@wtfalch/foundry 0.17.1 → 0.19.0

package/dist/plan/providers-readers.js

@@ -1,3 +1,4 @@
+import { ZitadelError } from '@wtfalch/providers/zitadel';
 import { BOULE_MANAGED_ENV_KEYS } from './boule.js';
 /**
  * A {@link ScopeResolver} backed by `AppliedState.serviceIds` (`../state.ts`)
@@ -8,15 +9,17 @@ import { BOULE_MANAGED_ENV_KEYS } from './boule.js';
  * resource it creates, keyed `system:kind:key` ({@link storeRecordedIds}
  * below reads those back), and #20's `FoundryStepExecutor` (`executor.ts`)
  * now also calls `StepExecutionContext.recordScopeId` for `coolify_project`,
- * `zitadel_org` and `zitadel_project`, so a resolver built with one of those
- * three `serviceKey`s returns the real id once that step has run. A
- * Cloudflare zone is the one scope id nothing writes yet: `executor.ts`'s
- * `cloudflareZone` records its result only under `cloudflare:zone:<domain>`
- * (a resource id, read back by {@link storeRecordedIds}), not under a plain
- * `cloudflare_zone` scope key — a resolver built with that `serviceKey`
- * still returns `null` for every org. That is the correct "nothing live yet"
- * answer: a reader passed `null` returns `[]`, which `computePlanDetail`
- * (`diff.ts`) already reads as "no live resource".
+ * `zitadel_org`, `zitadel_project` and (#510) `cloudflare_zone`, so a
+ * resolver built with one of those `serviceKey`s returns the real id once
+ * that step has run. Before #510, `cloudflareZone` recorded its result only
+ * under `cloudflare:zone:<domain>` (a resource id, read back by
+ * {@link storeRecordedIds}), never under the plain `cloudflare_zone` scope
+ * key — so a resolver built with that `serviceKey` always returned `null`,
+ * `ProvidersCloudflareReader.listResources` always returned `[]`, and
+ * `diff.ts`'s `planZone` re-proposed provisioning the zone on every apply
+ * even once it was live. A scope key that genuinely has nothing recorded yet
+ * still correctly resolves to `null`: a reader passed `null` returns `[]`,
+ * which `computePlanDetail` (`diff.ts`) already reads as "no live resource".
  */
 export function storeScopeResolver(store, serviceKey) {
     return async (orgId) => {
@@ -179,18 +182,34 @@ async function withEnvNamesConfig(client, resource, recorded) {
  * the `agora` kind, like {@link withLogVolumeConfig}. Unlike that read, a
  * failure here is not swallowed: a plan that cannot see the live config must
  * fail, not report it as missing.
+ *
+ * #506: also the live app's own `ports_exposes`, as `config.ports_exposes`,
+ * so `planAgora` can plan the fix for an app Coolify never got that setting
+ * on even when its env already matches -- the exact shape of the Company
+ * Included incident this issue names, where re-planning without this read
+ * would see no drift at all and never run `coolifyAgora` again.
  */
 async function withAgoraEnvConfig(client, resource, recorded) {
     if (resource.kind !== 'application' || !recorded[resource.key]?.startsWith('agora:')) {
         return resource;
     }
-    const envs = await client.listEnvs(resource.key);
+    const [envs, app] = await Promise.all([
+        client.listEnvs(resource.key),
+        client.getApplication(resource.key),
+    ]);
     const env = {};
     for (const e of envs) {
         if (!e.is_preview && e.key.startsWith('AGORA_'))
             env[e.key] = e.value;
     }
-    return { ...resource, config: { ...resource.config, env } };
+    // `@wtfalch/providers`' `CoolifyApplication` type does not declare
+    // `ports_exposes` (as of 0.7.3), but `getApplication` returns the raw
+    // Coolify API response (`coolify.ts`'s own `getApplication`, a plain
+    // `request` passthrough), which does carry it -- the same gap that
+    // repo's own CLAUDE.md names for other fields ("verified against a live
+    // instance, not the bundled openapi.yaml").
+    const portsExposes = app.ports_exposes;
+    return { ...resource, config: { ...resource.config, env, ports_exposes: portsExposes } };
 }
 /**
  * #161: the org's own recorded Boule app's live sign-in env vars, as
@@ -273,13 +292,17 @@ export class ProvidersCloudflareReader {
         // A zone needs no mapping: its key is already the zone name, which is
         // foundry's own zone key (`diff.ts`'s `planZone`), so it never matches a
         // recorded provider id and always passes through unchanged.
-        return applyRecordedIds(toFoundryResources('cloudflare', resources), recorded, CLOUDFLARE_DROP_UNRECORDED);
+        return applyRecordedIds(toFoundryResources('cloudflare', resources)
+            // Keyed by the zone id, so a recorded zone id would map it onto the
+            // zone's own key and replace the zone's status; nothing plans from it.
+            .filter((resource) => resource.kind !== 'email_routing'), recorded, CLOUDFLARE_DROP_UNRECORDED);
     }
 }
 /**
  * Backed by `@wtfalch/providers/zitadel`'s `ZitadelClient.listResources`: one
  * resource per project and per project grant in a ZITADEL org (v1 scope —
- * see that method's own doc comment).
+ * see that method's own doc comment), plus (#510) a synthesized `issuer`
+ * resource once the org's own ZITADEL org is confirmed live.
  */
 export class ProvidersZitadelReader {
     client;
@@ -294,11 +317,45 @@ export class ProvidersZitadelReader {
         const zitadelOrgId = await this.resolveScope(orgId);
         if (!zitadelOrgId)
             return [];
-        const [resources, recorded] = await Promise.all([
+        const [resources, recorded, issuer] = await Promise.all([
             this.client.listResources(zitadelOrgId),
             this.resolveRecordedIds(orgId),
+            this.liveIssuer(orgId, zitadelOrgId),
         ]);
-        return applyRecordedIds(toFoundryResources('zitadel', resources), recorded);
+        const mapped = applyRecordedIds(toFoundryResources('zitadel', resources), recorded);
+        return issuer ? [...mapped, issuer] : mapped;
+    }
+    /**
+     * #510: `client.listResources` reports only what is *inside* a ZITADEL org
+     * (its projects and grants), never the org record itself, so nothing ever
+     * matched `diff.ts`'s `planIssuer`'s own `zitadel:issuer:<orgId>` lookup —
+     * every plan re-proposed "provision the org's own ZITADEL org" after a
+     * clean apply, even once `zitadel_org` was recorded and live. `orgId` here
+     * is foundry's own id ({@link resourceKey}'s `key` for an issuer, `diff.ts`'s
+     * `planIssuer`), not `zitadelOrgId` — the resource foundry tracks is "this
+     * org's issuer", and ZITADEL's own org id is an implementation detail of
+     * where it lives, the same distinction {@link applyRecordedIds} draws for
+     * every other recorded resource.
+     *
+     * `resolveScope` only reads what was last recorded; it never confirms the
+     * org still exists in ZITADEL. A 404 here means the recorded id no longer
+     * resolves (the org was removed out of band) and reads as "not live" — the
+     * same `[]` answer a never-recorded scope already gives. Any other failure
+     * propagates, same as every other call in this reader. An org ZITADEL still
+     * returns but marks `ORG_STATE_REMOVED` is not live either.
+     */
+    async liveIssuer(orgId, zitadelOrgId) {
+        try {
+            const found = await this.client.getOrg(zitadelOrgId);
+            if (found.state === 'ORG_STATE_REMOVED')
+                return null;
+        }
+        catch (err) {
+            if (err instanceof ZitadelError && err.status === 404)
+                return null;
+            throw err;
+        }
+        return { system: 'zitadel', kind: 'issuer', key: orgId, config: {} };
     }
 }
 /**

package/dist/plan/step-system.js

@@ -4,7 +4,7 @@ const PLATFORM_APP_SYSTEMS = {
     'platform:mail': 'stalwart',
     'platform:files': 'files',
     'platform:ai': 'ai',
-    'platform:names': 'names',
+    'platform:edge': 'edge',
 };
 /** The system `action` touches. The one place that decides it, so no planner sets it by hand. */
 export function stepSystemOf(action) {

package/dist/plan/{edge-worker.d.ts → worker.d.ts}

@@ -1,24 +1,24 @@
-import type { DeclaredOrg, EdgeConfig, HostingEntry } from '../org.js';
+import type { DeclaredOrg, HostingEntry, WorkerConfig } from '../org.js';
 import type { DraftStep } from './diff.js';
 /**
  * F8 (#318): one plain Cloudflare Worker per hosting entry that declares
- * `edge`, deployed from a built artifact that entry's own repo publishes
+ * `worker`, deployed from a built artifact that entry's own repo publishes
  * (estate DECISIONS.md, 2026-10-04: foundry fetches and verifies it, never
  * checks it out or bundles it). Unlike `planEntryAiKeys`/`planFilesKeys`,
  * there is no renewal window -- a Worker script has no expiry -- so a step
  * is planned again only while the entry's own declared config (`route`,
  * `bindings` or, crucially, `artifactSha256`) differs from what was last
- * applied (recorded as that config's JSON, `edgeAppliedScopeKey`):
+ * applied (recorded as that config's JSON, `workerAppliedScopeKey`):
  * `artifactSha256` is itself the declared signal that the built bytes
  * changed, so a rebuild under an unchanged URL still redeploys as soon as
  * the entry declares the new digest. "Blocked, not failing" (CLAUDE.md): a
  * host whose executor carries no `WorkersPort` reports every entry's step
  * (apply or retire) as blocked, not planned to a step that would throw.
  */
-export declare const entryEdgeAppliedScopeKey: (entryKey: string) => string;
-export declare const entryEdgeRouteIdScopeKey: (entryKey: string) => string;
+export declare const entryWorkerAppliedScopeKey: (entryKey: string) => string;
+export declare const entryWorkerRouteIdScopeKey: (entryKey: string) => string;
 /** The route pattern the recorded route id above was created for -- read to find and delete the *old* route when the declared route pattern changes. */
-export declare const entryEdgeRoutePatternScopeKey: (entryKey: string) => string;
+export declare const entryWorkerRoutePatternScopeKey: (entryKey: string) => string;
 /**
  * The script name retired, once a retire step completes. `runSteps` only
  * ever writes a step's main recorded id from a *truthy* `resourceId`
@@ -27,25 +27,35 @@ export declare const entryEdgeRoutePatternScopeKey: (entryKey: string) => string
  * and without this marker the "gone" scan below would plan the same retire
  * forever. Compared against that still-live id, the same convergence
  * `entryAiRetiredScopeKey`/`entryFilesRetiredScopeKey`/
- * `entryNamesRetiredScopeKey` already give their own entry keys.
+ * `entryEdgeRetiredScopeKey` already give their own entry keys.
  */
-export declare const entryEdgeRetiredScopeKey: (entryKey: string) => string;
+export declare const entryWorkerRetiredScopeKey: (entryKey: string) => string;
 /** The script name being uploaded, recorded (and persisted) *before* the upload call -- so a crash mid-upload or a failed route create still leaves a trail to the script rather than orphaning it, and a retry reads the script as foundry's own instead of tripping the `scriptExists` overwrite guard. Cleared once the step records success. */
-export declare const entryEdgeUploadedScopeKey: (entryKey: string) => string;
-/** The zone the recorded route id lives in, as {@link EdgeRouteZone} JSON -- so retire and destroy delete it on *that* zone even after `org.domain` changes or goes null. */
-export declare const entryEdgeRouteZoneScopeKey: (entryKey: string) => string;
-/** A route about to be created, as {@link EdgeRoutePending} JSON, recorded and persisted before `createRoute` -- so a crash or failed persist right after Cloudflare creates it still leaves retire and destroy something to find it by (`findRoute`). Cleared once the route id is recorded. */
-export declare const entryEdgeRoutePendingScopeKey: (entryKey: string) => string;
-export interface EdgeRouteZone {
+export declare const entryWorkerUploadedScopeKey: (entryKey: string) => string;
+/** The zone the recorded route id lives in, as {@link WorkerRouteZone} JSON -- so retire and destroy delete it on *that* zone even after `org.domain` changes or goes null. */
+export declare const entryWorkerRouteZoneScopeKey: (entryKey: string) => string;
+/** A route about to be created, as {@link WorkerRoutePending} JSON, recorded and persisted before `createRoute` -- so a crash or failed persist right after Cloudflare creates it still leaves retire and destroy something to find it by (`findRoute`). Cleared once the route id is recorded. */
+export declare const entryWorkerRoutePendingScopeKey: (entryKey: string) => string;
+/**
+ * The no-Worker routes kept beside an entry's wildcard Worker route, as
+ * {@link WorkerExclusions} JSON. Written after each create or delete, so a
+ * crash leaves every route that exists recorded.
+ */
+export declare const entryWorkerExclusionsScopeKey: (entryKey: string) => string;
+export interface WorkerExclusions extends WorkerRouteZone {
+    /** Route pattern to Cloudflare route id. */
+    routes: Record<string, string>;
+}
+export interface WorkerRouteZone {
     id: string;
     apex: string;
 }
-export interface EdgeRoutePending extends EdgeRouteZone {
+export interface WorkerRoutePending extends WorkerRouteZone {
     pattern: string;
     script: string;
 }
 /** The per-entry scope keys that mark something deployed or half-deployed, or that a retire already handled it -- cleared together once org destroy has torn the Worker down (#318 re-review: the retired marker was left out, so it stayed recorded as a stale leftover after the org itself was gone). */
-export declare const edgeWorkerTraceScopeKeys: (entryKey: string) => string[];
+export declare const workerTraceScopeKeys: (entryKey: string) => string[];
 /**
  * Every entry key of `orgId` with something foundry deployed still live,
  * mapped to the script name recorded for it (`''` if only a route trace is
@@ -56,11 +66,11 @@ export declare const edgeWorkerTraceScopeKeys: (entryKey: string) => string[];
  * the retired marker, since an apply clears that marker before it leaves any
  * of these (#318 re-review).
  */
-export declare function liveEdgeWorkers(orgId: string, recordedIds: Readonly<Record<string, string>>): Map<string, string>;
-/** The first 8 hex characters of org.id's own sha256 -- see {@link edgeWorkerName}'s doc comment. */
-export declare const EDGE_WORKER_ORG_HASH_LENGTH = 8;
+export declare function liveWorkers(orgId: string, recordedIds: Readonly<Record<string, string>>): Map<string, string>;
+/** The first 8 hex characters of org.id's own sha256 -- see {@link workerName}'s doc comment. */
+export declare const WORKER_ORG_HASH_LENGTH = 8;
 /** Cloudflare's own limit on a Worker script name. */
-export declare const EDGE_WORKER_NAME_MAX_LENGTH = 63;
+export declare const WORKER_NAME_MAX_LENGTH = 63;
 /**
  * `${8-hex-char hash of org.id}-${entry.key}-edge`, not `${org.slug}-...`
  * (#318 re-review): a slug and an entry key both allow hyphens, so org
@@ -69,37 +79,47 @@ export declare const EDGE_WORKER_NAME_MAX_LENGTH = 63;
  * caught the second of the two to apply, and two concurrent applies could
  * both pass it. `org.id` is a UUID with no ambiguity of its own, but using
  * it in full would make the fixed part of the name longer than most of the
- * 63-character budget this port's `EDGE_WORKER_NAME_MAX_LENGTH` gives it,
- * so only a short hash of it is used -- `validateEntryEdge` (`org.ts`)
+ * 63-character budget this port's `WORKER_NAME_MAX_LENGTH` gives it,
+ * so only a short hash of it is used -- `validateEntryWorker` (`org.ts`)
  * checks the resulting name never exceeds that limit.
  */
-export declare const edgeWorkerName: (org: DeclaredOrg, entry: HostingEntry) => string;
+export declare const workerName: (org: DeclaredOrg, entry: HostingEntry) => string;
 /**
  * Foundry's own fixed compatibility date for every Worker it deploys -- not
- * a per-entry declared value, so it is not part of {@link EdgeWorkerWant}
+ * a per-entry declared value, so it is not part of {@link WorkerWant}
  * and never triggers a re-plan on its own; bumping it is a foundry release,
  * like {@link RATE_LIMIT_FREE_PLAN_PERIOD_SECONDS} is a fixed Cloudflare
  * Free plan value rather than something an org declares.
  */
-export declare const EDGE_WORKER_COMPATIBILITY_DATE = "2026-09-12";
-export type EdgeWorkerMode = 'apply' | 'retire';
-export interface EdgeWorkerWant {
+export declare const WORKER_COMPATIBILITY_DATE = "2026-09-12";
+export type WorkerMode = 'apply' | 'retire';
+export interface WorkerWant {
     name: string;
     artifactUrl: string;
     artifactSha256: string;
     route: string;
-    bindings: EdgeConfig['bindings'];
+    bindings: WorkerConfig['bindings'];
+    /** No-Worker route patterns, sorted; set only for a wildcard route with hostnames to keep out. */
+    exclusions?: string[];
 }
-export declare function wantedEdgeWorker(org: DeclaredOrg, entry: HostingEntry): EdgeWorkerWant;
+/**
+ * With a wildcard route (`*.<domain>/*`) the Worker would also capture every
+ * hostname foundry provisions on the domain, so each gets a no-Worker route
+ * `<hostname>/*` (a more specific pattern wins): every entry hostname plus the
+ * names `lockedHostnames` lists (Agora, Boule, the login host, platform apps).
+ * Never the wildcard itself.
+ */
+export declare function workerExclusions(org: DeclaredOrg, entry: HostingEntry, platformHostnames: readonly string[]): string[];
+export declare function wantedWorker(org: DeclaredOrg, entry: HostingEntry, platformHostnames?: readonly string[]): WorkerWant;
 type Blocked = Array<{
     description: string;
     key: string;
 }>;
 /**
- * One step per entry whose `edge` config is new or changed, plus one retire
+ * One step per entry whose `worker` config is new or changed, plus one retire
  * step per entry whose Worker is recorded but no longer declared -- either
- * because the entry dropped `edge` or because the entry itself is gone, the
- * same "gone" scan `planEntryAiKeys`/`planFilesKeys`/`planEntryNamesKeys`
+ * because the entry dropped `worker` or because the entry itself is gone, the
+ * same "gone" scan `planEntryAiKeys`/`planFilesKeys`/`planEntryEdgeKeys`
  * run over their own recorded keys, so removing a whole entry still cleans
  * up its Worker. `workersAvailable` is the host's own
  * `FoundryPlanApplyOptions.edgeWorkers` (mirrors `jobsAvailable`): without
@@ -107,7 +127,7 @@ type Blocked = Array<{
  * than planned to fail at apply. The caller (`diff.ts`) gates the *apply*
  * steps further, on an active zone, the same way it gates `planRateLimit`.
  */
-export declare function planEdgeWorkers(org: DeclaredOrg, recordedIds: Readonly<Record<string, string>>, workersAvailable: boolean): {
+export declare function planWorkers(org: DeclaredOrg, recordedIds: Readonly<Record<string, string>>, workersAvailable: boolean, platformHostnames?: readonly string[]): {
     steps: DraftStep[];
     blocked: Blocked;
 };

package/dist/plan/{edge-worker.js → worker.js}

@@ -1,24 +1,27 @@
 import { createHash } from 'node:crypto';
+import { entryHostnames } from './hostnames.js';
+import { lockedHostnames } from './locked-hostnames.js';
 import { appStepKey } from './platform-diff.js';
 /**
  * F8 (#318): one plain Cloudflare Worker per hosting entry that declares
- * `edge`, deployed from a built artifact that entry's own repo publishes
+ * `worker`, deployed from a built artifact that entry's own repo publishes
  * (estate DECISIONS.md, 2026-10-04: foundry fetches and verifies it, never
  * checks it out or bundles it). Unlike `planEntryAiKeys`/`planFilesKeys`,
  * there is no renewal window -- a Worker script has no expiry -- so a step
  * is planned again only while the entry's own declared config (`route`,
  * `bindings` or, crucially, `artifactSha256`) differs from what was last
- * applied (recorded as that config's JSON, `edgeAppliedScopeKey`):
+ * applied (recorded as that config's JSON, `workerAppliedScopeKey`):
  * `artifactSha256` is itself the declared signal that the built bytes
  * changed, so a rebuild under an unchanged URL still redeploys as soon as
  * the entry declares the new digest. "Blocked, not failing" (CLAUDE.md): a
  * host whose executor carries no `WorkersPort` reports every entry's step
  * (apply or retire) as blocked, not planned to a step that would throw.
  */
-export const entryEdgeAppliedScopeKey = (entryKey) => `edge_worker_applied_${entryKey}`;
-export const entryEdgeRouteIdScopeKey = (entryKey) => `edge_worker_route_id_${entryKey}`;
+// Recorded scope keys keep their `edge_worker_` prefix: renaming them would orphan live Workers.
+export const entryWorkerAppliedScopeKey = (entryKey) => `edge_worker_applied_${entryKey}`;
+export const entryWorkerRouteIdScopeKey = (entryKey) => `edge_worker_route_id_${entryKey}`;
 /** The route pattern the recorded route id above was created for -- read to find and delete the *old* route when the declared route pattern changes. */
-export const entryEdgeRoutePatternScopeKey = (entryKey) => `edge_worker_route_pattern_${entryKey}`;
+export const entryWorkerRoutePatternScopeKey = (entryKey) => `edge_worker_route_pattern_${entryKey}`;
 /**
  * The script name retired, once a retire step completes. `runSteps` only
  * ever writes a step's main recorded id from a *truthy* `resourceId`
@@ -27,23 +30,30 @@ export const entryEdgeRoutePatternScopeKey = (entryKey) => `edge_worker_route_pa
  * and without this marker the "gone" scan below would plan the same retire
  * forever. Compared against that still-live id, the same convergence
  * `entryAiRetiredScopeKey`/`entryFilesRetiredScopeKey`/
- * `entryNamesRetiredScopeKey` already give their own entry keys.
+ * `entryEdgeRetiredScopeKey` already give their own entry keys.
  */
-export const entryEdgeRetiredScopeKey = (entryKey) => `edge_worker_retired_${entryKey}`;
+export const entryWorkerRetiredScopeKey = (entryKey) => `edge_worker_retired_${entryKey}`;
 /** The script name being uploaded, recorded (and persisted) *before* the upload call -- so a crash mid-upload or a failed route create still leaves a trail to the script rather than orphaning it, and a retry reads the script as foundry's own instead of tripping the `scriptExists` overwrite guard. Cleared once the step records success. */
-export const entryEdgeUploadedScopeKey = (entryKey) => `edge_worker_uploaded_${entryKey}`;
-/** The zone the recorded route id lives in, as {@link EdgeRouteZone} JSON -- so retire and destroy delete it on *that* zone even after `org.domain` changes or goes null. */
-export const entryEdgeRouteZoneScopeKey = (entryKey) => `edge_worker_route_zone_${entryKey}`;
-/** A route about to be created, as {@link EdgeRoutePending} JSON, recorded and persisted before `createRoute` -- so a crash or failed persist right after Cloudflare creates it still leaves retire and destroy something to find it by (`findRoute`). Cleared once the route id is recorded. */
-export const entryEdgeRoutePendingScopeKey = (entryKey) => `edge_worker_route_pending_${entryKey}`;
+export const entryWorkerUploadedScopeKey = (entryKey) => `edge_worker_uploaded_${entryKey}`;
+/** The zone the recorded route id lives in, as {@link WorkerRouteZone} JSON -- so retire and destroy delete it on *that* zone even after `org.domain` changes or goes null. */
+export const entryWorkerRouteZoneScopeKey = (entryKey) => `edge_worker_route_zone_${entryKey}`;
+/** A route about to be created, as {@link WorkerRoutePending} JSON, recorded and persisted before `createRoute` -- so a crash or failed persist right after Cloudflare creates it still leaves retire and destroy something to find it by (`findRoute`). Cleared once the route id is recorded. */
+export const entryWorkerRoutePendingScopeKey = (entryKey) => `edge_worker_route_pending_${entryKey}`;
+/**
+ * The no-Worker routes kept beside an entry's wildcard Worker route, as
+ * {@link WorkerExclusions} JSON. Written after each create or delete, so a
+ * crash leaves every route that exists recorded.
+ */
+export const entryWorkerExclusionsScopeKey = (entryKey) => `edge_worker_exclusions_${entryKey}`;
 /** The per-entry scope keys that mark something deployed or half-deployed, or that a retire already handled it -- cleared together once org destroy has torn the Worker down (#318 re-review: the retired marker was left out, so it stayed recorded as a stale leftover after the org itself was gone). */
-export const edgeWorkerTraceScopeKeys = (entryKey) => [
-    entryEdgeUploadedScopeKey(entryKey),
-    entryEdgeRouteIdScopeKey(entryKey),
-    entryEdgeRouteZoneScopeKey(entryKey),
-    entryEdgeRoutePatternScopeKey(entryKey),
-    entryEdgeRoutePendingScopeKey(entryKey),
-    entryEdgeRetiredScopeKey(entryKey),
+export const workerTraceScopeKeys = (entryKey) => [
+    entryWorkerUploadedScopeKey(entryKey),
+    entryWorkerRouteIdScopeKey(entryKey),
+    entryWorkerRouteZoneScopeKey(entryKey),
+    entryWorkerRoutePatternScopeKey(entryKey),
+    entryWorkerRoutePendingScopeKey(entryKey),
+    entryWorkerRetiredScopeKey(entryKey),
+    entryWorkerExclusionsScopeKey(entryKey),
 ];
 /**
  * Every entry key of `orgId` with something foundry deployed still live,
@@ -55,13 +65,14 @@ export const edgeWorkerTraceScopeKeys = (entryKey) => [
  * the retired marker, since an apply clears that marker before it leaves any
  * of these (#318 re-review).
  */
-export function liveEdgeWorkers(orgId, recordedIds) {
+export function liveWorkers(orgId, recordedIds) {
     const mainPrefix = `cloudflare:worker:${orgId}:`;
     const tracePrefixes = [
         mainPrefix,
         'edge_worker_uploaded_',
         'edge_worker_route_id_',
         'edge_worker_route_pending_',
+        'edge_worker_exclusions_',
     ];
     const entryKeys = new Set();
     for (const [name, id] of Object.entries(recordedIds)) {
@@ -74,21 +85,22 @@ export function liveEdgeWorkers(orgId, recordedIds) {
     const live = new Map();
     for (const entryKey of entryKeys) {
         const mainId = recordedIds[`${mainPrefix}${entryKey}`] ?? '';
-        const uploaded = recordedIds[entryEdgeUploadedScopeKey(entryKey)] ?? '';
+        const uploaded = recordedIds[entryWorkerUploadedScopeKey(entryKey)] ?? '';
         const partial = uploaded ||
-            recordedIds[entryEdgeRouteIdScopeKey(entryKey)] ||
-            recordedIds[entryEdgeRoutePendingScopeKey(entryKey)];
-        const retired = mainId !== '' && recordedIds[entryEdgeRetiredScopeKey(entryKey)] === mainId;
+            recordedIds[entryWorkerRouteIdScopeKey(entryKey)] ||
+            recordedIds[entryWorkerRoutePendingScopeKey(entryKey)] ||
+            recordedIds[entryWorkerExclusionsScopeKey(entryKey)];
+        const retired = mainId !== '' && recordedIds[entryWorkerRetiredScopeKey(entryKey)] === mainId;
         if (!partial && (!mainId || retired))
             continue;
         live.set(entryKey, mainId || uploaded);
     }
     return live;
 }
-/** The first 8 hex characters of org.id's own sha256 -- see {@link edgeWorkerName}'s doc comment. */
-export const EDGE_WORKER_ORG_HASH_LENGTH = 8;
+/** The first 8 hex characters of org.id's own sha256 -- see {@link workerName}'s doc comment. */
+export const WORKER_ORG_HASH_LENGTH = 8;
 /** Cloudflare's own limit on a Worker script name. */
-export const EDGE_WORKER_NAME_MAX_LENGTH = 63;
+export const WORKER_NAME_MAX_LENGTH = 63;
 /**
  * `${8-hex-char hash of org.id}-${entry.key}-edge`, not `${org.slug}-...`
  * (#318 re-review): a slug and an entry key both allow hyphens, so org
@@ -97,34 +109,60 @@ export const EDGE_WORKER_NAME_MAX_LENGTH = 63;
  * caught the second of the two to apply, and two concurrent applies could
  * both pass it. `org.id` is a UUID with no ambiguity of its own, but using
  * it in full would make the fixed part of the name longer than most of the
- * 63-character budget this port's `EDGE_WORKER_NAME_MAX_LENGTH` gives it,
- * so only a short hash of it is used -- `validateEntryEdge` (`org.ts`)
+ * 63-character budget this port's `WORKER_NAME_MAX_LENGTH` gives it,
+ * so only a short hash of it is used -- `validateEntryWorker` (`org.ts`)
  * checks the resulting name never exceeds that limit.
  */
-export const edgeWorkerName = (org, entry) => `${createHash('sha256').update(org.id).digest('hex').slice(0, EDGE_WORKER_ORG_HASH_LENGTH)}-${entry.key}-edge`;
+export const workerName = (org, entry) => 
+// The `-edge` suffix stays after the entry field rename to `worker`, so live Workers keep their names and are not orphaned.
+`${createHash('sha256').update(org.id).digest('hex').slice(0, WORKER_ORG_HASH_LENGTH)}-${entry.key}-edge`;
 /**
  * Foundry's own fixed compatibility date for every Worker it deploys -- not
- * a per-entry declared value, so it is not part of {@link EdgeWorkerWant}
+ * a per-entry declared value, so it is not part of {@link WorkerWant}
  * and never triggers a re-plan on its own; bumping it is a foundry release,
  * like {@link RATE_LIMIT_FREE_PLAN_PERIOD_SECONDS} is a fixed Cloudflare
  * Free plan value rather than something an org declares.
  */
-export const EDGE_WORKER_COMPATIBILITY_DATE = '2026-09-12';
-export function wantedEdgeWorker(org, entry) {
-    const edge = entry.edge;
+export const WORKER_COMPATIBILITY_DATE = '2026-09-12';
+/**
+ * With a wildcard route (`*.<domain>/*`) the Worker would also capture every
+ * hostname foundry provisions on the domain, so each gets a no-Worker route
+ * `<hostname>/*` (a more specific pattern wins): every entry hostname plus the
+ * names `lockedHostnames` lists (Agora, Boule, the login host, platform apps).
+ * Never the wildcard itself.
+ */
+export function workerExclusions(org, entry, platformHostnames) {
+    const route = entry.worker?.route;
+    const { domain } = org;
+    if (!route || !domain || !route.startsWith('*.'))
+        return [];
+    const names = new Set(lockedHostnames(org, platformHostnames));
+    for (const e of org.hosting.entries)
+        for (const h of entryHostnames(org, e))
+            names.add(h);
+    return [...names]
+        .filter((h) => h === domain || h.endsWith(`.${domain}`))
+        .map((h) => `${h}/*`)
+        .filter((pattern) => pattern !== route)
+        .sort();
+}
+export function wantedWorker(org, entry, platformHostnames = []) {
+    const worker = entry.worker;
+    const exclusions = workerExclusions(org, entry, platformHostnames);
     return {
-        name: edgeWorkerName(org, entry),
-        artifactUrl: edge.artifactUrl,
-        artifactSha256: edge.artifactSha256,
-        route: edge.route,
-        bindings: edge.bindings,
+        name: workerName(org, entry),
+        artifactUrl: worker.artifactUrl,
+        artifactSha256: worker.artifactSha256,
+        route: worker.route,
+        bindings: worker.bindings,
+        exclusions: exclusions.length > 0 ? exclusions : undefined,
     };
 }
 /**
- * One step per entry whose `edge` config is new or changed, plus one retire
+ * One step per entry whose `worker` config is new or changed, plus one retire
  * step per entry whose Worker is recorded but no longer declared -- either
- * because the entry dropped `edge` or because the entry itself is gone, the
- * same "gone" scan `planEntryAiKeys`/`planFilesKeys`/`planEntryNamesKeys`
+ * because the entry dropped `worker` or because the entry itself is gone, the
+ * same "gone" scan `planEntryAiKeys`/`planFilesKeys`/`planEntryEdgeKeys`
  * run over their own recorded keys, so removing a whole entry still cleans
  * up its Worker. `workersAvailable` is the host's own
  * `FoundryPlanApplyOptions.edgeWorkers` (mirrors `jobsAvailable`): without
@@ -132,24 +170,24 @@ export function wantedEdgeWorker(org, entry) {
  * than planned to fail at apply. The caller (`diff.ts`) gates the *apply*
  * steps further, on an active zone, the same way it gates `planRateLimit`.
  */
-export function planEdgeWorkers(org, recordedIds, workersAvailable) {
+export function planWorkers(org, recordedIds, workersAvailable, platformHostnames = []) {
     const steps = [];
     const blocked = [];
     // Hosting off declares no Worker at all: the gone-scan below still runs,
     // so a Worker deployed while hosting was on is retired rather than left
     // live forever (#318 re-review). Only planning a *new* deploy is skipped.
-    const declared = new Set(org.hosting.enabled ? org.hosting.entries.filter((e) => e.edge).map((e) => e.key) : []);
+    const declared = new Set(org.hosting.enabled ? org.hosting.entries.filter((e) => e.worker).map((e) => e.key) : []);
     const mainPrefix = `cloudflare:worker:${org.id}:`;
-    // Every entryKey with a live, undeclared trace (`liveEdgeWorkers`): the
+    // Every entryKey with a live, undeclared trace (`liveWorkers`): the
     // main id or any partial-deploy marker, so a deploy that failed after
     // upload or mid-route-create is still found to retire (#318 review).
-    for (const entryKey of liveEdgeWorkers(org.id, recordedIds).keys()) {
+    for (const entryKey of liveWorkers(org.id, recordedIds).keys()) {
         if (declared.has(entryKey))
             continue;
         const stepKey = `${org.id}:${entryKey}`;
         if (!workersAvailable) {
             blocked.push({
-                description: `${org.slug}'s ${entryKey} edge Worker is blocked, not planned: the host supplies no WorkersPort`,
+                description: `${org.slug}'s ${entryKey} Worker is blocked, not planned: the host supplies no WorkersPort`,
                 key: `${mainPrefix}${entryKey}`,
             });
             continue;
@@ -157,7 +195,7 @@ export function planEdgeWorkers(org, recordedIds, workersAvailable) {
         steps.push({
             action: { system: 'cloudflare', kind: 'worker', key: stepKey, desired: { mode: 'retire' } },
             step: {
-                description: `delete ${org.slug}'s ${entryKey} edge Worker and its route: edge is no longer declared`,
+                description: `delete ${org.slug}'s ${entryKey} Worker and its route: worker is no longer declared`,
                 destroys: true,
                 migrates: false,
             },
@@ -166,11 +204,11 @@ export function planEdgeWorkers(org, recordedIds, workersAvailable) {
     if (!org.hosting.enabled)
         return { steps, blocked };
     for (const entry of org.hosting.entries) {
-        if (!entry.edge)
+        if (!entry.worker)
             continue;
         const stepKey = appStepKey(org, entry.key);
         const key = `cloudflare:worker:${stepKey}`;
-        const at = `${org.slug}'s ${entry.key} edge Worker`;
+        const at = `${org.slug}'s ${entry.key} Worker`;
         if (!workersAvailable) {
             blocked.push({
                 description: `${at} is blocked, not planned: the host supplies no WorkersPort`,
@@ -178,9 +216,9 @@ export function planEdgeWorkers(org, recordedIds, workersAvailable) {
             });
             continue;
         }
-        const want = wantedEdgeWorker(org, entry);
+        const want = wantedWorker(org, entry, platformHostnames);
         const wantJson = JSON.stringify(want);
-        const applied = recordedIds[entryEdgeAppliedScopeKey(entry.key)];
+        const applied = recordedIds[entryWorkerAppliedScopeKey(entry.key)];
         if (applied === wantJson)
             continue; // Rerun: nothing changed, down to the built artifact's own digest.
         steps.push({
@@ -188,10 +226,10 @@ export function planEdgeWorkers(org, recordedIds, workersAvailable) {
                 system: 'cloudflare',
                 kind: 'worker',
                 key: stepKey,
-                desired: { mode: 'apply', compatibilityDate: EDGE_WORKER_COMPATIBILITY_DATE, ...want },
+                desired: { mode: 'apply', compatibilityDate: WORKER_COMPATIBILITY_DATE, ...want },
             },
             step: {
-                description: `${applied ? 'update' : 'deploy'} ${at} on ${entry.edge.route}`,
+                description: `${applied ? 'update' : 'deploy'} ${at} on ${entry.worker.route}`,
                 destroys: false,
                 migrates: false,
             },

package/dist/platform.d.ts

@@ -26,11 +26,11 @@ export interface PlatformMailService extends PlatformService {
 }
 /**
  * The shared services a declared platform names, decided in #165, plus
- * `names` (#317, F7): the service that mints an entry's own names key and
+ * `edge` (#317, F7): the service that mints an entry's own edge key and
  * holds the Cloudflare token `<username>.<org domain>` claims use, so no
  * hosting entry ever holds that credential itself.
  */
-export type PlatformServiceKey = 'auth' | 'mail' | 'sfu' | 'files' | 'ai' | 'jobs' | 'integrations' | 'archon' | 'names';
+export type PlatformServiceKey = 'auth' | 'mail' | 'sfu' | 'files' | 'ai' | 'jobs' | 'integrations' | 'archon' | 'edge';
 export declare const PLATFORM_SERVICE_KEYS: readonly PlatformServiceKey[];
 /**
  * The one shared platform every org's services run on -- decided in #165 as
@@ -67,7 +67,7 @@ export interface DeclaredPlatform {
     integrations: PlatformService;
     archon: PlatformService;
     /** #317 (F7). No deploy step reads this service's own `gitRef` yet -- `N1` is deployed by hand until it exists. */
-    names: PlatformService;
+    edge: PlatformService;
 }
 /** `<service>.<apex>` -- the default `hostname` for a platform service, before an operator overrides it. */
 export declare function defaultPlatformHostname(service: PlatformServiceKey, apex: string): string;

package/dist/platform.js

@@ -9,7 +9,7 @@ export const PLATFORM_SERVICE_KEYS = [
     'jobs',
     'integrations',
     'archon',
-    'names',
+    'edge',
 ];
 /** `<service>.<apex>` -- the default `hostname` for a platform service, before an operator overrides it. */
 export function defaultPlatformHostname(service, apex) {