@wtfalch/foundry 0.19.0 → 0.20.0

package/dist/plan/index.d.ts

@@ -5,7 +5,7 @@ export { computePlanDetail, toPlan } from './diff.js';
 export type { StepSystem } from './step-system.js';
 export { stepSystemOf } from './step-system.js';
 export type { PlatformPlanDetail } from './platform-diff.js';
-export { planPlatform, toPlatformPlan, JOBS_SCHEDULER_KEY, PLATFORM_AI_KEY, PLATFORM_AI_INTERNAL_URL_SCOPE_KEY, PLATFORM_AI_MANAGEMENT_KEY_SCOPE_KEY, PLATFORM_AI_ORGANISATION_SCOPE_KEY, PLATFORM_AUTH_KEY, PLATFORM_FILES_KEY, PLATFORM_FILES_INTERNAL_URL_SCOPE_KEY, PLATFORM_FILES_ZITADEL_PROJECT_SCOPE_KEY, PLATFORM_MAIL_KEY, PLATFORM_MAIL_INTERNAL_URL_SCOPE_KEY, PLATFORM_MAIL_ZITADEL_PROJECT_SCOPE_KEY, PLATFORM_EDGE_KEY, PLATFORM_EDGE_KEY_REF, PLATFORM_EDGE_CLOUDFLARE_TOKEN_REF, } from './platform-diff.js';
+export { planPlatform, toPlatformPlan, JOBS_SCHEDULER_KEY, PLATFORM_AI_KEY, PLATFORM_AI_INTERNAL_URL_SCOPE_KEY, PLATFORM_AI_MANAGEMENT_KEY_SCOPE_KEY, PLATFORM_AI_ORGANISATION_SCOPE_KEY, PLATFORM_AUTH_KEY, PLATFORM_FILES_KEY, PLATFORM_FILES_INTERNAL_URL_SCOPE_KEY, PLATFORM_FILES_ZITADEL_PROJECT_SCOPE_KEY, PLATFORM_MAIL_KEY, PLATFORM_MAIL_INTERNAL_URL_SCOPE_KEY, PLATFORM_MAIL_ZITADEL_PROJECT_SCOPE_KEY, PLATFORM_EDGE_KEY, PLATFORM_EDGE_INTERNAL_URL_SCOPE_KEY, PLATFORM_EDGE_KEY_REF, PLATFORM_EDGE_CLOUDFLARE_TOKEN_REF, } from './platform-diff.js';
 export type { HeldKeyResolver, OrgPlatformReadiness } from './platform-org.js';
 export { DEFAULT_ORG_PLATFORM_READINESS, ORG_PLATFORM_KEY_REFS, agoraHostValuesFromPlatform, heldPlatformKeyRefs, orgPlatformReadinessFrom, } from './platform-org.js';
 export type { PlatformOrgClientFactories } from './platform-org-ports.js';
@@ -15,7 +15,7 @@ export { AdoptRefusedError } from './adopt.js';
 export type { AuditActor, AuditLog, AuthzGate, StepExecutor, StepDestroyer, DestroyTarget, StepExecutionContext, PlatformStepExecutor, PlatformStepExecutionContext, FoundryPlanApplyOptions, } from './plan-apply.js';
 export { FoundryPlanApply, DeclaredOrgNotFoundError, StalePlanError, ConfirmationRequiredError, NotAuthorizedError, NotATestOrgError, DeclaredPlatformNotFoundError, PlatformStalePlanError, PlatformConfirmationRequiredError, planNeedsConfirmation, } from './plan-apply.js';
 export { FoundryPlatformStepExecutor, ProvidersPlatformCloudflareReader, ProvidersPlatformCoolifyReader, PLATFORM_MAIL_ADMIN_KEY_DESCRIPTION, filesPublicHostsValue, filesShareDomains, } from './platform-providers.js';
-export type { PlatformAuthDeps, PlatformAuthRuntime, PlatformFilesDeps, PlatformFilesRuntime, PlatformEdgeDeps, PlatformEdgeRuntime, } from './platform-providers.js';
+export type { PlatformAuthDeps, PlatformAuthRuntime, PlatformFilesDeps, PlatformFilesRuntime, PlatformEdgeDeps, PlatformDnsFactory, PlatformAccessFactory, PlatformAccessPort, PlatformTunnelsFactory, PlatformEdgeRuntime, } from './platform-providers.js';
 export type { PlatformMailDeps, PlatformMailAdminPort, PlatformMailRuntime, } from './platform-providers.js';
 export { FILES_INTROSPECTION_SECRET_REF, FILES_MANAGEMENT_ISSUER, FILES_MANAGEMENT_KEY_ID, FILES_MANAGEMENT_KEY_REF, PLATFORM_AUTH_INSTANCE_BEARER_REF, } from './platform-providers.js';
 export { AI_MANAGEMENT_ISSUER, AI_MANAGEMENT_KEY_ID, AI_SIGNING_KEY_REF, AiManagementKeyExistsError, createAiManagementKeyMinter, PLATFORM_AI_MANAGEMENT_KEY_REF, PLATFORM_AI_MANAGEMENT_PERMISSIONS, } from './platform-providers.js';
@@ -27,7 +27,7 @@ export { MissingCallsSfuConnectionError, applyCallsSfuPlatformStep } from './pla
 export type { MailCopyJob, MailCopyPort, MailCopyStepResult } from './mail-copy.js';
 export { MAIL_COPY_COMPLETED_SCOPE_KEY, MAIL_COPY_DONE_SCOPE_KEY, MissingMailCopyAccountsError, MissingMailCopySourceTokenError, MissingMailCopyStalwartTokenError, parseMailCopyCompleted, runMailCopyStep, } from './mail-copy.js';
 export type { ScopeResolver, RecordedIds } from './providers-readers.js';
-export { ProvidersCloudflareReader, ProvidersCmsReader, ProvidersCoolifyReader, ProvidersZitadelReader, storeScopeResolver, storeRecordedIds, } from './providers-readers.js';
+export { ProvidersAiReader, ProvidersCloudflareReader, ProvidersCmsReader, ProvidersCoolifyReader, ProvidersZitadelReader, storeScopeResolver, storeRecordedIds, } from './providers-readers.js';
 export type { AgoraHostPort, AgoraHostValues } from './agora.js';
 export type { BrokerPort } from './broker-entries.js';
 export { PlatformBrokerPort } from './broker-entries.js';
@@ -39,6 +39,18 @@ export type { MailAllowlistApp } from './mail-identity-allowlist.js';
 export { checkMailAppsAllowlist } from './mail-identity-allowlist.js';
 export type { CoolifyPort, CloudflarePort, ZitadelPort, CallsSfuPort, JobsSchedulerPort, FilesOrganisationPort, AiOrganisationPort, FoundryStepExecutorPorts, PlatformOrgPortSource, } from './executor.js';
 export { FoundryStepExecutor, NotBuiltError, healthUrls } from './executor.js';
+export { createEdgeDns, EDGE_DNS_WRITE_CONCURRENCY } from './edge-dns.js';
+export type { DnsPort, DnsRecordInput, DnsRecordSummary, EdgePlatformDns } from './edge-dns.js';
+export { createEdgeAccess } from './edge-access.js';
+export type { AccessAppSummary, AccessDecision, AccessPolicyRule, AccessPort, EdgePlatformAccess, } from './edge-access.js';
+export { createEdgeWorkers } from './edge-workers.js';
+export type { EdgePlatformWorkers, EdgeWorkersOptions } from './edge-workers.js';
+export { createEdgeRateLimits } from './edge-ratelimits.js';
+export type { EdgePlatformRateLimits, EdgeRateLimitsOptions, RateLimitPort, RateLimitRuleInput, } from './edge-ratelimits.js';
+export { createEdgeZones } from './edge-zones.js';
+export type { EdgePlatformZones, EdgeZonesOptions, ZonePort } from './edge-zones.js';
+export { createEdgeTunnels } from './edge-tunnels.js';
+export type { EdgePlatformTunnels, TunnelIngress, TunnelPort, TunnelSummary, } from './edge-tunnels.js';
 export type { ZitadelListAppsRawApp } from './executor.js';
 export { adaptZitadelListApps } from './executor.js';
 export { HttpJobsSchedulerClient } from './jobs-scheduler-http.js';

package/dist/plan/index.js

@@ -1,7 +1,7 @@
 export { readLiveResources, readLivePlatformResources } from './live.js';
 export { computePlanDetail, toPlan } from './diff.js';
 export { stepSystemOf } from './step-system.js';
-export { planPlatform, toPlatformPlan, JOBS_SCHEDULER_KEY, PLATFORM_AI_KEY, PLATFORM_AI_INTERNAL_URL_SCOPE_KEY, PLATFORM_AI_MANAGEMENT_KEY_SCOPE_KEY, PLATFORM_AI_ORGANISATION_SCOPE_KEY, PLATFORM_AUTH_KEY, PLATFORM_FILES_KEY, PLATFORM_FILES_INTERNAL_URL_SCOPE_KEY, PLATFORM_FILES_ZITADEL_PROJECT_SCOPE_KEY, PLATFORM_MAIL_KEY, PLATFORM_MAIL_INTERNAL_URL_SCOPE_KEY, PLATFORM_MAIL_ZITADEL_PROJECT_SCOPE_KEY, PLATFORM_EDGE_KEY, PLATFORM_EDGE_KEY_REF, PLATFORM_EDGE_CLOUDFLARE_TOKEN_REF, } from './platform-diff.js';
+export { planPlatform, toPlatformPlan, JOBS_SCHEDULER_KEY, PLATFORM_AI_KEY, PLATFORM_AI_INTERNAL_URL_SCOPE_KEY, PLATFORM_AI_MANAGEMENT_KEY_SCOPE_KEY, PLATFORM_AI_ORGANISATION_SCOPE_KEY, PLATFORM_AUTH_KEY, PLATFORM_FILES_KEY, PLATFORM_FILES_INTERNAL_URL_SCOPE_KEY, PLATFORM_FILES_ZITADEL_PROJECT_SCOPE_KEY, PLATFORM_MAIL_KEY, PLATFORM_MAIL_INTERNAL_URL_SCOPE_KEY, PLATFORM_MAIL_ZITADEL_PROJECT_SCOPE_KEY, PLATFORM_EDGE_KEY, PLATFORM_EDGE_INTERNAL_URL_SCOPE_KEY, PLATFORM_EDGE_KEY_REF, PLATFORM_EDGE_CLOUDFLARE_TOKEN_REF, } from './platform-diff.js';
 export { DEFAULT_ORG_PLATFORM_READINESS, ORG_PLATFORM_KEY_REFS, agoraHostValuesFromPlatform, heldPlatformKeyRefs, orgPlatformReadinessFrom, } from './platform-org.js';
 export { PlatformOrgBlockedError, PlatformOrgPorts } from './platform-org-ports.js';
 export { AdoptRefusedError } from './adopt.js';
@@ -14,11 +14,17 @@ export { createZitadelAdminMinter } from './zitadel-machine-user.js';
 export { createZitadelProjectRoles } from './zitadel-project-roles.js';
 export { MissingCallsSfuConnectionError, applyCallsSfuPlatformStep } from './platform-sfu.js';
 export { MAIL_COPY_COMPLETED_SCOPE_KEY, MAIL_COPY_DONE_SCOPE_KEY, MissingMailCopyAccountsError, MissingMailCopySourceTokenError, MissingMailCopyStalwartTokenError, parseMailCopyCompleted, runMailCopyStep, } from './mail-copy.js';
-export { ProvidersCloudflareReader, ProvidersCmsReader, ProvidersCoolifyReader, ProvidersZitadelReader, storeScopeResolver, storeRecordedIds, } from './providers-readers.js';
+export { ProvidersAiReader, ProvidersCloudflareReader, ProvidersCmsReader, ProvidersCoolifyReader, ProvidersZitadelReader, storeScopeResolver, storeRecordedIds, } from './providers-readers.js';
 export { PlatformBrokerPort } from './broker-entries.js';
 export { loginHostnameFor } from './login-host.js';
 export { checkMailIdentityAudience } from './mail-identity.js';
 export { checkMailAppsAllowlist } from './mail-identity-allowlist.js';
 export { FoundryStepExecutor, NotBuiltError, healthUrls } from './executor.js';
+export { createEdgeDns, EDGE_DNS_WRITE_CONCURRENCY } from './edge-dns.js';
+export { createEdgeAccess } from './edge-access.js';
+export { createEdgeWorkers } from './edge-workers.js';
+export { createEdgeRateLimits } from './edge-ratelimits.js';
+export { createEdgeZones } from './edge-zones.js';
+export { createEdgeTunnels } from './edge-tunnels.js';
 export { adaptZitadelListApps } from './executor.js';
 export { HttpJobsSchedulerClient } from './jobs-scheduler-http.js';

package/dist/plan/plan-apply.js

@@ -8,7 +8,7 @@ import { AdoptRefusedError, adoptCandidates, adoptedKeysUnreadable, adoptedScope
 import { NO_AGORA_HOST_VALUES, readAgoraHost, } from './agora.js';
 import { AI_KEY_UNDELIVERED_SCOPE_KEY, JOBS_REGISTRATION_UNDELIVERED_SCOPE_KEY, computePlanDetail, toPlan, } from './diff.js';
 import { entryAiUndeliveredScopeKey } from './entry-ai-key.js';
-import { entryEdgeRetiredScopeKey, entryEdgeUndeliveredScopeKey } from './entry-edge-key.js';
+import { BOULE_EDGE_ENTRY_KEY, entryEdgeRetiredScopeKey, entryEdgeUndeliveredScopeKey, } from './entry-edge-key.js';
 import { FILES_ROOT_UNDELIVERED_SCOPE_KEY, entryFilesUndeliveredScopeKey, } from './entry-files-key.js';
 import { readLivePlatformResources, readLiveResources, } from './live.js';
 import { lockedHostnames } from './locked-hostnames.js';
@@ -1376,6 +1376,10 @@ function failedFields(org, detail, completed, serviceIds) {
             failed.add('hosting.entries.uses.edge');
         }
     }
+    // F3: Boule's own key, wanted whenever the org has a domain.
+    if (org.domain && serviceIds[entryEdgeUndeliveredScopeKey(BOULE_EDGE_ENTRY_KEY)]) {
+        failed.add('hosting.entries.uses.edge');
+    }
     // The same for a jobs registration whose credentials never reached the host.
     if (serviceIds[JOBS_REGISTRATION_UNDELIVERED_SCOPE_KEY] &&
         !serviceIds[`jobs:registration:${org.id}`]) {

package/dist/plan/platform-diff.d.ts

@@ -665,6 +665,15 @@ export declare const PLATFORM_EDGE_PLATFORM_KEY_SET_SCOPE_KEY = "edge_platform_k
  */
 export declare const PLATFORM_EDGE_APPLIED_HOSTNAME_SCOPE_KEY = "edge_applied_hostname";
 export declare const PLATFORM_EDGE_APPLIED_GIT_REF_SCOPE_KEY = "edge_applied_git_ref";
+/**
+ * F4.dns: where edge answers on the Coolify network
+ * (`http://<custom_internal_name>:3000`), recorded by the edge step once the
+ * host reports healthy there. Edge is the only caller of Cloudflare, so every
+ * platform step that writes a DNS record (auth, mail, archon, and edge's own
+ * CNAME) reaches edge at this address, before any public hostname exists
+ * (the {@link PLATFORM_FILES_INTERNAL_URL_SCOPE_KEY} pattern). Not a secret.
+ */
+export declare const PLATFORM_EDGE_INTERNAL_URL_SCOPE_KEY = "edge_platform_internal_url";
 /**
  * Options for {@link planPlatform}, replacing four positional arguments that
  * shifted on every merge that added a platform service (#186, #187, #188) --

package/dist/plan/platform-diff.js

@@ -741,6 +741,15 @@ export const PLATFORM_EDGE_PLATFORM_KEY_SET_SCOPE_KEY = 'edge_platform_key_set';
  */
 export const PLATFORM_EDGE_APPLIED_HOSTNAME_SCOPE_KEY = 'edge_applied_hostname';
 export const PLATFORM_EDGE_APPLIED_GIT_REF_SCOPE_KEY = 'edge_applied_git_ref';
+/**
+ * F4.dns: where edge answers on the Coolify network
+ * (`http://<custom_internal_name>:3000`), recorded by the edge step once the
+ * host reports healthy there. Edge is the only caller of Cloudflare, so every
+ * platform step that writes a DNS record (auth, mail, archon, and edge's own
+ * CNAME) reaches edge at this address, before any public hostname exists
+ * (the {@link PLATFORM_FILES_INTERNAL_URL_SCOPE_KEY} pattern). Not a secret.
+ */
+export const PLATFORM_EDGE_INTERNAL_URL_SCOPE_KEY = 'edge_platform_internal_url';
 /**
  * #167: the platform's own diff engine, mirroring `diff.ts`'s
  * `computePlanDetail` for the one shared {@link DeclaredPlatform} record
@@ -782,7 +791,24 @@ export function planPlatform(platform, live, options = {}) {
     const sfu = platform.sfu.enabled && sfuBlocked ? null : planSfu(platform);
     if (sfu)
         plannedSteps.push(sfu);
-    const auth = planAuth(platform, recordedIds, blocked.auth, blocked.authExecutorMissing ?? false, drifted.auth ?? false, blocked.authOtherInputsMissing ?? []);
+    // #478, F4.dns: first of the services, ahead of auth. Edge is the only
+    // caller of Cloudflare, so auth, mail and archon write their DNS records
+    // through it; it needs none of them (a Coolify database and app, its own
+    // tunnel and DNS record, a held Cloudflare token) and records the address
+    // they reach it at.
+    const edge = planEdge(platform, recordedIds, blocked.edge);
+    if (edge.step)
+        plannedSteps.push(edge.step);
+    // Auth, mail and archon would build their tunnels and then fail at the DNS
+    // write, so while edge is neither applied nor planned in this plan they are
+    // blocked, not planned (rule 2), naming edge as the cause.
+    const edgeApplied = Boolean(recordedIds[PLATFORM_EDGE_INTERNAL_URL_SCOPE_KEY]);
+    const dnsBlocked = edgeApplied || edge.step
+        ? undefined
+        : (service) => `the platform's ${service} is blocked, not planned: every DNS record is written through edge, and edge is neither applied nor planned (${platform.edge.enabled
+            ? (edge.blocked ?? 'its step is not planned')
+            : 'the platform does not enable edge'})`;
+    const auth = planAuth(platform, recordedIds, blocked.auth ?? dnsBlocked?.('sign-in'), blocked.authExecutorMissing ?? false, drifted.auth ?? false, blocked.authOtherInputsMissing ?? []);
     if (auth.step)
         plannedSteps.push(auth.step);
     // #174: the integrations host. Planned after auth; neither step reads the
@@ -798,21 +824,17 @@ export function planPlatform(platform, live, options = {}) {
         plannedSteps.push(files.step);
     // #169: the platform's own mail server. After auth, because its OIDC
     // directory is built against the platform's sign-in.
-    const mail = planMail(platform, recordedIds, blocked.mail, authReady);
+    const mail = planMail(platform, recordedIds, blocked.mail ?? dnsBlocked?.('mail server'), authReady);
     if (mail.step)
         plannedSteps.push(mail.step);
     // #172: a throw halts every step after it, so this one goes late.
     const ai = planAi(platform, recordedIds, blocked.ai);
     if (ai.step)
         plannedSteps.push(ai.step);
-    // #478: independent of auth and files -- the edge host needs neither.
-    const edge = planEdge(platform, recordedIds, blocked.edge);
-    if (edge.step)
-        plannedSteps.push(edge.step);
     // #175: last, on purpose. Archon's sign-in client lives in the sign-in
     // `planAuth` builds, and its env reads what every other service's step
     // records or delivers, so in one apply it runs after all of them.
-    const archon = planArchon(platform, recordedIds, blocked.archon, authReady, drifted.archon);
+    const archon = planArchon(platform, recordedIds, blocked.archon ?? dnsBlocked?.('Archon'), authReady, drifted.archon);
     if (archon.step)
         plannedSteps.push(archon.step);
     // #257: after every service above, so a database any of them just
@@ -1780,7 +1802,9 @@ function planEdge(platform, recordedIds, executorBlocked) {
     }
     const applied = Boolean(recordedIds[resourceKey('coolify', 'app', PLATFORM_EDGE_KEY)]) &&
         recordedIds[PLATFORM_EDGE_APPLIED_HOSTNAME_SCOPE_KEY] === platform.edge.hostname &&
-        recordedIds[PLATFORM_EDGE_APPLIED_GIT_REF_SCOPE_KEY] === platform.edge.gitRef;
+        recordedIds[PLATFORM_EDGE_APPLIED_GIT_REF_SCOPE_KEY] === platform.edge.gitRef &&
+        // F4.dns: an edge applied before its address was recorded runs once more to record it.
+        Boolean(recordedIds[PLATFORM_EDGE_INTERNAL_URL_SCOPE_KEY]);
     if (applied)
         return { step: null, blocked: null };
     if (executorBlocked)

package/dist/plan/platform-providers.d.ts

@@ -3,6 +3,9 @@ import type { DeclaredOrg } from '../org.js';
 import type { DeclaredPlatform } from '../platform.js';
 import type { DeclaredOrgStore, PlatformStore } from '../store.js';
 import type { StepAction } from './diff.js';
+import type { AccessPort } from './edge-access.js';
+import type { DnsPort } from './edge-dns.js';
+import type { TunnelPort } from './edge-tunnels.js';
 import type { CloudflarePort, CoolifyPort, FoundryStepExecutorPorts, ZitadelPort } from './executor.js';
 import type { LiveResource, PlatformCloudflareReader, PlatformCoolifyReader } from './live.js';
 import type { PlatformStepExecutionContext, PlatformStepExecutor } from './plan-apply.js';
@@ -14,6 +17,34 @@ import { type CallsSfuPlatformDeps } from './platform-sfu.js';
  * positions, so every #167-era caller of {@link FoundryPlatformStepExecutor}
  * (zone only) keeps compiling with this third argument simply omitted.
  */
+/**
+ * F4.dns: builds the {@link DnsPort} a platform step writes its records
+ * through, given the address edge answers at on the Coolify network
+ * ({@link PLATFORM_EDGE_INTERNAL_URL_SCOPE_KEY}). The host builds it with
+ * `createEdgeDns(createEdgeClient({ baseUrl, key }).platform.dns)`, `key`
+ * being the platform key held under {@link PLATFORM_EDGE_KEY_REF}.
+ */
+export type PlatformDnsFactory = (edgeUrl: string) => DnsPort | Promise<DnsPort>;
+/**
+ * F4.tunnels: builds the {@link TunnelPort} a platform step creates, configures
+ * and reads the connector token of its tunnel through, given the same address
+ * as {@link PlatformDnsFactory}. The host builds it with
+ * `createEdgeTunnels(createEdgeClient({ baseUrl, key }).platform.tunnels)`,
+ * `key` being the platform key held under {@link PLATFORM_EDGE_KEY_REF}.
+ */
+export type PlatformTunnelsFactory = (edgeUrl: string) => PlatformTunnelPort | Promise<PlatformTunnelPort>;
+/** The tunnel calls a platform step makes; it never deletes one. */
+export type PlatformTunnelPort = Pick<TunnelPort, 'findTunnelByName' | 'createTunnel' | 'putTunnelConfig' | 'getTunnelToken'>;
+/**
+ * F4.access: builds the {@link AccessPort} a platform step finds, creates and
+ * deletes its Access app through, given the same address as
+ * {@link PlatformDnsFactory}. The host builds it with
+ * `createEdgeAccess(createEdgeClient({ baseUrl, key }).platform.access)`,
+ * `key` being the platform key held under {@link PLATFORM_EDGE_KEY_REF}.
+ */
+export type PlatformAccessFactory = (edgeUrl: string) => PlatformAccessPort | Promise<PlatformAccessPort>;
+/** The Access calls a platform step makes. */
+export type PlatformAccessPort = Pick<AccessPort, 'listAccessApps' | 'createAccessApp' | 'listAccessPolicies' | 'createAccessPolicy' | 'deleteAccessApp'>;
 /**
  * The SMTP call `provisionPlatformAuth` makes on the instance's ZITADEL.
  * `@wtfalch/providers` gains it in 0.7.2; stated here so foundry compiles
@@ -35,9 +66,11 @@ export interface PlatformZitadelSmtp {
 }
 export interface PlatformAuthDeps {
     coolify: Pick<CoolifyPort, 'findProjectByName' | 'createProject' | 'findOrCreateEnvironment' | 'listServers' | 'findApplicationByName' | 'getApplication' | 'requireGithubApp' | 'createGithubAppApplication' | 'createDockerImageApplication' | 'createDockerfileApplication' | 'createPostgresDatabase' | 'getDatabase' | 'bulkUpsertEnvs' | 'listEnvs' | 'updateApplication' | 'deploy' | 'raw'>;
-    cloudflare: Pick<CloudflarePort, 'findZoneByApex' | 'findTunnelByName' | 'createTunnel' | 'putTunnelConfig' | 'findDnsRecord' | 'createDnsRecord' | 'updateDnsRecord'
-    /** #197: fetches the tunnel's connector token for {@link ensureCloudflaredConnector}. */
-     | 'getTunnelToken'>;
+    /** F4.dns: every DNS record call, through edge at its recorded address (see {@link PlatformDnsFactory}). */
+    dns: PlatformDnsFactory;
+    /** F4.tunnels: every tunnel call, through edge at its recorded address (see {@link PlatformTunnelsFactory}). */
+    tunnels: PlatformTunnelsFactory;
+    cloudflare: Pick<CloudflarePort, 'findZoneByApex'>;
     /** Must target the platform's own new instance (its issuer), or `zitadelForInstance` must be set. */
     zitadel: Pick<ZitadelPort, 'findOrCreateOrg' | 'mintAdminMachineUser' | 'mintLoginClientMachineUser' | 'listLoginClientPats' | 'inviteOrgOwner'> & PlatformZitadelSmtp;
     /**
@@ -377,7 +410,11 @@ export declare function defaultStalwartForInstance(input: {
  */
 export interface PlatformMailDeps {
     coolify: Pick<CoolifyPort, 'findProjectByName' | 'createProject' | 'findOrCreateEnvironment' | 'listServers' | 'findApplicationByName' | 'getApplication' | 'createDockerImageApplication' | 'createDockerfileApplication' | 'raw' | 'listStorages' | 'createPersistentStorage' | 'bulkUpsertEnvs' | 'listEnvs' | 'updateApplication' | 'deploy' | 'deployAndWait'>;
-    cloudflare: Pick<CloudflarePort, 'findZoneByApex' | 'findTunnelByName' | 'createTunnel' | 'putTunnelConfig' | 'getTunnelToken' | 'findDnsRecord' | 'createDnsRecord' | 'updateDnsRecord'>;
+    /** F4.dns: every DNS record call, through edge at its recorded address (see {@link PlatformDnsFactory}). */
+    dns: PlatformDnsFactory;
+    /** F4.tunnels: every tunnel call, through edge at its recorded address (see {@link PlatformTunnelsFactory}). */
+    tunnels: PlatformTunnelsFactory;
+    cloudflare: Pick<CloudflarePort, 'findZoneByApex'>;
     /**
      * Must target the platform's own ZITADEL instance, or `zitadelForInstance`
      * must be set. `provisionPlatformMail` finds or creates a `mail` project
@@ -421,7 +458,13 @@ export interface PlatformMailRuntime {
  */
 export interface PlatformArchonDeps {
     coolify: Pick<CoolifyPort, 'findProjectByName' | 'createProject' | 'findOrCreateEnvironment' | 'listServers' | 'findApplicationByName' | 'getApplication' | 'requireGithubApp' | 'createGithubAppApplication' | 'createDockerfileApplication' | 'listDatabases' | 'createPostgresDatabase' | 'getDatabase' | 'raw' | 'bulkUpsertEnvs' | 'listEnvs' | 'deleteEnv' | 'updateApplication' | 'deploy' | 'deployAndWait'>;
-    cloudflare: Pick<CloudflarePort, 'findZoneByApex' | 'findTunnelByName' | 'createTunnel' | 'putTunnelConfig' | 'getTunnelToken' | 'findDnsRecord' | 'createDnsRecord' | 'updateDnsRecord' | 'listAccessApps' | 'createAccessApp' | 'listAccessPolicies' | 'createAccessPolicy' | 'deleteAccessApp'>;
+    /** F4.dns: every DNS record call, through edge at its recorded address (see {@link PlatformDnsFactory}). */
+    dns: PlatformDnsFactory;
+    /** F4.tunnels: every tunnel call, through edge at its recorded address (see {@link PlatformTunnelsFactory}). */
+    tunnels: PlatformTunnelsFactory;
+    /** F4.access: every Access app call, through edge at its recorded address (see {@link PlatformAccessFactory}). */
+    access: PlatformAccessFactory;
+    cloudflare: Pick<CloudflarePort, 'findZoneByApex'>;
     /** Must target the platform's own ZITADEL instance, or `zitadelForInstance` must be set. */
     zitadel: Pick<ZitadelPort, 'findOrCreateOrg' | 'findOrCreateProject' | 'createOidcApp' | 'listApps' | 'deleteApp'>;
     /** {@link PlatformAuthDeps.zitadelForInstance}, for Archon's sign-in client. */
@@ -834,7 +877,11 @@ export interface PlatformEdgeRuntime {
 }
 export interface PlatformEdgeDeps {
     coolify: Pick<CoolifyPort, 'findProjectByName' | 'createProject' | 'findOrCreateEnvironment' | 'listServers' | 'findApplicationByName' | 'getApplication' | 'requireGithubApp' | 'createGithubAppApplication' | 'createDockerfileApplication' | 'listDatabases' | 'createPostgresDatabase' | 'getDatabase' | 'bulkUpsertEnvs' | 'listEnvs' | 'updateApplication' | 'deploy' | 'deployAndWait' | 'raw'>;
-    cloudflare: Pick<CloudflarePort, 'findZoneByApex' | 'findTunnelByName' | 'createTunnel' | 'putTunnelConfig' | 'getTunnelToken' | 'findDnsRecord' | 'createDnsRecord' | 'updateDnsRecord'>;
+    /** F4.dns: every DNS record call, through edge at its recorded address (see {@link PlatformDnsFactory}). */
+    dns: PlatformDnsFactory;
+    /** F4.tunnels: every tunnel call, through edge at its recorded address (see {@link PlatformTunnelsFactory}). */
+    tunnels: PlatformTunnelsFactory;
+    cloudflare: Pick<CloudflarePort, 'findZoneByApex'>;
     deliverSecret: FoundryStepExecutorPorts['deliverSecret'];
     /**
      * Reads the edge service's own Cloudflare API token back, held under

package/dist/plan/platform-providers.js

@@ -7,7 +7,7 @@ import { ensureCloudflaredConnector } from './cloudflared-connector.js';
 import { waitForDeploymentFinished, waitForHealthyVersion, waitForNewDeployment, } from './deploy-health.js';
 import { ACCESS_POLICY_NAME, getDatabaseStarted, isNotFoundError, isRunningOrStarting, } from './executor.js';
 import { coolifyDomains, filesShareHostname } from './hostnames.js';
-import { AUTH_ZITADEL_RUN_OPTIONS, JOBS_SCHEDULER_KEY, PLATFORM_AI_APPLIED_GITREF_SCOPE_KEY, PLATFORM_AI_APPLIED_HOSTNAME_SCOPE_KEY, PLATFORM_AI_DEPLOY_PENDING_SCOPE_KEY, PLATFORM_AI_INTERNAL_URL_SCOPE_KEY, PLATFORM_AI_KEY, PLATFORM_AI_MANAGEMENT_KEY_CONFLICT_SCOPE_KEY, PLATFORM_AI_MANAGEMENT_KEY_SCOPE_KEY, PLATFORM_AI_MANAGEMENT_KEY_UNDELIVERED_SCOPE_KEY, PLATFORM_AI_MIGRATE_BLOCKED_SCOPE_KEY, PLATFORM_AI_ORGANISATION_SCOPE_KEY, PLATFORM_AI_SIGNING_KEY_SET_SCOPE_KEY, PLATFORM_AI_SIGNING_KEY_UNDELIVERED_SCOPE_KEY, PLATFORM_ARCHON_APPLIED_BROKER_SCOPE_KEY, PLATFORM_ARCHON_APPLIED_GIT_REF_SCOPE_KEY, PLATFORM_ARCHON_APPLIED_HOSTNAME_SCOPE_KEY, PLATFORM_ARCHON_APPLIED_OPERATOR_SCOPE_KEY, PLATFORM_ARCHON_APPLIED_ROLLING_UPDATE_SCOPE_KEY, PLATFORM_ARCHON_CONNECTOR_APP_SCOPE_KEY, PLATFORM_ARCHON_COOLIFY_READ_TOKEN_REF, PLATFORM_ARCHON_ENVS_DEPLOYED_SCOPE_KEY, PLATFORM_ARCHON_GATE_CLOSED_SCOPE_KEY, PLATFORM_ARCHON_INTEGRATIONS_KEY_SYNCED_SCOPE_KEY, PLATFORM_ARCHON_KEY, PLATFORM_ARCHON_MASTER_CLOUDFLARE_TOKEN_REF, PLATFORM_ARCHON_MASTER_COOLIFY_TOKEN_REF, PLATFORM_ARCHON_MASTER_COOLIFY_URL_REF, PLATFORM_AUTH_ADMIN_UNDELIVERED_SCOPE_KEY, PLATFORM_AUTH_ADMIN_USER_SCOPE_KEY, PLATFORM_AUTH_BROKER_DEPLOYED_SCOPE_KEY, PLATFORM_AUTH_BROKER_SCOPE_KEY, PLATFORM_AUTH_CONNECTOR_APP_SCOPE_KEY, PLATFORM_AUTH_INSTANCE_SCOPE_KEY, PLATFORM_AUTH_INSTANCE_UNDELIVERED_SCOPE_KEY, PLATFORM_AUTH_KEY, PLATFORM_AUTH_LOGIN_CLIENT_UNDELIVERED_SCOPE_KEY, PLATFORM_AUTH_LOGIN_CLIENT_USER_SCOPE_KEY, PLATFORM_AUTH_OWNER_INVITE_SCOPE_KEY, PLATFORM_AUTH_SMTP_SCOPE_KEY, PLATFORM_AUTH_ZITADEL_APPLIED_IMAGE_TAG_SCOPE_KEY, PLATFORM_AUTH_ZITADEL_RUN_OPTIONS_SCOPE_KEY, PLATFORM_BACKUP_DATABASE_SCOPE_KEYS, PLATFORM_BACKUP_SERVICE_KEYS, PLATFORM_EDGE_APPLIED_GIT_REF_SCOPE_KEY, PLATFORM_EDGE_APPLIED_HOSTNAME_SCOPE_KEY, PLATFORM_EDGE_CLOUDFLARE_TOKEN_REF, PLATFORM_EDGE_KEY, PLATFORM_EDGE_KEY_REF, PLATFORM_EDGE_PLATFORM_KEY_SET_SCOPE_KEY, PLATFORM_EDGE_PLATFORM_KEY_UNDELIVERED_SCOPE_KEY, PLATFORM_FILES_APPLIED_GIT_REF_SCOPE_KEY, PLATFORM_FILES_APPLIED_HOSTNAME_SCOPE_KEY, PLATFORM_FILES_INTERNAL_URL_SCOPE_KEY, PLATFORM_FILES_INTROSPECTION_SCOPE_KEY, PLATFORM_FILES_INTROSPECTION_UNDELIVERED_SCOPE_KEY, PLATFORM_FILES_KEY, PLATFORM_FILES_MANAGEMENT_KEY_SCOPE_KEY, PLATFORM_FILES_MANAGEMENT_UNDELIVERED_SCOPE_KEY, PLATFORM_FILES_ZITADEL_PROJECT_SCOPE_KEY, PLATFORM_INTEGRATIONS_APPLIED_GITREF_SCOPE_KEY, PLATFORM_INTEGRATIONS_APPLIED_HOSTNAME_SCOPE_KEY, PLATFORM_INTEGRATIONS_KEY, PLATFORM_INTEGRATIONS_KEY_ID_SCOPE_KEY, PLATFORM_INTEGRATIONS_KEY_ROTATION_PREVIOUS_SCOPE_KEY, PLATFORM_INTEGRATIONS_KEY_ROTATION_REQUESTED_SCOPE_KEY, PLATFORM_INTEGRATIONS_KEY_ROTATION_UNDELIVERED_SCOPE_KEY, PLATFORM_INTEGRATIONS_KEY_SET_SCOPE_KEY, PLATFORM_INTEGRATIONS_KEY_UNDELIVERED_SCOPE_KEY, PLATFORM_INTEGRATIONS_RUNNER_KEYRING_DEPLOYED_SCOPE_KEY, PLATFORM_MAIL_ADMIN_KEY_SCOPE_KEY, PLATFORM_MAIL_ADMIN_UNDELIVERED_SCOPE_KEY, PLATFORM_MAIL_APPLIED_GIT_REF_SCOPE_KEY, PLATFORM_MAIL_APPLIED_HOSTNAME_SCOPE_KEY, PLATFORM_MAIL_CONNECTOR_APP_SCOPE_KEY, PLATFORM_MAIL_INTERNAL_URL_SCOPE_KEY, PLATFORM_MAIL_KEY, PLATFORM_MAIL_ZITADEL_PROJECT_SCOPE_KEY, archonBootstrapOperator, parseBrokerDeployRecord, parseLoginClientRecord, platformMailMxHost, } from './platform-diff.js';
+import { AUTH_ZITADEL_RUN_OPTIONS, JOBS_SCHEDULER_KEY, PLATFORM_AI_APPLIED_GITREF_SCOPE_KEY, PLATFORM_AI_APPLIED_HOSTNAME_SCOPE_KEY, PLATFORM_AI_DEPLOY_PENDING_SCOPE_KEY, PLATFORM_AI_INTERNAL_URL_SCOPE_KEY, PLATFORM_AI_KEY, PLATFORM_AI_MANAGEMENT_KEY_CONFLICT_SCOPE_KEY, PLATFORM_AI_MANAGEMENT_KEY_SCOPE_KEY, PLATFORM_AI_MANAGEMENT_KEY_UNDELIVERED_SCOPE_KEY, PLATFORM_AI_MIGRATE_BLOCKED_SCOPE_KEY, PLATFORM_AI_ORGANISATION_SCOPE_KEY, PLATFORM_AI_SIGNING_KEY_SET_SCOPE_KEY, PLATFORM_AI_SIGNING_KEY_UNDELIVERED_SCOPE_KEY, PLATFORM_ARCHON_APPLIED_BROKER_SCOPE_KEY, PLATFORM_ARCHON_APPLIED_GIT_REF_SCOPE_KEY, PLATFORM_ARCHON_APPLIED_HOSTNAME_SCOPE_KEY, PLATFORM_ARCHON_APPLIED_OPERATOR_SCOPE_KEY, PLATFORM_ARCHON_APPLIED_ROLLING_UPDATE_SCOPE_KEY, PLATFORM_ARCHON_CONNECTOR_APP_SCOPE_KEY, PLATFORM_ARCHON_COOLIFY_READ_TOKEN_REF, PLATFORM_ARCHON_ENVS_DEPLOYED_SCOPE_KEY, PLATFORM_ARCHON_GATE_CLOSED_SCOPE_KEY, PLATFORM_ARCHON_INTEGRATIONS_KEY_SYNCED_SCOPE_KEY, PLATFORM_ARCHON_KEY, PLATFORM_ARCHON_MASTER_CLOUDFLARE_TOKEN_REF, PLATFORM_ARCHON_MASTER_COOLIFY_TOKEN_REF, PLATFORM_ARCHON_MASTER_COOLIFY_URL_REF, PLATFORM_AUTH_ADMIN_UNDELIVERED_SCOPE_KEY, PLATFORM_AUTH_ADMIN_USER_SCOPE_KEY, PLATFORM_AUTH_BROKER_DEPLOYED_SCOPE_KEY, PLATFORM_AUTH_BROKER_SCOPE_KEY, PLATFORM_AUTH_CONNECTOR_APP_SCOPE_KEY, PLATFORM_AUTH_INSTANCE_SCOPE_KEY, PLATFORM_AUTH_INSTANCE_UNDELIVERED_SCOPE_KEY, PLATFORM_AUTH_KEY, PLATFORM_AUTH_LOGIN_CLIENT_UNDELIVERED_SCOPE_KEY, PLATFORM_AUTH_LOGIN_CLIENT_USER_SCOPE_KEY, PLATFORM_AUTH_OWNER_INVITE_SCOPE_KEY, PLATFORM_AUTH_SMTP_SCOPE_KEY, PLATFORM_AUTH_ZITADEL_APPLIED_IMAGE_TAG_SCOPE_KEY, PLATFORM_AUTH_ZITADEL_RUN_OPTIONS_SCOPE_KEY, PLATFORM_BACKUP_DATABASE_SCOPE_KEYS, PLATFORM_BACKUP_SERVICE_KEYS, PLATFORM_EDGE_APPLIED_GIT_REF_SCOPE_KEY, PLATFORM_EDGE_APPLIED_HOSTNAME_SCOPE_KEY, PLATFORM_EDGE_CLOUDFLARE_TOKEN_REF, PLATFORM_EDGE_INTERNAL_URL_SCOPE_KEY, PLATFORM_EDGE_KEY, PLATFORM_EDGE_KEY_REF, PLATFORM_EDGE_PLATFORM_KEY_SET_SCOPE_KEY, PLATFORM_EDGE_PLATFORM_KEY_UNDELIVERED_SCOPE_KEY, PLATFORM_FILES_APPLIED_GIT_REF_SCOPE_KEY, PLATFORM_FILES_APPLIED_HOSTNAME_SCOPE_KEY, PLATFORM_FILES_INTERNAL_URL_SCOPE_KEY, PLATFORM_FILES_INTROSPECTION_SCOPE_KEY, PLATFORM_FILES_INTROSPECTION_UNDELIVERED_SCOPE_KEY, PLATFORM_FILES_KEY, PLATFORM_FILES_MANAGEMENT_KEY_SCOPE_KEY, PLATFORM_FILES_MANAGEMENT_UNDELIVERED_SCOPE_KEY, PLATFORM_FILES_ZITADEL_PROJECT_SCOPE_KEY, PLATFORM_INTEGRATIONS_APPLIED_GITREF_SCOPE_KEY, PLATFORM_INTEGRATIONS_APPLIED_HOSTNAME_SCOPE_KEY, PLATFORM_INTEGRATIONS_KEY, PLATFORM_INTEGRATIONS_KEY_ID_SCOPE_KEY, PLATFORM_INTEGRATIONS_KEY_ROTATION_PREVIOUS_SCOPE_KEY, PLATFORM_INTEGRATIONS_KEY_ROTATION_REQUESTED_SCOPE_KEY, PLATFORM_INTEGRATIONS_KEY_ROTATION_UNDELIVERED_SCOPE_KEY, PLATFORM_INTEGRATIONS_KEY_SET_SCOPE_KEY, PLATFORM_INTEGRATIONS_KEY_UNDELIVERED_SCOPE_KEY, PLATFORM_INTEGRATIONS_RUNNER_KEYRING_DEPLOYED_SCOPE_KEY, PLATFORM_MAIL_ADMIN_KEY_SCOPE_KEY, PLATFORM_MAIL_ADMIN_UNDELIVERED_SCOPE_KEY, PLATFORM_MAIL_APPLIED_GIT_REF_SCOPE_KEY, PLATFORM_MAIL_APPLIED_HOSTNAME_SCOPE_KEY, PLATFORM_MAIL_CONNECTOR_APP_SCOPE_KEY, PLATFORM_MAIL_INTERNAL_URL_SCOPE_KEY, PLATFORM_MAIL_KEY, PLATFORM_MAIL_ZITADEL_PROJECT_SCOPE_KEY, archonBootstrapOperator, parseBrokerDeployRecord, parseLoginClientRecord, platformMailMxHost, } from './platform-diff.js';
 import { applyCallsSfuPlatformStep } from './platform-sfu.js';
 import { CreateInstanceError, createZitadelInstance, generateSystemApiKeypair, instanceWithoutBearerMessage, systemApiUsersEnv, } from './zitadel-system-api.js';
 /** The key `runPlatformSteps` records the apex zone's id under (`system:kind:key`). */
@@ -16,6 +16,35 @@ function apexZoneKey(apex) {
 }
 /** The key `runPlatformSteps` records the jobs scheduler app's id under (`system:kind:key`, #173). */
 const JOBS_APP_KEY = `coolify:jobs:${JOBS_SCHEDULER_KEY}`;
+/**
+ * The DNS port for a platform step: edge's recorded address, never a public
+ * hostname, because auth, mail and archon write their records before any of
+ * those exist. Edge's step runs first and records the address
+ * (`planPlatform`), so a missing one means that step has not finished.
+ */
+async function platformDns(deps, recorded, step) {
+    const edgeUrl = recorded[PLATFORM_EDGE_INTERNAL_URL_SCOPE_KEY];
+    if (!edgeUrl) {
+        throw new Error(`${step}: edge has not been applied yet (no recorded ${PLATFORM_EDGE_INTERNAL_URL_SCOPE_KEY}); platform:edge runs first and every DNS record is written through it`);
+    }
+    return deps.dns(edgeUrl);
+}
+/** The tunnel port for a platform step; same address and same reason as {@link platformDns}. */
+async function platformTunnels(deps, recorded, step) {
+    const edgeUrl = recorded[PLATFORM_EDGE_INTERNAL_URL_SCOPE_KEY];
+    if (!edgeUrl) {
+        throw new Error(`${step}: edge has not been applied yet (no recorded ${PLATFORM_EDGE_INTERNAL_URL_SCOPE_KEY}); platform:edge runs first and every tunnel is managed through it`);
+    }
+    return deps.tunnels(edgeUrl);
+}
+/** The Access port for a platform step; same address and same reason as {@link platformDns}. */
+async function platformAccess(deps, recorded, step) {
+    const edgeUrl = recorded[PLATFORM_EDGE_INTERNAL_URL_SCOPE_KEY];
+    if (!edgeUrl) {
+        throw new Error(`${step}: edge has not been applied yet (no recorded ${PLATFORM_EDGE_INTERNAL_URL_SCOPE_KEY}); platform:edge runs first and every Access app is managed through it`);
+    }
+    return deps.access(edgeUrl);
+}
 /**
  * #173: the jobs scheduler's own Coolify project and database, flat scope
  * ids recorded via `PlatformStepExecutionContext.recordScopeId` -- not
@@ -271,7 +300,7 @@ export class FoundryPlatformStepExecutor {
         if (platform.archon.enabled &&
             this.archon &&
             recordedIds[`coolify:app:${PLATFORM_ARCHON_KEY}`]) {
-            const accessDrifted = await archonAccessDrifted(this.archon.cloudflare, platform.archon.hostname, this.archon.accessEmails);
+            const accessDrifted = await archonAccessDrifted(this.archon, recordedIds, platform.archon.hostname, this.archon.accessEmails);
             const brokerDrifted = !accessDrifted && (await archonBrokerRegistrationDrifted(this.archon.coolify, recordedIds));
             const bootstrapOperatorDrifted = !accessDrifted &&
                 !brokerDrifted &&
@@ -1193,10 +1222,11 @@ async function provisionPlatformAuth(context, deps, owners = []) {
         await record(PLATFORM_AUTH_BROKER_DEPLOYED_SCOPE_KEY, brokerDeployRecordValue(brokerAppId, authAppsRaw));
     }
     // ---- tunnel and DNS ------------------------------------------------------
-    const existingTunnel = await deps.cloudflare.findTunnelByName(PLATFORM_AUTH_TUNNEL_NAME);
-    const tunnel = existingTunnel ?? (await deps.cloudflare.createTunnel(PLATFORM_AUTH_TUNNEL_NAME));
+    const tunnels = await platformTunnels(deps, context.recordedIds(), 'platform:auth');
+    const existingTunnel = await tunnels.findTunnelByName(PLATFORM_AUTH_TUNNEL_NAME);
+    const tunnel = existingTunnel ?? (await tunnels.createTunnel(PLATFORM_AUTH_TUNNEL_NAME));
     await record(PLATFORM_AUTH_TUNNEL_SCOPE_KEY, tunnel.id);
-    await deps.cloudflare.putTunnelConfig(tunnel.id, {
+    await tunnels.putTunnelConfig(tunnel.id, {
         ingress: [
             {
                 hostname,
@@ -1221,7 +1251,7 @@ async function provisionPlatformAuth(context, deps, owners = []) {
     // step's own tunnel only (see this function's doc comment).
     await ensureCloudflaredConnector({
         coolify: deps.coolify,
-        cloudflare: deps.cloudflare,
+        tunnels,
         tunnelId: tunnel.id,
         appName: PLATFORM_AUTH_CLOUDFLARED_APP_NAME,
         projectUuid,
@@ -1237,9 +1267,10 @@ async function provisionPlatformAuth(context, deps, owners = []) {
         throw new Error(`platform:auth: no Cloudflare zone for ${platform.apex} to put ${hostname} in`);
     }
     const dnsTarget = `${tunnel.id}.cfargotunnel.com`;
-    const [dnsRecord] = await deps.cloudflare.findDnsRecord(zoneId, hostname, 'CNAME');
+    const dns = await platformDns(deps, context.recordedIds(), 'platform:auth');
+    const [dnsRecord] = await dns.findDnsRecord(platform.apex, hostname, 'CNAME');
     if (!dnsRecord) {
-        await deps.cloudflare.createDnsRecord(zoneId, {
+        await dns.createDnsRecord(platform.apex, {
             type: 'CNAME',
             name: hostname,
             content: dnsTarget,
@@ -1247,7 +1278,7 @@ async function provisionPlatformAuth(context, deps, owners = []) {
         });
     }
     else if (dnsRecord.content !== dnsTarget) {
-        await deps.cloudflare.updateDnsRecord(zoneId, dnsRecord.id, {
+        await dns.updateDnsRecord(platform.apex, dnsRecord.id, {
             type: 'CNAME',
             name: hostname,
             content: dnsTarget,
@@ -1884,10 +1915,11 @@ async function provisionPlatformMail(context, deps) {
         await record(PLATFORM_MAIL_DEPLOYED_GIT_REF_SCOPE_KEY, imageTag);
     }
     // ---- tunnel and DNS: web/JMAP/management ------------------------------------
-    const existingTunnel = await deps.cloudflare.findTunnelByName(PLATFORM_MAIL_TUNNEL_NAME);
-    const tunnel = existingTunnel ?? (await deps.cloudflare.createTunnel(PLATFORM_MAIL_TUNNEL_NAME));
+    const tunnels = await platformTunnels(deps, context.recordedIds(), 'platform:mail');
+    const existingTunnel = await tunnels.findTunnelByName(PLATFORM_MAIL_TUNNEL_NAME);
+    const tunnel = existingTunnel ?? (await tunnels.createTunnel(PLATFORM_MAIL_TUNNEL_NAME));
     await record(PLATFORM_MAIL_TUNNEL_SCOPE_KEY, tunnel.id);
-    await deps.cloudflare.putTunnelConfig(tunnel.id, {
+    await tunnels.putTunnelConfig(tunnel.id, {
         ingress: [
             {
                 hostname,
@@ -1899,7 +1931,7 @@ async function provisionPlatformMail(context, deps) {
     // #197: without a connector, `hostname` answers with a Cloudflare error.
     await ensureCloudflaredConnector({
         coolify: deps.coolify,
-        cloudflare: deps.cloudflare,
+        tunnels,
         tunnelId: tunnel.id,
         appName: PLATFORM_MAIL_CLOUDFLARED_APP_NAME,
         projectUuid,
@@ -1914,9 +1946,10 @@ async function provisionPlatformMail(context, deps) {
         throw new Error(`platform:mail: no Cloudflare zone for ${platform.apex} to put ${hostname} in`);
     }
     const dnsTarget = `${tunnel.id}.cfargotunnel.com`;
-    const [dnsRecord] = await deps.cloudflare.findDnsRecord(zoneId, hostname, 'CNAME');
+    const dns = await platformDns(deps, context.recordedIds(), 'platform:mail');
+    const [dnsRecord] = await dns.findDnsRecord(platform.apex, hostname, 'CNAME');
     if (!dnsRecord) {
-        await deps.cloudflare.createDnsRecord(zoneId, {
+        await dns.createDnsRecord(platform.apex, {
             type: 'CNAME',
             name: hostname,
             content: dnsTarget,
@@ -1924,7 +1957,7 @@ async function provisionPlatformMail(context, deps) {
         });
     }
     else if (dnsRecord.content !== dnsTarget) {
-        await deps.cloudflare.updateDnsRecord(zoneId, dnsRecord.id, {
+        await dns.updateDnsRecord(platform.apex, dnsRecord.id, {
             type: 'CNAME',
             name: hostname,
             content: dnsTarget,
@@ -1933,9 +1966,9 @@ async function provisionPlatformMail(context, deps) {
     }
     // ---- the MX hostname: a direct, unproxied A record --------------------------
     const serverIp = (platform.serverIpv4 ?? server.ip); // checked by mailServerIpBlocked above
-    const [mxRecord] = await deps.cloudflare.findDnsRecord(zoneId, mailHost, 'A');
+    const [mxRecord] = await dns.findDnsRecord(platform.apex, mailHost, 'A');
     if (!mxRecord) {
-        await deps.cloudflare.createDnsRecord(zoneId, {
+        await dns.createDnsRecord(platform.apex, {
             type: 'A',
             name: mailHost,
             content: serverIp,
@@ -1943,7 +1976,7 @@ async function provisionPlatformMail(context, deps) {
         });
     }
     else if (mxRecord.content !== serverIp) {
-        await deps.cloudflare.updateDnsRecord(zoneId, mxRecord.id, {
+        await dns.updateDnsRecord(platform.apex, mxRecord.id, {
             type: 'A',
             name: mailHost,
             content: serverIp,
@@ -2878,17 +2911,19 @@ async function provisionPlatformArchon(context, deps) {
         await record(PLATFORM_AUTH_BROKER_DEPLOYED_SCOPE_KEY, brokerDeployRecordValue(brokerAppId, desiredAuthAppsRaw));
     }
     // ---- Cloudflare Access, before the hostname resolves ----------------------
+    const tunnels = await platformTunnels(deps, context.recordedIds(), 'platform:archon');
+    const access = await platformAccess(deps, context.recordedIds(), 'platform:archon');
     let gateClosed = Boolean(recorded[PLATFORM_ARCHON_GATE_CLOSED_SCOPE_KEY]);
-    const accessAppId = await ensureArchonAccess(deps.cloudflare, hostname, deps.accessEmails, async () => {
+    const accessAppId = await ensureArchonAccess(access, hostname, deps.accessEmails, async () => {
         // The Access app is about to be rebuilt: answer 404 for every hostname
         // meanwhile, so it is never served without the gate. The marker is
         // persisted first: a failure before the real ingress is written back
         // leaves it set, and the next plan repairs the step.
         gateClosed = true;
         await record(PLATFORM_ARCHON_GATE_CLOSED_SCOPE_KEY, '1');
-        const tunnel = await deps.cloudflare.findTunnelByName(PLATFORM_ARCHON_TUNNEL_NAME);
+        const tunnel = await tunnels.findTunnelByName(PLATFORM_ARCHON_TUNNEL_NAME);
         if (tunnel)
-            await deps.cloudflare.putTunnelConfig(tunnel.id, {
+            await tunnels.putTunnelConfig(tunnel.id, {
                 ingress: [{ service: 'http_status:404' }],
             });
     });
@@ -2940,12 +2975,12 @@ async function provisionPlatformArchon(context, deps) {
         await waitForDeploymentFinished(deps.coolify, appId, runtime, 'platform:archon', `archon stays at ${appliedGitRef ?? 'no recorded ref'} on ${recorded[PLATFORM_ARCHON_APPLIED_HOSTNAME_SCOPE_KEY] ?? 'no recorded hostname'}`);
     }
     // ---- tunnel and DNS ---------------------------------------------------------
-    const existingTunnel = await deps.cloudflare.findTunnelByName(PLATFORM_ARCHON_TUNNEL_NAME);
-    const tunnel = existingTunnel ?? (await deps.cloudflare.createTunnel(PLATFORM_ARCHON_TUNNEL_NAME));
+    const existingTunnel = await tunnels.findTunnelByName(PLATFORM_ARCHON_TUNNEL_NAME);
+    const tunnel = existingTunnel ?? (await tunnels.createTunnel(PLATFORM_ARCHON_TUNNEL_NAME));
     if (recorded[PLATFORM_ARCHON_TUNNEL_SCOPE_KEY] !== tunnel.id) {
         await record(PLATFORM_ARCHON_TUNNEL_SCOPE_KEY, tunnel.id);
     }
-    await deps.cloudflare.putTunnelConfig(tunnel.id, {
+    await tunnels.putTunnelConfig(tunnel.id, {
         ingress: [
             {
                 hostname,
@@ -2960,7 +2995,7 @@ async function provisionPlatformArchon(context, deps) {
     // #197: without a connector, `hostname` answers with a Cloudflare error.
     await ensureCloudflaredConnector({
         coolify: deps.coolify,
-        cloudflare: deps.cloudflare,
+        tunnels,
         tunnelId: tunnel.id,
         appName: PLATFORM_ARCHON_CLOUDFLARED_APP_NAME,
         projectUuid,
@@ -2974,9 +3009,10 @@ async function provisionPlatformArchon(context, deps) {
         throw new Error(`platform:archon: no Cloudflare zone for ${platform.apex} to put ${hostname} in`);
     }
     const dnsTarget = `${tunnel.id}.cfargotunnel.com`;
-    const [dnsRecord] = await deps.cloudflare.findDnsRecord(zoneId, hostname, 'CNAME');
+    const dns = await platformDns(deps, context.recordedIds(), 'platform:archon');
+    const [dnsRecord] = await dns.findDnsRecord(platform.apex, hostname, 'CNAME');
     if (!dnsRecord) {
-        await deps.cloudflare.createDnsRecord(zoneId, {
+        await dns.createDnsRecord(platform.apex, {
             type: 'CNAME',
             name: hostname,
             content: dnsTarget,
@@ -2984,7 +3020,7 @@ async function provisionPlatformArchon(context, deps) {
         });
     }
     else if (dnsRecord.content !== dnsTarget) {
-        await deps.cloudflare.updateDnsRecord(zoneId, dnsRecord.id, {
+        await dns.updateDnsRecord(platform.apex, dnsRecord.id, {
             type: 'CNAME',
             name: hostname,
             content: dnsTarget,
@@ -3365,8 +3401,9 @@ function sameEmails(include, emails) {
  * exactly the declared emails. A failed read is not drift: the next plan reads
  * again.
  */
-async function archonAccessDrifted(cf, domain, emails) {
+async function archonAccessDrifted(deps, recorded, domain, emails) {
     try {
+        const cf = await platformAccess(deps, recorded, 'platform:archon');
         const app = (await cf.listAccessApps()).find((a) => a.domain === domain && a.name === PLATFORM_ARCHON_ACCESS_APP_NAME);
         if (!app)
             return true;
@@ -5359,11 +5396,22 @@ async function provisionPlatformEdge(context, deps) {
         { key: 'EDGE_PLATFORM_KEY_HASH', value: keyHash },
         ...(await missingEnvs(deps.coolify, appId, PLATFORM_EDGE_RUNNER_DEFAULTS)),
     ]);
-    // ---- tunnel and DNS -------------------------------------------------------
-    const existingTunnel = await deps.cloudflare.findTunnelByName(EDGE_TUNNEL_NAME);
-    const tunnel = existingTunnel ?? (await deps.cloudflare.createTunnel(EDGE_TUNNEL_NAME));
+    // ---- deploy and wait, on edge's own address ---------------------------------
+    // F4.dns: edge is the only caller of Cloudflare, so its own CNAME is
+    // written through edge. Edge has to be up before that, and no public name
+    // routes to it yet: health is checked on its Coolify-network address, which
+    // is then recorded for every step that writes DNS (auth, mail, archon). #252:
+    // the combined helper checks the deployment record, then the `/api/health`
+    // probe.
+    const internalUrl = `http://${EDGE_RUNNER_INTERNAL_NAME}:${EDGE_PORT}`;
+    await waitForNewDeployment(deps.coolify, appId, { kind: 'ready', url: `${internalUrl}/api/health` }, runtime, sleep, 'platform:edge', `edge stays at ${recorded[PLATFORM_EDGE_APPLIED_GIT_REF_SCOPE_KEY] ?? 'no recorded ref'}`);
+    await record(PLATFORM_EDGE_INTERNAL_URL_SCOPE_KEY, internalUrl);
+    // ---- tunnel and DNS, now that edge answers ---------------------------------
+    const tunnels = await platformTunnels(deps, { [PLATFORM_EDGE_INTERNAL_URL_SCOPE_KEY]: internalUrl }, 'platform:edge');
+    const existingTunnel = await tunnels.findTunnelByName(EDGE_TUNNEL_NAME);
+    const tunnel = existingTunnel ?? (await tunnels.createTunnel(EDGE_TUNNEL_NAME));
     await record(PLATFORM_EDGE_TUNNEL_SCOPE_KEY, tunnel.id);
-    await deps.cloudflare.putTunnelConfig(tunnel.id, {
+    await tunnels.putTunnelConfig(tunnel.id, {
         ingress: [
             { hostname, service: `http://${EDGE_RUNNER_INTERNAL_NAME}:${EDGE_PORT}` },
             { service: 'http_status:404' },
@@ -5372,7 +5420,7 @@ async function provisionPlatformEdge(context, deps) {
     // #197: without a connector, `hostname` answers with a Cloudflare error.
     await ensureCloudflaredConnector({
         coolify: deps.coolify,
-        cloudflare: deps.cloudflare,
+        tunnels,
         tunnelId: tunnel.id,
         appName: EDGE_CLOUDFLARED_APP_NAME,
         projectUuid,
@@ -5386,9 +5434,10 @@ async function provisionPlatformEdge(context, deps) {
         throw new Error(`platform:edge: no Cloudflare zone for ${platform.apex} to put ${hostname} in`);
     }
     const dnsTarget = `${tunnel.id}.cfargotunnel.com`;
-    const [dnsRecord] = await deps.cloudflare.findDnsRecord(zoneId, hostname, 'CNAME');
+    const dns = await deps.dns(internalUrl);
+    const [dnsRecord] = await dns.findDnsRecord(platform.apex, hostname, 'CNAME');
     if (!dnsRecord) {
-        await deps.cloudflare.createDnsRecord(zoneId, {
+        await dns.createDnsRecord(platform.apex, {
             type: 'CNAME',
             name: hostname,
             content: dnsTarget,
@@ -5396,19 +5445,13 @@ async function provisionPlatformEdge(context, deps) {
         });
     }
     else if (dnsRecord.content !== dnsTarget) {
-        await deps.cloudflare.updateDnsRecord(zoneId, dnsRecord.id, {
+        await dns.updateDnsRecord(platform.apex, dnsRecord.id, {
             type: 'CNAME',
             name: hostname,
             content: dnsTarget,
             proxied: true,
         });
     }
-    // ---- deploy and wait -------------------------------------------------------
-    // #252: the tunnel and DNS above already route `hostname`, so the combined
-    // helper (deployment-record check, then the `/api/health` probe) can run
-    // in one call -- unlike `platform:mail`, nothing here needs to happen
-    // between the two phases.
-    await waitForNewDeployment(deps.coolify, appId, { kind: 'ready', url: `https://${hostname}/api/health` }, runtime, sleep, 'platform:edge', `edge stays at ${recorded[PLATFORM_EDGE_APPLIED_GIT_REF_SCOPE_KEY] ?? 'no recorded ref'}`);
     // Last: a run that failed anywhere above is planned again.
     context.recordScopeId(PLATFORM_EDGE_APPLIED_HOSTNAME_SCOPE_KEY, hostname);
     await record(PLATFORM_EDGE_APPLIED_GIT_REF_SCOPE_KEY, gitRef);