@wtfalch/foundry 0.19.0 → 0.20.0

package/dist/plan/executor.js

@@ -2,7 +2,7 @@ import { randomBytes } from 'node:crypto';
 import { URL } from 'node:url';
 import { CALLS_SFU_PRIVATE_URL, CALLS_SFU_PUBLIC_URL } from '../calls-sfu.js';
 import { APP_ENTRY_KEY, appEntry, filesCollectionEnvName, ownerMailboxRecorded, ownerMailboxes, sharedSecretRef, } from '../org.js';
-import { AGORA_ACTIVATED_ENV_SCOPE_KEY, AGORA_APP_PORTS_EXPOSES, AGORA_CLIENT_ID_SCOPE_KEY, AGORA_DEPLOYED_SCOPE_KEY, APP_CLIENT_ID_SCOPE_KEY, CALLS_INTROSPECTION_SCOPE_KEY, CALLS_INTROSPECTION_UNDELIVERED_SCOPE_KEY, CALLS_SERVICE_NAME_SCOPE_KEY, CALLS_SERVICE_PORT, CALLS_SERVICE_TOKEN_ENV_SCOPE_KEY, CHAT_SERVICE_URL_SCOPE_KEY, CMS_CLIENT_ID_SCOPE_KEY, ENTRY_CLIENT_ID_SCOPE_PREFIX, ZITADEL_MESSAGING_PROJECT_SCOPE_KEY, ZITADEL_ORG_SCOPE_KEY, agoraEnvDrift, agoraEnvRevision, agoraHostnameFor, callsIntrospectionAppName, callsServiceHasName, callsServiceInternalName, callsTokenEnvMarker, callsTokenEnvMovedMessage, desiredAgoraEnv, entryClientIdScopeKey, } from './agora.js';
+import { AGORA_ACTIVATED_ENV_SCOPE_KEY, AGORA_APP_PORTS_EXPOSES, AGORA_CLIENT_ID_SCOPE_KEY, AGORA_DEPLOYED_SCOPE_KEY, APP_CLIENT_ID_SCOPE_KEY, CALLS_INTROSPECTION_SCOPE_KEY, CALLS_INTROSPECTION_UNDELIVERED_SCOPE_KEY, CALLS_SERVICE_NAME_SCOPE_KEY, CALLS_SERVICE_PORT, CALLS_SERVICE_TOKEN_ENV_SCOPE_KEY, CHAT_INTROSPECTION_SCOPE_KEY, CHAT_INTROSPECTION_UNDELIVERED_SCOPE_KEY, CHAT_SERVICE_URL_SCOPE_KEY, CMS_CLIENT_ID_SCOPE_KEY, ENTRY_CLIENT_ID_SCOPE_PREFIX, ZITADEL_MESSAGING_PROJECT_SCOPE_KEY, ZITADEL_ORG_SCOPE_KEY, agoraEnvDrift, agoraEnvRevision, agoraHostnameFor, callsIntrospectionAppName, callsServiceHasName, callsServiceInternalName, callsTokenEnvMarker, callsTokenEnvMovedMessage, chatIntrospectionAppName, desiredAgoraEnv, entryClientIdScopeKey, } from './agora.js';
 import { BOULE_BROKER_ENTRY_KEY, BOULE_CLIENT_ID_SCOPE_KEY, BOULE_DATABASE_SCOPE_KEY, BOULE_DEPLOYED_SCOPE_KEY, bouleEnvDrift, bouleHostnameFor, desiredBouleEnv, wantedBouleBrokerEntry, } from './boule.js';
 import { brokerEntryAppliedScopeKey, brokerEntryWarningsScopeKey, entryAuthEnv, entryAuthEnvAppliedScopeKey, wantedBrokerEntry, writeBrokerEntry, } from './broker-entries.js';
 import { MAS_IMAGE, MAS_TAG, SYNAPSE_IMAGE, SYNAPSE_TAG, callsMasConfigYaml, callsServerName, callsSynapseHomeserverYaml, mintCallsMatrixSecrets, parseCallsDbUrl, } from './calls-matrix.js';
@@ -10,8 +10,13 @@ import { CHAT_REPO, CHAT_SERVICE_DOCKERFILE, CHAT_SERVICE_PORT, CHAT_SYNAPSE_DOC
 import { ensureCloudflaredConnector } from './cloudflared-connector.js';
 import { CORE_FILES_COLLECTION_NAME, FILES_CORE_COLLECTION_SCOPE_KEY, ZITADEL_FILES_PROJECT_SCOPE_KEY, } from './core-files.js';
 import { DEFAULT_AI_LIMIT_MICROS } from './diff.js';
+import { createEdgeAccess, } from './edge-access.js';
+import { EDGE_DNS_WRITE_CONCURRENCY, createEdgeDns, limiter, } from './edge-dns.js';
+import { createEdgeRateLimits, } from './edge-ratelimits.js';
+import { createEdgeTunnels } from './edge-tunnels.js';
+import { createEdgeZones } from './edge-zones.js';
 import { AI_ENTRY_RENEW_WINDOW_DAYS, entryAiAppliedScopeKey, entryAiClampedScopeKey, entryAiExpiresScopeKey, entryAiPendingExpiresScopeKey, entryAiRetiredScopeKey, entryAiUndeliveredScopeKey, entryAiUnrevokedScopeKey, entryAiWebhookPendingScopeKey, entryAiWrittenScopeKey, parseIdList, } from './entry-ai-key.js';
-import { EDGE_ENTRY_KEY_DAYS, EDGE_RESERVED_LABELS_APPLIED_SCOPE_KEY, ENTRY_EDGE_KEY_DELIVERY_ATTEMPTS, entryEdgeMintedAtScopeKey, entryEdgeRetiredScopeKey, entryEdgeUndeliveredScopeKey, } from './entry-edge-key.js';
+import { BOULE_EDGE_ENTRY_KEY, EDGE_ENTRY_KEY_DAYS, EDGE_RESERVED_LABELS_APPLIED_SCOPE_KEY, ENTRY_EDGE_KEY_DELIVERY_ATTEMPTS, edgeKeyAppRecordKey, entryEdgeMintedAtScopeKey, entryEdgeRetiredScopeKey, entryEdgeUndeliveredScopeKey, } from './entry-edge-key.js';
 import { FILES_AGORA_KEY_SCOPE_KEY, FILES_AGORA_UNDELIVERED_SCOPE_KEY, FILES_KEY_DAYS, FILES_KEY_RENEW_WINDOW_DAYS, FILES_ORG_OWNER_SCOPE_KEY, FILES_ROOT_EXPIRES_SCOPE_KEY, FILES_ROOT_PREVIOUS_SCOPE_KEY, FILES_ROOT_UNDELIVERED_SCOPE_KEY, FILES_ROOT_UNREVOKED_SCOPE_KEY, entryFilesAppliedScopeKey, entryFilesExpiresScopeKey, entryFilesMinterScopeKey, entryFilesPendingExpiresScopeKey, entryFilesRetiredScopeKey, entryFilesUndeliveredScopeKey, entryFilesUnrevokedScopeKey, entryFilesWrittenScopeKey, filesOwnerUserId, parseIdList as parseFilesIdList, } from './entry-files-key.js';
 import { appHostname, coolifyDomains, entryHostnames, tunnelDnsHostnames, tunnelIngressHostnames, } from './hostnames.js';
 import { LOGIN_BINDING_SCOPE_KEY, LOGIN_HOST_PENDING_REMOVAL_SCOPE_KEY, LOGIN_HOST_SHARED_SCOPE_KEY, loginBindingState, loginHostClientIds, pendingRemovalHosts, pendingRemovalState, } from './login-host.js';
@@ -479,6 +484,16 @@ const MAIL_ROLE_MAILBOXES_SCOPE_KEY = 'mail_role_mailboxes';
 const AI_KEY_UNDELIVERED_SCOPE_KEY = 'ai_key_undelivered';
 /** How many times `aiKey` tries `deliverSecret` before giving up. */
 const AI_KEY_DELIVERY_ATTEMPTS = 3;
+/**
+ * #515: the limit `aiBudget` last applied, a flat scope id (no `:`) alongside
+ * `AI_KEY_UNDELIVERED_SCOPE_KEY`'s own. AI's `updateBudget` offers no read
+ * back, so nothing else can tell `diff.ts`'s `planAiBudget` the limit is
+ * already live -- without this, every plan for an applied org proposed
+ * setting it again. `providers-readers.ts`'s `ProvidersAiReader` keeps its
+ * own copy of this literal, the same "restated, not shared" choice this
+ * codebase already makes for `cloudflare_zone`/`zitadel_org`.
+ */
+const AI_BUDGET_LIMIT_SCOPE_KEY = 'ai_budget_limit_micros';
 const DAY_MS = 24 * 60 * 60 * 1000;
 /** What a failed files call says about itself: its HTTP status, never its message, which can echo a value. */
 function filesErrorCause(error) {
@@ -640,6 +655,12 @@ export const databaseStartWait = {
 // ---------------------------------------------------------------------------
 export class FoundryStepExecutor {
     ports;
+    edgeDns;
+    edgeTunnels;
+    edgeAccess;
+    edgeRateLimits;
+    edgeZones;
+    edgeWriteSlot;
     constructor(ports) {
         this.ports = ports;
     }
@@ -686,7 +707,7 @@ export class FoundryStepExecutor {
             case 'ai:organisation':
                 return this.aiOrganisation(action, org);
             case 'ai:budget':
-                return this.aiBudget(action, org);
+                return this.aiBudget(action, org, context);
             case 'ai:key':
                 // The org's own key is keyed `<orgId>`, an entry's `<orgId>:<entry>` (F6a).
                 return action.key.includes(':')
@@ -774,7 +795,7 @@ export class FoundryStepExecutor {
                 // `everyone` is Cloudflare's own shape for "match every visitor".
                 return { decision: 'bypass', include: [{ everyone: {} }] };
             case 'service-token': {
-                const token = await this.ports.cloudflare.findServiceTokenByName(rule.serviceTokenName);
+                const token = await this.accessPort().findServiceTokenByName(rule.serviceTokenName);
                 if (!token) {
                     throw new Error(`cloudflare:access for ${org.slug}: no Cloudflare Access service token named '${rule.serviceTokenName}'`);
                 }
@@ -788,7 +809,7 @@ export class FoundryStepExecutor {
      */
     async cloudflareAccessApp(org, opts) {
         const { appName, domain, policyName, policy } = opts;
-        const cf = this.ports.cloudflare;
+        const cf = this.accessPort();
         const onDomain = (await cf.listAccessApps()).filter((a) => a.domain === domain);
         const foreign = onDomain.find((a) => a.name !== appName);
         if (foreign) {
@@ -812,12 +833,10 @@ export class FoundryStepExecutor {
      * gate), so `org.domain` is set and that zone is the org's alone, never
      * shared with another org the way `oikos.host` is.
      *
-     * Rate limiting rules attach to a zone's `http_ratelimit` phase entry
-     * point ruleset, one `GET`/`PUT` pair per zone (`@wtfalch/providers` 0.5.0
-     * has no typed method for either -- `CloudflarePort.request`'s own doc
-     * comment) -- so "find by name" here means reading that one ruleset's
-     * `rules[]` and matching `RATE_LIMIT_RULE_DESCRIPTION`, the same shape
-     * `cloudflareAccess` above finds its own Access app by name. The Free
+     * Rate limiting rules go through edge (`RateLimitPort`) -- so "find by
+     * name" here means listing the zone's rules and matching
+     * `RATE_LIMIT_RULE_DESCRIPTION`, the same shape `cloudflareAccess` above
+     * finds its own Access app by name. The Free
      * plan allows exactly one rule per zone, so a rule already there under a
      * different description is refused, never adopted or replaced, mirroring
      * `cloudflareAccess`'s own refusal when a foreign Access app already
@@ -827,40 +846,33 @@ export class FoundryStepExecutor {
         if (!org.domain) {
             throw new Error(`cloudflare:ratelimit for ${org.slug}: hosting.usesDomain is set but domain is null`);
         }
-        const cf = this.ports.cloudflare;
+        const cf = this.zonePort();
         const zone = await cf.findZoneByApex(org.domain);
         if (!zone) {
             throw new Error(`cloudflare:ratelimit for ${org.slug}: no Cloudflare zone found for ${org.domain} -- cloudflare:zone must provision it first`);
         }
-        const path = `/zones/${zone.id}/rulesets/phases/http_ratelimit/entrypoint`;
-        const existing = await cf.request('GET', path, undefined, true);
-        const rules = existing?.rules ?? [];
+        const rateLimits = this.rateLimitPort();
+        const rules = await rateLimits.listRateLimitRules(zone.id);
         const own = rules.find((r) => r.description === RATE_LIMIT_RULE_DESCRIPTION);
-        if (own)
-            return { resourceId: own.id };
-        const foreign = rules.find((r) => r.description !== RATE_LIMIT_RULE_DESCRIPTION);
-        if (foreign) {
-            throw new Error(`cloudflare:ratelimit for ${org.slug}: zone ${org.domain} already has a rate limiting rule ('${foreign.description ?? foreign.id}') foundry did not create; the Free plan allows only one rule per zone, so foundry does not adopt or replace it`);
-        }
-        const updated = await cf.request('PUT', path, {
-            rules: [
-                {
-                    description: RATE_LIMIT_RULE_DESCRIPTION,
-                    expression: SIGN_IN_PATH_EXPRESSION,
-                    action: 'block',
-                    ratelimit: {
-                        characteristics: ['cf.colo.id', 'ip.src'],
-                        period: RATE_LIMIT_FREE_PLAN_PERIOD_SECONDS,
-                        requests_per_period: RATE_LIMIT_REQUESTS_PER_PERIOD,
-                        mitigation_timeout: RATE_LIMIT_FREE_PLAN_PERIOD_SECONDS,
-                    },
-                },
-            ],
-        });
-        const created = updated.rules?.[0];
-        if (!created) {
-            throw new Error(`cloudflare:ratelimit for ${org.slug}: PUT ${path} did not return the created rule`);
+        if (!own) {
+            const foreign = rules[0];
+            if (foreign) {
+                throw new Error(`cloudflare:ratelimit for ${org.slug}: zone ${org.domain} already has a rate limiting rule ('${foreign.description ?? foreign.id}') foundry did not create; the Free plan allows only one rule per zone, so foundry does not adopt or replace it`);
+            }
         }
+        // Edge adopts a live rule with no edge row (made before edge owned rate
+        // limits) and then makes the rule once: a repeat returns it unchanged.
+        const created = await rateLimits.createRateLimitRule(zone.id, {
+            description: RATE_LIMIT_RULE_DESCRIPTION,
+            expression: SIGN_IN_PATH_EXPRESSION,
+            action: 'block',
+            ratelimit: {
+                characteristics: ['cf.colo.id', 'ip.src'],
+                period: RATE_LIMIT_FREE_PLAN_PERIOD_SECONDS,
+                requests_per_period: RATE_LIMIT_REQUESTS_PER_PERIOD,
+                mitigation_timeout: RATE_LIMIT_FREE_PLAN_PERIOD_SECONDS,
+            },
+        });
         return { resourceId: created.id };
     }
     /**
@@ -913,7 +925,7 @@ export class FoundryStepExecutor {
         if (!org.domain) {
             throw new Error(`${at}: worker needs org.domain, and validateHosting already refuses it without one`);
         }
-        const zone = await this.ports.cloudflare.findZoneByApex(org.domain);
+        const zone = await this.zonePort().findZoneByApex(org.domain);
         if (!zone) {
             throw new Error(`${at}: no Cloudflare zone found for ${org.domain} -- cloudflare:zone must provision it first`);
         }
@@ -1066,7 +1078,7 @@ export class FoundryStepExecutor {
             throw new Error(`${at}: a route is recorded but its zone is not, so foundry cannot tell which zone holds it; refuses to forget it`);
         }
         const { id, apex } = JSON.parse(recordedZone);
-        const zone = await this.ports.cloudflare.findZoneByApex(apex);
+        const zone = await this.zonePort().findZoneByApex(apex);
         return zone && zone.id === id ? id : undefined;
     }
     /** Deletes the route an interrupted apply was creating, if `findRoute` shows it exists, points at that apply's script, and is not `keepRouteId`. */
@@ -2481,11 +2493,11 @@ export class FoundryStepExecutor {
             scopedProjectIds.push(platformLettermintProjectId);
         }
         await this.ports.lettermint.restrictDomainToProjects(domain.id, scopedProjectIds);
-        const zone = await this.ports.cloudflare.findZoneByApex(mailDomain);
+        const zone = await this.zonePort().findZoneByApex(mailDomain);
         if (!zone) {
             throw new Error(`Lettermint for ${org.slug}: no Cloudflare zone found for ${mailDomain}`);
         }
-        await this.publishLettermintDnsRecords(zone.id, domain.dnsRecords);
+        await this.publishLettermintDnsRecords(zone.name, domain.dnsRecords);
         await this.ports.lettermint.verifyDomain(domain.id);
     }
     /**
@@ -3079,6 +3091,74 @@ export class FoundryStepExecutor {
         }
     }
     // ---- chat -----------------------------------------------------------------
+    /**
+     * The chat service's introspection client: an API app in the org's
+     * messaging project (the audience Agora's token carries), so ZITADEL's
+     * introspection accepts it. The chat service authenticates as it with
+     * `client_secret_basic`. Minted once, the way {@link callsTokenEnvs} does:
+     * the id is recorded under an undelivered key and persisted before the
+     * secret leaves, the secret goes to `deliverSecret` and to the caller's env
+     * write, never to a log, error or return beyond that. A re-run reads the id
+     * and secret back from the service's own env and mints nothing. `changed`
+     * is true only for a fresh mint.
+     */
+    async ensureChatIntrospection(org, zitadelOrgId, projectId, serviceAppId, context) {
+        const recorded = context.recordedIds();
+        const done = recorded[CHAT_INTROSPECTION_SCOPE_KEY];
+        const undelivered = recorded[CHAT_INTROSPECTION_UNDELIVERED_SCOPE_KEY];
+        if (done) {
+            const envs = await this.ports.coolify.listEnvs(serviceAppId);
+            const read = (key) => envs.find((e) => e.key === key && !e.is_preview)?.value;
+            const clientId = read('CHAT_INTROSPECTION_CLIENT_ID');
+            const clientSecret = read('CHAT_INTROSPECTION_CLIENT_SECRET');
+            if (!clientId || !clientSecret) {
+                throw new Error(`coolify:chat for ${org.slug}: the introspection client (ZITADEL app ${done}) is recorded but its id or secret is no longer on the service; remove the recorded keys ${CHAT_INTROSPECTION_SCOPE_KEY} and ${CHAT_INTROSPECTION_UNDELIVERED_SCOPE_KEY}, and delete the ZITADEL client, to mint a new one`);
+            }
+            return { clientId, clientSecret, appId: done, changed: false };
+        }
+        if (undelivered) {
+            // A minted client with no marker: a crash or failure after the mint.
+            // Both values on the service mean the write landed and only the marker
+            // was lost; otherwise nothing usable was delivered, and the app is
+            // deleted below and made again.
+            const envs = await this.ports.coolify.listEnvs(serviceAppId);
+            const read = (key) => envs.find((e) => e.key === key && !e.is_preview)?.value;
+            const clientId = read('CHAT_INTROSPECTION_CLIENT_ID');
+            const clientSecret = read('CHAT_INTROSPECTION_CLIENT_SECRET');
+            if (clientId && clientSecret) {
+                return { clientId, clientSecret, appId: undelivered, changed: false };
+            }
+        }
+        // An app by this name with no recorded secret is a crash between create
+        // and record: nothing was delivered, so it is deleted and made again.
+        const stale = (await this.ports.zitadel.listApps(zitadelOrgId, projectId)).apps.filter((app) => app.name === chatIntrospectionAppName(org) && app.state !== 'APP_STATE_REMOVED');
+        const staleIds = new Set(stale.map((app) => app.id));
+        if (undelivered)
+            staleIds.add(undelivered);
+        for (const id of staleIds) {
+            try {
+                await this.ports.zitadel.deleteApp(zitadelOrgId, projectId, id);
+            }
+            catch (error) {
+                if (!isNotFoundError(error))
+                    throw error;
+            }
+        }
+        const client = await this.ports.zitadel.createApiApp(zitadelOrgId, projectId, {
+            name: chatIntrospectionAppName(org),
+        });
+        context.recordScopeId(CHAT_INTROSPECTION_UNDELIVERED_SCOPE_KEY, client.appId);
+        await context.persistScopeIds();
+        if (!(await this.deliverWithRetry(`zitadel:chat:${org.slug}:introspection`, client.clientSecret))) {
+            throw new Error(`coolify:chat for ${org.slug}: the introspection client secret (ZITADEL app ${client.appId}) could not be delivered after ${JOBS_DELIVERY_ATTEMPTS} attempts`);
+        }
+        return {
+            clientId: client.clientId,
+            clientSecret: client.clientSecret,
+            appId: client.appId,
+            changed: true,
+        };
+    }
     /**
      * Creates the `chat.admin` role on the org's messaging project and grants
      * it to each owner whose invite is recorded (`zitadel:owner:<orgId>:<email>`,
@@ -3147,6 +3227,29 @@ export class FoundryStepExecutor {
                 context.recordScopeId(markerKey, '1');
                 return { resourceId: serviceAppId };
             }
+            // `planChat` plans this for a live chat whose service has no
+            // introspection client: mint it once, push only its two env vars and
+            // redeploy. Never the re-key paths or a fresh provision.
+            if (action.desired.refreshIntrospection === true) {
+                const serviceAppId = recorded[CHAT_SERVICE_SCOPE_KEY];
+                const zitadelOrgId = recorded[ZITADEL_ORG_SCOPE_KEY];
+                const projectId = recorded[ZITADEL_MESSAGING_PROJECT_SCOPE_KEY];
+                if (!serviceAppId || !zitadelOrgId || !projectId) {
+                    throw new Error(`coolify:chat introspection for ${org.slug}: the chat service app, the ZITADEL org or the messaging project is not recorded yet`);
+                }
+                const hadMarker = Boolean(recorded[CHAT_INTROSPECTION_SCOPE_KEY]);
+                const client = await this.ensureChatIntrospection(org, zitadelOrgId, projectId, serviceAppId, context);
+                await this.ports.coolify.bulkUpsertEnvs(serviceAppId, [
+                    { key: 'CHAT_INTROSPECTION_CLIENT_ID', value: client.clientId },
+                    { key: 'CHAT_INTROSPECTION_CLIENT_SECRET', value: client.clientSecret },
+                ]);
+                // Deploy first, marker last: a failed deploy leaves the marker unset,
+                // so the next plan still carries this step and the container gets the env.
+                if (client.changed || !hadMarker)
+                    await this.ports.coolify.deploy(serviceAppId);
+                context.recordScopeId(CHAT_INTROSPECTION_SCOPE_KEY, client.appId);
+                return { resourceId: serviceAppId };
+            }
             if (action.desired.usesDomain === false) {
                 throw new NotBuiltError(`coolify:chat reverse re-key for ${org.slug}`, 'moving its chat back onto the original server_name is not built (#7 amendment 3)');
             }
@@ -3280,6 +3383,7 @@ export class FoundryStepExecutor {
             rsaKeyPem: secrets.value.masRsaKeyPem,
             ecKeyPem: secrets.value.masEcKeyPem,
         }));
+        const introspection = await this.ensureChatIntrospection(org, zitadelOrgId, project.id, service.appId, context);
         await this.ports.coolify.bulkUpsertEnvs(service.appId, chatServiceEnvs({
             orgSlug: org.slug,
             companyName: org.displayName,
@@ -3289,6 +3393,8 @@ export class FoundryStepExecutor {
             agoraHost,
             masClientId: secrets.value.masClientId,
             masClientSecret: secrets.value.masClientSecret,
+            introspectionClientId: introspection.clientId,
+            introspectionClientSecret: introspection.clientSecret,
         }));
         // Split the same way `coolifyApp`'s and `cmsSite`'s own databases are
         // (#239, #456): `DATABASE_URL_OWNER` is the superuser string,
@@ -3306,11 +3412,14 @@ export class FoundryStepExecutor {
         for (const app of [mas, synapse, service]) {
             if (!app.existed ||
                 secrets.changed ||
-                (app === service && serviceDbPush.changed) ||
+                (app === service && (serviceDbPush.changed || introspection.changed)) ||
                 !isRunningOrStarting((await this.ports.coolify.getApplication(app.appId)).status)) {
                 await this.ports.coolify.deploy(app.appId);
             }
         }
+        // After the write and the deploys, so a failure before them leaves the
+        // marker unset and the next apply repeats the step.
+        context.recordScopeId(CHAT_INTROSPECTION_SCOPE_KEY, introspection.appId);
         // #456: recorded here too, not only on the `refreshDatabaseSplit` replan
         // path above -- without it a fresh provision's very first apply never
         // sets this marker, so `planChat` (`!recordedIds[serviceDbEnvAppliedScopeKey('chat')]`)
@@ -3837,6 +3946,87 @@ export class FoundryStepExecutor {
             throw new Error('ai: this executor was built without an ai port (#177)');
         return port;
     }
+    /**
+     * Every DNS record call runs through edge (`edge.dns`, the platform
+     * credential), adopting live records before it first changes them. `dns` on
+     * the ports is a seam for a host or test that supplies its own {@link DnsPort}.
+     */
+    dnsPort() {
+        if (this.ports.dns)
+            return this.ports.dns;
+        if (!this.ports.edge) {
+            throw new Error('dns: this executor was built without an EdgePort (F4.dns)');
+        }
+        this.edgeWriteSlot ??= limiter(EDGE_DNS_WRITE_CONCURRENCY);
+        this.edgeDns ??= createEdgeDns(this.ports.edge.dns, { writeSlot: this.edgeWriteSlot });
+        return this.edgeDns;
+    }
+    /**
+     * Every tunnel call runs through edge (`edge.tunnels`, the platform
+     * credential), adopting a live tunnel before it first configures, reads the
+     * token of or deletes it. Shares edge's write slot with {@link dnsPort}.
+     */
+    tunnelPort() {
+        if (this.ports.tunnels)
+            return this.ports.tunnels;
+        if (!this.ports.edge) {
+            throw new Error('tunnels: this executor was built without an EdgePort (F4.tunnels)');
+        }
+        this.edgeWriteSlot ??= limiter(EDGE_DNS_WRITE_CONCURRENCY);
+        this.edgeTunnels ??= createEdgeTunnels(this.ports.edge.tunnels, {
+            writeSlot: this.edgeWriteSlot,
+        });
+        return this.edgeTunnels;
+    }
+    /**
+     * Every Access call runs through edge (`edge.access`, the platform
+     * credential), adopting a live app before it first adds a policy to or
+     * deletes it. Shares edge's write slot with {@link dnsPort}.
+     */
+    accessPort() {
+        if (this.ports.access)
+            return this.ports.access;
+        if (!this.ports.edge) {
+            throw new Error('access: this executor was built without an EdgePort (F4.access)');
+        }
+        this.edgeWriteSlot ??= limiter(EDGE_DNS_WRITE_CONCURRENCY);
+        this.edgeAccess ??= createEdgeAccess(this.ports.edge.access, {
+            writeSlot: this.edgeWriteSlot,
+        });
+        return this.edgeAccess;
+    }
+    /**
+     * Every rate limiting rule call runs through edge (`edge.ratelimits`, the
+     * platform credential), adopting the live rule before it first creates it.
+     * Shares edge's write slot with {@link dnsPort}.
+     */
+    rateLimitPort() {
+        if (this.ports.ratelimits)
+            return this.ports.ratelimits;
+        if (!this.ports.edge) {
+            throw new Error('ratelimits: this executor was built without an EdgePort (F4.ratelimits)');
+        }
+        this.edgeWriteSlot ??= limiter(EDGE_DNS_WRITE_CONCURRENCY);
+        this.edgeRateLimits ??= createEdgeRateLimits(this.ports.edge.ratelimits, {
+            writeSlot: this.edgeWriteSlot,
+        });
+        return this.edgeRateLimits;
+    }
+    /**
+     * Every zone lookup and create runs through edge (`edge.zones`, the
+     * platform credential), adopting a live zone before it first creates it.
+     * Shares edge's write slot with {@link dnsPort}.
+     */
+    zonePort() {
+        if (this.ports.zones)
+            return this.ports.zones;
+        if (!this.ports.edge) {
+            throw new Error('zones: this executor was built without an EdgePort (F4.zones)');
+        }
+        this.edgeWriteSlot ??= limiter(EDGE_DNS_WRITE_CONCURRENCY);
+        this.edgeZones ??= createEdgeZones(this.ports.edge.zones, { writeSlot: this.edgeWriteSlot });
+        return this.edgeZones;
+    }
     async jobsPort(org) {
         const port = this.ports.jobsScheduler ?? (await this.ports.platformOrg?.jobs());
         if (!port) {
@@ -3905,7 +4095,7 @@ export class FoundryStepExecutor {
             }
             // Cleared, not deleted (#7 corrections 1): an ingress with only the
             // mandatory catch-all routes nothing.
-            await this.ports.cloudflare.putTunnelConfig(tunnelId, {
+            await this.tunnelPort().putTunnelConfig(tunnelId, {
                 ingress: [{ service: 'http_status:404' }],
             });
             // #235: park stops the connector too -- an ingress with nothing
@@ -3931,8 +4121,9 @@ export class FoundryStepExecutor {
         // domain declared still leaves `destroy` a way to recognise the old
         // id's CNAMEs as this tunnel's own rather than a foreign record.
         const recordedTunnelId = context.recordedIds()[`cloudflare:tunnel:${action.key}`];
-        const existing = await this.ports.cloudflare.findTunnelByName(tunnelName);
-        const tunnel = existing ?? (await this.ports.cloudflare.createTunnel(tunnelName));
+        const tunnels = this.tunnelPort();
+        const existing = await tunnels.findTunnelByName(tunnelName);
+        const tunnel = existing ?? (await tunnels.createTunnel(tunnelName));
         const previousIds = parseTunnelPreviousIds(context.recordedIds());
         if (recordedTunnelId && recordedTunnelId !== tunnel.id) {
             previousIds.add(recordedTunnelId);
@@ -3959,7 +4150,7 @@ export class FoundryStepExecutor {
             hostname,
             service: COOLIFY_PROXY_ORIGIN,
         }));
-        await this.ports.cloudflare.putTunnelConfig(tunnel.id, {
+        await this.tunnelPort().putTunnelConfig(tunnel.id, {
             ingress: [...ingress, { service: 'http_status:404' }],
         });
         // #235: a connector for this org's own tunnel, the same call every
@@ -3973,7 +4164,7 @@ export class FoundryStepExecutor {
         const { environment } = await this.ports.coolify.findOrCreateEnvironment(projectUuid, 'production');
         await ensureCloudflaredConnector({
             coolify: this.ports.coolify,
-            cloudflare: this.ports.cloudflare,
+            tunnels: this.tunnelPort(),
             tunnelId: tunnel.id,
             appName: `${org.slug}-cloudflared`,
             projectUuid,
@@ -4104,7 +4295,7 @@ export class FoundryStepExecutor {
      * nothing of this domain's left in that set either way.
      */
     async deleteStaleTunnelDnsRecords(tunnelId, previousIds, previousDomain, previousHostnames, context) {
-        const zone = await this.ports.cloudflare.findZoneByApex(previousDomain);
+        const zone = await this.zonePort().findZoneByApex(previousDomain);
         if (!zone)
             return;
         const dnsTargets = new Set([`${tunnelId}.cfargotunnel.com`]);
@@ -4112,13 +4303,13 @@ export class FoundryStepExecutor {
             if (id !== tunnelId)
                 dnsTargets.add(`${id}.cfargotunnel.com`);
         }
-        const cf = this.ports.cloudflare;
+        const dns = this.dnsPort();
         const records = previousHostnames.length > 0
-            ? (await Promise.all(previousHostnames.map((hostname) => cf.findDnsRecord(zone.id, hostname, 'CNAME')))).flat()
-            : await cf.listDnsRecords(zone.id, { type: 'CNAME' });
+            ? (await Promise.all(previousHostnames.map((hostname) => dns.findDnsRecord(zone.name, hostname, 'CNAME')))).flat()
+            : await dns.listDnsRecords(zone.name, { type: 'CNAME' });
         for (const record of records) {
             if (dnsTargets.has(record.content)) {
-                await cf.deleteDnsRecord(zone.id, record.id);
+                await dns.deleteDnsRecord(zone.name, record.id);
             }
         }
         if (previousHostnames.length > 0) {
@@ -4186,8 +4377,8 @@ export class FoundryStepExecutor {
      * both read this set.
      */
     async publishTunnelDnsRecords(org, domain, tunnelId, previousIds, previousHostnames, context) {
-        const cf = this.ports.cloudflare;
-        const zone = await cf.findZoneByApex(domain);
+        const dns = this.dnsPort();
+        const zone = await this.zonePort().findZoneByApex(domain);
         if (!zone) {
             throw new Error(`cloudflare:tunnel for ${org.slug}: no Cloudflare zone found for ${domain} to point its hostnames at -- cloudflare:zone must provision it first`);
         }
@@ -4199,14 +4390,14 @@ export class FoundryStepExecutor {
         const toCreate = [];
         const toRepoint = [];
         for (const hostname of hostnames) {
-            const [a] = await cf.findDnsRecord(zone.id, hostname, 'A');
-            const [aaaa] = await cf.findDnsRecord(zone.id, hostname, 'AAAA');
+            const [a] = await dns.findDnsRecord(zone.name, hostname, 'A');
+            const [aaaa] = await dns.findDnsRecord(zone.name, hostname, 'AAAA');
             const foreign = a ?? aaaa;
             if (foreign) {
                 conflicts.push(`${hostname} already has a ${foreign.type} record`);
                 continue;
             }
-            const [cname] = await cf.findDnsRecord(zone.id, hostname, 'CNAME');
+            const [cname] = await dns.findDnsRecord(zone.name, hostname, 'CNAME');
             if (cname && cname.content !== dnsTarget) {
                 if (previousTargets.has(cname.content)) {
                     toRepoint.push({ hostname, recordId: cname.id });
@@ -4238,7 +4429,7 @@ export class FoundryStepExecutor {
         for (const hostname of settled)
             recordTracked(hostname);
         for (const hostname of toCreate) {
-            await cf.createDnsRecord(zone.id, {
+            await dns.createDnsRecord(zone.name, {
                 type: 'CNAME',
                 name: hostname,
                 content: dnsTarget,
@@ -4247,7 +4438,7 @@ export class FoundryStepExecutor {
             recordTracked(hostname);
         }
         for (const { hostname, recordId } of toRepoint) {
-            await cf.updateDnsRecord(zone.id, recordId, {
+            await dns.updateDnsRecord(zone.name, recordId, {
                 type: 'CNAME',
                 name: hostname,
                 content: dnsTarget,
@@ -4266,9 +4457,9 @@ export class FoundryStepExecutor {
         // tracking under `domain`, so it is dropped from the shared set either
         // way.
         for (const hostname of droppedHostnames) {
-            const [cname] = await cf.findDnsRecord(zone.id, hostname, 'CNAME');
+            const [cname] = await dns.findDnsRecord(zone.name, hostname, 'CNAME');
             if (cname && (cname.content === dnsTarget || previousTargets.has(cname.content))) {
-                await cf.deleteDnsRecord(zone.id, cname.id);
+                await dns.deleteDnsRecord(zone.name, cname.id);
             }
             tracked.delete(trackedTunnelDnsEntry(domain, hostname));
             context.recordScopeId(CLOUDFLARE_TUNNEL_DNS_TRACKED_SCOPE_KEY, trackedTunnelDnsState(tracked));
@@ -4302,7 +4493,7 @@ export class FoundryStepExecutor {
      */
     async cloudflareZone(action, org, context) {
         const domain = action.key;
-        const cf = this.ports.cloudflare;
+        const cf = this.zonePort();
         const existing = await cf.findZoneByApex(domain);
         if (existing) {
             const owner = await this.ports.declaredOrgStore.findOrgIdForZone(existing.id);
@@ -4503,12 +4694,12 @@ export class FoundryStepExecutor {
      * publishes it.
      */
     async publishMailDnsRecords(org, result) {
-        const zone = await this.ports.cloudflare.findZoneByApex(result.domain);
+        const zone = await this.zonePort().findZoneByApex(result.domain);
         if (!zone) {
             throw new Error(`coolify:mail for ${org.slug}: no Cloudflare zone found for ${result.domain}`);
         }
         for (const record of result.records) {
-            await this.upsertMailDnsRecord(zone.id, record);
+            await this.upsertMailDnsRecord(zone.name, record);
         }
     }
     /**
@@ -4522,7 +4713,7 @@ export class FoundryStepExecutor {
      * a record someone proxied by hand is put back. An `MX` record carries the
      * priority it was given, which Cloudflare requires.
      *
-     * Found by an exact name+type match (`CloudflarePort.findDnsRecord`'s own
+     * Found by an exact name+type match (`DnsPort.findDnsRecord`'s own
      * doc comment) so a stale record of a different type is never taken for a
      * match. A name can hold several `TXT` records (an apex often holds a site
      * verification beside SPF), so a `TXT` record only replaces one that
@@ -4531,8 +4722,8 @@ export class FoundryStepExecutor {
      * whatever it was.
      */
     async upsertMailDnsRecord(zoneId, record) {
-        const cf = this.ports.cloudflare;
-        const found = await cf.findDnsRecord(zoneId, record.name, record.type);
+        const dns = this.dnsPort();
+        const found = await dns.findDnsRecord(zoneId, record.name, record.type);
         const existing = record.type === 'TXT'
             ? found.find((r) => txtRecordTag(r.content) === txtRecordTag(record.value))
             : found[0];
@@ -4544,10 +4735,10 @@ export class FoundryStepExecutor {
             ...(record.priority === undefined ? {} : { priority: record.priority }),
         };
         if (existing) {
-            await cf.updateDnsRecord(zoneId, existing.id, rec);
+            await dns.updateDnsRecord(zoneId, existing.id, rec);
         }
         else {
-            await cf.createDnsRecord(zoneId, rec);
+            await dns.createDnsRecord(zoneId, rec);
         }
     }
     /**
@@ -4603,13 +4794,13 @@ export class FoundryStepExecutor {
      * `dkim_secondary`, none of them SPF -- so that merge has no case left to
      * handle here and is dropped rather than kept as dead code.
      */
-    async publishLettermintDnsRecords(zoneId, records) {
+    async publishLettermintDnsRecords(zone, records) {
         for (const record of records) {
             if (record.type === 'TXT' && record.value.toLowerCase().startsWith('v=dmarc1')) {
-                await this.ensureLettermintDmarcRecord(this.ports.cloudflare, zoneId, record);
+                await this.ensureLettermintDmarcRecord(this.dnsPort(), zone, record);
                 continue;
             }
-            await this.upsertMailDnsRecord(zoneId, record);
+            await this.upsertMailDnsRecord(zone, record);
         }
     }
     /**
@@ -4617,11 +4808,11 @@ export class FoundryStepExecutor {
      * already set (`p=quarantine`/`p=reject`) should not be relaxed back to
      * Lettermint's own `p=none` default.
      */
-    async ensureLettermintDmarcRecord(cf, zoneId, record) {
-        const hasDmarc = (await cf.findDnsRecord(zoneId, record.name, 'TXT')).some((r) => txtRecordTag(r.content) === 'v=dmarc1');
+    async ensureLettermintDmarcRecord(dns, zoneId, record) {
+        const hasDmarc = (await dns.findDnsRecord(zoneId, record.name, 'TXT')).some((r) => txtRecordTag(r.content) === 'v=dmarc1');
         if (hasDmarc)
             return;
-        await cf.createDnsRecord(zoneId, {
+        await dns.createDnsRecord(zoneId, {
             type: 'TXT',
             name: record.name,
             content: record.value,
@@ -4748,7 +4939,7 @@ export class FoundryStepExecutor {
         await ai.setOrganisationOffers(org.id, action.desired.offers ?? []);
         return { resourceId: provisioned.organisationId };
     }
-    async aiBudget(action, org) {
+    async aiBudget(action, org, context) {
         // #484: ai/packages/sdk/src/types.ts:134-137's UpdateBudget.limitMicros
         // is a required string -- there is no "uncapped" this API can express
         // yet (Finding, this campaign's report) -- so a null `desired.limitMicros`
@@ -4759,6 +4950,10 @@ export class FoundryStepExecutor {
         const limitMicros = action.desired.limitMicros ?? DEFAULT_AI_LIMIT_MICROS;
         const ai = await this.aiPort();
         await ai.updateBudget(org.id, { keyId: null, limitMicros });
+        // #515: recorded only once `updateBudget` has actually succeeded, so a
+        // crash or a thrown call before this line leaves nothing recorded and
+        // the step replans, rather than recording a limit that was never applied.
+        context.recordScopeId(AI_BUDGET_LIMIT_SCOPE_KEY, limitMicros);
         return { resourceId: org.id };
     }
     /**
@@ -5018,7 +5213,7 @@ export class FoundryStepExecutor {
                         throw error;
                 }
             }
-            const appId = recorded[`coolify:app:${action.key}`];
+            const appId = recorded[edgeKeyAppRecordKey(org, entryKey)];
             if (appId) {
                 // A revoked key's env values are dead, not merely stale -- remove
                 // them so nothing reads a credential edge has already revoked. A
@@ -5052,10 +5247,14 @@ export class FoundryStepExecutor {
             context.recordScopeId(entryEdgeRetiredScopeKey(entryKey), keyId);
             return {};
         }
-        const entry = org.hosting.entries.find((e) => e.key === entryKey && e.uses?.edge);
-        if (!entry)
+        if (entryKey === BOULE_EDGE_ENTRY_KEY) {
+            if (!org.domain)
+                throw new Error(`${at}: Boule's edge key needs org.domain`);
+        }
+        else if (!org.hosting.entries.some((e) => e.key === entryKey && e.uses?.edge)) {
             throw new Error(`${at}: the entry no longer declares uses.edge`);
-        const appId = context.recordedIds()[`coolify:app:${action.key}`];
+        }
+        const appId = context.recordedIds()[edgeKeyAppRecordKey(org, entryKey)];
         if (!appId)
             throw new Error(`${at}: the entry's app is not recorded yet`);
         if (!org.domain) {
@@ -5493,15 +5692,15 @@ export class FoundryStepExecutor {
                     }
                     for (const [dnsDomain, dnsHostnames] of hostnamesByDomain) {
                         try {
-                            const zone = await this.ports.cloudflare.findZoneByApex(dnsDomain);
+                            const zone = await this.zonePort().findZoneByApex(dnsDomain);
                             if (zone) {
-                                const cf = this.ports.cloudflare;
+                                const dns = this.dnsPort();
                                 const records = dnsHostnames.length > 0
-                                    ? (await Promise.all(dnsHostnames.map((hostname) => cf.findDnsRecord(zone.id, hostname, 'CNAME')))).flat()
-                                    : await cf.listDnsRecords(zone.id, { type: 'CNAME' });
+                                    ? (await Promise.all(dnsHostnames.map((hostname) => dns.findDnsRecord(zone.name, hostname, 'CNAME')))).flat()
+                                    : await dns.listDnsRecords(zone.name, { type: 'CNAME' });
                                 for (const record of records) {
                                     if (dnsTargets.has(record.content)) {
-                                        await cf.deleteDnsRecord(zone.id, record.id);
+                                        await dns.deleteDnsRecord(zone.name, record.id);
                                     }
                                 }
                             }
@@ -5511,11 +5710,11 @@ export class FoundryStepExecutor {
                                 throw error;
                         }
                     }
-                    await this.ports.cloudflare.deleteTunnel(target.id);
+                    await this.tunnelPort().deleteTunnel(target.id);
                     return;
                 }
                 case 'cloudflare:access':
-                    await this.ports.cloudflare.deleteAccessApp(target.id);
+                    await this.accessPort().deleteAccessApp(target.id);
                     return;
                 case 'ai:key': {
                     // F6a: an entry's key (`<orgId>:<entry>`). REVOKE SEAM (ai#157): a