@wtfalch/foundry 0.17.1 → 0.19.0

package/dist/bootstrap/declare.d.ts

@@ -37,8 +37,17 @@ export interface BootstrapOwner {
  */
 export declare function ownerIdentity(owner: BootstrapOwner): OwnerIdentity;
 /**
- * Company Included's declared org: the platform's owner, running no app or
- * mail of its own. Chat is on, like every org's.
+ * Company Included's declared org: the platform's owner, tier 3 on the
+ * platform's own apex from the start (#512) -- it runs on that domain with
+ * hosted mail, not a level-1 org whose domain gets set by hand afterward.
+ * `issuer`/`calls`/`site` go on the domain too, the same tier-3 defaults
+ * archon#388 gives every company declared there. `calls` and `site` stay
+ * disabled (calls is not in v1; no site is declared), so `usesDomain` is
+ * inert on both until one is switched on. Chat stays off the domain: its
+ * re-key onto a per-org homeserver is not built yet (#463). The org's own
+ * sign-in still never collides with the shared ZITADEL instance's host --
+ * `loginHostnameFor` (#488) falls back to `<slug>-auth.oikos.host` whenever
+ * `auth.<domain>` would equal the platform's own auth hostname.
  */
 export declare function declaredCompanyOrg(company: BootstrapCompany, owner: BootstrapOwner): DeclaredOrg;
 /**

package/dist/bootstrap/declare.js

@@ -23,11 +23,11 @@ export const DEFAULT_GIT_REF = 'main';
  */
 export const DEFAULT_MAIL_IMAGE_TAG = VERSIONS.stalwart;
 /**
- * Every platform service except `sfu` and `names` is enabled, like the other
+ * Every platform service except `sfu` and `edge` is enabled, like the other
  * steps: a service whose dependencies the host did not supply is reported
  * blocked, not planned. `sfu` stays off because it needs a held SSH key and
- * host fingerprint, a separate human step (issue 170). `names` stays off
- * because the names service (N1) does not exist yet -- a human deploys it
+ * host fingerprint, a separate human step (issue 170). `edge` stays off
+ * because the edge service (N1) does not exist yet -- a human deploys it
  * and sets its hostname before enabling it (#317's own "Human steps").
  */
 const SERVICES_ENABLED_BY_DEFAULT = new Set([
@@ -55,25 +55,34 @@ export function ownerIdentity(owner) {
     return identity;
 }
 /**
- * Company Included's declared org: the platform's owner, running no app or
- * mail of its own. Chat is on, like every org's.
+ * Company Included's declared org: the platform's owner, tier 3 on the
+ * platform's own apex from the start (#512) -- it runs on that domain with
+ * hosted mail, not a level-1 org whose domain gets set by hand afterward.
+ * `issuer`/`calls`/`site` go on the domain too, the same tier-3 defaults
+ * archon#388 gives every company declared there. `calls` and `site` stay
+ * disabled (calls is not in v1; no site is declared), so `usesDomain` is
+ * inert on both until one is switched on. Chat stays off the domain: its
+ * re-key onto a per-org homeserver is not built yet (#463). The org's own
+ * sign-in still never collides with the shared ZITADEL instance's host --
+ * `loginHostnameFor` (#488) falls back to `<slug>-auth.oikos.host` whenever
+ * `auth.<domain>` would equal the platform's own auth hostname.
  */
 export function declaredCompanyOrg(company, owner) {
     return {
         id: COMPANY_INCLUDED_ORG_ID,
         slug: company.slug,
         displayName: company.name,
-        domain: null,
+        domain: company.apex,
         mail: {
-            mode: 'off',
-            usesDomain: false,
+            mode: 'hosted',
+            usesDomain: true,
             ownerMailboxAddress: null,
             noReplyLocalPart: 'no-reply',
         },
         chat: { enabled: true, usesDomain: false },
-        calls: { enabled: false, usesDomain: false },
-        issuer: { usesDomain: false },
-        site: { enabled: false, usesDomain: false },
+        calls: { enabled: false, usesDomain: true },
+        issuer: { usesDomain: true },
+        site: { enabled: false, usesDomain: true },
         hosting: {
             enabled: false,
             usesDomain: false,

package/dist/index.d.ts

@@ -20,7 +20,7 @@ export type { FoundryStoreDb } from './store/postgres.js';
 export { declaredOrgs, foundryAppliedState, foundryAppliedVersions, foundryAuditEvents, foundryDeclaredPlatform, foundryRequestedChanges, type AuditEventRow, type DeclaredOrgRow, type NewDeclaredOrgRow, type AppliedStateRow, type NewAppliedStateRow, type AppliedVersionRow, type NewAppliedVersionRow, type DeclaredPlatformRow, type NewDeclaredPlatformRow, type RequestedChangeRow, type NewRequestedChangeRow, } from './store/schema.js';
 export type { LiveResource, ZitadelReader, CoolifyReader, CloudflareReader, FilesReader, AiReader, CmsReader, LiveReaders, PlatformCloudflareReader, PlatformCoolifyReader, PlatformLiveReaders, StepAction, PlannedStep, StepSystem, PlanDetail, PlatformPlanDetail, AdoptCandidate, AdoptInput, AdoptPlan, AdoptSnapshot, AuditActor, AuditLog, AuthzGate, StepExecutor, StepDestroyer, DestroyTarget, StepExecutionContext, PlatformStepExecutor, PlatformStepExecutionContext, FoundryPlanApplyOptions, } from './plan/index.js';
 export { AdoptRefusedError } from './plan/index.js';
-export { readLiveResources, readLivePlatformResources, computePlanDetail, toPlan, planPlatform, toPlatformPlan, JOBS_SCHEDULER_KEY, PLATFORM_AI_KEY, PLATFORM_AI_INTERNAL_URL_SCOPE_KEY, PLATFORM_AI_MANAGEMENT_KEY_SCOPE_KEY, PLATFORM_AI_ORGANISATION_SCOPE_KEY, PLATFORM_FILES_KEY, PLATFORM_FILES_INTERNAL_URL_SCOPE_KEY, PLATFORM_FILES_ZITADEL_PROJECT_SCOPE_KEY, PLATFORM_MAIL_INTERNAL_URL_SCOPE_KEY, PLATFORM_MAIL_ZITADEL_PROJECT_SCOPE_KEY, PLATFORM_NAMES_KEY, PLATFORM_NAMES_KEY_REF, PLATFORM_NAMES_CLOUDFLARE_TOKEN_REF, FoundryPlanApply, DeclaredOrgNotFoundError, StalePlanError, ConfirmationRequiredError, NotAuthorizedError, NotATestOrgError, DeclaredPlatformNotFoundError, PlatformStalePlanError, PlatformConfirmationRequiredError, planNeedsConfirmation, } from './plan/index.js';
+export { readLiveResources, readLivePlatformResources, computePlanDetail, toPlan, planPlatform, toPlatformPlan, JOBS_SCHEDULER_KEY, PLATFORM_AI_KEY, PLATFORM_AI_INTERNAL_URL_SCOPE_KEY, PLATFORM_AI_MANAGEMENT_KEY_SCOPE_KEY, PLATFORM_AI_ORGANISATION_SCOPE_KEY, PLATFORM_FILES_KEY, PLATFORM_FILES_INTERNAL_URL_SCOPE_KEY, PLATFORM_FILES_ZITADEL_PROJECT_SCOPE_KEY, PLATFORM_MAIL_INTERNAL_URL_SCOPE_KEY, PLATFORM_MAIL_ZITADEL_PROJECT_SCOPE_KEY, PLATFORM_EDGE_KEY, PLATFORM_EDGE_KEY_REF, PLATFORM_EDGE_CLOUDFLARE_TOKEN_REF, FoundryPlanApply, DeclaredOrgNotFoundError, StalePlanError, ConfirmationRequiredError, NotAuthorizedError, NotATestOrgError, DeclaredPlatformNotFoundError, PlatformStalePlanError, PlatformConfirmationRequiredError, planNeedsConfirmation, } from './plan/index.js';
 export type { HeldKeyResolver, OrgPlatformReadiness } from './plan/index.js';
 export { DEFAULT_ORG_PLATFORM_READINESS, ORG_PLATFORM_KEY_REFS, agoraHostValuesFromPlatform, heldPlatformKeyRefs, orgPlatformReadinessFrom, } from './plan/index.js';
 export type { PlatformOrgClientFactories } from './plan/index.js';
@@ -28,6 +28,8 @@ export { PlatformOrgBlockedError, PlatformOrgPorts } from './plan/index.js';
 export type { CoolifyPort, CloudflarePort, ZitadelPort, CallsSfuPort, JobsSchedulerPort, FilesOrganisationPort, AiOrganisationPort, FoundryStepExecutorPorts, PlatformOrgPortSource, AgoraHostPort, AgoraHostValues, LoginHostBinding, LoginHostBindingsPort, } from './plan/index.js';
 export { FoundryStepExecutor, NotBuiltError, healthUrls, loginHostnameFor } from './plan/index.js';
 export { HttpJobsSchedulerClient } from './plan/index.js';
+export type { ScopeResolver, RecordedIds } from './plan/index.js';
+export { ProvidersCloudflareReader, ProvidersCmsReader, ProvidersCoolifyReader, ProvidersZitadelReader, storeScopeResolver, storeRecordedIds, } from './plan/index.js';
 export type { ZitadelListAppsRawApp } from './plan/index.js';
 export { adaptZitadelListApps } from './plan/index.js';
 export type { MailIdentityApp, MailIdentityAudienceCheck } from './plan/index.js';
@@ -35,7 +37,7 @@ export { checkMailIdentityAudience } from './plan/index.js';
 export type { MailAllowlistApp } from './plan/index.js';
 export { checkMailAppsAllowlist } from './plan/index.js';
 export { FoundryPlatformStepExecutor, ProvidersPlatformCloudflareReader, ProvidersPlatformCoolifyReader, createZitadelAdminMinter, createZitadelProjectRoles, PLATFORM_AUTH_KEY, PLATFORM_MAIL_KEY, PLATFORM_MAIL_ADMIN_KEY_DESCRIPTION, } from './plan/index.js';
-export type { PlatformAuthDeps, PlatformAuthRuntime, PlatformFilesDeps, PlatformFilesRuntime, PlatformNamesDeps, PlatformNamesRuntime, } from './plan/index.js';
+export type { PlatformAuthDeps, PlatformAuthRuntime, PlatformFilesDeps, PlatformFilesRuntime, PlatformEdgeDeps, PlatformEdgeRuntime, } from './plan/index.js';
 export type { PlatformMailDeps, PlatformMailAdminPort, PlatformMailRuntime, } from './plan/index.js';
 export { FILES_INTROSPECTION_SECRET_REF, FILES_MANAGEMENT_ISSUER, FILES_MANAGEMENT_KEY_ID, FILES_MANAGEMENT_KEY_REF, PLATFORM_AUTH_INSTANCE_BEARER_REF, } from './plan/index.js';
 export { AI_MANAGEMENT_ISSUER, AI_MANAGEMENT_KEY_ID, AI_SIGNING_KEY_REF, AiManagementKeyExistsError, createAiManagementKeyMinter, PLATFORM_AI_MANAGEMENT_KEY_REF, PLATFORM_AI_MANAGEMENT_PERMISSIONS, } from './plan/index.js';

package/dist/index.js

@@ -12,11 +12,12 @@ export { createPostgresAppliedVersionsStore, createPostgresDeclaredOrgStore, cre
 export { createPostgresAuditLog } from './store/audit.js';
 export { declaredOrgs, foundryAppliedState, foundryAppliedVersions, foundryAuditEvents, foundryDeclaredPlatform, foundryRequestedChanges, } from './store/schema.js';
 export { AdoptRefusedError } from './plan/index.js';
-export { readLiveResources, readLivePlatformResources, computePlanDetail, toPlan, planPlatform, toPlatformPlan, JOBS_SCHEDULER_KEY, PLATFORM_AI_KEY, PLATFORM_AI_INTERNAL_URL_SCOPE_KEY, PLATFORM_AI_MANAGEMENT_KEY_SCOPE_KEY, PLATFORM_AI_ORGANISATION_SCOPE_KEY, PLATFORM_FILES_KEY, PLATFORM_FILES_INTERNAL_URL_SCOPE_KEY, PLATFORM_FILES_ZITADEL_PROJECT_SCOPE_KEY, PLATFORM_MAIL_INTERNAL_URL_SCOPE_KEY, PLATFORM_MAIL_ZITADEL_PROJECT_SCOPE_KEY, PLATFORM_NAMES_KEY, PLATFORM_NAMES_KEY_REF, PLATFORM_NAMES_CLOUDFLARE_TOKEN_REF, FoundryPlanApply, DeclaredOrgNotFoundError, StalePlanError, ConfirmationRequiredError, NotAuthorizedError, NotATestOrgError, DeclaredPlatformNotFoundError, PlatformStalePlanError, PlatformConfirmationRequiredError, planNeedsConfirmation, } from './plan/index.js';
+export { readLiveResources, readLivePlatformResources, computePlanDetail, toPlan, planPlatform, toPlatformPlan, JOBS_SCHEDULER_KEY, PLATFORM_AI_KEY, PLATFORM_AI_INTERNAL_URL_SCOPE_KEY, PLATFORM_AI_MANAGEMENT_KEY_SCOPE_KEY, PLATFORM_AI_ORGANISATION_SCOPE_KEY, PLATFORM_FILES_KEY, PLATFORM_FILES_INTERNAL_URL_SCOPE_KEY, PLATFORM_FILES_ZITADEL_PROJECT_SCOPE_KEY, PLATFORM_MAIL_INTERNAL_URL_SCOPE_KEY, PLATFORM_MAIL_ZITADEL_PROJECT_SCOPE_KEY, PLATFORM_EDGE_KEY, PLATFORM_EDGE_KEY_REF, PLATFORM_EDGE_CLOUDFLARE_TOKEN_REF, FoundryPlanApply, DeclaredOrgNotFoundError, StalePlanError, ConfirmationRequiredError, NotAuthorizedError, NotATestOrgError, DeclaredPlatformNotFoundError, PlatformStalePlanError, PlatformConfirmationRequiredError, planNeedsConfirmation, } from './plan/index.js';
 export { DEFAULT_ORG_PLATFORM_READINESS, ORG_PLATFORM_KEY_REFS, agoraHostValuesFromPlatform, heldPlatformKeyRefs, orgPlatformReadinessFrom, } from './plan/index.js';
 export { PlatformOrgBlockedError, PlatformOrgPorts } from './plan/index.js';
 export { FoundryStepExecutor, NotBuiltError, healthUrls, loginHostnameFor } from './plan/index.js';
 export { HttpJobsSchedulerClient } from './plan/index.js';
+export { ProvidersCloudflareReader, ProvidersCmsReader, ProvidersCoolifyReader, ProvidersZitadelReader, storeScopeResolver, storeRecordedIds, } from './plan/index.js';
 export { adaptZitadelListApps } from './plan/index.js';
 export { checkMailIdentityAudience } from './plan/index.js';
 export { checkMailAppsAllowlist } from './plan/index.js';

package/dist/migrations/0045_names_to_edge.sql

@@ -0,0 +1,107 @@
+-- @wtfalch/foundry: the names service is renamed edge, and the hosting entry
+-- field `edge` (a Cloudflare Worker) is renamed `worker`. No behaviour change.
+-- Mirrors `src/store/schema.ts`'s `foundryDeclaredPlatform` columns.
+--
+-- 1. foundry_declared_platform: names_enabled / names_hostname /
+--    names_git_ref become edge_*. Each rename runs only while the old column
+--    exists, so a second run is a no-op.
+-- 2. The hostname moves from `names.<apex>` to `edge.<apex>` only where it
+--    still equals the old default (0043); an operator's own value stays.
+-- 3. Recorded ids are rewritten in place: `names:key:`, `names:reserved-labels:`
+--    and `platform:names` (ids and step ids), and the colon-free scope keys
+--    `names_*` and `*_platform_names*`. The applied-hostname value is left
+--    alone, so the planner sees a changed hostname and applies the step again.
+--    Every WHERE clause matches only text that still holds an old key, so a
+--    second run changes nothing. `foundry_audit_events` is a signed chain and
+--    is not touched.
+-- 4. foundry_declared_orgs.hosting_entries: each entry's `uses.names` becomes
+--    `uses.edge`, and its `edge` becomes `worker`.
+
+do $$
+begin
+  if exists (select 1 from information_schema.columns
+              where table_schema = current_schema()
+                and table_name = 'foundry_declared_platform' and column_name = 'names_enabled') then
+    alter table foundry_declared_platform rename column names_enabled to edge_enabled;
+  end if;
+  if exists (select 1 from information_schema.columns
+              where table_schema = current_schema()
+                and table_name = 'foundry_declared_platform' and column_name = 'names_hostname') then
+    alter table foundry_declared_platform rename column names_hostname to edge_hostname;
+  end if;
+  if exists (select 1 from information_schema.columns
+              where table_schema = current_schema()
+                and table_name = 'foundry_declared_platform' and column_name = 'names_git_ref') then
+    alter table foundry_declared_platform rename column names_git_ref to edge_git_ref;
+  end if;
+end
+$$;
+
+update foundry_declared_platform
+   set edge_hostname = 'edge.' || apex
+ where edge_hostname = 'names.' || apex;
+
+-- The old-to-new text rewrite for recorded ids, applied to the jsonb as text.
+create or replace function pg_temp.names_to_edge(value jsonb) returns jsonb
+language sql immutable as $fn$
+  select replace(
+           replace(
+             replace(
+               replace(
+                 replace(value::text, '"names:key:', '"edge:key:'),
+                 '"names:reserved-labels:', '"edge:reserved-labels:'),
+               '"names_', '"edge_'),
+             '_platform_names', '_platform_edge'),
+           'platform:names', 'platform:edge')::jsonb
+$fn$;
+
+update foundry_declared_platform
+   set service_ids = pg_temp.names_to_edge(service_ids)
+ where service_ids::text ~ '"names[:_]|_platform_names|platform:names';
+
+update foundry_applied_state
+   set service_ids = pg_temp.names_to_edge(service_ids)
+ where service_ids::text ~ '"names[:_]|_platform_names|platform:names';
+
+update foundry_applied_state
+   set checkpoints = pg_temp.names_to_edge(checkpoints)
+ where checkpoints::text ~ '"names[:_]|_platform_names|platform:names';
+
+update foundry_applied_state
+   set destroy = pg_temp.names_to_edge(destroy)
+ where destroy is not null
+   and destroy::text ~ '"names[:_]|_platform_names|platform:names';
+
+update foundry_runs
+   set step_ids = pg_temp.names_to_edge(step_ids)
+ where step_ids::text ~ '"names[:_]|_platform_names|platform:names';
+
+update foundry_runs
+   set checkpoints = pg_temp.names_to_edge(checkpoints)
+ where checkpoints::text ~ '"names[:_]|_platform_names|platform:names';
+
+update foundry_runs
+   set failure = pg_temp.names_to_edge(failure)
+ where failure is not null
+   and failure::text ~ '"names[:_]|_platform_names|platform:names';
+
+update foundry_declared_orgs o
+   set hosting_entries = (
+         select coalesce(jsonb_agg(
+                  case
+                    when jsonb_typeof(s -> 'uses') = 'object' and (s -> 'uses') ? 'names'
+                    then jsonb_set(s, '{uses}',
+                           ((s -> 'uses') - 'names') || jsonb_build_object('edge', s -> 'uses' -> 'names'))
+                    else s
+                  end order by t.ord), '[]'::jsonb)
+           from jsonb_array_elements(o.hosting_entries) with ordinality as t(e, ord),
+                lateral (select case
+                                  when jsonb_typeof(t.e) = 'object' and t.e ? 'edge'
+                                  then (t.e - 'edge') || jsonb_build_object('worker', t.e -> 'edge')
+                                  else t.e
+                                end as s) as r(s))
+ where exists (
+         select 1 from jsonb_array_elements(o.hosting_entries) e
+          where jsonb_typeof(e) = 'object'
+            and (e ? 'edge' or (jsonb_typeof(e -> 'uses') = 'object' and (e -> 'uses') ? 'names'))
+       );

package/dist/org.d.ts

@@ -335,26 +335,26 @@ export interface HostingEntry {
      * F8: a Cloudflare Worker foundry deploys from this entry's own repo,
      * beside the app, on the org's own zone. Only our own repos may use this
      * (#318: outside customers need Workers for Platforms, not built yet), so
-     * `validateEntryEdge` refuses it unless `repo` is set (every non-null
+     * `validateEntryWorker` refuses it unless `repo` is set (every non-null
      * `repo` already matches `wtfalch/...`, {@link REPO}) and the route's zone
      * is the org's own domain.
      */
-    edge?: EdgeConfig;
+    worker?: WorkerConfig;
 }
 /**
  * One Cloudflare rate limiting binding on a Worker (#318) -- Cloudflare's own
  * "simple" shape: a fixed number of requests per period, where `period` is
  * the only two values Cloudflare's rate limiting binding accepts.
  */
-export interface EdgeRateLimitBinding {
+export interface WorkerRateLimitBinding {
     name: string;
     namespaceId: string;
     limit: number;
     period: 10 | 60;
 }
-/** {@link HostingEntry.edge}'s bindings, one list per binding kind -- only rate limits today. */
-export interface EdgeBindings {
-    rateLimits: EdgeRateLimitBinding[];
+/** {@link HostingEntry.worker}'s bindings, one list per binding kind -- only rate limits today. */
+export interface WorkerBindings {
+    rateLimits: WorkerRateLimitBinding[];
 }
 /**
  * A plain Worker deployed beside a hosting entry (#318), named by one route
@@ -365,14 +365,14 @@ export interface EdgeBindings {
  * Worker setup": "The app's automated build process builds the bundle
  * outside Foundry; Foundry consumes and deploys the artifact through the
  * provider boundary... No manual build step and no source checkout/bundling
- * in Foundry"). `validateEntryEdge` refuses anything that is not an
+ * in Foundry"). `validateEntryWorker` refuses anything that is not an
  * `https://` URL -- a bare path or relative file name is exactly the shape
  * this decision rules out.
  */
-export interface EdgeConfig {
+export interface WorkerConfig {
     /** Where foundry fetches the built module from, behind `WorkersPort` -- never checked out or bundled here. */
     artifactUrl: string;
-    /** The built module's sha256, lowercase hex. Verified against the fetched bytes before upload, and the sole signal `planEdgeWorkers` diffs on: an org that rebuilds under an unchanged URL redeploys only when this changes. */
+    /** The built module's sha256, lowercase hex. Verified against the fetched bytes before upload, and the sole signal `planWorkers` diffs on: an org that rebuilds under an unchanged URL redeploys only when this changes. */
     artifactSha256: string;
     /**
      * One route per entry today. A wildcard route (`*.<domain>/*`) matches
@@ -386,7 +386,7 @@ export interface EdgeConfig {
      * separate entry with that exact route; there is no exclusion list.
      */
     route: string;
-    bindings?: EdgeBindings;
+    bindings?: WorkerBindings;
 }
 /**
  * Sign-in for one entry: one ZITADEL client and one broker entry, signing in
@@ -441,16 +441,16 @@ export interface HostingEntryUses {
     ai?: EntryAi;
     files?: EntryFiles;
     /**
-     * F7 (#317): the entry gets its own names key, minted directly below the
-     * org with the names service, and `NAMES_URL`/`NAMES_API_KEY` in its env.
-     * Serves only the org's own domain (names claims `<label>.<org's domain>`),
-     * so `validateEntryNames` refuses it without `hosting.usesDomain` and an
+     * F7 (#317): the entry gets its own edge key, minted directly below the
+     * org with the edge service, and `EDGE_URL`/`EDGE_API_KEY` in its env.
+     * Serves only the org's own domain (edge claims `<label>.<org's domain>`),
+     * so `validateEntryEdge` refuses it without `hosting.usesDomain` and an
      * org `domain`.
      */
-    names?: true;
+    edge?: true;
 }
-/** The env names `uses.names` writes; `env` may not name them (#317). */
-export declare const NAMES_ENTRY_ENV_NAMES: readonly ["NAMES_URL", "NAMES_API_KEY"];
+/** The env names `uses.edge` writes; `env` may not name them (#317). */
+export declare const EDGE_ENTRY_ENV_NAMES: readonly ["EDGE_URL", "EDGE_API_KEY"];
 /**
  * A plain string is pushed as it is, so `validateHosting` refuses one that
  * looks like a secret. `{ from }` names a value the plan already mints.

package/dist/org.js

@@ -36,8 +36,8 @@ export const FILES_ENTRY_ENV_NAMES = [
     'FILES_API_KEY',
 ];
 export const filesCollectionEnvName = (name) => `FILES_COLLECTION_${name}_ID`;
-/** The env names `uses.names` writes; `env` may not name them (#317). */
-export const NAMES_ENTRY_ENV_NAMES = ['NAMES_URL', 'NAMES_API_KEY'];
+/** The env names `uses.edge` writes; `env` may not name them (#317). */
+export const EDGE_ENTRY_ENV_NAMES = ['EDGE_URL', 'EDGE_API_KEY'];
 /** The org's `app` entry: today's one app. */
 export function appEntry(hosting) {
     return hosting.entries.find((entry) => entry.key === APP_ENTRY_KEY);
@@ -132,29 +132,29 @@ export function validateHosting(hosting, names) {
         const invalidFiles = validateEntryFiles(entry, hosting, names?.domain);
         if (invalidFiles)
             return invalidFiles;
-        const invalidEdge = validateEntryEdge(entry, hosting, names?.domain, names?.locked);
-        if (invalidEdge)
-            return invalidEdge;
-        const invalidNamesUse = validateEntryNames(entry, hosting, names?.domain);
-        if (invalidNamesUse)
-            return invalidNamesUse;
+        const invalidWorker = validateEntryWorker(entry, hosting, names?.domain);
+        if (invalidWorker)
+            return invalidWorker;
+        const invalidEdgeUse = validateEntryEdge(entry, hosting, names?.domain);
+        if (invalidEdgeUse)
+            return invalidEdgeUse;
     }
     if (hosting.entries.filter((entry) => entry.uses?.ai?.webhookPath !== undefined).length > 1) {
         return 'at most one hosting entry may set uses.ai webhookPath: ai keeps one webhook per organisation';
     }
-    // #318 re-review: two entries declaring the same edge route both throw at
+    // #318 re-review: two entries declaring the same worker route both throw at
     // apply (`cloudflareWorker` refuses a route already bound to a Worker
     // that is not its own), one of which stops Agora and everything planned
     // after it provisioning at all -- refused here instead, before an apply
     // ever reaches it.
-    const seenEdgeRoutes = new Set();
+    const seenWorkerRoutes = new Set();
     for (const entry of hosting.entries) {
-        if (!entry.edge)
+        if (!entry.worker)
             continue;
-        if (seenEdgeRoutes.has(entry.edge.route)) {
-            return `hosting.entries '${entry.key}' edge route '${entry.edge.route}' is already declared by another entry`;
+        if (seenWorkerRoutes.has(entry.worker.route)) {
+            return `hosting.entries '${entry.key}' worker route '${entry.worker.route}' is already declared by another entry`;
         }
-        seenEdgeRoutes.add(entry.edge.route);
+        seenWorkerRoutes.add(entry.worker.route);
     }
     const invalidNames = validateEntryHostnames(hosting, names);
     if (invalidNames)
@@ -438,27 +438,27 @@ function validateEntryFiles(entry, hosting, domain) {
     return null;
 }
 /** A route pattern's zone apex: the host part before the first `/`, with one leading `*.` label stripped. */
-function edgeRouteZone(route) {
+function workerRouteZone(route) {
     const slash = route.indexOf('/');
     if (slash < 1)
         return null;
     const host = route.slice(0, slash);
     return host.startsWith('*.') ? host.slice(2) : host;
 }
-const EDGE_ROUTE = /^(\*\.)?[a-z0-9]([a-z0-9-]*[a-z0-9])?(\.[a-z0-9]([a-z0-9-]*[a-z0-9])?)+\/.*$/;
-const EDGE_SHA256 = /^[0-9a-f]{64}$/;
+const WORKER_ROUTE = /^(\*\.)?[a-z0-9]([a-z0-9-]*[a-z0-9])?(\.[a-z0-9]([a-z0-9-]*[a-z0-9])?)+\/.*$/;
+const WORKER_SHA256 = /^[0-9a-f]{64}$/;
 /**
- * Restated, not shared, from `plan/edge-worker.ts`'s `EDGE_WORKER_ORG_HASH_LENGTH`/
- * `EDGE_WORKER_NAME_MAX_LENGTH` -- importing them here would import that
+ * Restated, not shared, from `plan/worker.ts`'s `WORKER_ORG_HASH_LENGTH`/
+ * `WORKER_NAME_MAX_LENGTH` -- importing them here would import that
  * module's own `DeclaredOrg`/`HostingEntry` imports right back into this
- * one. `edgeWorkerName`'s shape is `${8-hex-char hash}-${entry.key}-edge`;
+ * one. `workerName`'s shape is `${8-hex-char hash}-${entry.key}-edge`;
  * the hash and the `-edge` suffix are fixed length, so the entry key's own
  * budget against Cloudflare's 63-character Worker name limit is fixed too.
  */
-const EDGE_WORKER_NAME_FIXED_LENGTH = 8 + 1 + '-edge'.length;
-const EDGE_WORKER_NAME_MAX_LENGTH = 63;
+const WORKER_NAME_FIXED_LENGTH = 8 + 1 + '-edge'.length;
+const WORKER_NAME_MAX_LENGTH = 63;
 /**
- * `edge`: the entry's own repo (never the shared standard app -- entries
+ * `worker`: the entry's own repo (never the shared standard app -- entries
  * with `repo: null` have no Worker source of their own), an `https://`
  * artifact URL with a lowercase-hex sha256 (never a bare path or relative
  * file -- estate DECISIONS.md, 2026-10-04, rules out any checkout or
@@ -467,22 +467,22 @@ const EDGE_WORKER_NAME_MAX_LENGTH = 63;
  * binding's `period` restricted to the two values Cloudflare's simple rate
  * limiting binding accepts.
  */
-function validateEntryEdge(entry, hosting, domain, locked) {
-    const edge = entry.edge;
-    if (!edge)
+function validateEntryWorker(entry, hosting, domain) {
+    const worker = entry.worker;
+    if (!worker)
         return null;
-    const at = `hosting.entries '${entry.key}' edge`;
+    const at = `hosting.entries '${entry.key}' worker`;
     if (!hosting.enabled)
         return `${at} requires hosting.enabled`;
     if (entry.repo === null) {
         return `${at} needs its own repo (repo: null is the shared standard app, not a Worker source)`;
     }
-    if (entry.key.length > EDGE_WORKER_NAME_MAX_LENGTH - EDGE_WORKER_NAME_FIXED_LENGTH) {
-        return `${at} entry key is too long: the deployed Worker's name (an 8-character org hash, the key, and "-edge") must fit Cloudflare's ${EDGE_WORKER_NAME_MAX_LENGTH}-character limit`;
+    if (entry.key.length > WORKER_NAME_MAX_LENGTH - WORKER_NAME_FIXED_LENGTH) {
+        return `${at} entry key is too long: the deployed Worker's name (an 8-character org hash, the key, and "-edge") must fit Cloudflare's ${WORKER_NAME_MAX_LENGTH}-character limit`;
     }
     let artifactUrl;
     try {
-        artifactUrl = new URL(edge.artifactUrl);
+        artifactUrl = new URL(worker.artifactUrl);
     }
     catch {
         return `${at} artifactUrl must be an absolute URL, not a bare path or relative file`;
@@ -497,32 +497,22 @@ function validateEntryEdge(entry, hosting, domain, locked) {
         return `${at} artifactUrl must not carry a query string (a signed or credentialed URL ends up stored verbatim in recorded scope ids)`;
     }
     // `URL.hash` is '' for a bare trailing `#`, so the raw string is checked.
-    if (edge.artifactUrl.includes('#')) {
+    if (worker.artifactUrl.includes('#')) {
         return `${at} artifactUrl must not carry a fragment (refused for the same reason as a query string)`;
     }
-    if (!EDGE_SHA256.test(edge.artifactSha256)) {
+    if (!WORKER_SHA256.test(worker.artifactSha256)) {
         return `${at} artifactSha256 must be 64 lowercase hex characters`;
     }
-    if (!EDGE_ROUTE.test(edge.route)) {
+    if (!WORKER_ROUTE.test(worker.route)) {
         return `${at} route must be a hostname (an optional leading '*.' label, then at least two more labels) and a path, joined by '/'`;
     }
-    const zone = edgeRouteZone(edge.route);
+    const zone = workerRouteZone(worker.route);
     if (!domain || zone !== domain) {
-        return `${at} route '${edge.route}' must be on the org's own domain${domain ? ` (${domain})` : ''}: edge is only for our own projects`;
-    }
-    // #318 re-review: a Worker route has no path-based exclusion of its own,
-    // so a wildcard (`*.<domain>/*`) captures every hostname foundry already
-    // owns under the domain -- Agora, Boule, the login host and the rest of
-    // `locked-hostnames.ts`'s set -- not only the org's other entries. (A
-    // non-wildcard route can only ever be the bare apex here -- the check
-    // just above requires `edgeRouteZone(edge.route) === domain`, and that
-    // function returns a non-wildcard route's host unchanged -- and the apex
-    // alone is never itself a locked name, so there is no direct-match case
-    // to refuse alongside this one.)
-    if (locked && locked.size > 0 && edge.route.startsWith('*.')) {
-        return `${at} route '${edge.route}' is a wildcard: it would also capture ${[...locked].sort().join(', ')}, every hostname foundry already owns under this domain`;
-    }
-    for (const limit of edge.bindings?.rateLimits ?? []) {
+        return `${at} route '${worker.route}' must be on the org's own domain${domain ? ` (${domain})` : ''}: worker is only for our own projects`;
+    }
+    // A wildcard route (`*.<domain>/*`) is allowed beside hostnames foundry owns:
+    // `planWorkers` plans a no-Worker route for each of them, so they stay out of it.
+    for (const limit of worker.bindings?.rateLimits ?? []) {
         if (!limit.name.trim())
             return `${at} bindings.rateLimits needs a non-empty name`;
         if (!limit.namespaceId.trim())
@@ -537,23 +527,23 @@ function validateEntryEdge(entry, hosting, domain, locked) {
     return null;
 }
 /**
- * `uses.names`: serves only the org's own domain (names claims
+ * `uses.edge`: serves only the org's own domain (edge claims
  * `<label>.<domain>`), so it needs `hosting.usesDomain` and a `domain`, and
- * no `env` entry that names a value `uses.names` writes.
+ * no `env` entry that names a value `uses.edge` writes.
  */
-function validateEntryNames(entry, hosting, domain) {
-    const names = entry.uses?.names;
-    if (names === undefined)
+function validateEntryEdge(entry, hosting, domain) {
+    const edge = entry.uses?.edge;
+    if (edge === undefined)
         return null;
-    const at = `hosting.entries '${entry.key}' uses.names`;
-    if (names !== true)
+    const at = `hosting.entries '${entry.key}' uses.edge`;
+    if (edge !== true)
         return `${at} must be true`;
     if (!hosting.enabled)
         return `${at} requires hosting.enabled`;
     if (!hosting.usesDomain || !domain) {
-        return `${at} needs hosting.usesDomain and an org domain: names serves only the org's own domain`;
+        return `${at} needs hosting.usesDomain and an org domain: edge serves only the org's own domain`;
     }
-    const named = Object.keys(entry.env ?? {}).find((name) => NAMES_ENTRY_ENV_NAMES.includes(name));
+    const named = Object.keys(entry.env ?? {}).find((name) => EDGE_ENTRY_ENV_NAMES.includes(name));
     if (named)
         return `${at} writes ${named}; remove it from env`;
     return null;

package/dist/plan/agora.d.ts

@@ -110,6 +110,18 @@ export declare function agoraHostMissing(host: AgoraHostValues): string[];
 export declare function agoraHostnameFor(org: DeclaredOrg): string;
 /** The port `calls/packages/service/Dockerfile` documents (`EXPOSE 8080`); `config.mjs`'s `PORT` has no default, so the executor pushes it. */
 export declare const CALLS_SERVICE_PORT = "8080";
+/**
+ * The port `wtfalch/agora`'s `apps/agora/Dockerfile` serves Caddy on
+ * (`EXPOSE 8080`). Coolify's github-app build never reads a Dockerfile's
+ * `EXPOSE` on its own, so without this passed as `ports_exposes` Traefik is
+ * left routing to a port nothing listens on and Agora answers 502 behind the
+ * tunnel (#506, seen live on Company Included, 2026-10-05). `executor.ts`'s
+ * `coolifyAgora` sets it at create time and fixes it on a found app whose
+ * live value differs; `diff.ts`'s `planAgora` plans that fix the same way it
+ * plans an env difference, by comparing this constant against the live
+ * app's own `ports_exposes` (`providers-readers.ts`'s `withAgoraPortConfig`).
+ */
+export declare const AGORA_APP_PORTS_EXPOSES = "8080";
 /**
  * Recorded by the executor once the calls service app carries its fixed
  * internal name (`callsServiceInternalName`). `desiredAgoraEnv` waits for it,
@@ -196,6 +208,19 @@ export declare function agoraEnvDrift(desired: Readonly<Record<string, string>>,
  * against (#442's own probe: "one env write, zero restarts, zero deploys").
  */
 export declare const AGORA_ACTIVATED_ENV_SCOPE_KEY = "coolify_agora_activated_env";
+/**
+ * #504: recorded once `coolifyAgora` has actually called `deploy` on this
+ * org's Agora app -- `createGithubAppApplication` never sets
+ * `instant_deploy`, and Coolify defaults it to false, so a freshly created
+ * app (or one found by name that a previous apply created but crashed
+ * before deploying) sat at `exited:unhealthy` with zero deployments
+ * forever: nothing ever deployed it, and `restart` cannot start a container
+ * that was never built. Absent means "never deployed", regardless of
+ * whether the app is found live this run or created fresh -- unlike
+ * {@link AGORA_ACTIVATED_ENV_SCOPE_KEY}, this never changes value once set,
+ * so a later env change restarts rather than deploys again.
+ */
+export declare const AGORA_DEPLOYED_SCOPE_KEY = "coolify_agora_deployed";
 /**
  * A stable digest of `env`, for comparison against what was last recorded
  * under {@link AGORA_ACTIVATED_ENV_SCOPE_KEY}. `AGORA_CONFIG` is compared by

package/dist/plan/agora.js

@@ -118,6 +118,18 @@ export function agoraHostnameFor(org) {
 }
 /** The port `calls/packages/service/Dockerfile` documents (`EXPOSE 8080`); `config.mjs`'s `PORT` has no default, so the executor pushes it. */
 export const CALLS_SERVICE_PORT = '8080';
+/**
+ * The port `wtfalch/agora`'s `apps/agora/Dockerfile` serves Caddy on
+ * (`EXPOSE 8080`). Coolify's github-app build never reads a Dockerfile's
+ * `EXPOSE` on its own, so without this passed as `ports_exposes` Traefik is
+ * left routing to a port nothing listens on and Agora answers 502 behind the
+ * tunnel (#506, seen live on Company Included, 2026-10-05). `executor.ts`'s
+ * `coolifyAgora` sets it at create time and fixes it on a found app whose
+ * live value differs; `diff.ts`'s `planAgora` plans that fix the same way it
+ * plans an env difference, by comparing this constant against the live
+ * app's own `ports_exposes` (`providers-readers.ts`'s `withAgoraPortConfig`).
+ */
+export const AGORA_APP_PORTS_EXPOSES = '8080';
 /**
  * Recorded by the executor once the calls service app carries its fixed
  * internal name (`callsServiceInternalName`). `desiredAgoraEnv` waits for it,
@@ -305,6 +317,19 @@ export function agoraEnvDrift(desired, live) {
  * against (#442's own probe: "one env write, zero restarts, zero deploys").
  */
 export const AGORA_ACTIVATED_ENV_SCOPE_KEY = 'coolify_agora_activated_env';
+/**
+ * #504: recorded once `coolifyAgora` has actually called `deploy` on this
+ * org's Agora app -- `createGithubAppApplication` never sets
+ * `instant_deploy`, and Coolify defaults it to false, so a freshly created
+ * app (or one found by name that a previous apply created but crashed
+ * before deploying) sat at `exited:unhealthy` with zero deployments
+ * forever: nothing ever deployed it, and `restart` cannot start a container
+ * that was never built. Absent means "never deployed", regardless of
+ * whether the app is found live this run or created fresh -- unlike
+ * {@link AGORA_ACTIVATED_ENV_SCOPE_KEY}, this never changes value once set,
+ * so a later env change restarts rather than deploys again.
+ */
+export const AGORA_DEPLOYED_SCOPE_KEY = 'coolify_agora_deployed';
 /**
  * A stable digest of `env`, for comparison against what was last recorded
  * under {@link AGORA_ACTIVATED_ENV_SCOPE_KEY}. `AGORA_CONFIG` is compared by

package/dist/plan/boule.d.ts

@@ -20,6 +20,14 @@ export declare const BOULE_CLIENT_ID_SCOPE_KEY = "boule_client_id";
  * scope id, like the cms and calls databases.
  */
 export declare const BOULE_DATABASE_SCOPE_KEY = "coolify_boule_database";
+/**
+ * #504: the same marker `agora.ts`'s `AGORA_DEPLOYED_SCOPE_KEY` is, for
+ * Boule -- recorded once `coolifyBoule` has actually called `deploy` on this
+ * org's Boule app. See that constant's own doc comment for why: Coolify
+ * defaults `instant_deploy` to false, so without this a freshly created app
+ * sat built but never started, and `restart` cannot fix that.
+ */
+export declare const BOULE_DEPLOYED_SCOPE_KEY = "coolify_boule_deployed";
 /**
  * `boule.<domain>` when the org has a domain, `<slug>-boule.oikos.host`
  * otherwise (the tier rule of boule#128 and foundry#147; `../slug.ts`'s

package/dist/plan/boule.js

@@ -19,6 +19,14 @@ export const BOULE_CLIENT_ID_SCOPE_KEY = 'boule_client_id';
  * scope id, like the cms and calls databases.
  */
 export const BOULE_DATABASE_SCOPE_KEY = 'coolify_boule_database';
+/**
+ * #504: the same marker `agora.ts`'s `AGORA_DEPLOYED_SCOPE_KEY` is, for
+ * Boule -- recorded once `coolifyBoule` has actually called `deploy` on this
+ * org's Boule app. See that constant's own doc comment for why: Coolify
+ * defaults `instant_deploy` to false, so without this a freshly created app
+ * sat built but never started, and `restart` cannot fix that.
+ */
+export const BOULE_DEPLOYED_SCOPE_KEY = 'coolify_boule_deployed';
 /**
  * `boule.<domain>` when the org has a domain, `<slug>-boule.oikos.host`
  * otherwise (the tier rule of boule#128 and foundry#147; `../slug.ts`'s