@wtfalch/foundry 0.17.1 → 0.19.0

package/dist/plan/index.d.ts

@@ -5,7 +5,7 @@ export { computePlanDetail, toPlan } from './diff.js';
 export type { StepSystem } from './step-system.js';
 export { stepSystemOf } from './step-system.js';
 export type { PlatformPlanDetail } from './platform-diff.js';
-export { planPlatform, toPlatformPlan, JOBS_SCHEDULER_KEY, PLATFORM_AI_KEY, PLATFORM_AI_INTERNAL_URL_SCOPE_KEY, PLATFORM_AI_MANAGEMENT_KEY_SCOPE_KEY, PLATFORM_AI_ORGANISATION_SCOPE_KEY, PLATFORM_AUTH_KEY, PLATFORM_FILES_KEY, PLATFORM_FILES_INTERNAL_URL_SCOPE_KEY, PLATFORM_FILES_ZITADEL_PROJECT_SCOPE_KEY, PLATFORM_MAIL_KEY, PLATFORM_MAIL_INTERNAL_URL_SCOPE_KEY, PLATFORM_MAIL_ZITADEL_PROJECT_SCOPE_KEY, PLATFORM_NAMES_KEY, PLATFORM_NAMES_KEY_REF, PLATFORM_NAMES_CLOUDFLARE_TOKEN_REF, } from './platform-diff.js';
+export { planPlatform, toPlatformPlan, JOBS_SCHEDULER_KEY, PLATFORM_AI_KEY, PLATFORM_AI_INTERNAL_URL_SCOPE_KEY, PLATFORM_AI_MANAGEMENT_KEY_SCOPE_KEY, PLATFORM_AI_ORGANISATION_SCOPE_KEY, PLATFORM_AUTH_KEY, PLATFORM_FILES_KEY, PLATFORM_FILES_INTERNAL_URL_SCOPE_KEY, PLATFORM_FILES_ZITADEL_PROJECT_SCOPE_KEY, PLATFORM_MAIL_KEY, PLATFORM_MAIL_INTERNAL_URL_SCOPE_KEY, PLATFORM_MAIL_ZITADEL_PROJECT_SCOPE_KEY, PLATFORM_EDGE_KEY, PLATFORM_EDGE_KEY_REF, PLATFORM_EDGE_CLOUDFLARE_TOKEN_REF, } from './platform-diff.js';
 export type { HeldKeyResolver, OrgPlatformReadiness } from './platform-org.js';
 export { DEFAULT_ORG_PLATFORM_READINESS, ORG_PLATFORM_KEY_REFS, agoraHostValuesFromPlatform, heldPlatformKeyRefs, orgPlatformReadinessFrom, } from './platform-org.js';
 export type { PlatformOrgClientFactories } from './platform-org-ports.js';
@@ -15,7 +15,7 @@ export { AdoptRefusedError } from './adopt.js';
 export type { AuditActor, AuditLog, AuthzGate, StepExecutor, StepDestroyer, DestroyTarget, StepExecutionContext, PlatformStepExecutor, PlatformStepExecutionContext, FoundryPlanApplyOptions, } from './plan-apply.js';
 export { FoundryPlanApply, DeclaredOrgNotFoundError, StalePlanError, ConfirmationRequiredError, NotAuthorizedError, NotATestOrgError, DeclaredPlatformNotFoundError, PlatformStalePlanError, PlatformConfirmationRequiredError, planNeedsConfirmation, } from './plan-apply.js';
 export { FoundryPlatformStepExecutor, ProvidersPlatformCloudflareReader, ProvidersPlatformCoolifyReader, PLATFORM_MAIL_ADMIN_KEY_DESCRIPTION, filesPublicHostsValue, filesShareDomains, } from './platform-providers.js';
-export type { PlatformAuthDeps, PlatformAuthRuntime, PlatformFilesDeps, PlatformFilesRuntime, PlatformNamesDeps, PlatformNamesRuntime, } from './platform-providers.js';
+export type { PlatformAuthDeps, PlatformAuthRuntime, PlatformFilesDeps, PlatformFilesRuntime, PlatformEdgeDeps, PlatformEdgeRuntime, } from './platform-providers.js';
 export type { PlatformMailDeps, PlatformMailAdminPort, PlatformMailRuntime, } from './platform-providers.js';
 export { FILES_INTROSPECTION_SECRET_REF, FILES_MANAGEMENT_ISSUER, FILES_MANAGEMENT_KEY_ID, FILES_MANAGEMENT_KEY_REF, PLATFORM_AUTH_INSTANCE_BEARER_REF, } from './platform-providers.js';
 export { AI_MANAGEMENT_ISSUER, AI_MANAGEMENT_KEY_ID, AI_SIGNING_KEY_REF, AiManagementKeyExistsError, createAiManagementKeyMinter, PLATFORM_AI_MANAGEMENT_KEY_REF, PLATFORM_AI_MANAGEMENT_PERMISSIONS, } from './platform-providers.js';

package/dist/plan/index.js

@@ -1,7 +1,7 @@
 export { readLiveResources, readLivePlatformResources } from './live.js';
 export { computePlanDetail, toPlan } from './diff.js';
 export { stepSystemOf } from './step-system.js';
-export { planPlatform, toPlatformPlan, JOBS_SCHEDULER_KEY, PLATFORM_AI_KEY, PLATFORM_AI_INTERNAL_URL_SCOPE_KEY, PLATFORM_AI_MANAGEMENT_KEY_SCOPE_KEY, PLATFORM_AI_ORGANISATION_SCOPE_KEY, PLATFORM_AUTH_KEY, PLATFORM_FILES_KEY, PLATFORM_FILES_INTERNAL_URL_SCOPE_KEY, PLATFORM_FILES_ZITADEL_PROJECT_SCOPE_KEY, PLATFORM_MAIL_KEY, PLATFORM_MAIL_INTERNAL_URL_SCOPE_KEY, PLATFORM_MAIL_ZITADEL_PROJECT_SCOPE_KEY, PLATFORM_NAMES_KEY, PLATFORM_NAMES_KEY_REF, PLATFORM_NAMES_CLOUDFLARE_TOKEN_REF, } from './platform-diff.js';
+export { planPlatform, toPlatformPlan, JOBS_SCHEDULER_KEY, PLATFORM_AI_KEY, PLATFORM_AI_INTERNAL_URL_SCOPE_KEY, PLATFORM_AI_MANAGEMENT_KEY_SCOPE_KEY, PLATFORM_AI_ORGANISATION_SCOPE_KEY, PLATFORM_AUTH_KEY, PLATFORM_FILES_KEY, PLATFORM_FILES_INTERNAL_URL_SCOPE_KEY, PLATFORM_FILES_ZITADEL_PROJECT_SCOPE_KEY, PLATFORM_MAIL_KEY, PLATFORM_MAIL_INTERNAL_URL_SCOPE_KEY, PLATFORM_MAIL_ZITADEL_PROJECT_SCOPE_KEY, PLATFORM_EDGE_KEY, PLATFORM_EDGE_KEY_REF, PLATFORM_EDGE_CLOUDFLARE_TOKEN_REF, } from './platform-diff.js';
 export { DEFAULT_ORG_PLATFORM_READINESS, ORG_PLATFORM_KEY_REFS, agoraHostValuesFromPlatform, heldPlatformKeyRefs, orgPlatformReadinessFrom, } from './platform-org.js';
 export { PlatformOrgBlockedError, PlatformOrgPorts } from './platform-org-ports.js';
 export { AdoptRefusedError } from './adopt.js';

package/dist/plan/live.d.ts

@@ -26,11 +26,11 @@ export interface LiveResource {
      * `platform-diff.ts`'s `planSfu` always plans its step when
      * `DeclaredPlatform.sfu.enabled` is true, rather than diffing against a
      * live resource the way every other system here does. It is still part of
-     * this union so `StepAction.system` (`diff.ts`) can name it. `'names'`
-     * (#317) is the same: a names key has no live lookup of its own, the same
+     * this union so `StepAction.system` (`diff.ts`) can name it. `'edge'`
+     * (#317) is the same: a edge key has no live lookup of its own, the same
      * shape `ai`/`files` entry keys already follow.
      */
-    system: 'zitadel' | 'coolify' | 'cloudflare' | 'files' | 'ai' | 'cms' | 'jobs' | 'sfu' | 'names';
+    system: 'zitadel' | 'coolify' | 'cloudflare' | 'files' | 'ai' | 'cms' | 'jobs' | 'sfu' | 'edge';
     kind: string;
     key: string;
     config: Record<string, unknown>;

package/dist/plan/login-host.d.ts

@@ -22,18 +22,22 @@ import type { DeclaredOrg } from '../org.js';
  * org's own `<slug>.oikos.host` can collide with this subdomain, the same
  * way `AGORA_SUFFIX` reserves `-agora`.
  *
- * #488: `auth.<domain>` is refused when it would equal `platformAuthHostname`
- * -- the platform's own org, declared with-domain on the platform's own
- * domain, would otherwise compute the shared ZITADEL instance's own login
- * host (`platform.auth.hostname`, e.g. `auth.companyincriminated.com` ->
- * `auth.companyincluded.com`). Archon's login-host write throws on that
- * duplicate host (`archon`'s `validateLoginHostRegistry`); if it were ever
- * written instead, `auth`'s own `company-host.ts` denies every request
- * through a duplicate host, the shared one included. `platformAuthHostname`
- * is `null` when the caller has none to compare against (no platform
- * declared, or sign-in not ready yet), in which case this never refuses.
+ * #488: the platform's own org is not handled here: it signs in on the shared
+ * ZITADEL instance's own host (`platformAuthHostname`), whatever
+ * `issuer.usesDomain` says (William, 2026-10-06), and `planLoginHost` picks
+ * that host itself. That host must never get a trusted
+ * domain or a login binding of its own:
+ * Archon's login-host write throws on a duplicate host, and `auth`'s own
+ * `company-host.ts` denies every request through one, the shared one
+ * included (`planLoginHost` and `zitadelLoginHost` skip both for it).
  */
-export declare function loginHostnameFor(org: DeclaredOrg, platformAuthHostname?: string | null): string;
+export declare function loginHostnameFor(org: DeclaredOrg): string;
+/**
+ * Scope id set to `'1'` once an org's recorded login host is the platform's
+ * shared instance host: that host's trusted domain belongs to the shared
+ * instance, so `destroy` must not remove it.
+ */
+export declare const LOGIN_HOST_SHARED_SCOPE_KEY = "zitadel_login_host_shared";
 /**
  * One entry in zitadel-login's own `LOGIN_HOST_BINDINGS`
  * (`auth/docs/company-login-hosts.md`) -- a single-line JSON document naming

package/dist/plan/login-host.js

@@ -23,30 +23,30 @@ import { BOULE_CLIENT_ID_SCOPE_KEY } from './boule.js';
  * org's own `<slug>.oikos.host` can collide with this subdomain, the same
  * way `AGORA_SUFFIX` reserves `-agora`.
  *
- * #488: `auth.<domain>` is refused when it would equal `platformAuthHostname`
- * -- the platform's own org, declared with-domain on the platform's own
- * domain, would otherwise compute the shared ZITADEL instance's own login
- * host (`platform.auth.hostname`, e.g. `auth.companyincriminated.com` ->
- * `auth.companyincluded.com`). Archon's login-host write throws on that
- * duplicate host (`archon`'s `validateLoginHostRegistry`); if it were ever
- * written instead, `auth`'s own `company-host.ts` denies every request
- * through a duplicate host, the shared one included. `platformAuthHostname`
- * is `null` when the caller has none to compare against (no platform
- * declared, or sign-in not ready yet), in which case this never refuses.
+ * #488: the platform's own org is not handled here: it signs in on the shared
+ * ZITADEL instance's own host (`platformAuthHostname`), whatever
+ * `issuer.usesDomain` says (William, 2026-10-06), and `planLoginHost` picks
+ * that host itself. That host must never get a trusted
+ * domain or a login binding of its own:
+ * Archon's login-host write throws on a duplicate host, and `auth`'s own
+ * `company-host.ts` denies every request through one, the shared one
+ * included (`planLoginHost` and `zitadelLoginHost` skip both for it).
  */
-export function loginHostnameFor(org, platformAuthHostname = null) {
+export function loginHostnameFor(org) {
     // `issuer.usesDomain` is the issuer's opt-in into the org's domain
     // (`org.ts`'s `IssuerConfig`): a domain alone never moves it, so a domain
     // with `usesDomain` false stays on the tier 1 host.
     if (org.domain && org.issuer.usesDomain) {
-        const host = `auth.${org.domain}`;
-        if (platformAuthHostname && host === platformAuthHostname) {
-            return `${org.slug}-auth.oikos.host`;
-        }
-        return host;
+        return `auth.${org.domain}`;
     }
     return `${org.slug}-auth.oikos.host`;
 }
+/**
+ * Scope id set to `'1'` once an org's recorded login host is the platform's
+ * shared instance host: that host's trusted domain belongs to the shared
+ * instance, so `destroy` must not remove it.
+ */
+export const LOGIN_HOST_SHARED_SCOPE_KEY = 'zitadel_login_host_shared';
 /**
  * Scope id holding what the binding was last written with
  * ({@link loginBindingState}). Client ids are not secrets. The planner

package/dist/plan/plan-apply.d.ts

@@ -335,7 +335,7 @@ export interface FoundryPlanApplyOptions {
     broker?: boolean;
     /**
      * #318: true when the host's executor was built with a `WorkersPort`.
-     * Optional, and false without it: each entry's `edge` Worker is then
+     * Optional, and false without it: each entry's `worker` Worker is then
      * reported blocked instead of planned.
      */
     edgeWorkers?: boolean;
@@ -347,11 +347,11 @@ export interface FoundryPlanApplyOptions {
     filesOrganisation?: boolean;
     aiOrganisation?: boolean;
     /**
-     * #317: true when the host's executor was built with a `NamesPort`.
-     * Optional, and false without it: each entry's `uses.names` step is then
+     * #317: true when the host's executor was built with a `EdgePort`.
+     * Optional, and false without it: each entry's `uses.edge` step is then
      * reported blocked instead of planned to fail.
      */
-    names?: boolean;
+    edge?: boolean;
     /** Overridable for tests; defaults to `() => new Date()`. */
     now?: () => Date;
     /** #441: how long a mutation lease lasts before another caller may take it over. Defaults to 30 minutes. */
@@ -431,7 +431,7 @@ export declare class FoundryPlanApply implements PlanApply {
     private readonly edgeWorkers;
     private readonly hostFiles;
     private readonly hostAi;
-    private readonly hostNames;
+    private readonly hostEdge;
     private readonly now;
     private readonly leaseTtlMs;
     private readonly appliedVersions;
@@ -580,6 +580,7 @@ export declare class FoundryPlanApply implements PlanApply {
      * which only the plan can read.
      */
     private invalidHosting;
+    private platformServiceHostnames;
     /**
      * #177: an org's plan reads the shared platform's own addresses and
      * readiness through the very `platform` deps `planPlatform`/`applyPlatform`

package/dist/plan/plan-apply.js

@@ -7,15 +7,15 @@ import { StaleLeaseError, } from '../store.js';
 import { AdoptRefusedError, adoptCandidates, adoptedKeysUnreadable, adoptedScopeKey, parseAdoptSnapshot, planAdoptFrom, } from './adopt.js';
 import { NO_AGORA_HOST_VALUES, readAgoraHost, } from './agora.js';
 import { AI_KEY_UNDELIVERED_SCOPE_KEY, JOBS_REGISTRATION_UNDELIVERED_SCOPE_KEY, computePlanDetail, toPlan, } from './diff.js';
-import { edgeWorkerTraceScopeKeys, liveEdgeWorkers } from './edge-worker.js';
 import { entryAiUndeliveredScopeKey } from './entry-ai-key.js';
+import { entryEdgeRetiredScopeKey, entryEdgeUndeliveredScopeKey } from './entry-edge-key.js';
 import { FILES_ROOT_UNDELIVERED_SCOPE_KEY, entryFilesUndeliveredScopeKey, } from './entry-files-key.js';
-import { entryNamesRetiredScopeKey, entryNamesUndeliveredScopeKey } from './entry-names-key.js';
 import { readLivePlatformResources, readLiveResources, } from './live.js';
 import { lockedHostnames } from './locked-hostnames.js';
 import { PLATFORM_ARCHON_KEY, PLATFORM_FILES_APPLIED_HOSTNAME_SCOPE_KEY, PLATFORM_FILES_KEY, appStepKey, planPlatform as computePlatformPlanDetail, toPlatformPlan, } from './platform-diff.js';
 import { DEFAULT_ORG_PLATFORM_READINESS, ORG_PLATFORM_KEY_REFS, agoraHostValuesFromPlatform, heldPlatformKeyRefs, orgPlatformReadinessFrom, } from './platform-org.js';
 import { PLATFORM_AUTH_BROKER_MAIL_KEY_REF } from './platform-providers.js';
+import { liveWorkers, workerTraceScopeKeys } from './worker.js';
 /** #441: the lease scope that serializes every mutation of one company, and the one for the shared platform. */
 const companyScope = (orgId) => `company:${orgId}`;
 const PLATFORM_SCOPE = 'platform';
@@ -100,7 +100,7 @@ const HOSTNAME_STEPS = new Set([
     'cloudflare:access',
     'jobs:registration',
     // #318 (F8): the route is itself hostname-shaped, validated against the
-    // org's own domain by `validateEntryEdge`.
+    // org's own domain by `validateEntryWorker`.
     'cloudflare:worker',
 ]);
 /**
@@ -124,7 +124,7 @@ export class FoundryPlanApply {
     edgeWorkers;
     hostFiles;
     hostAi;
-    hostNames;
+    hostEdge;
     now;
     leaseTtlMs;
     appliedVersions;
@@ -145,7 +145,7 @@ export class FoundryPlanApply {
         this.edgeWorkers = options.edgeWorkers ?? false;
         this.hostFiles = options.filesOrganisation ?? false;
         this.hostAi = options.aiOrganisation ?? false;
-        this.hostNames = options.names ?? false;
+        this.hostEdge = options.edge ?? false;
         this.now = options.now ?? (() => new Date());
         this.leaseTtlMs = options.leaseTtlMs ?? DEFAULT_LEASE_TTL_MS;
         this.appliedVersions = options.appliedVersions;
@@ -543,7 +543,7 @@ export class FoundryPlanApply {
                             // #318: its partial-deploy traces too, or a retry after a later
                             // step fails would read this Worker as live again.
                             const entryKey = target.key.slice(id.length + 1);
-                            for (const scopeKey of edgeWorkerTraceScopeKeys(entryKey)) {
+                            for (const scopeKey of workerTraceScopeKeys(entryKey)) {
                                 delete serviceIds[scopeKey];
                             }
                         }
@@ -869,6 +869,7 @@ export class FoundryPlanApply {
             this.orgArchonUrl(),
         ]);
         const otherSlugs = (await this.store.list()).filter((o) => o.id !== id).map((o) => o.slug);
+        const platformHostnames = await this.platformServiceHostnames();
         const detail = computePlanDetail(org, live, applied?.serviceIds ?? {}, agoraHost, this.jobsScheduler, platformReadiness, {
             loginHostBindings: this.loginHostBindings,
             broker: this.broker,
@@ -876,6 +877,7 @@ export class FoundryPlanApply {
             otherSlugs,
             now: () => this.now().getTime(),
             archonUrl,
+            platformHostnames,
         });
         const invalid = await this.invalidHosting(org);
         if (invalid) {
@@ -895,15 +897,15 @@ export class FoundryPlanApply {
      * which only the plan can read.
      */
     async invalidHosting(org) {
-        const platform = await this.platformDeps?.store.get();
-        const platformHostnames = platform
-            ? PLATFORM_SERVICE_KEYS.map((k) => platform[k].hostname)
-            : [];
         return validateHosting(org.hosting, {
             domain: org.domain,
-            locked: lockedHostnames(org, platformHostnames),
+            locked: lockedHostnames(org, await this.platformServiceHostnames()),
         });
     }
+    async platformServiceHostnames() {
+        const platform = await this.platformDeps?.store.get();
+        return platform ? PLATFORM_SERVICE_KEYS.map((k) => platform[k].hostname) : [];
+    }
     /**
      * #177: an org's plan reads the shared platform's own addresses and
      * readiness through the very `platform` deps `planPlatform`/`applyPlatform`
@@ -927,7 +929,7 @@ export class FoundryPlanApply {
             refs.add(ORG_PLATFORM_KEY_REFS.ai);
         if (this.jobsScheduler)
             refs.add(ORG_PLATFORM_KEY_REFS.jobs);
-        const readiness = orgPlatformReadinessFrom(platform, recorded, refs, !heldKeys, this.hostNames);
+        const readiness = orgPlatformReadinessFrom(platform, recorded, refs, !heldKeys, this.hostEdge);
         // Entry env from the platform's mail key or a shared secret (#T8).
         let mailKeyHeld = false;
         try {
@@ -1138,7 +1140,7 @@ function destroyTargets(serviceIds, orgId) {
         'zitadel:login-host:',
         'cloudflare:tunnel:',
         'cloudflare:access:',
-        // #318: an entry's edge Worker and its route.
+        // #318: an entry's Worker and its route.
         'cloudflare:worker:',
         'coolify:database:',
         'coolify:app:',
@@ -1147,18 +1149,18 @@ function destroyTargets(serviceIds, orgId) {
         'ai:key:',
         // F6b: an entry's files key, `<orgId>:<entry>`; the org's own key has no `:` and is left alone.
         'files:key:',
-        // F7 (#317): an entry's names key, `<orgId>:<entry>` -- names has no org-root key.
-        'names:key:',
+        // F7 (#317): an entry's edge key, `<orgId>:<entry>` -- edge has no org-root key.
+        'edge:key:',
     ];
     const targets = [];
     const adopted = adoptedResourceIds(serviceIds);
     for (const prefix of ORDERED_PREFIXES) {
         if (prefix === 'cloudflare:worker:') {
-            // #318 re-review: not the main ids alone -- `liveEdgeWorkers` also
+            // #318 re-review: not the main ids alone -- `liveWorkers` also
             // finds an upload-only or route-only partial deploy, and leaves out an
             // entry whose Worker is already retired (nothing live, so a host with
             // no WorkersPort is not blocked from destroying the org by it).
-            for (const [entryKey, scriptName] of liveEdgeWorkers(orgId, serviceIds)) {
+            for (const [entryKey, scriptName] of liveWorkers(orgId, serviceIds)) {
                 targets.push({
                     system: 'cloudflare',
                     kind: 'worker',
@@ -1181,16 +1183,16 @@ function destroyTargets(serviceIds, orgId) {
             // A key a retire step already revoked before org destroy ever ran
             // (#317 review): `runSteps` never clears this main id on a step that
             // returns no resourceId, so without this check destroy would target
-            // an already-revoked key and get stuck on names' 404 forever.
-            if (prefix === 'names:key:') {
+            // an already-revoked key and get stuck on edge' 404 forever.
+            if (prefix === 'edge:key:') {
                 // `resourceKey.slice(prefix.length)` is `<orgId>:<entryKey>`, but
-                // `entryNamesRetiredScopeKey` takes the bare entry key alone (as
-                // every caller in entry-names-key.ts/executor.ts gives it) --
+                // `entryEdgeRetiredScopeKey` takes the bare entry key alone (as
+                // every caller in entry-edge-key.ts/executor.ts gives it) --
                 // entry keys hold no `:` of their own, so the first one found is
                 // exactly the org id/entry key boundary.
                 const fullKey = resourceKey.slice(prefix.length);
                 const entryKey = fullKey.slice(fullKey.indexOf(':') + 1);
-                if (serviceIds[entryNamesRetiredScopeKey(entryKey)] === id)
+                if (serviceIds[entryEdgeRetiredScopeKey(entryKey)] === id)
                     continue;
             }
             const [system, kind] = prefix.split(':');
@@ -1198,7 +1200,7 @@ function destroyTargets(serviceIds, orgId) {
         }
     }
     // F7 (#317): a key minted but never delivered never gets the main
-    // `names:key:<org>:<entry>` id recorded (the mint step throws before
+    // `edge:key:<org>:<entry>` id recorded (the mint step throws before
     // `runSteps` sees a `resourceId`), so the loop above never finds it to
     // revoke on destroy. Skipped if a later mint already succeeded and holds
     // its own, still-live main id -- entry keys hold no `:`, so matching the
@@ -1207,19 +1209,19 @@ function destroyTargets(serviceIds, orgId) {
     // marker A); re-declare, mint B, fail delivery three times (undelivered
     // B, main id stays A). Without this check, A's stale-but-truthy main id
     // hid B from destroy, leaking it the same way the gone-scan in
-    // `entry-names-key.ts` once did (#317 re-review).
-    const undeliveredNamesPrefix = 'names_key_undelivered_';
+    // `entry-edge-key.ts` once did (#317 re-review).
+    const undeliveredEdgePrefix = 'edge_key_undelivered_';
     for (const [resourceKey, id] of Object.entries(serviceIds)) {
-        if (!id || !resourceKey.startsWith(undeliveredNamesPrefix))
+        if (!id || !resourceKey.startsWith(undeliveredEdgePrefix))
             continue;
-        const entryKey = resourceKey.slice(undeliveredNamesPrefix.length);
+        const entryKey = resourceKey.slice(undeliveredEdgePrefix.length);
         const hasLaterMainId = Object.entries(serviceIds).some(([k, v]) => v &&
-            k.startsWith('names:key:') &&
+            k.startsWith('edge:key:') &&
             k.endsWith(`:${entryKey}`) &&
-            serviceIds[entryNamesRetiredScopeKey(entryKey)] !== v);
+            serviceIds[entryEdgeRetiredScopeKey(entryKey)] !== v);
         if (hasLaterMainId)
             continue;
-        targets.push({ system: 'names', kind: 'key', key: entryKey, id });
+        targets.push({ system: 'edge', kind: 'key', key: entryKey, id });
     }
     for (const [resourceKey, id] of Object.entries(serviceIds)) {
         if (!resourceKey.startsWith('zitadel:app:'))
@@ -1302,7 +1304,7 @@ const STEP_FIELDS = {
     'cloudflare:zone': 'hosting.usesDomain',
     'cloudflare:access': 'hosting.accessEmails',
     'cloudflare:ratelimit': 'hosting.usesDomain',
-    'cloudflare:worker': 'hosting.entries.edge',
+    'cloudflare:worker': 'hosting.entries.worker',
 };
 function stepField(action) {
     // An entry's ai key (F6a) is keyed `<orgId>:<entry>`; the org's own is `<orgId>`.
@@ -1312,9 +1314,9 @@ function stepField(action) {
     // The org's own files key (F6b) is keyed `<orgId>`, an entry's `<orgId>:<entry>`.
     if (action.system === 'files' && action.kind === 'key')
         return 'hosting.entries.uses.files';
-    // An entry's names key (F7): always `<orgId>:<entry>`, names has no org-root key.
-    if (action.system === 'names' && action.kind === 'key')
-        return 'hosting.entries.uses.names';
+    // An entry's edge key (F7): always `<orgId>:<entry>`, edge has no org-root key.
+    if (action.system === 'edge' && action.kind === 'key')
+        return 'hosting.entries.uses.edge';
     // An org declares several issuer apps, each keyed by its name (#71).
     if (action.system === 'zitadel' && action.kind === 'app') {
         return `hosting.issuerApps.${action.key}`;
@@ -1363,15 +1365,15 @@ function failedFields(org, detail, completed, serviceIds) {
             }
         }
     }
-    // The same for an entry's names key (F7): minted, never delivered is no
+    // The same for an entry's edge key (F7): minted, never delivered is no
     // longer blocked forever on its own (the next apply revokes it and
     // mints again, #317 re-review) -- but while that retry step is itself
-    // not planned this run (no names service wired, say), the leftover
+    // not planned this run (no edge service wired, say), the leftover
     // undelivered id must still read as unresolved rather than the org
     // converging silently around it.
     for (const entry of org.hosting.entries) {
-        if (entry.uses?.names && serviceIds[entryNamesUndeliveredScopeKey(entry.key)]) {
-            failed.add('hosting.entries.uses.names');
+        if (entry.uses?.edge && serviceIds[entryEdgeUndeliveredScopeKey(entry.key)]) {
+            failed.add('hosting.entries.uses.edge');
         }
     }
     // The same for a jobs registration whose credentials never reached the host.

package/dist/plan/platform-diff.d.ts

@@ -622,32 +622,32 @@ export declare const PLATFORM_FILES_MANAGEMENT_UNDELIVERED_SCOPE_KEY = "files_ma
 export declare const PLATFORM_FILES_APPLIED_HOSTNAME_SCOPE_KEY = "files_applied_hostname";
 export declare const PLATFORM_FILES_APPLIED_GIT_REF_SCOPE_KEY = "files_applied_git_ref";
 /**
- * #478: the resource key `planNames` plans under and
+ * #478: the resource key `planEdge` plans under and
  * `FoundryPlatformStepExecutor` dispatches on -- the {@link PLATFORM_FILES_KEY}
- * shape for the names host (https://github.com/wtfalch/names). `runPlatformSteps`
- * records the app's uuid under `coolify:app:platform:names` once the step
- * succeeds, which is what stops `planNames` planning it again.
+ * shape for the edge host (https://github.com/wtfalch/edge). `runPlatformSteps`
+ * records the app's uuid under `coolify:app:platform:edge` once the step
+ * succeeds, which is what stops `planEdge` planning it again.
  */
-export declare const PLATFORM_NAMES_KEY = "platform:names";
+export declare const PLATFORM_EDGE_KEY = "platform:edge";
 /**
- * #478: the held-key ref the names platform secret's full value is
+ * #478: the held-key ref the edge platform secret's full value is
  * delivered under, once, by {@link FoundryStepExecutorPorts.deliverSecret} --
  * never the host's app env, which gets only its SHA-256 hash
- * (`NAMES_PLATFORM_KEY_HASH`). Archon's own `NamesPort` reads the full
- * secret back from this ref to call names' `mintKey`/`revokeKey`/
+ * (`EDGE_PLATFORM_KEY_HASH`). Archon's own `EdgePort` reads the full
+ * secret back from this ref to call edge' `mintKey`/`revokeKey`/
  * `setReservedLabels`.
  */
-export declare const PLATFORM_NAMES_KEY_REF = "names:platform:key";
+export declare const PLATFORM_EDGE_KEY_REF = "edge:platform:key";
 /**
- * #478: the held-key ref for names' own Cloudflare API token (tunnel edit +
+ * #478: the held-key ref for edge' own Cloudflare API token (tunnel edit +
  * DNS edit on one account) -- the issue's own "never Archon's token": this
- * is a narrower, names-only credential a human provisions and holds
- * separately from whatever broader token `PlatformNamesDeps.cloudflare`
+ * is a narrower, edge-only credential a human provisions and holds
+ * separately from whatever broader token `PlatformEdgeDeps.cloudflare`
  * uses to stand the host itself up on Coolify.
  */
-export declare const PLATFORM_NAMES_CLOUDFLARE_TOKEN_REF = "cloudflare:names:apiToken";
+export declare const PLATFORM_EDGE_CLOUDFLARE_TOKEN_REF = "cloudflare:edge:apiToken";
 /**
- * #478: scope keys (colon-free) for the names platform key, the
+ * #478: scope keys (colon-free) for the edge platform key, the
  * {@link PLATFORM_FILES_MANAGEMENT_UNDELIVERED_SCOPE_KEY} pattern once:
  * the undelivered id is recorded and persisted the moment the secret is
  * minted, before delivery; the guard is recorded only once it was delivered
@@ -655,16 +655,16 @@ export declare const PLATFORM_NAMES_CLOUDFLARE_TOKEN_REF = "cloudflare:names:api
  * means the secret is lost (never kept past that point): the planner
  * reports it and never mints again. Neither key holds the secret itself.
  */
-export declare const PLATFORM_NAMES_PLATFORM_KEY_UNDELIVERED_SCOPE_KEY = "names_platform_key_undelivered";
-export declare const PLATFORM_NAMES_PLATFORM_KEY_SET_SCOPE_KEY = "names_platform_key_set";
+export declare const PLATFORM_EDGE_PLATFORM_KEY_UNDELIVERED_SCOPE_KEY = "edge_platform_key_undelivered";
+export declare const PLATFORM_EDGE_PLATFORM_KEY_SET_SCOPE_KEY = "edge_platform_key_set";
 /**
  * #478: the hostname and `gitRef` the last successful names run applied.
- * `planNames` plans the step again when either differs from the declared
+ * `planEdge` plans the step again when either differs from the declared
  * value; a re-run updates `git_branch` and the runner env and redeploys,
  * and mints no new platform key (the guards above hold).
  */
-export declare const PLATFORM_NAMES_APPLIED_HOSTNAME_SCOPE_KEY = "names_applied_hostname";
-export declare const PLATFORM_NAMES_APPLIED_GIT_REF_SCOPE_KEY = "names_applied_git_ref";
+export declare const PLATFORM_EDGE_APPLIED_HOSTNAME_SCOPE_KEY = "edge_applied_hostname";
+export declare const PLATFORM_EDGE_APPLIED_GIT_REF_SCOPE_KEY = "edge_applied_git_ref";
 /**
  * Options for {@link planPlatform}, replacing four positional arguments that
  * shifted on every merge that added a platform service (#186, #187, #188) --
@@ -703,8 +703,8 @@ export interface PlanPlatformOptions {
         ai?: string;
         archon?: string;
         mail?: string;
-        /** #478: why the names host is blocked, or absent when it is not. */
-        names?: string;
+        /** #478: why the edge host is blocked, or absent when it is not. */
+        edge?: string;
         /**
          * #257: true once a service's database exists but the host built the
          * platform executor with no backup dependencies -- every such service's
@@ -756,7 +756,7 @@ export interface PlanPlatformOptions {
  * Scope for #167: the frame plus one step, {@link planApexZone}. #173 adds
  * {@link planJobs}, #170 adds {@link planSfu}, #168 adds {@link planAuth},
  * #169 adds {@link planMail}, #174 adds {@link planIntegrations}, #171 adds
- * {@link planFiles}, #172 adds {@link planAi}, #478 adds {@link planNames}
+ * {@link planFiles}, #172 adds {@link planAi}, #478 adds {@link planEdge}
  * and #175 adds
  * {@link planArchon}, the same way #19 shipped org plan/apply against
  * three singletons before #27, #71, #80 and the rest added the remaining