@wtfalch/foundry 0.17.1 → 0.19.0

package/dist/plan/{entry-names-key.js → entry-edge-key.js}

@@ -1,14 +1,16 @@
+import { tunnelIngressHostnames } from './hostnames.js';
+import { lockedHostnames } from './locked-hostnames.js';
 import { appStepKey } from './platform-diff.js';
 /**
- * F7 (#317): one names key per entry with `uses.names`, minted directly
- * below the org with the names service (`NamesPort.mintKey({
+ * F7 (#317): one edge key per entry with `uses.edge`, minted directly
+ * below the org with the edge service (`EdgePort.mintKey({
  * organisationId, ... })` -- no org-level root key the way files/ai have
- * one, since the names service takes the org id itself). `NAMES_URL` and
- * `NAMES_API_KEY` go to the entry's env and nowhere else. A names key has no
+ * one, since the edge service takes the org id itself). `EDGE_URL` and
+ * `EDGE_API_KEY` go to the entry's env and nowhere else. A edge key has no
  * declared renewal window in the issue, so unlike `planEntryAiKeys`/
  * `planFilesKeys` this mints once and never renews.
  *
- * `NAMES_*` is written in this step, after the app's own `coolify:app`
+ * `EDGE_*` is written in this step, after the app's own `coolify:app`
  * create (which never knows the key yet), so the app's first boot has
  * neither and its first deploy restarts once this step's env write lands --
  * the same one-extra-restart shape `planEntryAiKeys`'s `AI_*`/
@@ -17,55 +19,77 @@ import { appStepKey } from './platform-diff.js';
  * A domain change after mint is not detected (#317 re-review): the key is
  * bound to the domain passed at mint time, but nothing here records that
  * domain to compare against a later `org.domain`, so an org that changes
- * domains keeps a names key still bound to the old one. Not built --
- * resolving it needs a manual revoke-and-re-mint (drop `uses.names`, apply,
+ * domains keeps a edge key still bound to the old one. Not built --
+ * resolving it needs a manual revoke-and-re-mint (drop `uses.edge`, apply,
  * re-add it) until this is.
  */
-export const entryNamesUndeliveredScopeKey = (entryKey) => `names_key_undelivered_${entryKey}`;
-/** The id of a key that was live when its entry stopped declaring `uses.names`, once handled. */
-export const entryNamesRetiredScopeKey = (entryKey) => `names_key_retired_${entryKey}`;
-export const ENTRY_NAMES_KEY_DELIVERY_ATTEMPTS = 3;
-/** How long an entry's names key lives. The issue names no renewal window, so this mints once and never renews. */
-export const NAMES_ENTRY_KEY_DAYS = 365;
+export const entryEdgeUndeliveredScopeKey = (entryKey) => `edge_key_undelivered_${entryKey}`;
+/** The id of a key that was live when its entry stopped declaring `uses.edge`, once handled. */
+export const entryEdgeRetiredScopeKey = (entryKey) => `edge_key_retired_${entryKey}`;
+export const ENTRY_EDGE_KEY_DELIVERY_ATTEMPTS = 3;
+/** How long an entry's edge key lives. The issue names no renewal window, so this mints once and never renews. */
+export const EDGE_ENTRY_KEY_DAYS = 365;
 /** The ISO time a delivered key's mint succeeded -- the only trace of its age, since there is no renewal to track against. */
-export const entryNamesMintedAtScopeKey = (entryKey) => `names_key_minted_at_${entryKey}`;
+export const entryEdgeMintedAtScopeKey = (entryKey) => `edge_key_minted_at_${entryKey}`;
 /** A key with fewer days left than this is surfaced as a blocked warning row (#317 review): still live, but nothing here renews it. */
-export const NAMES_ENTRY_KEY_WARN_WINDOW_DAYS = 30;
+export const EDGE_ENTRY_KEY_WARN_WINDOW_DAYS = 30;
 const DAY_MS = 24 * 60 * 60 * 1000;
-/** The reserved labels last sent to the names service, as that sorted list's own JSON. */
-export const NAMES_RESERVED_LABELS_APPLIED_SCOPE_KEY = 'names_reserved_labels_applied';
-export const entryNamesKeyName = (org, entry) => `${org.slug}-${entry.key}-names`;
+/** The reserved labels last sent to the edge service, as that sorted list's own JSON. */
+export const EDGE_RESERVED_LABELS_APPLIED_SCOPE_KEY = 'edge_reserved_labels_applied';
+export const entryEdgeKeyName = (org, entry) => `${org.slug}-${entry.key}-edge`;
 /**
- * Every label a declared entry serves (`@`/`*` reserve nothing of their own:
- * the bare domain and the wildcard are not names a customer could claim
- * under names anyway), plus `www`, which `setReservedLabels`'s own doc
- * comment in `executor.ts` explains is reserved unconditionally.
+ * Mail names foundry's mail setup puts on the org's domain. Stalwart's and
+ * Lettermint's own record names (DKIM selectors, return path) come back from
+ * the mail port at apply time, so only the fixed ones are listed here.
  */
-export function namesReservedLabels(org) {
+const MAIL_LABELS = ['mail', 'autoconfig', 'autodiscover', '_dmarc'];
+/**
+ * Every label under `org.domain` that foundry provisions or the platform
+ * uses, so edge never lets a company claim one: the hostnames foundry routes
+ * (`tunnelIngressHostnames`: entries, site, cms, calls, Agora, Boule, share),
+ * the names it locks (`lockedHostnames`: also the sign-in host and the
+ * platform's service hostnames), each entry's own labels, the mail labels
+ * and `www`. The entry's `*` is the space users claim in, so it reserves
+ * nothing, and neither does the bare domain.
+ *
+ * An org without a domain has no hostnames edge sees (`uses.edge` needs a
+ * domain), so it reserves `www` only.
+ */
+export function edgeReservedLabels(org, platformHostnames = []) {
     const labels = new Set(['www']);
+    const { domain } = org;
+    if (!domain)
+        return [...labels];
+    for (const label of MAIL_LABELS)
+        labels.add(label);
     for (const entry of org.hosting.entries) {
         for (const name of entry.hostnames) {
             if (name !== '@' && name !== '*')
                 labels.add(name);
         }
     }
+    const suffix = `.${domain}`;
+    for (const host of [...tunnelIngressHostnames(org), ...lockedHostnames(org, platformHostnames)]) {
+        if (host.endsWith(suffix) && !host.startsWith('*.'))
+            labels.add(host.slice(0, -suffix.length));
+    }
     return [...labels].sort();
 }
 /**
- * One step per entry whose names key is missing, plus one retire step per
- * entry whose `uses.names` was removed but still has a recorded key.
- * Blocked, not planned (rule 2), while the platform has no names service
+ * One step per entry whose edge key is missing, plus one retire step per
+ * entry whose `uses.edge` was removed but still has a recorded key.
+ * Blocked, not planned (rule 2), while the platform has no edge service
  * wired, the entry's app is not recorded, or a previous mint's delivery
  * failed.
  */
-export function planEntryNamesKeys(org, recordedIds, plannedSteps, readiness, now = Date.now()) {
+export function planEntryEdgeKeys(org, recordedIds, plannedSteps, readiness, now = Date.now()) {
     const steps = [];
     const blocked = [];
     const planned = (system, kind, k) => plannedSteps.some((p) => p.action.system === system && p.action.kind === kind && p.action.key === k);
-    // A key whose entry lost `uses.names`, or whose entry is gone entirely --
+    // A key whose entry lost `uses.edge`, or whose entry is gone entirely --
     // either way it is no longer in `declared`, the same "gone" scan
     // `planEntryAiKeys`/`planFilesKeys` run over their own recorded keys.
-    // Gated on `namesReady`: without a port there is nothing that could revoke
+    // Gated on `edgeReady`: without a port there is nothing that could revoke
     // it, so it is reported blocked, not planned to a step that would throw.
     //
     // Scanned from both the main recorded id and the undelivered marker: a
@@ -73,9 +97,9 @@ export function planEntryNamesKeys(org, recordedIds, plannedSteps, readiness, no
     // throws before `runSteps` sees a `resourceId`), so scanning the main
     // prefix alone would never find it to revoke once its entry is gone
     // (#317 review).
-    const declared = new Set(org.hosting.entries.filter((e) => e.uses?.names).map((e) => e.key));
-    const mainPrefix = `names:key:${org.id}:`;
-    const undeliveredPrefix = 'names_key_undelivered_';
+    const declared = new Set(org.hosting.entries.filter((e) => e.uses?.edge).map((e) => e.key));
+    const mainPrefix = `edge:key:${org.id}:`;
+    const undeliveredPrefix = 'edge_key_undelivered_';
     const goneEntryKeys = new Set();
     for (const [name, id] of Object.entries(recordedIds)) {
         if (!id)
@@ -95,39 +119,39 @@ export function planEntryNamesKeys(org, recordedIds, plannedSteps, readiness, no
         // (mint, three failed deliveries, undeclare again) must not hide
         // behind id A's retired marker just because id A's main-id field is
         // still truthy (#317 re-review).
-        if (name.startsWith(mainPrefix) && recordedIds[entryNamesRetiredScopeKey(entryKey)] === id) {
+        if (name.startsWith(mainPrefix) && recordedIds[entryEdgeRetiredScopeKey(entryKey)] === id) {
             continue;
         }
         goneEntryKeys.add(entryKey);
     }
     for (const entryKey of goneEntryKeys) {
-        if (!readiness.namesReady) {
+        if (!readiness.edgeReady) {
             blocked.push({
-                description: `${org.slug}'s ${entryKey} names key is blocked, not planned: the host supplies no names service, or the platform has not enabled it`,
+                description: `${org.slug}'s ${entryKey} edge key is blocked, not planned: the host supplies no edge service, or the platform has not enabled it`,
                 key: `${mainPrefix}${entryKey}`,
             });
             continue;
         }
         steps.push({
             action: {
-                system: 'names',
+                system: 'edge',
                 kind: 'key',
                 key: `${org.id}:${entryKey}`,
                 desired: { mode: 'retire' },
             },
             step: {
-                description: `revoke ${org.slug}'s ${entryKey} names key: the entry no longer declares uses.names`,
+                description: `revoke ${org.slug}'s ${entryKey} edge key: the entry no longer declares uses.edge`,
                 destroys: true,
                 migrates: false,
             },
         });
     }
     for (const entry of org.hosting.entries) {
-        if (!entry.uses?.names)
+        if (!entry.uses?.edge)
             continue;
         const stepKey = appStepKey(org, entry.key);
-        const key = `names:key:${stepKey}`;
-        const liveKeyId = recordedIds[key] && recordedIds[entryNamesRetiredScopeKey(entry.key)] !== recordedIds[key]
+        const key = `edge:key:${stepKey}`;
+        const liveKeyId = recordedIds[key] && recordedIds[entryEdgeRetiredScopeKey(entry.key)] !== recordedIds[key]
             ? recordedIds[key]
             : undefined;
         if (liveKeyId) {
@@ -140,20 +164,20 @@ export function planEntryNamesKeys(org, recordedIds, plannedSteps, readiness, no
             // mint could ever clear) can tell the two apart -- a permanently
             // "blocked" row past day 335 that no action removes is the problem
             // this prefix exists to avoid.
-            const mintedAt = recordedIds[entryNamesMintedAtScopeKey(entry.key)];
+            const mintedAt = recordedIds[entryEdgeMintedAtScopeKey(entry.key)];
             if (mintedAt) {
-                const expiresAt = Date.parse(mintedAt) + NAMES_ENTRY_KEY_DAYS * DAY_MS;
+                const expiresAt = Date.parse(mintedAt) + EDGE_ENTRY_KEY_DAYS * DAY_MS;
                 const daysLeft = Math.floor((expiresAt - now) / DAY_MS);
-                if (daysLeft < NAMES_ENTRY_KEY_WARN_WINDOW_DAYS) {
+                if (daysLeft < EDGE_ENTRY_KEY_WARN_WINDOW_DAYS) {
                     blocked.push({
-                        description: `warning: ${org.slug}'s ${entry.key} names key ${daysLeft < 0 ? 'expired' : 'expires'} ${new Date(expiresAt).toISOString().slice(0, 10)} and is never renewed (#317): mint a new key by hand and update the entry's env`,
+                        description: `warning: ${org.slug}'s ${entry.key} edge key ${daysLeft < 0 ? 'expired' : 'expires'} ${new Date(expiresAt).toISOString().slice(0, 10)} and is never renewed (#317): mint a new key by hand and update the entry's env`,
                         key,
                     });
                 }
             }
             continue;
         }
-        const at = `${org.slug}'s ${entry.key} names key`;
+        const at = `${org.slug}'s ${entry.key} edge key`;
         const block = (why) => blocked.push({ description: `${at} is blocked: ${why}`, key });
         // An undelivered key from a previous mint is no longer a reason to
         // block forever: nothing here keeps the secret around to retry
@@ -162,8 +186,8 @@ export function planEntryNamesKeys(org, recordedIds, plannedSteps, readiness, no
         // re-review) -- blocking indefinitely, as a prior round did, left the
         // orphan live for up to 365 days with no recorded trace an operator
         // could act on beyond this description.
-        if (!readiness.namesReady) {
-            block('the host supplies no names service, or the platform has not enabled it');
+        if (!readiness.edgeReady) {
+            block('the host supplies no edge service, or the platform has not enabled it');
             continue;
         }
         if (!recordedIds[`coolify:app:${stepKey}`] && !planned('coolify', 'app', stepKey)) {
@@ -172,17 +196,17 @@ export function planEntryNamesKeys(org, recordedIds, plannedSteps, readiness, no
         }
         steps.push({
             action: {
-                system: 'names',
+                system: 'edge',
                 kind: 'key',
                 key: stepKey,
                 desired: {
                     mode: 'mint',
-                    name: entryNamesKeyName(org, entry),
-                    namesUrl: readiness.namesUrl,
+                    name: entryEdgeKeyName(org, entry),
+                    edgeUrl: readiness.edgeUrl,
                 },
             },
             step: {
-                description: `mint ${at} below the org, write NAMES_* env, restart the app`,
+                description: `mint ${at} below the org, write EDGE_* env, restart the app`,
                 destroys: false,
                 migrates: false,
             },
@@ -192,41 +216,41 @@ export function planEntryNamesKeys(org, recordedIds, plannedSteps, readiness, no
 }
 /**
  * The reserved-labels step: resent whenever the org's own label set
- * (`namesReservedLabels`) differs from what was last sent. While the org
- * uses names at all (at least one entry with `uses.names`) that set is
- * `namesReservedLabels(org)`; once the last entry drops `uses.names`, this
+ * (`edgeReservedLabels`) differs from what was last sent. While the org
+ * uses edge at all (at least one entry with `uses.edge`) that set is
+ * `edgeReservedLabels(org)`; once the last entry drops `uses.edge`, this
  * clears whatever was last sent (an empty list) rather than leaving it
  * stuck in names forever -- a one-time step, same as any other change.
  */
-export function planNamesReservedLabels(org, recordedIds, readiness) {
-    const usesNames = org.hosting.entries.some((e) => e.uses?.names);
-    const applied = recordedIds[NAMES_RESERVED_LABELS_APPLIED_SCOPE_KEY];
-    if (!usesNames && (!applied || applied === '[]')) {
+export function planEdgeReservedLabels(org, recordedIds, readiness, platformHostnames = []) {
+    const usesEdge = org.hosting.entries.some((e) => e.uses?.edge);
+    const applied = recordedIds[EDGE_RESERVED_LABELS_APPLIED_SCOPE_KEY];
+    if (!usesEdge && (!applied || applied === '[]')) {
         return { step: null, blocked: [] };
     }
-    if (!readiness.namesReady) {
+    if (!readiness.edgeReady) {
         return {
             step: null,
             blocked: [
                 {
-                    description: `${org.slug}'s reserved labels are blocked: the host supplies no names service, or the platform has not enabled it`,
-                    key: `names:reserved-labels:${org.id}`,
+                    description: `${org.slug}'s reserved labels are blocked: the host supplies no edge service, or the platform has not enabled it`,
+                    key: `edge:reserved-labels:${org.id}`,
                 },
             ],
         };
     }
-    const labels = usesNames ? namesReservedLabels(org) : [];
+    const labels = usesEdge ? edgeReservedLabels(org, platformHostnames) : [];
     const wantJson = JSON.stringify(labels);
     if (applied === wantJson) {
         return { step: null, blocked: [] };
     }
     return {
         step: {
-            action: { system: 'names', kind: 'reserved-labels', key: org.id, desired: { labels } },
+            action: { system: 'edge', kind: 'reserved-labels', key: org.id, desired: { labels } },
             step: {
-                description: usesNames
-                    ? `send ${org.slug}'s reserved labels to names: ${labels.join(', ')}`
-                    : `clear ${org.slug}'s reserved labels from names: no entry uses names any more`,
+                description: usesEdge
+                    ? `send ${org.slug}'s reserved labels to edge: ${labels.join(', ')}`
+                    : `clear ${org.slug}'s reserved labels from edge: no entry uses edge any more`,
                 destroys: false,
                 migrates: false,
             },

package/dist/plan/executor.d.ts

@@ -89,6 +89,10 @@ export interface CoolifyPort {
      * `settings`, not at the top level -- confirmed against live Coolify
      * 4.3.23 (PR #482 review); `custom_network_aliases` and
      * `health_check_enabled` are both top-level there.
+     *
+     * #506: also the port Traefik routes to, so `coolifyAgora` can tell an app
+     * that predates passing `ports_exposes` at create apart from one already
+     * fixed.
      */
     getApplication(uuid: string): Promise<{
         uuid: string;
@@ -99,6 +103,7 @@ export interface CoolifyPort {
         };
         custom_network_aliases?: string | null;
         health_check_enabled?: boolean;
+        ports_exposes?: string;
     }>;
     createGithubAppApplication(input: {
         project_uuid: string;
@@ -565,11 +570,11 @@ export interface WorkersRateLimitBinding {
 }
 /**
  * The Cloudflare Workers calls `cloudflareWorker` makes (#318, F8): deploys
- * a plain Worker from an entry's `edge` declaration and routes it on the
+ * a plain Worker from an entry's `worker` declaration and routes it on the
  * org's own zone. Optional on {@link FoundryStepExecutorPorts} -- a host
  * with no Workers rights on its Cloudflare token (the issue's own "Human
  * steps": the token needs them added first) wires none, and the planner
- * reports every `edge` entry blocked instead of planning a step that would
+ * reports every `worker` entry blocked instead of planning a step that would
  * throw (`FoundryPlanApplyOptions.edgeWorkers`).
  *
  * `uploadScript` takes the *declared artifact reference*, not bytes:
@@ -604,10 +609,13 @@ export interface WorkersPort {
     /** The script name currently bound to `pattern` in `zoneId`, or `undefined` for no route there. */
     findRoute(zoneId: string, pattern: string): Promise<{
         id: string;
-        script: string;
+        script?: string;
     } | undefined>;
-    /** Creates the route if absent; `cloudflareWorker` only calls this once `findRoute` has confirmed the pattern is foundry's own or unclaimed. */
-    createRoute(zoneId: string, pattern: string, script: string): Promise<{
+    /**
+     * Creates the route if absent; `cloudflareWorker` only calls this once `findRoute` has confirmed the pattern is foundry's own or unclaimed.
+     * With no `script` it creates Cloudflare's "no Worker" route (`POST /zones/{zone_id}/workers/routes` with `pattern` only), which turns Workers off for that pattern; a more specific pattern wins over a wildcard.
+     */
+    createRoute(zoneId: string, pattern: string, script?: string): Promise<{
         id: string;
     }>;
     /** A no-op, not a throw, when `routeId` is already gone. */
@@ -1338,22 +1346,22 @@ export interface AiOrganisationPort {
     }): Promise<unknown>;
 }
 /**
- * #317 (F7): the names service's own management API
- * (https://github.com/wtfalch/names, live on main, offering `mintKey`,
+ * #317 (F7): the edge service's own management API
+ * (https://github.com/wtfalch/edge, live on main, offering `mintKey`,
  * `revokeKey` and `setReservedLabels`) -- this port states the shape this
  * executor assumes of it. `organisationId` is the org itself: unlike
- * `AiOrganisationPort.mintNestedKey`, names takes no separate minter key
- * id, so `namesEntryKey` mints directly below the org. A real adapter
+ * `AiOrganisationPort.mintNestedKey`, edge takes no separate minter key
+ * id, so `edgeEntryKey` mints directly below the org. A real adapter
  * wiring this port into `platform-providers.ts` is tracked separately
  * (https://github.com/wtfalch/archon/issues/339).
  */
-export interface NamesPort {
+export interface EdgePort {
     /**
-     * `domain` is required: names's own `mintKey` refuses a request without a
+     * `domain` is required: edge's own `mintKey` refuses a request without a
      * lowercase hostname and binds the key to it
-     * (`wtfalch/names`'s `packages/service/src/keys.ts`) -- `namesEntryKey`
-     * passes `org.domain`, which `validateEntryNames` already requires before
-     * `uses.names` is accepted.
+     * (`wtfalch/edge`'s `packages/service/src/keys.ts`) -- `edgeEntryKey`
+     * passes `org.domain`, which `validateEntryEdge` already requires before
+     * `uses.edge` is accepted.
      */
     mintKey(input: {
         organisationId: string;
@@ -1407,6 +1415,8 @@ export interface PlatformOrgPortSource {
     files(): Promise<FilesOrganisationPort>;
     ai(): Promise<AiOrganisationPort>;
     jobs(): Promise<JobsSchedulerPort>;
+    /** The platform's shared sign-in host, or `null` when none is declared. */
+    authHostname?(): Promise<string | null>;
 }
 export interface FoundryStepExecutorPorts {
     coolify: CoolifyPort;
@@ -1437,14 +1447,14 @@ export interface FoundryStepExecutorPorts {
     filesOrganisation?: FilesOrganisationPort;
     aiOrganisation?: AiOrganisationPort;
     /**
-     * #317 (F7): mints an entry's names key -- see {@link NamesPort}'s own
+     * #317 (F7): mints an entry's edge key -- see {@link EdgePort}'s own
      * doc comment. Optional the same way `jobsScheduler` is: a host with no
-     * names service deployed builds the executor without one, and tells the
-     * planner so (`FoundryPlanApplyOptions.names`), which then reports each
-     * entry's `uses.names` step as blocked instead of planning one that would
+     * edge service deployed builds the executor without one, and tells the
+     * planner so (`FoundryPlanApplyOptions.edge`), which then reports each
+     * entry's `uses.edge` step as blocked instead of planning one that would
      * throw.
      */
-    names?: NamesPort;
+    edge?: EdgePort;
     /**
      * #177: builds the files, AI and jobs ports from the platform's addresses
      * and held keys. A port set above overrides it (tests); with neither, the
@@ -1468,9 +1478,9 @@ export interface FoundryStepExecutorPorts {
      */
     broker?: BrokerPort;
     /**
-     * #318: deploys and routes an entry's `edge` Worker -- see
+     * #318: deploys and routes an entry's `worker` Worker -- see
      * {@link WorkersPort}'s own doc comment. Optional the same way `broker` is:
-     * without it the plan reports each `edge` entry blocked (the host also
+     * without it the plan reports each `worker` entry blocked (the host also
      * sets `FoundryPlanApplyOptions.edgeWorkers`).
      */
     workers?: WorkersPort;
@@ -1618,10 +1628,10 @@ export declare class FoundryStepExecutor implements StepExecutor, StepDestroyer
      */
     private cloudflareRateLimit;
     /**
-     * `plan/diff.ts`'s `planEdgeWorkers` (#318, F8): deploys one entry's
-     * `edge` Worker and routes it on the org's own zone. Throws by name
+     * `plan/diff.ts`'s `planWorkers` (#318, F8): deploys one entry's
+     * `worker` Worker and routes it on the org's own zone. Throws by name
      * without a {@link WorkersPort}, the same `jobsRegistration` shape --
-     * `planEdgeWorkers` reports the step blocked instead while the host has
+     * `planWorkers` reports the step blocked instead while the host has
      * none, so this only fires against a stale plan. The route is checked
      * before upload: a foreign route already on the pattern is refused, never
      * adopted or replaced (`cloudflareAccess`'s own precedent for a foreign
@@ -1638,6 +1648,14 @@ export declare class FoundryStepExecutor implements StepExecutor, StepDestroyer
      * live state actually matches it.
      */
     private cloudflareWorker;
+    /**
+     * Makes the no-Worker routes recorded for an entry match `patterns`: deletes
+     * the ones no longer wanted (all of them if the zone changed), creates the
+     * missing ones without a script. A route already on a pattern that is bound
+     * to a Worker is foreign and refused; one with no script is adopted. Records
+     * and persists after each change.
+     */
+    private syncWorkerExclusions;
     /**
      * The zone id a recorded route lives in, or `undefined` only when that
      * zone is *positively* gone -- its apex resolves to no zone, or to a
@@ -1651,15 +1669,15 @@ export declare class FoundryStepExecutor implements StepExecutor, StepDestroyer
      * live on the old one, the exact bug a recorded-per-route zone exists to
      * avoid (#318 re-review).
      */
-    private liveEdgeZone;
+    private liveWorkerZone;
     /** Deletes the route an interrupted apply was creating, if `findRoute` shows it exists, points at that apply's script, and is not `keepRouteId`. */
-    private deletePendingEdgeRoute;
+    private deletePendingWorkerRoute;
     /**
      * Retire and destroy share this: delete the recorded route on its own
      * zone, then any route an interrupted apply created but never recorded,
      * then the script. Records nothing -- the caller does.
      */
-    private teardownEdgeWorker;
+    private teardownWorker;
     private zitadelIssuer;
     /**
      * `plan/diff.ts`'s `planOwner`: invites the org's owner into its ZITADEL
@@ -2320,11 +2338,25 @@ export declare class FoundryStepExecutor implements StepExecutor, StepDestroyer
      * actually differs, or whenever the last restart this step confirmed
      * ({@link AGORA_ACTIVATED_ENV_SCOPE_KEY}) is not this exact env (an org
      * applied before this existed, whose live env already matched desired
-     * with nothing ever confirmed running it). A brand new app has nothing
-     * running yet to restart. The activation marker is recorded last, after
-     * the restart (if any) returns without throwing, so a failed restart
-     * leaves it stale and the next plan replans this step even though
-     * Coolify's own env store already matches desired.
+     * with nothing ever confirmed running it). The activation marker is
+     * recorded last, after the restart (if any) returns without throwing, so a
+     * failed restart leaves it stale and the next plan replans this step even
+     * though Coolify's own env store already matches desired.
+     *
+     * #504: a brand new app is never restarted -- but it is deployed, once
+     * ({@link AGORA_DEPLOYED_SCOPE_KEY}). `createGithubAppApplication` never
+     * sets `instant_deploy`, and Coolify defaults it to false, so without an
+     * explicit deploy the app sat created but never built or started.
+     *
+     * #506: `ports_exposes: AGORA_APP_PORTS_EXPOSES` goes on the create call
+     * itself, so Traefik has a port to route to from the moment the app
+     * exists. An app `findOrCreateCallsApp` instead *found* may predate this
+     * fix and carry no `ports_exposes` at all (or the wrong one), so its live
+     * value is read and, when it differs, patched -- and, since the container
+     * listens on `ports_exposes` only at its next deploy (the same rule
+     * `coolifyApp`'s own `settingsNeedDeploy` follows for a port change
+     * there), redeployed even on a run that already has its one #504 deploy
+     * behind it.
      */
     private coolifyAgora;
     /**
@@ -2349,6 +2381,10 @@ export declare class FoundryStepExecutor implements StepExecutor, StepDestroyer
      *
      * `AUTH_APP_KEY` is minted once here; its broker entry is the next step
      * (`bouleBrokerEntry`).
+     *
+     * #504: a brand new app is never restarted -- but it is deployed, once
+     * ({@link BOULE_DEPLOYED_SCOPE_KEY}), the same reason and the same marker
+     * shape {@link coolifyAgora}'s own doc comment explains.
      */
     private coolifyBoule;
     /**
@@ -2490,6 +2526,15 @@ export declare class FoundryStepExecutor implements StepExecutor, StepDestroyer
      * shared-hostname collision this ticket exists to refuse. An org re-running
      * its own already-recorded zone is unaffected: the store then names this
      * same org as the owner.
+     *
+     * #510: also records the zone's own id under the flat `cloudflare_zone`
+     * scope key, alongside the `cloudflare:zone:<domain>` resource id `runSteps`
+     * already records from this method's return value. Without it, nothing
+     * ever gives `ProvidersCloudflareReader` a zone id to resolve this org's
+     * scope with (`providers-readers.ts`'s `storeScopeResolver` doc comment),
+     * so that reader's `listResources` always returned `[]` and `diff.ts`'s
+     * `planZone` re-proposed "provision a Cloudflare zone" on every apply, even
+     * once the zone was live.
      */
     private cloudflareZone;
     /**
@@ -2716,21 +2761,21 @@ export declare class FoundryStepExecutor implements StepExecutor, StepDestroyer
      */
     private revokeEntryKey;
     /**
-     * F7 (#317): mints one entry's names key directly below the org (names
-     * takes no separate minter key id, unlike ai/files), writes `NAMES_URL`
-     * and `NAMES_API_KEY` to the entry's app env, then restarts it. Retires
-     * the key when `uses.names` is removed. Follows the "one mint" rule
+     * F7 (#317): mints one entry's edge key directly below the org (edge
+     * takes no separate minter key id, unlike ai/files), writes `EDGE_URL`
+     * and `EDGE_API_KEY` to the entry's app env, then restarts it. Retires
+     * the key when `uses.edge` is removed. Follows the "one mint" rule
      * (CLAUDE.md "Platform steps"): the id is recorded as undelivered and
      * persisted before delivery is attempted, so a crash or a failed write
-     * never leads to a second mint -- `planEntryNamesKeys` blocks instead.
+     * never leads to a second mint -- `planEntryEdgeKeys` blocks instead.
      */
-    private namesEntryKey;
+    private edgeEntryKey;
     /**
-     * F7 (#317): `plan/entry-names-key.ts`'s `planNamesReservedLabels` --
-     * tells the names service every label this org's own entries already
-     * hold, so names refuses a customer claiming one of them.
+     * F7 (#317): `plan/entry-edge-key.ts`'s `planEdgeReservedLabels` --
+     * tells the edge service every label this org's own entries already
+     * hold, so edge refuses a customer claiming one of them.
      */
-    private namesReservedLabels;
+    private edgeReservedLabels;
     /**
      * F6b: mints or renews the org's own files key, or revokes the ones a
      * renewal replaced. The key is minted below the files organisation's owner