@wtfalch/foundry 0.17.1 → 0.19.0

package/dist/plan/platform-providers.js

@@ -7,7 +7,7 @@ import { ensureCloudflaredConnector } from './cloudflared-connector.js';
 import { waitForDeploymentFinished, waitForHealthyVersion, waitForNewDeployment, } from './deploy-health.js';
 import { ACCESS_POLICY_NAME, getDatabaseStarted, isNotFoundError, isRunningOrStarting, } from './executor.js';
 import { coolifyDomains, filesShareHostname } from './hostnames.js';
-import { AUTH_ZITADEL_RUN_OPTIONS, JOBS_SCHEDULER_KEY, PLATFORM_AI_APPLIED_GITREF_SCOPE_KEY, PLATFORM_AI_APPLIED_HOSTNAME_SCOPE_KEY, PLATFORM_AI_DEPLOY_PENDING_SCOPE_KEY, PLATFORM_AI_INTERNAL_URL_SCOPE_KEY, PLATFORM_AI_KEY, PLATFORM_AI_MANAGEMENT_KEY_CONFLICT_SCOPE_KEY, PLATFORM_AI_MANAGEMENT_KEY_SCOPE_KEY, PLATFORM_AI_MANAGEMENT_KEY_UNDELIVERED_SCOPE_KEY, PLATFORM_AI_MIGRATE_BLOCKED_SCOPE_KEY, PLATFORM_AI_ORGANISATION_SCOPE_KEY, PLATFORM_AI_SIGNING_KEY_SET_SCOPE_KEY, PLATFORM_AI_SIGNING_KEY_UNDELIVERED_SCOPE_KEY, PLATFORM_ARCHON_APPLIED_BROKER_SCOPE_KEY, PLATFORM_ARCHON_APPLIED_GIT_REF_SCOPE_KEY, PLATFORM_ARCHON_APPLIED_HOSTNAME_SCOPE_KEY, PLATFORM_ARCHON_APPLIED_OPERATOR_SCOPE_KEY, PLATFORM_ARCHON_APPLIED_ROLLING_UPDATE_SCOPE_KEY, PLATFORM_ARCHON_CONNECTOR_APP_SCOPE_KEY, PLATFORM_ARCHON_COOLIFY_READ_TOKEN_REF, PLATFORM_ARCHON_ENVS_DEPLOYED_SCOPE_KEY, PLATFORM_ARCHON_GATE_CLOSED_SCOPE_KEY, PLATFORM_ARCHON_INTEGRATIONS_KEY_SYNCED_SCOPE_KEY, PLATFORM_ARCHON_KEY, PLATFORM_ARCHON_MASTER_CLOUDFLARE_TOKEN_REF, PLATFORM_ARCHON_MASTER_COOLIFY_TOKEN_REF, PLATFORM_ARCHON_MASTER_COOLIFY_URL_REF, PLATFORM_AUTH_ADMIN_UNDELIVERED_SCOPE_KEY, PLATFORM_AUTH_ADMIN_USER_SCOPE_KEY, PLATFORM_AUTH_BROKER_DEPLOYED_SCOPE_KEY, PLATFORM_AUTH_BROKER_SCOPE_KEY, PLATFORM_AUTH_CONNECTOR_APP_SCOPE_KEY, PLATFORM_AUTH_INSTANCE_SCOPE_KEY, PLATFORM_AUTH_INSTANCE_UNDELIVERED_SCOPE_KEY, PLATFORM_AUTH_KEY, PLATFORM_AUTH_LOGIN_CLIENT_UNDELIVERED_SCOPE_KEY, PLATFORM_AUTH_LOGIN_CLIENT_USER_SCOPE_KEY, PLATFORM_AUTH_OWNER_INVITE_SCOPE_KEY, PLATFORM_AUTH_SMTP_SCOPE_KEY, PLATFORM_AUTH_ZITADEL_APPLIED_IMAGE_TAG_SCOPE_KEY, PLATFORM_AUTH_ZITADEL_RUN_OPTIONS_SCOPE_KEY, PLATFORM_BACKUP_DATABASE_SCOPE_KEYS, PLATFORM_BACKUP_SERVICE_KEYS, PLATFORM_FILES_APPLIED_GIT_REF_SCOPE_KEY, PLATFORM_FILES_APPLIED_HOSTNAME_SCOPE_KEY, PLATFORM_FILES_INTERNAL_URL_SCOPE_KEY, PLATFORM_FILES_INTROSPECTION_SCOPE_KEY, PLATFORM_FILES_INTROSPECTION_UNDELIVERED_SCOPE_KEY, PLATFORM_FILES_KEY, PLATFORM_FILES_MANAGEMENT_KEY_SCOPE_KEY, PLATFORM_FILES_MANAGEMENT_UNDELIVERED_SCOPE_KEY, PLATFORM_FILES_ZITADEL_PROJECT_SCOPE_KEY, PLATFORM_INTEGRATIONS_APPLIED_GITREF_SCOPE_KEY, PLATFORM_INTEGRATIONS_APPLIED_HOSTNAME_SCOPE_KEY, PLATFORM_INTEGRATIONS_KEY, PLATFORM_INTEGRATIONS_KEY_ID_SCOPE_KEY, PLATFORM_INTEGRATIONS_KEY_ROTATION_PREVIOUS_SCOPE_KEY, PLATFORM_INTEGRATIONS_KEY_ROTATION_REQUESTED_SCOPE_KEY, PLATFORM_INTEGRATIONS_KEY_ROTATION_UNDELIVERED_SCOPE_KEY, PLATFORM_INTEGRATIONS_KEY_SET_SCOPE_KEY, PLATFORM_INTEGRATIONS_KEY_UNDELIVERED_SCOPE_KEY, PLATFORM_INTEGRATIONS_RUNNER_KEYRING_DEPLOYED_SCOPE_KEY, PLATFORM_MAIL_ADMIN_KEY_SCOPE_KEY, PLATFORM_MAIL_ADMIN_UNDELIVERED_SCOPE_KEY, PLATFORM_MAIL_APPLIED_GIT_REF_SCOPE_KEY, PLATFORM_MAIL_APPLIED_HOSTNAME_SCOPE_KEY, PLATFORM_MAIL_CONNECTOR_APP_SCOPE_KEY, PLATFORM_MAIL_INTERNAL_URL_SCOPE_KEY, PLATFORM_MAIL_KEY, PLATFORM_MAIL_ZITADEL_PROJECT_SCOPE_KEY, PLATFORM_NAMES_APPLIED_GIT_REF_SCOPE_KEY, PLATFORM_NAMES_APPLIED_HOSTNAME_SCOPE_KEY, PLATFORM_NAMES_CLOUDFLARE_TOKEN_REF, PLATFORM_NAMES_KEY, PLATFORM_NAMES_KEY_REF, PLATFORM_NAMES_PLATFORM_KEY_SET_SCOPE_KEY, PLATFORM_NAMES_PLATFORM_KEY_UNDELIVERED_SCOPE_KEY, archonBootstrapOperator, parseBrokerDeployRecord, parseLoginClientRecord, platformMailMxHost, } from './platform-diff.js';
+import { AUTH_ZITADEL_RUN_OPTIONS, JOBS_SCHEDULER_KEY, PLATFORM_AI_APPLIED_GITREF_SCOPE_KEY, PLATFORM_AI_APPLIED_HOSTNAME_SCOPE_KEY, PLATFORM_AI_DEPLOY_PENDING_SCOPE_KEY, PLATFORM_AI_INTERNAL_URL_SCOPE_KEY, PLATFORM_AI_KEY, PLATFORM_AI_MANAGEMENT_KEY_CONFLICT_SCOPE_KEY, PLATFORM_AI_MANAGEMENT_KEY_SCOPE_KEY, PLATFORM_AI_MANAGEMENT_KEY_UNDELIVERED_SCOPE_KEY, PLATFORM_AI_MIGRATE_BLOCKED_SCOPE_KEY, PLATFORM_AI_ORGANISATION_SCOPE_KEY, PLATFORM_AI_SIGNING_KEY_SET_SCOPE_KEY, PLATFORM_AI_SIGNING_KEY_UNDELIVERED_SCOPE_KEY, PLATFORM_ARCHON_APPLIED_BROKER_SCOPE_KEY, PLATFORM_ARCHON_APPLIED_GIT_REF_SCOPE_KEY, PLATFORM_ARCHON_APPLIED_HOSTNAME_SCOPE_KEY, PLATFORM_ARCHON_APPLIED_OPERATOR_SCOPE_KEY, PLATFORM_ARCHON_APPLIED_ROLLING_UPDATE_SCOPE_KEY, PLATFORM_ARCHON_CONNECTOR_APP_SCOPE_KEY, PLATFORM_ARCHON_COOLIFY_READ_TOKEN_REF, PLATFORM_ARCHON_ENVS_DEPLOYED_SCOPE_KEY, PLATFORM_ARCHON_GATE_CLOSED_SCOPE_KEY, PLATFORM_ARCHON_INTEGRATIONS_KEY_SYNCED_SCOPE_KEY, PLATFORM_ARCHON_KEY, PLATFORM_ARCHON_MASTER_CLOUDFLARE_TOKEN_REF, PLATFORM_ARCHON_MASTER_COOLIFY_TOKEN_REF, PLATFORM_ARCHON_MASTER_COOLIFY_URL_REF, PLATFORM_AUTH_ADMIN_UNDELIVERED_SCOPE_KEY, PLATFORM_AUTH_ADMIN_USER_SCOPE_KEY, PLATFORM_AUTH_BROKER_DEPLOYED_SCOPE_KEY, PLATFORM_AUTH_BROKER_SCOPE_KEY, PLATFORM_AUTH_CONNECTOR_APP_SCOPE_KEY, PLATFORM_AUTH_INSTANCE_SCOPE_KEY, PLATFORM_AUTH_INSTANCE_UNDELIVERED_SCOPE_KEY, PLATFORM_AUTH_KEY, PLATFORM_AUTH_LOGIN_CLIENT_UNDELIVERED_SCOPE_KEY, PLATFORM_AUTH_LOGIN_CLIENT_USER_SCOPE_KEY, PLATFORM_AUTH_OWNER_INVITE_SCOPE_KEY, PLATFORM_AUTH_SMTP_SCOPE_KEY, PLATFORM_AUTH_ZITADEL_APPLIED_IMAGE_TAG_SCOPE_KEY, PLATFORM_AUTH_ZITADEL_RUN_OPTIONS_SCOPE_KEY, PLATFORM_BACKUP_DATABASE_SCOPE_KEYS, PLATFORM_BACKUP_SERVICE_KEYS, PLATFORM_EDGE_APPLIED_GIT_REF_SCOPE_KEY, PLATFORM_EDGE_APPLIED_HOSTNAME_SCOPE_KEY, PLATFORM_EDGE_CLOUDFLARE_TOKEN_REF, PLATFORM_EDGE_KEY, PLATFORM_EDGE_KEY_REF, PLATFORM_EDGE_PLATFORM_KEY_SET_SCOPE_KEY, PLATFORM_EDGE_PLATFORM_KEY_UNDELIVERED_SCOPE_KEY, PLATFORM_FILES_APPLIED_GIT_REF_SCOPE_KEY, PLATFORM_FILES_APPLIED_HOSTNAME_SCOPE_KEY, PLATFORM_FILES_INTERNAL_URL_SCOPE_KEY, PLATFORM_FILES_INTROSPECTION_SCOPE_KEY, PLATFORM_FILES_INTROSPECTION_UNDELIVERED_SCOPE_KEY, PLATFORM_FILES_KEY, PLATFORM_FILES_MANAGEMENT_KEY_SCOPE_KEY, PLATFORM_FILES_MANAGEMENT_UNDELIVERED_SCOPE_KEY, PLATFORM_FILES_ZITADEL_PROJECT_SCOPE_KEY, PLATFORM_INTEGRATIONS_APPLIED_GITREF_SCOPE_KEY, PLATFORM_INTEGRATIONS_APPLIED_HOSTNAME_SCOPE_KEY, PLATFORM_INTEGRATIONS_KEY, PLATFORM_INTEGRATIONS_KEY_ID_SCOPE_KEY, PLATFORM_INTEGRATIONS_KEY_ROTATION_PREVIOUS_SCOPE_KEY, PLATFORM_INTEGRATIONS_KEY_ROTATION_REQUESTED_SCOPE_KEY, PLATFORM_INTEGRATIONS_KEY_ROTATION_UNDELIVERED_SCOPE_KEY, PLATFORM_INTEGRATIONS_KEY_SET_SCOPE_KEY, PLATFORM_INTEGRATIONS_KEY_UNDELIVERED_SCOPE_KEY, PLATFORM_INTEGRATIONS_RUNNER_KEYRING_DEPLOYED_SCOPE_KEY, PLATFORM_MAIL_ADMIN_KEY_SCOPE_KEY, PLATFORM_MAIL_ADMIN_UNDELIVERED_SCOPE_KEY, PLATFORM_MAIL_APPLIED_GIT_REF_SCOPE_KEY, PLATFORM_MAIL_APPLIED_HOSTNAME_SCOPE_KEY, PLATFORM_MAIL_CONNECTOR_APP_SCOPE_KEY, PLATFORM_MAIL_INTERNAL_URL_SCOPE_KEY, PLATFORM_MAIL_KEY, PLATFORM_MAIL_ZITADEL_PROJECT_SCOPE_KEY, archonBootstrapOperator, parseBrokerDeployRecord, parseLoginClientRecord, platformMailMxHost, } from './platform-diff.js';
 import { applyCallsSfuPlatformStep } from './platform-sfu.js';
 import { CreateInstanceError, createZitadelInstance, generateSystemApiKeypair, instanceWithoutBearerMessage, systemApiUsersEnv, } from './zitadel-system-api.js';
 /** The key `runPlatformSteps` records the apex zone's id under (`system:kind:key`). */
@@ -94,8 +94,8 @@ const JOBS_SCHEDULER_REPO = 'wtfalch/jobs';
  * #172 adds `coolify:app` keyed {@link PLATFORM_AI_KEY}, the platform's AI
  * host ({@link provisionPlatformAi}), once a host passes {@link PlatformAiDeps}.
  *
- * #478 adds `coolify:app` keyed {@link PLATFORM_NAMES_KEY}, the names host
- * ({@link provisionPlatformNames}), once a host passes {@link PlatformNamesDeps}.
+ * #478 adds `coolify:app` keyed {@link PLATFORM_EDGE_KEY}, the edge host
+ * ({@link provisionPlatformEdge}), once a host passes {@link PlatformEdgeDeps}.
  *
  * #175 adds `coolify:app` keyed {@link PLATFORM_ARCHON_KEY}, Archon itself
  * ({@link provisionPlatformArchon}), once a host passes
@@ -116,7 +116,7 @@ export class FoundryPlatformStepExecutor {
     integrations;
     files;
     ai;
-    names;
+    edge;
     archon;
     backup;
     constructor(cloudflare, declaredOrgStore, options = {}) {
@@ -130,7 +130,7 @@ export class FoundryPlatformStepExecutor {
         this.integrations = options.integrations;
         this.files = options.files;
         this.ai = options.ai;
-        this.names = options.names;
+        this.edge = options.edge;
         this.archon = options.archon;
         this.backup = options.backup;
     }
@@ -217,14 +217,14 @@ export class FoundryPlatformStepExecutor {
             blocked.ai =
                 "the platform's AI host is blocked, not planned: its signing key is already pinned but the host built the platform executor without a held-key reader to read back its private half (PlatformAiDeps.heldKeys)";
         }
-        if (platform.names.enabled && !this.names) {
-            blocked.names =
-                'the names host is blocked, not planned: the host built the platform executor without its names dependencies';
+        if (platform.edge.enabled && !this.edge) {
+            blocked.edge =
+                'the edge host is blocked, not planned: the host built the platform executor without its edge dependencies';
         }
-        else if (platform.names.enabled && this.names) {
-            const namesBlocked = await namesBlockedReason(this.names);
-            if (namesBlocked)
-                blocked.names = namesBlocked;
+        else if (platform.edge.enabled && this.edge) {
+            const edgeBlocked = await edgeBlockedReason(this.edge);
+            if (edgeBlocked)
+                blocked.edge = edgeBlocked;
         }
         if (platform.archon.enabled) {
             if (!this.archon) {
@@ -375,11 +375,11 @@ export class FoundryPlatformStepExecutor {
             }
             return provisionPlatformAi(context, this.ai);
         }
-        if (action.system === 'coolify' && action.kind === 'app' && action.key === PLATFORM_NAMES_KEY) {
-            if (!this.names) {
-                throw new Error('platform:names needs FoundryPlatformStepExecutor to be constructed with its names dependencies (#478)');
+        if (action.system === 'coolify' && action.kind === 'app' && action.key === PLATFORM_EDGE_KEY) {
+            if (!this.edge) {
+                throw new Error('platform:edge needs FoundryPlatformStepExecutor to be constructed with its edge dependencies (#478)');
             }
-            return provisionPlatformNames(context, this.names);
+            return provisionPlatformEdge(context, this.edge);
         }
         if (action.system === 'coolify' &&
             action.kind === 'app' &&
@@ -2330,11 +2330,14 @@ const PLATFORM_ARCHON_PROJECT = 'platform';
 const PLATFORM_ARCHON_APP_NAME = 'platform-archon';
 const PLATFORM_ARCHON_DB_NAME = 'platform-archon-db';
 /**
- * The database Coolify creates for Archon. Archon's own
- * `drizzle/0001_runtime_role.sql` names its runtime role
- * `current_database() || '_rt'`, so {@link ARCHON_RUNTIME_ROLE} follows.
+ * The database Archon runs on. Live platform-archon moved to `archon_v2` on
+ * the same server (2026-10-02, the move onto `@wtfalch/db`), while its Coolify
+ * resource still names `archon` as its first database. So both URLs built
+ * here set this database themselves, never `internal_db_url`'s path.
+ * Archon's own migrations grant to `current_database() || '_rt'`, so
+ * {@link ARCHON_RUNTIME_ROLE} follows.
  */
-const ARCHON_POSTGRES_DB = 'archon';
+const ARCHON_POSTGRES_DB = 'archon_v2';
 const ARCHON_RUNTIME_ROLE = `${ARCHON_POSTGRES_DB}_rt`;
 /** Fixed so the tunnel addresses the container directly (see `provisionPlatformAuth`). */
 const PLATFORM_ARCHON_INTERNAL_NAME = 'platform-archon';
@@ -2668,11 +2671,12 @@ async function provisionPlatformArchon(context, deps) {
     // The owner URL must name the adopted database's host, or the app's two
     // database URLs would point at different databases.
     const liveOwnerUrl = await currentEnvValue(deps.coolify, appId, 'DATABASE_URL_OWNER');
+    const ownerUrl = archonDatabaseUrl(db.internal_db_url);
     if (liveOwnerUrl) {
         assertSameDatabaseHost('DATABASE_URL_OWNER', liveOwnerUrl, db.internal_db_url);
     }
     else {
-        envs.push({ key: 'DATABASE_URL_OWNER', value: db.internal_db_url });
+        envs.push({ key: 'DATABASE_URL_OWNER', value: ownerUrl });
     }
     const liveReportingSite = await currentEnvValue(deps.coolify, appId, 'REPORTING_SITE');
     if (!liveReportingSite) {
@@ -2692,7 +2696,7 @@ async function provisionPlatformArchon(context, deps) {
     // reflects the env Archon actually ends up running with, not just this
     // run's delta.
     const archonEnvHashOverrides = new Map([
-        ['DATABASE_URL_OWNER', liveOwnerUrl ?? db.internal_db_url],
+        ['DATABASE_URL_OWNER', liveOwnerUrl ?? ownerUrl],
         ['REPORTING_SITE', liveReportingSite ?? 'archon'],
     ]);
     const effectiveCookieSecret = cookieSecret ?? (await currentEnvValue(deps.coolify, appId, 'AUTH_COOKIE_SECRET'));
@@ -3625,10 +3629,9 @@ async function ensureArchonRuntimeUrl(coolify, appId, dbInternalUrl) {
         return null;
     }
     let host;
-    let pathname;
     let search;
     try {
-        ({ host, pathname, search } = new URL(dbInternalUrl));
+        ({ host, search } = new URL(dbInternalUrl));
     }
     catch {
         // Node's `ERR_INVALID_URL` carries the whole input, credential included, so
@@ -3636,7 +3639,19 @@ async function ensureArchonRuntimeUrl(coolify, appId, dbInternalUrl) {
         throw new Error('platform:archon: the database internal_db_url could not be parsed; not generating DATABASE_URL. Check the database in Coolify and apply again');
     }
     const password = randomBytes(24).toString('base64url');
-    return `postgres://${ARCHON_RUNTIME_ROLE}:${password}@${host}${pathname}${search}`;
+    return `postgres://${ARCHON_RUNTIME_ROLE}:${password}@${host}/${ARCHON_POSTGRES_DB}${search}`;
+}
+/** `internalUrl` on {@link ARCHON_POSTGRES_DB}. The error never carries the URL: it holds a credential. */
+function archonDatabaseUrl(internalUrl) {
+    let url;
+    try {
+        url = new URL(internalUrl);
+    }
+    catch {
+        throw new Error('platform:archon: the database internal_db_url could not be parsed; not generating DATABASE_URL_OWNER. Check the database in Coolify and apply again');
+    }
+    url.pathname = `/${ARCHON_POSTGRES_DB}`;
+    return url.toString();
 }
 /**
  * Thrown by {@link createAiManagementKeyMinter} (never by a test's own
@@ -3720,8 +3735,9 @@ export const PLATFORM_AI_MANAGEMENT_KEY_REF = 'ai:platform:managementKey';
  * What Archon's management key may do in ai: exactly `ai`'s own
  * `ARCHON_AI_PERMISSIONS` (`apps/host/scripts/authz/bootstrap-archon.ts`) --
  * configuration only (offerings, provisioning, offers, budgets, usage, cost)
- * plus deleting (archiving) an organisation, never connections, runs or
- * webhooks. ai's `/v1/platform/keys` route refuses any permission outside
+ * plus deleting (archiving) an organisation and setting another
+ * organisation's webhook address and budget, never connections, runs or
+ * webhook deliveries. ai's `/v1/platform/keys` route refuses any permission outside
  * this same list, so a request for more than this is a 403, not a wider key.
  */
 export const PLATFORM_AI_MANAGEMENT_PERMISSIONS = [
@@ -3732,6 +3748,8 @@ export const PLATFORM_AI_MANAGEMENT_PERMISSIONS = [
     'ai.organisations:provision',
     'ai.organisations:offer',
     'ai.organisations:delete',
+    'ai.organisations:webhook',
+    'ai.organisations:budget',
     'ai.keys:issue',
     'ai.budgets:read',
     'ai.budgets:update',
@@ -5105,74 +5123,74 @@ shareDomains) {
     await record(PLATFORM_FILES_APPLIED_GIT_REF_SCOPE_KEY, gitRef);
     return { resourceId: runnerApp.appId };
 }
-/** https://github.com/wtfalch/names -- root Dockerfile, one `runner` target (see {@link provisionPlatformNames}'s own doc comment for why there is no `migration` target any more). */
-const NAMES_REPO = 'wtfalch/names';
-const PLATFORM_NAMES_PROJECT = 'platform';
-const PLATFORM_NAMES_DB_NAME = 'platform-names-db';
-const NAMES_APP_NAME = 'names';
+/** https://github.com/wtfalch/edge -- root Dockerfile, one `runner` target (see {@link provisionPlatformEdge}'s own doc comment for why there is no `migration` target any more). */
+const EDGE_REPO = 'wtfalch/edge';
+const PLATFORM_EDGE_PROJECT = 'platform';
+const PLATFORM_EDGE_DB_NAME = 'platform-edge-db';
+const EDGE_APP_NAME = 'edge';
 /** The app's fixed `custom_internal_name`, the way `platform:files`' runner names itself. */
-const NAMES_RUNNER_INTERNAL_NAME = 'platform-names';
+const EDGE_RUNNER_INTERNAL_NAME = 'platform-edge';
 /** The runner's port (its Dockerfile: `PORT=3000`, `EXPOSE 3000`). */
-const NAMES_PORT = '3000';
+const EDGE_PORT = '3000';
 /** The Postgres database name, and the owner role's name per the host's own `.env.example`. */
-const NAMES_DB = 'names';
-const NAMES_OWNER_ROLE = 'names_owner';
+const EDGE_DB = 'names';
+const EDGE_OWNER_ROLE = 'names_owner';
 /** The restricted runtime role `migrate.mjs`'s own `ensureRuntimeRole` creates or syncs at every boot. */
-const NAMES_RUNTIME_ROLE = 'names_rt';
-const NAMES_TUNNEL_NAME = 'platform-names-tunnel';
-/** #197: the one Coolify app that runs `cloudflared` for {@link NAMES_TUNNEL_NAME}. */
-const NAMES_CLOUDFLARED_APP_NAME = 'platform-names-cloudflared';
-const PLATFORM_NAMES_PROJECT_SCOPE_KEY = 'coolify_project_platform_names';
-const PLATFORM_NAMES_DB_SCOPE_KEY = 'coolify_platform_names_database';
-const PLATFORM_NAMES_APP_SCOPE_KEY = 'coolify_platform_names_app';
-const PLATFORM_NAMES_TUNNEL_SCOPE_KEY = 'cloudflare_platform_names_tunnel';
-const PLATFORM_NAMES_CONNECTOR_APP_SCOPE_KEY = 'coolify_platform_names_connector_app';
+const EDGE_RUNTIME_ROLE = 'names_rt';
+const EDGE_TUNNEL_NAME = 'platform-edge-tunnel';
+/** #197: the one Coolify app that runs `cloudflared` for {@link EDGE_TUNNEL_NAME}. */
+const EDGE_CLOUDFLARED_APP_NAME = 'platform-edge-cloudflared';
+const PLATFORM_EDGE_PROJECT_SCOPE_KEY = 'coolify_project_platform_edge';
+const PLATFORM_EDGE_DB_SCOPE_KEY = 'coolify_platform_edge_database';
+const PLATFORM_EDGE_APP_SCOPE_KEY = 'coolify_platform_edge_app';
+const PLATFORM_EDGE_TUNNEL_SCOPE_KEY = 'cloudflare_platform_edge_tunnel';
+const PLATFORM_EDGE_CONNECTOR_APP_SCOPE_KEY = 'coolify_platform_edge_connector_app';
 /**
  * Written only when absent, never overwritten -- the `PLATFORM_FILES_RUNNER_DEFAULTS`
  * convention, so an operator's own cap or rate survives every apply. Values
  * are the host's own `.env.example` defaults.
  */
-const PLATFORM_NAMES_RUNNER_DEFAULTS = [
+const PLATFORM_EDGE_RUNNER_DEFAULTS = [
     { key: 'MAX_CLAIMS_PER_ORGANISATION', value: '100' },
-    { key: 'NAMES_RATE_BURST', value: '10' },
-    { key: 'NAMES_RATE_PER_SECOND', value: '0.5' },
+    { key: 'EDGE_RATE_BURST', value: '10' },
+    { key: 'EDGE_RATE_PER_SECOND', value: '0.5' },
 ];
 /**
- * Why `coolify:app` keyed {@link PLATFORM_NAMES_KEY} cannot be planned yet,
- * or `null` when it can -- the host built no names dependencies (checked by
+ * Why `coolify:app` keyed {@link PLATFORM_EDGE_KEY} cannot be planned yet,
+ * or `null` when it can -- the host built no edge dependencies (checked by
  * the caller, `FoundryPlatformStepExecutor.blockedSteps`, before this is
  * even called), no Cloudflare API token held under
- * {@link PLATFORM_NAMES_CLOUDFLARE_TOKEN_REF} (CLAUDE.md's "Human steps"),
+ * {@link PLATFORM_EDGE_CLOUDFLARE_TOKEN_REF} (CLAUDE.md's "Human steps"),
  * or no Cloudflare account id supplied beside it.
  */
-async function namesBlockedReason(names) {
+async function edgeBlockedReason(names) {
     let token;
     try {
-        token = (await names.heldKeys?.resolve(PLATFORM_NAMES_CLOUDFLARE_TOKEN_REF)) ?? null;
+        token = (await names.heldKeys?.resolve(PLATFORM_EDGE_CLOUDFLARE_TOKEN_REF)) ?? null;
     }
     catch {
         token = null;
     }
     if (!token) {
-        return `the names host is blocked, not planned: no Cloudflare API token is held under ${PLATFORM_NAMES_CLOUDFLARE_TOKEN_REF} yet (the names service's own token, tunnel edit + DNS edit, never the platform's) -- a human step`;
+        return `the edge host is blocked, not planned: no Cloudflare API token is held under ${PLATFORM_EDGE_CLOUDFLARE_TOKEN_REF} yet (the edge service's own token, tunnel edit + DNS edit, never the platform's) -- a human step`;
     }
     if (!names.cloudflareAccountId) {
-        return 'the names host is blocked, not planned: the host supplies no Cloudflare account id (PlatformNamesDeps.cloudflareAccountId) for the token above';
+        return 'the edge host is blocked, not planned: the host supplies no Cloudflare account id (PlatformEdgeDeps.cloudflareAccountId) for the token above';
     }
     return null;
 }
 /**
- * #478: makes `coolify:app` keyed {@link PLATFORM_NAMES_KEY} true -- the
- * names host (https://github.com/wtfalch/names), its own database, and
- * foundry's own platform key, reached at `platform.names.hostname` through
+ * #478: makes `coolify:app` keyed {@link PLATFORM_EDGE_KEY} true -- the
+ * edge host (https://github.com/wtfalch/edge), its own database, and
+ * foundry's own platform key, reached at `platform.edge.hostname` through
  * a Cloudflare tunnel and DNS record (the public-service shape
  * {@link provisionPlatformMail}/{@link provisionPlatformAuth} use, not
- * `platform:files`' internal-only one -- `NAMES_URL` has to be reachable by
+ * `platform:files`' internal-only one -- `EDGE_URL` has to be reachable by
  * every org's own app, which runs outside this Coolify network, and by
  * Archon).
  *
  * One Coolify app only, unlike `platform:files`/`platform:ai`'s separate
- * `migrate` app: names' own Dockerfile dropped its `migration` target
+ * `migrate` app: edge' own Dockerfile dropped its `migration` target
  * (its own comment: no generated package's Coolify app ever built or ran
  * that stage, which once shipped `wtfalch/cms` with an empty database and
  * no runtime role). `apps/host/scripts/start.sh` now runs `migrate.mjs`
@@ -5188,27 +5206,27 @@ async function namesBlockedReason(names) {
  * restricted `names_rt` role is never created here -- `migrate.mjs`'s own
  * `ensureRuntimeRole` call creates or syncs it and sets its password from
  * `DATABASE_URL` at every boot, so this function only has to mint that
- * password once and reuse it (`ensureNamesRuntimeUrl`, the
+ * password once and reuse it (`ensureEdgeRuntimeUrl`, the
  * `ensureFilesRuntimeUrl` shape) -- never rotated, since the role's
  * password is set from it on every migration.
  *
  * The platform key follows `platform:files`' management-key discipline
  * (CLAUDE.md rule 1): a random secret is minted once, its id recorded
- * undelivered and persisted before {@link PlatformNamesDeps.deliverSecret}
+ * undelivered and persisted before {@link PlatformEdgeDeps.deliverSecret}
  * is even tried, and the guard recorded only once delivery AND the env
- * write (the SHA-256 hash, as `NAMES_PLATFORM_KEY_HASH`) both succeeded. The
+ * write (the SHA-256 hash, as `EDGE_PLATFORM_KEY_HASH`) both succeeded. The
  * secret itself is never written to the host's own env, logged, returned
  * or put in an error -- only its hash ever reaches names, and the full
- * value goes to {@link PlatformNamesDeps.deliverSecret} under
- * {@link PLATFORM_NAMES_KEY_REF} alone, for Archon's own `NamesPort` to read
- * back later when it mints or revokes an entry's own names key.
+ * value goes to {@link PlatformEdgeDeps.deliverSecret} under
+ * {@link PLATFORM_EDGE_KEY_REF} alone, for Archon's own `EdgePort` to read
+ * back later when it mints or revokes an entry's own edge key.
  *
  * `CLOUDFLARE_API_TOKEN`/`CLOUDFLARE_ACCOUNT_ID` on the runner are never
- * minted here either: they are the names service's own credential (never
- * Archon's), read back from {@link PlatformNamesDeps.heldKeys} under
- * {@link PLATFORM_NAMES_CLOUDFLARE_TOKEN_REF} once a human has put one there
+ * minted here either: they are the edge service's own credential (never
+ * Archon's), read back from {@link PlatformEdgeDeps.heldKeys} under
+ * {@link PLATFORM_EDGE_CLOUDFLARE_TOKEN_REF} once a human has put one there
  * (the issue's own "Human steps") -- `blockedSteps`
- * ({@link namesBlockedReason}) reports the step blocked, not planned, until
+ * ({@link edgeBlockedReason}) reports the step blocked, not planned, until
  * then.
  *
  * Every part is safe to run again after a throw partway, `platform:files`'
@@ -5220,49 +5238,49 @@ async function namesBlockedReason(names) {
  * app redeploys, with no new secret minted.
  *
  * Known gaps, left for review:
- * - `NAMES_MAX_QUEUE_DEPTH` (the host's `.env.example`) is not set; the host
+ * - `EDGE_MAX_QUEUE_DEPTH` (the host's `.env.example`) is not set; the host
  *   falls back to its own default.
- * - `NAMES_TRUST_CF_CONNECTING_IP` is always written `true` rather than
+ * - `EDGE_TRUST_CF_CONNECTING_IP` is always written `true` rather than
  *   left to the host's own default, since this step always puts the
  *   runner behind the Cloudflare tunnel it also creates.
  */
-async function provisionPlatformNames(context, deps) {
+async function provisionPlatformEdge(context, deps) {
     const { platform } = context;
-    const hostname = platform.names.hostname;
-    const gitRef = platform.names.gitRef;
+    const hostname = platform.edge.hostname;
+    const gitRef = platform.edge.gitRef;
     const recorded = context.recordedIds();
     const runtime = deps.runtime ?? {};
     const sleep = runtime.sleep ?? defaultSleep;
     const attempts = runtime.deliverAttempts ?? 3;
-    const cloudflareToken = await deps.heldKeys?.resolve(PLATFORM_NAMES_CLOUDFLARE_TOKEN_REF);
+    const cloudflareToken = await deps.heldKeys?.resolve(PLATFORM_EDGE_CLOUDFLARE_TOKEN_REF);
     if (!cloudflareToken || !deps.cloudflareAccountId) {
-        throw new Error(`platform:names needs the names service's own Cloudflare API token (held under ${PLATFORM_NAMES_CLOUDFLARE_TOKEN_REF}) and account id (PlatformNamesDeps.cloudflareAccountId); names never becomes healthy without them`);
+        throw new Error(`platform:edge needs the edge service's own Cloudflare API token (held under ${PLATFORM_EDGE_CLOUDFLARE_TOKEN_REF}) and account id (PlatformEdgeDeps.cloudflareAccountId); names never becomes healthy without them`);
     }
     // Never plan-and-throw (CLAUDE.md rule 2): the planner reports a lost
     // secret and plans nothing; this is the same rule for a caller that
     // reaches the step anyway.
-    const lostKey = recorded[PLATFORM_NAMES_PLATFORM_KEY_UNDELIVERED_SCOPE_KEY];
-    if (lostKey && !recorded[PLATFORM_NAMES_PLATFORM_KEY_SET_SCOPE_KEY]) {
-        throw new Error(`platform:names: the platform key (${lostKey}) was minted but never delivered; remove the recorded key ${PLATFORM_NAMES_PLATFORM_KEY_UNDELIVERED_SCOPE_KEY} to mint a new one`);
+    const lostKey = recorded[PLATFORM_EDGE_PLATFORM_KEY_UNDELIVERED_SCOPE_KEY];
+    if (lostKey && !recorded[PLATFORM_EDGE_PLATFORM_KEY_SET_SCOPE_KEY]) {
+        throw new Error(`platform:edge: the platform key (${lostKey}) was minted but never delivered; remove the recorded key ${PLATFORM_EDGE_PLATFORM_KEY_UNDELIVERED_SCOPE_KEY} to mint a new one`);
     }
     const record = async (key, id) => {
         context.recordScopeId(key, id);
         await context.persist?.();
     };
-    let projectUuid = recorded[PLATFORM_NAMES_PROJECT_SCOPE_KEY];
+    let projectUuid = recorded[PLATFORM_EDGE_PROJECT_SCOPE_KEY];
     if (!projectUuid) {
-        const found = await deps.coolify.findProjectByName(PLATFORM_NAMES_PROJECT);
+        const found = await deps.coolify.findProjectByName(PLATFORM_EDGE_PROJECT);
         projectUuid = found
             ? found.uuid
-            : (await deps.coolify.createProject(PLATFORM_NAMES_PROJECT)).uuid;
-        await record(PLATFORM_NAMES_PROJECT_SCOPE_KEY, projectUuid);
+            : (await deps.coolify.createProject(PLATFORM_EDGE_PROJECT)).uuid;
+        await record(PLATFORM_EDGE_PROJECT_SCOPE_KEY, projectUuid);
     }
     const { environment } = await deps.coolify.findOrCreateEnvironment(projectUuid, 'production');
     const server = await resolvePlatformServer(deps.coolify);
     // ---- database ----------------------------------------------------------
-    let dbId = recorded[PLATFORM_NAMES_DB_SCOPE_KEY];
+    let dbId = recorded[PLATFORM_EDGE_DB_SCOPE_KEY];
     if (!dbId) {
-        const found = (await deps.coolify.listDatabases()).find((db) => db.name === PLATFORM_NAMES_DB_NAME && db.environment_id === environment.id);
+        const found = (await deps.coolify.listDatabases()).find((db) => db.name === PLATFORM_EDGE_DB_NAME && db.environment_id === environment.id);
         if (found) {
             dbId = found.uuid;
         }
@@ -5272,20 +5290,20 @@ async function provisionPlatformNames(context, deps) {
                 server_uuid: server.uuid,
                 environment_name: environment.name,
                 environment_uuid: environment.uuid,
-                name: PLATFORM_NAMES_DB_NAME,
-                postgres_db: NAMES_DB,
-                postgres_user: NAMES_OWNER_ROLE,
+                name: PLATFORM_EDGE_DB_NAME,
+                postgres_db: EDGE_DB,
+                postgres_user: EDGE_OWNER_ROLE,
             });
             dbId = created.uuid;
         }
-        await record(PLATFORM_NAMES_DB_SCOPE_KEY, dbId);
+        await record(PLATFORM_EDGE_DB_SCOPE_KEY, dbId);
     }
     const db = await getDatabaseStarted(deps.coolify, dbId);
     if (!db.internal_db_url) {
-        throw new Error('coolify:app for the platform (names): the database has no internal_db_url yet -- retry this apply once Coolify reports one');
+        throw new Error('coolify:app for the platform (edge): the database has no internal_db_url yet -- retry this apply once Coolify reports one');
     }
     // ---- the app -------------------------------------------------------------
-    const app = await findOrCreatePlatformApp(deps.coolify, NAMES_APP_NAME, environment, async () => {
+    const app = await findOrCreatePlatformApp(deps.coolify, EDGE_APP_NAME, environment, async () => {
         const githubApp = await deps.coolify.requireGithubApp();
         return deps.coolify.createGithubAppApplication({
             project_uuid: projectUuid,
@@ -5293,41 +5311,41 @@ async function provisionPlatformNames(context, deps) {
             environment_name: environment.name,
             environment_uuid: environment.uuid,
             github_app_uuid: githubApp.uuid,
-            git_repository: NAMES_REPO,
+            git_repository: EDGE_REPO,
             git_branch: gitRef,
             build_pack: 'dockerfile',
-            name: NAMES_APP_NAME,
+            name: EDGE_APP_NAME,
         });
     });
     const appId = app.appId;
-    await record(PLATFORM_NAMES_APP_SCOPE_KEY, appId);
+    await record(PLATFORM_EDGE_APP_SCOPE_KEY, appId);
     // Set on every run, not only after a create: a throw right after the
     // create must not leave the app on the wrong target for good, and a
     // changed `gitRef` has to reach an app made on an earlier one.
     await deps.coolify.updateApplication(appId, {
         dockerfile_target_build: 'runner',
-        custom_internal_name: NAMES_RUNNER_INTERNAL_NAME,
+        custom_internal_name: EDGE_RUNNER_INTERNAL_NAME,
         git_branch: gitRef,
     });
-    const runtimeUrl = await ensureNamesRuntimeUrl(deps.coolify, appId, db.internal_db_url);
+    const runtimeUrl = await ensureEdgeRuntimeUrl(deps.coolify, appId, db.internal_db_url);
     // ---- the platform key, once ----------------------------------------------
     // The recorded `set` id *is* the hash (never read back from Coolify's own
     // env, which can be missing or stale on a re-apply): the hash is never
     // secret, so it doubles as both the undelivered id and the value the base
     // env below writes, with nothing extra to compute or a live read that
     // could fall back to a blank value.
-    let keyHash = recorded[PLATFORM_NAMES_PLATFORM_KEY_SET_SCOPE_KEY] ?? '';
+    let keyHash = recorded[PLATFORM_EDGE_PLATFORM_KEY_SET_SCOPE_KEY] ?? '';
     if (!keyHash) {
         const secret = randomBytes(32).toString('base64url');
         keyHash = createHash('sha256').update(secret).digest('hex');
-        await record(PLATFORM_NAMES_PLATFORM_KEY_UNDELIVERED_SCOPE_KEY, keyHash);
-        await deliverWithRetry(deps.deliverSecret, PLATFORM_NAMES_KEY_REF, secret, attempts, sleep, 'the names platform key', 'platform:names');
+        await record(PLATFORM_EDGE_PLATFORM_KEY_UNDELIVERED_SCOPE_KEY, keyHash);
+        await deliverWithRetry(deps.deliverSecret, PLATFORM_EDGE_KEY_REF, secret, attempts, sleep, 'the edge platform key', 'platform:edge');
         // Recorded as soon as delivery succeeds, before the env write below (the
         // base env block, further down, is what actually writes the hash) --
         // so a failed or crashed env write is simply retried on the next apply
         // instead of leaving an undelivered secret with no `set` partner and no
         // way to recover but a hand edit of the recorded ids.
-        await record(PLATFORM_NAMES_PLATFORM_KEY_SET_SCOPE_KEY, keyHash);
+        await record(PLATFORM_EDGE_PLATFORM_KEY_SET_SCOPE_KEY, keyHash);
     }
     // ---- base env, written on every run --------------------------------------
     await deps.coolify.bulkUpsertEnvs(appId, [
@@ -5336,18 +5354,18 @@ async function provisionPlatformNames(context, deps) {
         { key: 'APP_URL', value: `https://${hostname}` },
         { key: 'CLOUDFLARE_API_TOKEN', value: cloudflareToken },
         { key: 'CLOUDFLARE_ACCOUNT_ID', value: deps.cloudflareAccountId },
-        { key: 'NAMES_TRUST_CF_CONNECTING_IP', value: 'true' },
+        { key: 'EDGE_TRUST_CF_CONNECTING_IP', value: 'true' },
         { key: 'NODE_ENV', value: 'production' },
-        { key: 'NAMES_PLATFORM_KEY_HASH', value: keyHash },
-        ...(await missingEnvs(deps.coolify, appId, PLATFORM_NAMES_RUNNER_DEFAULTS)),
+        { key: 'EDGE_PLATFORM_KEY_HASH', value: keyHash },
+        ...(await missingEnvs(deps.coolify, appId, PLATFORM_EDGE_RUNNER_DEFAULTS)),
     ]);
     // ---- tunnel and DNS -------------------------------------------------------
-    const existingTunnel = await deps.cloudflare.findTunnelByName(NAMES_TUNNEL_NAME);
-    const tunnel = existingTunnel ?? (await deps.cloudflare.createTunnel(NAMES_TUNNEL_NAME));
-    await record(PLATFORM_NAMES_TUNNEL_SCOPE_KEY, tunnel.id);
+    const existingTunnel = await deps.cloudflare.findTunnelByName(EDGE_TUNNEL_NAME);
+    const tunnel = existingTunnel ?? (await deps.cloudflare.createTunnel(EDGE_TUNNEL_NAME));
+    await record(PLATFORM_EDGE_TUNNEL_SCOPE_KEY, tunnel.id);
     await deps.cloudflare.putTunnelConfig(tunnel.id, {
         ingress: [
-            { hostname, service: `http://${NAMES_RUNNER_INTERNAL_NAME}:${NAMES_PORT}` },
+            { hostname, service: `http://${EDGE_RUNNER_INTERNAL_NAME}:${EDGE_PORT}` },
             { service: 'http_status:404' },
         ],
     });
@@ -5356,16 +5374,16 @@ async function provisionPlatformNames(context, deps) {
         coolify: deps.coolify,
         cloudflare: deps.cloudflare,
         tunnelId: tunnel.id,
-        appName: NAMES_CLOUDFLARED_APP_NAME,
+        appName: EDGE_CLOUDFLARED_APP_NAME,
         projectUuid,
         environment,
         resolveServer: async () => server,
-        recordedConnectorAppId: recorded[PLATFORM_NAMES_CONNECTOR_APP_SCOPE_KEY] ?? null,
-        recordAppId: (connectorAppId) => record(PLATFORM_NAMES_CONNECTOR_APP_SCOPE_KEY, connectorAppId),
+        recordedConnectorAppId: recorded[PLATFORM_EDGE_CONNECTOR_APP_SCOPE_KEY] ?? null,
+        recordAppId: (connectorAppId) => record(PLATFORM_EDGE_CONNECTOR_APP_SCOPE_KEY, connectorAppId),
     });
     const zoneId = recorded[apexZoneKey(platform.apex)] ?? (await exactZone(deps.cloudflare, platform.apex))?.id;
     if (!zoneId) {
-        throw new Error(`platform:names: no Cloudflare zone for ${platform.apex} to put ${hostname} in`);
+        throw new Error(`platform:edge: no Cloudflare zone for ${platform.apex} to put ${hostname} in`);
     }
     const dnsTarget = `${tunnel.id}.cfargotunnel.com`;
     const [dnsRecord] = await deps.cloudflare.findDnsRecord(zoneId, hostname, 'CNAME');
@@ -5390,10 +5408,10 @@ async function provisionPlatformNames(context, deps) {
     // helper (deployment-record check, then the `/api/health` probe) can run
     // in one call -- unlike `platform:mail`, nothing here needs to happen
     // between the two phases.
-    await waitForNewDeployment(deps.coolify, appId, { kind: 'ready', url: `https://${hostname}/api/health` }, runtime, sleep, 'platform:names', `names stays at ${recorded[PLATFORM_NAMES_APPLIED_GIT_REF_SCOPE_KEY] ?? 'no recorded ref'}`);
+    await waitForNewDeployment(deps.coolify, appId, { kind: 'ready', url: `https://${hostname}/api/health` }, runtime, sleep, 'platform:edge', `edge stays at ${recorded[PLATFORM_EDGE_APPLIED_GIT_REF_SCOPE_KEY] ?? 'no recorded ref'}`);
     // Last: a run that failed anywhere above is planned again.
-    context.recordScopeId(PLATFORM_NAMES_APPLIED_HOSTNAME_SCOPE_KEY, hostname);
-    await record(PLATFORM_NAMES_APPLIED_GIT_REF_SCOPE_KEY, gitRef);
+    context.recordScopeId(PLATFORM_EDGE_APPLIED_HOSTNAME_SCOPE_KEY, hostname);
+    await record(PLATFORM_EDGE_APPLIED_GIT_REF_SCOPE_KEY, gitRef);
     return { resourceId: appId };
 }
 /**
@@ -5403,7 +5421,7 @@ async function provisionPlatformNames(context, deps) {
  * throws a message with no part of the URL in it, since the URL carries the
  * owner's password.
  */
-async function ensureNamesRuntimeUrl(coolify, appId, dbInternalUrl) {
+async function ensureEdgeRuntimeUrl(coolify, appId, dbInternalUrl) {
     const existing = (await coolify.listEnvs(appId)).find((e) => e.key === 'DATABASE_URL' && !e.is_preview && e.value);
     if (existing)
         return existing.value;
@@ -5414,10 +5432,10 @@ async function ensureNamesRuntimeUrl(coolify, appId, dbInternalUrl) {
         ({ host, pathname, search } = new URL(dbInternalUrl));
     }
     catch {
-        throw new Error("coolify:app for the platform (names): the database's internal_db_url could not be parsed to build the runtime DATABASE_URL");
+        throw new Error("coolify:app for the platform (edge): the database's internal_db_url could not be parsed to build the runtime DATABASE_URL");
     }
     const password = randomBytes(24).toString('base64url');
-    return `postgres://${NAMES_RUNTIME_ROLE}:${password}@${host}${pathname}${search}`;
+    return `postgres://${EDGE_RUNTIME_ROLE}:${password}@${host}${pathname}${search}`;
 }
 function aiKeys(deps) {
     const keys = deps?.keys;

package/dist/plan/providers-readers.d.ts

@@ -1,6 +1,6 @@
 import type { CloudflareClient } from '@wtfalch/providers/cloudflare';
 import type { CoolifyClient } from '@wtfalch/providers/coolify';
-import type { ZitadelClient } from '@wtfalch/providers/zitadel';
+import { type ZitadelClient } from '@wtfalch/providers/zitadel';
 import type { OrgId } from '../org.js';
 import type { DeclaredOrgStore } from '../store.js';
 import type { CloudflareReader, CmsReader, CoolifyReader, LiveResource, ZitadelReader } from './live.js';
@@ -53,15 +53,17 @@ export type ScopeResolver = (orgId: OrgId) => Promise<string | null>;
  * resource it creates, keyed `system:kind:key` ({@link storeRecordedIds}
  * below reads those back), and #20's `FoundryStepExecutor` (`executor.ts`)
  * now also calls `StepExecutionContext.recordScopeId` for `coolify_project`,
- * `zitadel_org` and `zitadel_project`, so a resolver built with one of those
- * three `serviceKey`s returns the real id once that step has run. A
- * Cloudflare zone is the one scope id nothing writes yet: `executor.ts`'s
- * `cloudflareZone` records its result only under `cloudflare:zone:<domain>`
- * (a resource id, read back by {@link storeRecordedIds}), not under a plain
- * `cloudflare_zone` scope key — a resolver built with that `serviceKey`
- * still returns `null` for every org. That is the correct "nothing live yet"
- * answer: a reader passed `null` returns `[]`, which `computePlanDetail`
- * (`diff.ts`) already reads as "no live resource".
+ * `zitadel_org`, `zitadel_project` and (#510) `cloudflare_zone`, so a
+ * resolver built with one of those `serviceKey`s returns the real id once
+ * that step has run. Before #510, `cloudflareZone` recorded its result only
+ * under `cloudflare:zone:<domain>` (a resource id, read back by
+ * {@link storeRecordedIds}), never under the plain `cloudflare_zone` scope
+ * key — so a resolver built with that `serviceKey` always returned `null`,
+ * `ProvidersCloudflareReader.listResources` always returned `[]`, and
+ * `diff.ts`'s `planZone` re-proposed provisioning the zone on every apply
+ * even once it was live. A scope key that genuinely has nothing recorded yet
+ * still correctly resolves to `null`: a reader passed `null` returns `[]`,
+ * which `computePlanDetail` (`diff.ts`) already reads as "no live resource".
  */
 export declare function storeScopeResolver(store: DeclaredOrgStore, serviceKey: string): ScopeResolver;
 /**
@@ -112,7 +114,8 @@ export declare class ProvidersCloudflareReader implements CloudflareReader {
 /**
  * Backed by `@wtfalch/providers/zitadel`'s `ZitadelClient.listResources`: one
  * resource per project and per project grant in a ZITADEL org (v1 scope —
- * see that method's own doc comment).
+ * see that method's own doc comment), plus (#510) a synthesized `issuer`
+ * resource once the org's own ZITADEL org is confirmed live.
  */
 export declare class ProvidersZitadelReader implements ZitadelReader {
     private readonly client;
@@ -120,6 +123,26 @@ export declare class ProvidersZitadelReader implements ZitadelReader {
     private readonly resolveRecordedIds;
     constructor(client: ZitadelClient, resolveScope: ScopeResolver, resolveRecordedIds: RecordedIds);
     listResources(orgId: OrgId): Promise<LiveResource[]>;
+    /**
+     * #510: `client.listResources` reports only what is *inside* a ZITADEL org
+     * (its projects and grants), never the org record itself, so nothing ever
+     * matched `diff.ts`'s `planIssuer`'s own `zitadel:issuer:<orgId>` lookup —
+     * every plan re-proposed "provision the org's own ZITADEL org" after a
+     * clean apply, even once `zitadel_org` was recorded and live. `orgId` here
+     * is foundry's own id ({@link resourceKey}'s `key` for an issuer, `diff.ts`'s
+     * `planIssuer`), not `zitadelOrgId` — the resource foundry tracks is "this
+     * org's issuer", and ZITADEL's own org id is an implementation detail of
+     * where it lives, the same distinction {@link applyRecordedIds} draws for
+     * every other recorded resource.
+     *
+     * `resolveScope` only reads what was last recorded; it never confirms the
+     * org still exists in ZITADEL. A 404 here means the recorded id no longer
+     * resolves (the org was removed out of band) and reads as "not live" — the
+     * same `[]` answer a never-recorded scope already gives. Any other failure
+     * propagates, same as every other call in this reader. An org ZITADEL still
+     * returns but marks `ORG_STATE_REMOVED` is not live either.
+     */
+    private liveIssuer;
 }
 /**
  * Backed by the same `@wtfalch/providers/coolify`'s `CoolifyClient.listResources`