created for -- read to find and delete the *old* route when the declared route pattern changes. */
-export declare const entryEdgeRoutePatternScopeKey: (entryKey: string) => string;
+export declare const entryWorkerRoutePatternScopeKey: (entryKey: string) => string;
 /**
  * The script name retired, once a retire step completes. `runSteps` only
  * ever writes a step's main recorded id from a *truthy* `resourceId`
@@ -27,25 +27,35 @@ export declare const entryEdgeRoutePatternScopeKey: (entryKey: string) => string
  * and without this marker the "gone" scan below would plan the same retire
  * forever. Compared against that still-live id, the same convergence
  * `entryAiRetiredScopeKey`/`entryFilesRetiredScopeKey`/
- * `entryNamesRetiredScopeKey` already give their own entry keys.
+ * `entryEdgeRetiredScopeKey` already give their own entry keys.
  */
-export declare const entryEdgeRetiredScopeKey: (entryKey: string) => string;
+export declare const entryWorkerRetiredScopeKey: (entryKey: string) => string;
 /** The script name being uploaded, recorded (and persisted) *before* the upload call -- so a crash mid-upload or a failed route create still leaves a trail to the script rather than orphaning it, and a retry reads the script as foundry's own instead of tripping the `scriptExists` overwrite guard. Cleared once the step records success. */
-export declare const entryEdgeUploadedScopeKey: (entryKey: string) => string;
-/** The zone the recorded route id lives in, as {@link EdgeRouteZone} JSON -- so retire and destroy delete it on *that* zone even after `org.domain` changes or goes null. */
-export declare const entryEdgeRouteZoneScopeKey: (entryKey: string) => string;
-/** A route about to be created, as {@link EdgeRoutePending} JSON, recorded and persisted before `createRoute` -- so a crash or failed persist right after Cloudflare creates it still leaves retire and destroy something to find it by (`findRoute`). Cleared once the route id is recorded. */
-export declare const entryEdgeRoutePendingScopeKey: (entryKey: string) => string;
-export interface EdgeRouteZone {
+export declare const entryWorkerUploadedScopeKey: (entryKey: string) => string;
+/** The zone the recorded route id lives in, as {@link WorkerRouteZone} JSON -- so retire and destroy delete it on *that* zone even after `org.domain` changes or goes null. */
+export declare const entryWorkerRouteZoneScopeKey: (entryKey: string) => string;
+/** A route about to be created, as {@link WorkerRoutePending} JSON, recorded and persisted before `createRoute` -- so a crash or failed persist right after Cloudflare creates it still leaves retire and destroy something to find it by (`findRoute`). Cleared once the route id is recorded. */
+export declare const entryWorkerRoutePendingScopeKey: (entryKey: string) => string;
+/**
+ * The no-Worker routes kept beside an entry's wildcard Worker route, as
+ * {@link WorkerExclusions} JSON. Written after each create or delete, so a
+ * crash leaves every route that exists recorded.
+ */
+export declare const entryWorkerExclusionsScopeKey: (entryKey: string) => string;
+export interface WorkerExclusions extends WorkerRouteZone {
+    /** Route pattern to Cloudflare route id. */
+    routes: Record<string, string>;
+}
+export interface WorkerRouteZone {
     id: string;
     apex: string;
 }
-export interface EdgeRoutePending extends EdgeRouteZone {
+export interface WorkerRoutePending extends WorkerRouteZone {
     pattern: string;
     script: string;
 }
 /** The per-entry scope keys that mark something deployed or half-deployed, or that a retire already handled it -- cleared together once org destroy has torn the Worker down (#318 re-review: the retired marker was left out, so it stayed recorded as a stale leftover after the org itself was gone). */
-export declare const edgeWorkerTraceScopeKeys: (entryKey: string) => string[];
+export declare const workerTraceScopeKeys: (entryKey: string) => string[];
 /**
  * Every entry key of `orgId` with something foundry deployed still live,
  * mapped to the script name recorded for it (`''` if only a route trace is
@@ -56,11 +66,11 @@ export declare const edgeWorkerTraceScopeKeys: (entryKey: string) => string[];
  * the retired marker, since an apply clears that marker before it leaves any
  * of these (#318 re-review).
  */
-export declare function liveEdgeWorkers(orgId: string, recordedIds: Readonly<Record<string, string>>): Map<string, string>;
-/** The first 8 hex characters of org.id's own sha256 -- see {@link edgeWorkerName}'s doc comment. */
-export declare const EDGE_WORKER_ORG_HASH_LENGTH = 8;
+export declare function liveWorkers(orgId: string, recordedIds: Readonly<Record<string, string>>): Map<string, string>;
+/** The first 8 hex characters of org.id's own sha256 -- see {@link workerName}'s doc comment. */
+export declare const WORKER_ORG_HASH_LENGTH = 8;
 /** Cloudflare's own limit on a Worker script name. */
-export declare const EDGE_WORKER_NAME_MAX_LENGTH = 63;
+export declare const WORKER_NAME_MAX_LENGTH = 63;
 /**
  * `${8-hex-char hash of org.id}-${entry.key}-edge`, not `${org.slug}-...`
  * (#318 re-review): a slug and an entry key both allow hyphens, so org
@@ -69,37 +79,47 @@ export declare const EDGE_WORKER_NAME_MAX_LENGTH = 63;
  * caught the second of the two to apply, and two concurrent applies could
  * both pass it. `org.id` is a UUID with no ambiguity of its own, but using
  * it in full would make the fixed part of the name longer than most of the
- * 63-character budget this port's `EDGE_WORKER_NAME_MAX_LENGTH` gives it,
- * so only a short hash of it is used -- `validateEntryEdge` (`org.ts`)
+ * 63-character budget this port's `WORKER_NAME_MAX_LENGTH` gives it,
+ * so only a short hash of it is used -- `validateEntryWorker` (`org.ts`)
  * checks the resulting name never exceeds that limit.
  */
-export declare const edgeWorkerName: (org: DeclaredOrg, entry: HostingEntry) => string;
+export declare const workerName: (org: DeclaredOrg, entry: HostingEntry) => string;
 /**
  * Foundry's own fixed compatibility date for every Worker it deploys -- not
- * a per-entry declared value, so it is not part of {@link EdgeWorkerWant}
+ * a per-entry declared value, so it is not part of {@link WorkerWant}
  * and never triggers a re-plan on its own; bumping it is a foundry release,
  * like {@link RATE_LIMIT_FREE_PLAN_PERIOD_SECONDS} is a fixed Cloudflare
  * Free plan value rather than something an org declares.
  */
-export declare const EDGE_WORKER_COMPATIBILITY_DATE = "2026-09-12";
-export type EdgeWorkerMode = 'apply' | 'retire';
-export interface EdgeWorkerWant {
+export declare const WORKER_COMPATIBILITY_DATE = "2026-09-12";
+export type WorkerMode = 'apply' | 'retire';
+export interface WorkerWant {
     name: string;
     artifactUrl: string;
     artifactSha256: string;
     route: string;
-    bindings: EdgeConfig['bindings'];
+    bindings: WorkerConfig['bindings'];
+    /** No-Worker route patterns, sorted; set only for a wildcard route with hostnames to keep out. */
+    exclusions?: string[];
 }
-export declare function wantedEdgeWorker(org: DeclaredOrg, entry: HostingEntry): EdgeWorkerWant;
+/**
+ * With a wildcard route (`*.<domain>/*`) the Worker would also capture every
+ * hostname foundry provisions on the domain, so each gets a no-Worker route
+ * `<hostname>/*` (a more specific pattern wins): every entry hostname plus the
+ * names `lockedHostnames` lists (Agora, Boule, the login host, platform apps).
+ * Never the wildcard itself.
+ */
+export declare function workerExclusions(org: DeclaredOrg, entry: HostingEntry, platformHostnames: readonly string[]): string[];
+export declare function wantedWorker(org: DeclaredOrg, entry: HostingEntry, platformHostnames?: readonly string[]): WorkerWant;
 type Blocked = Array<{
     description: string;
     key: string;
 }>;
 /**
- * One step per entry whose `edge` config is new or changed, plus one retire
+ * One step per entry whose `worker` config is new or changed, plus one retire
  * step per entry whose Worker is recorded but no longer declared -- either
- * because the entry dropped `edge` or because the entry itself is gone, the
- * same "gone" scan `planEntryAiKeys`/`planFilesKeys`/`planEntryNamesKeys`
+ * because the entry dropped `worker` or because the entry itself is gone, the
+ * same "gone" scan `planEntryAiKeys`/`planFilesKeys`/`planEntryEdgeKeys`
  * run over their own recorded keys, so removing a whole entry still cleans
  * up its Worker. `workersAvailable` is the host's own
  * `FoundryPlanApplyOptions.edgeWorkers` (mirrors `jobsAvailable`): without
@@ -107,7 +127,7 @@ type Blocked = Array<{
  * than planned to fail at apply. The caller (`diff.ts`) gates the *apply*
  * steps further, on an active zone, the same way it gates `planRateLimit`.
  */
-export declare function planEdgeWorkers(org: DeclaredOrg, recordedIds: Readonly<Record<string, string>>, workersAvailable: boolean): {
+export declare function planWorkers(org: DeclaredOrg, recordedIds: Readonly<Record<string, string>>, workersAvailable: boolean, platformHostnames?: readonly string[]): {
     steps: DraftStep[];
     blocked: Blocked;
 };

package/dist/plan/{edge-worker.js → worker.js}

@@ -1,24 +1,27 @@
 import { createHash } from 'node:crypto';
+import { entryHostnames } from './hostnames.js';
+import { lockedHostnames } from './locked-hostnames.js';
 import { appStepKey } from './platform-diff.js';
 /**
  * F8 (#318): one plain Cloudflare Worker per hosting entry that declares
- * `edge`, deployed from a built artifact that entry's own repo publishes
+ * `worker`, deployed from a built artifact that entry's own repo publishes
  * (estate DECISIONS.md, 2026-10-04: foundry fetches and verifies it, never
  * checks it out or bundles it). Unlike `planEntryAiKeys`/`planFilesKeys`,
  * there is no renewal window -- a Worker script has no expiry -- so a step
  * is planned again only while the entry's own declared config (`route`,
  * `bindings` or, crucially, `artifactSha256`) differs from what was last
- * applied (recorded as that config's JSON, `edgeAppliedScopeKey`):
+ * applied (recorded as that config's JSON, `workerAppliedScopeKey`):
  * `artifactSha256` is itself the declared signal that the built bytes
  * changed, so a rebuild under an unchanged URL still redeploys as soon as
  * the entry declares the new digest. "Blocked, not failing" (CLAUDE.md): a
  * host whose executor carries no `WorkersPort` reports every entry's step
  * (apply or retire) as blocked, not planned to a step that would throw.
  */
-export const entryEdgeAppliedScopeKey = (entryKey) => `edge_worker_applied_${entryKey}`;
-export const entryEdgeRouteIdScopeKey = (entryKey) => `edge_worker_route_id_${entryKey}`;
+// Recorded scope keys keep their `edge_worker_` prefix: renaming them would orphan live Workers.
+export const entryWorkerAppliedScopeKey = (entryKey) => `edge_worker_applied_${entryKey}`;
+export const entryWorkerRouteIdScopeKey = (entryKey) => `edge_worker_route_id_${entryKey}`;
 /** The route pattern the recorded route id above was created for -- read to find and delete the *old* route when the declared route pattern changes. */
-export const entryEdgeRoutePatternScopeKey = (entryKey) => `edge_worker_route_pattern_${entryKey}`;
+export const entryWorkerRoutePatternScopeKey = (entryKey) => `edge_worker_route_pattern_${entryKey}`;
 /**
  * The script name retired, once a retire step completes. `runSteps` only
  * ever writes a step's main recorded id from a *truthy* `resourceId`
@@ -27,23 +30,30 @@ export const entryEdgeRoutePatternScopeKey = (entryKey) => `edge_worker_route_pa
  * and without this marker the "gone" scan below would plan the same retire
  * forever. Compared against that still-live id, the same convergence
  * `entryAiRetiredScopeKey`/`entryFilesRetiredScopeKey`/
- * `entryNamesRetiredScopeKey` already give their own entry keys.
+ * `entryEdgeRetiredScopeKey` already give their own entry keys.
  */
-export const entryEdgeRetiredScopeKey = (entryKey) => `edge_worker_retired_${entryKey}`;
+export const entryWorkerRetiredScopeKey = (entryKey) => `edge_worker_retired_${entryKey}`;
 /** The script name being uploaded, recorded (and persisted) *before* the upload call -- so a crash mid-upload or a failed route create still leaves a trail to the script rather than orphaning it, and a retry reads the script as foundry's own instead of tripping the `scriptExists` overwrite guard. Cleared once the step records success. */
-export const entryEdgeUploadedScopeKey = (entryKey) => `edge_worker_uploaded_${entryKey}`;
-/** The zone the recorded route id lives in, as {@link EdgeRouteZone} JSON -- so retire and destroy delete it on *that* zone even after `org.domain` changes or goes null. */
-export const entryEdgeRouteZoneScopeKey = (entryKey) => `edge_worker_route_zone_${entryKey}`;
-/** A route about to be created, as {@link EdgeRoutePending} JSON, recorded and persisted before `createRoute` -- so a crash or failed persist right after Cloudflare creates it still leaves retire and destroy something to find it by (`findRoute`). Cleared once the route id is recorded. */
-export const entryEdgeRoutePendingScopeKey = (entryKey) => `edge_worker_route_pending_${entryKey}`;
+export const entryWorkerUploadedScopeKey = (entryKey) => `edge_worker_uploaded_${entryKey}`;
+/** The zone the recorded route id lives in, as {@link WorkerRouteZone} JSON -- so retire and destroy delete it on *that* zone even after `org.domain` changes or goes null. */
+export const entryWorkerRouteZoneScopeKey = (entryKey) => `edge_worker_route_zone_${entryKey}`;
+/** A route about to be created, as {@link WorkerRoutePending} JSON, recorded and persisted before `createRoute` -- so a crash or failed persist right after Cloudflare creates it still leaves retire and destroy something to find it by (`findRoute`). Cleared once the route id is recorded. */
+export const entryWorkerRoutePendingScopeKey = (entryKey) => `edge_worker_route_pending_${entryKey}`;
+/**
+ * The no-Worker routes kept beside an entry's wildcard Worker route, as
+ * {@link WorkerExclusions} JSON. Written after each create or delete, so a
+ * crash leaves every route that exists recorded.
+ */
+export const entryWorkerExclusionsScopeKey = (entryKey) => `edge_worker_exclusions_${entryKey}`;
 /** The per-entry scope keys that mark something deployed or half-deployed, or that a retire already handled it -- cleared together once org destroy has torn the Worker down (#318 re-review: the retired marker was left out, so it stayed recorded as a stale leftover after the org itself was gone). */
-export const edgeWorkerTraceScopeKeys = (entryKey) => [
-    entryEdgeUploadedScopeKey(entryKey),
-    entryEdgeRouteIdScopeKey(entryKey),
-    entryEdgeRouteZoneScopeKey(entryKey),
-    entryEdgeRoutePatternScopeKey(entryKey),
-    entryEdgeRoutePendingScopeKey(entryKey),
-    entryEdgeRetiredScopeKey(entryKey),
+export const workerTraceScopeKeys = (entryKey) => [
+    entryWorkerUploadedScopeKey(entryKey),
+    entryWorkerRouteIdScopeKey(entryKey),
+    entryWorkerRouteZoneScopeKey(entryKey),
+    entryWorkerRoutePatternScopeKey(entryKey),
+    entryWorkerRoutePendingScopeKey(entryKey),
+    entryWorkerRetiredScopeKey(entryKey),
+    entryWorkerExclusionsScopeKey(entryKey),
 ];
 /**
  * Every entry key of `orgId` with something foundry deployed still live,
@@ -55,13 +65,14 @@ export const edgeWorkerTraceScopeKeys = (entryKey) => [
  * the retired marker, since an apply clears that marker before it leaves any
  * of these (#318 re-review).
  */
-export function liveEdgeWorkers(orgId, recordedIds) {
+export function liveWorkers(orgId, recordedIds) {
     const mainPrefix = `cloudflare:worker:${orgId}:`;
     const tracePrefixes = [
         mainPrefix,
         'edge_worker_uploaded_',
         'edge_worker_route_id_',
         'edge_worker_route_pending_',
+        'edge_worker_exclusions_',
     ];
     const entryKeys = new Set();
     for (const [name, id] of Object.entries(recordedIds)) {
@@ -74,21 +85,22 @@ export function liveEdgeWorkers(orgId, recordedIds) {
     const live = new Map();
     for (const entryKey of entryKeys) {
         const mainId = recordedIds[`${mainPrefix}${entryKey}`] ?? '';
-        const uploaded = recordedIds[entryEdgeUploadedScopeKey(entryKey)] ?? '';
+        const uploaded = recordedIds[entryWorkerUploadedScopeKey(entryKey)] ?? '';
         const partial = uploaded ||
-            recordedIds[entryEdgeRouteIdScopeKey(entryKey)] ||
-            recordedIds[entryEdgeRoutePendingScopeKey(entryKey)];
-        const retired = mainId !== '' && recordedIds[entryEdgeRetiredScopeKey(entryKey)] === mainId;
+            recordedIds[entryWorkerRouteIdScopeKey(entryKey)] ||
+            recordedIds[entryWorkerRoutePendingScopeKey(entryKey)] ||
+            recordedIds[entryWorkerExclusionsScopeKey(entryKey)];
+        const retired = mainId !== '' && recordedIds[entryWorkerRetiredScopeKey(entryKey)] === mainId;
         if (!partial && (!mainId || retired))
             continue;
         live.set(entryKey, mainId || uploaded);
     }
     return live;
 }
-/** The first 8 hex characters of org.id's own sha256 -- see {@link edgeWorkerName}'s doc comment. */
-export const EDGE_WORKER_ORG_HASH_LENGTH = 8;
+/** The first 8 hex characters of org.id's own sha256 -- see {@link workerName}'s doc comment. */
+export const WORKER_ORG_HASH_LENGTH = 8;
 /** Cloudflare's own limit on a Worker script name. */
-export const EDGE_WORKER_NAME_MAX_LENGTH = 63;
+export const WORKER_NAME_MAX_LENGTH = 63;
 /**
  * `${8-hex-char hash of org.id}-${entry.key}-edge`, not `${org.slug}-...`
  * (#318 re-review): a slug and an entry key both allow hyphens, so org
@@ -97,34 +109,60 @@ export const EDGE_WORKER_NAME_MAX_LENGTH = 63;
  * caught the second of the two to apply, and two concurrent applies could
  * both pass it. `org.id` is a UUID with no ambiguity of its own, but using
  * it in full would make the fixed part of the name longer than most of the
- * 63-character budget this port's `EDGE_WORKER_NAME_MAX_LENGTH` gives it,
- * so only a short hash of it is used -- `validateEntryEdge` (`org.ts`)
+ * 63-character budget this port's `WORKER_NAME_MAX_LENGTH` gives it,
+ * so only a short hash of it is used -- `validateEntryWorker` (`org.ts`)
  * checks the resulting name never exceeds that limit.
  */
-export const edgeWorkerName = (org, entry) => `${createHash('sha256').update(org.id).digest('hex').slice(0, EDGE_WORKER_ORG_HASH_LENGTH)}-${entry.key}-edge`;
+export const workerName = (org, entry) => 
+// The `-edge` suffix stays after the entry field rename to `worker`, so live Workers keep their names and are not orphaned.
+`${createHash('sha256').update(org.id).digest('hex').slice(0, WORKER_ORG_HASH_LENGTH)}-${entry.key}-edge`;
 /**
  * Foundry's own fixed compatibility date for every Worker it deploys -- not
- * a per-entry declared value, so it is not part of {@link EdgeWorkerWant}
+ * a per-entry declared value, so it is not part of {@link WorkerWant}
  * and never triggers a re-plan on its own; bumping it is a foundry release,
  * like {@link RATE_LIMIT_FREE_PLAN_PERIOD_SECONDS} is a fixed Cloudflare
  * Free plan value rather than something an org declares.
  */
-export const EDGE_WORKER_COMPATIBILITY_DATE = '2026-09-12';
-export function wantedEdgeWorker(org, entry) {
-    const edge = entry.edge;
+export const WORKER_COMPATIBILITY_DATE = '2026-09-12';
+/**
+ * With a wildcard route (`*.<domain>/*`) the Worker would also capture every
+ * hostname foundry provisions on the domain, so each gets a no-Worker route
+ * `<hostname>/*` (a more specific pattern wins): every entry hostname plus the
+ * names `lockedHostnames` lists (Agora, Boule, the login host, platform apps).
+ * Never the wildcard itself.
+ */
+export function workerExclusions(org, entry, platformHostnames) {
+    const route = entry.worker?.route;
+    const { domain } = org;
+    if (!route || !domain || !route.startsWith('*.'))
+        return [];
+    const names = new Set(lockedHostnames(org, platformHostnames));
+    for (const e of org.hosting.entries)
+        for (const h of entryHostnames(org, e))
+            names.add(h);
+    return [...names]
+        .filter((h) => h === domain || h.endsWith(`.${domain}`))
+        .map((h) => `${h}/*`)
+        .filter((pattern) => pattern !== route)
+        .sort();
+}
+export function wantedWorker(org, entry, platformHostnames = []) {
+    const worker = entry.worker;
+    const exclusions = workerExclusions(org, entry, platformHostnames);
     return {
-        name: edgeWorkerName(org, entry),
-        artifactUrl: edge.artifactUrl,
-        artifactSha256: edge.artifactSha256,
-        route: edge.route,
-        bindings: edge.bindings,
+        name: workerName(org, entry),
+        artifactUrl: worker.artifactUrl,
+        artifactSha256: worker.artifactSha256,
+        route: worker.route,
+        bindings: worker.bindings,
+        exclusions: exclusions.length > 0 ? exclusions : undefined,
     };
 }
 /**
- * One step per entry whose `edge` config is new or changed, plus one retire
+ * One step per entry whose `worker` config is new or changed, plus one retire
  * step per entry whose Worker is recorded but no longer declared -- either
- * because the entry dropped `edge` or because the entry itself is gone, the
- * same "gone" scan `planEntryAiKeys`/`planFilesKeys`/`planEntryNamesKeys`
+ * because the entry dropped `worker` or because the entry itself is gone, the
+ * same "gone" scan `planEntryAiKeys`/`planFilesKeys`/`planEntryEdgeKeys`
  * run over their own recorded keys, so removing a whole entry still cleans
  * up its Worker. `workersAvailable` is the host's own
  * `FoundryPlanApplyOptions.edgeWorkers` (mirrors `jobsAvailable`): without
@@ -132,24 +170,24 @@ export function wantedEdgeWorker(org, entry) {
  * than planned to fail at apply. The caller (`diff.ts`) gates the *apply*
  * steps further, on an active zone, the same way it gates `planRateLimit`.
  */
-export function planEdgeWorkers(org, recordedIds, workersAvailable) {
+export function planWorkers(org, recordedIds, workersAvailable, platformHostnames = []) {
     const steps = [];
     const blocked = [];
     // Hosting off declares no Worker at all: the gone-scan below still runs,
     // so a Worker deployed while hosting was on is retired rather than left
     // live forever (#318 re-review). Only planning a *new* deploy is skipped.
-    const declared = new Set(org.hosting.enabled ? org.hosting.entries.filter((e) => e.edge).map((e) => e.key) : []);
+    const declared = new Set(org.hosting.enabled ? org.hosting.entries.filter((e) => e.worker).map((e) => e.key) : []);
     const mainPrefix = `cloudflare:worker:${org.id}:`;
-    // Every entryKey with a live, undeclared trace (`liveEdgeWorkers`): the
+    // Every entryKey with a live, undeclared trace (`liveWorkers`): the
     // main id or any partial-deploy marker, so a deploy that failed after
     // upload or mid-route-create is still found to retire (#318 review).
-    for (const entryKey of liveEdgeWorkers(org.id, recordedIds).keys()) {
+    for (const entryKey of liveWorkers(org.id, recordedIds).keys()) {
         if (declared.has(entryKey))
             continue;
         const stepKey = `${org.id}:${entryKey}`;
         if (!workersAvailable) {
             blocked.push({
-                description: `${org.slug}'s ${entryKey} edge Worker is blocked, not planned: the host supplies no WorkersPort`,
+                description: `${org.slug}'s ${entryKey} Worker is blocked, not planned: the host supplies no WorkersPort`,
                 key: `${mainPrefix}${entryKey}`,
             });
             continue;
@@ -157,7 +195,7 @@ export function planEdgeWorkers(org, recordedIds, workersAvailable) {
         steps.push({
             action: { system: 'cloudflare', kind: 'worker', key: stepKey, desired: { mode: 'retire' } },
             step: {
-                description: `delete ${org.slug}'s ${entryKey} edge Worker and its route: edge is no longer declared`,
+                description: `delete ${org.slug}'s ${entryKey} Worker and its route: worker is no longer declared`,
                 destroys: true,
                 migrates: false,
             },
@@ -166,11 +204,11 @@ export function planEdgeWorkers(org, recordedIds, workersAvailable) {
     if (!org.hosting.enabled)
         return { steps, blocked };
     for (const entry of org.hosting.entries) {
-        if (!entry.edge)
+        if (!entry.worker)
             continue;
         const stepKey = appStepKey(org, entry.key);
         const key = `cloudflare:worker:${stepKey}`;
-        const at = `${org.slug}'s ${entry.key} edge Worker`;
+        const at = `${org.slug}'s ${entry.key} Worker`;
         if (!workersAvailable) {
             blocked.push({
                 description: `${at} is blocked, not planned: the host supplies no WorkersPort`,
@@ -178,9 +216,9 @@ export function planEdgeWorkers(org, recordedIds, workersAvailable) {
             });
             continue;
         }
-        const want = wantedEdgeWorker(org, entry);
+        const want = wantedWorker(org, entry, platformHostnames);
         const wantJson = JSON.stringify(want);
-        const applied = recordedIds[entryEdgeAppliedScopeKey(entry.key)];
+        const applied = recordedIds[entryWorkerAppliedScopeKey(entry.key)];
         if (applied === wantJson)
             continue; // Rerun: nothing changed, down to the built artifact's own digest.
         steps.push({
@@ -188,10 +226,10 @@ export function planEdgeWorkers(org, recordedIds, workersAvailable) {
                 system: 'cloudflare',
                 kind: 'worker',
                 key: stepKey,
-                desired: { mode: 'apply', compatibilityDate: EDGE_WORKER_COMPATIBILITY_DATE, ...want },
+                desired: { mode: 'apply', compatibilityDate: WORKER_COMPATIBILITY_DATE, ...want },
             },
             step: {
-                description: `${applied ? 'update' : 'deploy'} ${at} on ${entry.edge.route}`,
+                description: `${applied ? 'update' : 'deploy'} ${at} on ${entry.worker.route}`,
                 destroys: false,
                 migrates: false,
             },

package/dist/platform.d.ts

@@ -26,11 +26,11 @@ export interface PlatformMailService extends PlatformService {
 }
 /**
  * The shared services a declared platform names, decided in #165, plus
- * `names` (#317, F7): the service that mints an entry's own names key and
+ * `edge` (#317, F7): the service that mints an entry's own edge key and
  * holds the Cloudflare token `<username>.<org domain>` claims use, so no
  * hosting entry ever holds that credential itself.
  */
-export type PlatformServiceKey = 'auth' | 'mail' | 'sfu' | 'files' | 'ai' | 'jobs' | 'integrations' | 'archon' | 'names';
+export type PlatformServiceKey = 'auth' | 'mail' | 'sfu' | 'files' | 'ai' | 'jobs' | 'integrations' | 'archon' | 'edge';
 export declare const PLATFORM_SERVICE_KEYS: readonly PlatformServiceKey[];
 /**
  * The one shared platform every org's services run on -- decided in #165 as
@@ -67,7 +67,7 @@ export interface DeclaredPlatform {
     integrations: PlatformService;
     archon: PlatformService;
     /** #317 (F7). No deploy step reads this service's own `gitRef` yet -- `N1` is deployed by hand until it exists. */
-    names: PlatformService;
+    edge: PlatformService;
 }
 /** `<service>.<apex>` -- the default `hostname` for a platform service, before an operator overrides it. */
 export declare function defaultPlatformHostname(service: PlatformServiceKey, apex: string): string;

package/dist/platform.js

@@ -9,7 +9,7 @@ export const PLATFORM_SERVICE_KEYS = [
     'jobs',
     'integrations',
     'archon',
-    'names',
+    'edge',
 ];
 /** `<service>.<apex>` -- the default `hostname` for a platform service, before an operator overrides it. */
 export function defaultPlatformHostname(service, apex) {

package/dist/store/postgres.js

@@ -598,10 +598,10 @@ function rowToPlatform(row) {
             hostname: row.archonHostname,
             gitRef: row.archonGitRef,
         },
-        names: {
-            enabled: row.namesEnabled,
-            hostname: row.namesHostname,
-            gitRef: row.namesGitRef,
+        edge: {
+            enabled: row.edgeEnabled,
+            hostname: row.edgeHostname,
+            gitRef: row.edgeGitRef,
         },
     };
 }
@@ -636,9 +636,9 @@ function platformToRow(platform) {
         archonEnabled: platform.archon.enabled,
         archonHostname: platform.archon.hostname,
         archonGitRef: platform.archon.gitRef,
-        namesEnabled: platform.names.enabled,
-        namesHostname: platform.names.hostname,
-        namesGitRef: platform.names.gitRef,
+        edgeEnabled: platform.edge.enabled,
+        edgeHostname: platform.edge.hostname,
+        edgeGitRef: platform.edge.gitRef,
     };
 }
 /**

package/dist/store/schema.d.ts

@@ -1881,8 +1881,8 @@ export declare const foundryDeclaredPlatform: import("drizzle-orm/pg-core").PgTa
             identity: undefined;
             generated: undefined;
         }, {}, {}>;
-        namesEnabled: import("drizzle-orm/pg-core").PgColumn<{
-            name: "names_enabled";
+        edgeEnabled: import("drizzle-orm/pg-core").PgColumn<{
+            name: "edge_enabled";
             tableName: "foundry_declared_platform";
             dataType: "boolean";
             columnType: "PgBoolean";
@@ -1898,8 +1898,8 @@ export declare const foundryDeclaredPlatform: import("drizzle-orm/pg-core").PgTa
             identity: undefined;
             generated: undefined;
         }, {}, {}>;
-        namesHostname: import("drizzle-orm/pg-core").PgColumn<{
-            name: "names_hostname";
+        edgeHostname: import("drizzle-orm/pg-core").PgColumn<{
+            name: "edge_hostname";
             tableName: "foundry_declared_platform";
             dataType: "string";
             columnType: "PgText";
@@ -1915,8 +1915,8 @@ export declare const foundryDeclaredPlatform: import("drizzle-orm/pg-core").PgTa
             identity: undefined;
             generated: undefined;
         }, {}, {}>;
-        namesGitRef: import("drizzle-orm/pg-core").PgColumn<{
-            name: "names_git_ref";
+        edgeGitRef: import("drizzle-orm/pg-core").PgColumn<{
+            name: "edge_git_ref";
             tableName: "foundry_declared_platform";
             dataType: "string";
             columnType: "PgText";

package/dist/store/schema.js

@@ -178,10 +178,10 @@ export const foundryDeclaredPlatform = pgTable('foundry_declared_platform', {
     archonEnabled: boolean('archon_enabled').notNull().default(false),
     archonHostname: text('archon_hostname').notNull(),
     archonGitRef: text('archon_git_ref').notNull().default(''),
-    /** #317 (F7), `migrations/0038_platform_names.sql`. */
-    namesEnabled: boolean('names_enabled').notNull().default(false),
-    namesHostname: text('names_hostname').notNull(),
-    namesGitRef: text('names_git_ref').notNull().default(''),
+    /** #317 (F7), `migrations/0043_platform_names.sql`, renamed from `names_*` by `0045_names_to_edge.sql`. */
+    edgeEnabled: boolean('edge_enabled').notNull().default(false),
+    edgeHostname: text('edge_hostname').notNull(),
+    edgeGitRef: text('edge_git_ref').notNull().default(''),
     /** `migrations/0018_platform_apply.sql`: the platform's applied state, `system:kind:key` to provider id. */
     serviceIds: jsonb('service_ids').$type().notNull().default({}),
     createdAt: timestamp('created_at', { withTimezone: true }).notNull().defaultNow(),

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@wtfalch/foundry",
-  "version": "0.17.1",
+  "version": "0.18.0",
   "description": "Foundry's SDK: the declared org's types, the plan and apply contracts, and the state store's interface.",
   "repository": {
     "type": "git",

package/dist/plan/entry-names-key.d.ts

@@ -1,73 +0,0 @@
-import type { DeclaredOrg, HostingEntry } from '../org.js';
-import type { DraftStep } from './diff.js';
-import type { OrgPlatformReadiness } from './platform-org.js';
-/**
- * F7 (#317): one names key per entry with `uses.names`, minted directly
- * below the org with the names service (`NamesPort.mintKey({
- * organisationId, ... })` -- no org-level root key the way files/ai have
- * one, since the names service takes the org id itself). `NAMES_URL` and
- * `NAMES_API_KEY` go to the entry's env and nowhere else. A names key has no
- * declared renewal window in the issue, so unlike `planEntryAiKeys`/
- * `planFilesKeys` this mints once and never renews.
- *
- * `NAMES_*` is written in this step, after the app's own `coolify:app`
- * create (which never knows the key yet), so the app's first boot has
- * neither and its first deploy restarts once this step's env write lands --
- * the same one-extra-restart shape `planEntryAiKeys`'s `AI_*`/
- * `planFilesKeys`'s `FILES_*` already have, not a names-specific gap.
- *
- * A domain change after mint is not detected (#317 re-review): the key is
- * bound to the domain passed at mint time, but nothing here records that
- * domain to compare against a later `org.domain`, so an org that changes
- * domains keeps a names key still bound to the old one. Not built --
- * resolving it needs a manual revoke-and-re-mint (drop `uses.names`, apply,
- * re-add it) until this is.
- */
-export declare const entryNamesUndeliveredScopeKey: (entryKey: string) => string;
-/** The id of a key that was live when its entry stopped declaring `uses.names`, once handled. */
-export declare const entryNamesRetiredScopeKey: (entryKey: string) => string;
-export declare const ENTRY_NAMES_KEY_DELIVERY_ATTEMPTS = 3;
-/** How long an entry's names key lives. The issue names no renewal window, so this mints once and never renews. */
-export declare const NAMES_ENTRY_KEY_DAYS = 365;
-/** The ISO time a delivered key's mint succeeded -- the only trace of its age, since there is no renewal to track against. */
-export declare const entryNamesMintedAtScopeKey: (entryKey: string) => string;
-/** A key with fewer days left than this is surfaced as a blocked warning row (#317 review): still live, but nothing here renews it. */
-export declare const NAMES_ENTRY_KEY_WARN_WINDOW_DAYS = 30;
-/** The reserved labels last sent to the names service, as that sorted list's own JSON. */
-export declare const NAMES_RESERVED_LABELS_APPLIED_SCOPE_KEY = "names_reserved_labels_applied";
-export declare const entryNamesKeyName: (org: DeclaredOrg, entry: HostingEntry) => string;
-/**
- * Every label a declared entry serves (`@`/`*` reserve nothing of their own:
- * the bare domain and the wildcard are not names a customer could claim
- * under names anyway), plus `www`, which `setReservedLabels`'s own doc
- * comment in `executor.ts` explains is reserved unconditionally.
- */
-export declare function namesReservedLabels(org: DeclaredOrg): string[];
-type Blocked = Array<{
-    description: string;
-    key: string;
-}>;
-/**
- * One step per entry whose names key is missing, plus one retire step per
- * entry whose `uses.names` was removed but still has a recorded key.
- * Blocked, not planned (rule 2), while the platform has no names service
- * wired, the entry's app is not recorded, or a previous mint's delivery
- * failed.
- */
-export declare function planEntryNamesKeys(org: DeclaredOrg, recordedIds: Readonly<Record<string, string>>, plannedSteps: readonly DraftStep[], readiness: OrgPlatformReadiness, now?: number): {
-    steps: DraftStep[];
-    blocked: Blocked;
-};
-/**
- * The reserved-labels step: resent whenever the org's own label set
- * (`namesReservedLabels`) differs from what was last sent. While the org
- * uses names at all (at least one entry with `uses.names`) that set is
- * `namesReservedLabels(org)`; once the last entry drops `uses.names`, this
- * clears whatever was last sent (an empty list) rather than leaving it
- * stuck in names forever -- a one-time step, same as any other change.
- */
-export declare function planNamesReservedLabels(org: DeclaredOrg, recordedIds: Readonly<Record<string, string>>, readiness: OrgPlatformReadiness): {
-    step: DraftStep | null;
-    blocked: Blocked;
-};
-export {};