@wtfalch/foundry 0.19.1 → 0.20.0

package/dist/plan/executor.js

@@ -10,8 +10,13 @@ import { CHAT_REPO, CHAT_SERVICE_DOCKERFILE, CHAT_SERVICE_PORT, CHAT_SYNAPSE_DOC
 import { ensureCloudflaredConnector } from './cloudflared-connector.js';
 import { CORE_FILES_COLLECTION_NAME, FILES_CORE_COLLECTION_SCOPE_KEY, ZITADEL_FILES_PROJECT_SCOPE_KEY, } from './core-files.js';
 import { DEFAULT_AI_LIMIT_MICROS } from './diff.js';
+import { createEdgeAccess, } from './edge-access.js';
+import { EDGE_DNS_WRITE_CONCURRENCY, createEdgeDns, limiter, } from './edge-dns.js';
+import { createEdgeRateLimits, } from './edge-ratelimits.js';
+import { createEdgeTunnels } from './edge-tunnels.js';
+import { createEdgeZones } from './edge-zones.js';
 import { AI_ENTRY_RENEW_WINDOW_DAYS, entryAiAppliedScopeKey, entryAiClampedScopeKey, entryAiExpiresScopeKey, entryAiPendingExpiresScopeKey, entryAiRetiredScopeKey, entryAiUndeliveredScopeKey, entryAiUnrevokedScopeKey, entryAiWebhookPendingScopeKey, entryAiWrittenScopeKey, parseIdList, } from './entry-ai-key.js';
-import { EDGE_ENTRY_KEY_DAYS, EDGE_RESERVED_LABELS_APPLIED_SCOPE_KEY, ENTRY_EDGE_KEY_DELIVERY_ATTEMPTS, entryEdgeMintedAtScopeKey, entryEdgeRetiredScopeKey, entryEdgeUndeliveredScopeKey, } from './entry-edge-key.js';
+import { BOULE_EDGE_ENTRY_KEY, EDGE_ENTRY_KEY_DAYS, EDGE_RESERVED_LABELS_APPLIED_SCOPE_KEY, ENTRY_EDGE_KEY_DELIVERY_ATTEMPTS, edgeKeyAppRecordKey, entryEdgeMintedAtScopeKey, entryEdgeRetiredScopeKey, entryEdgeUndeliveredScopeKey, } from './entry-edge-key.js';
 import { FILES_AGORA_KEY_SCOPE_KEY, FILES_AGORA_UNDELIVERED_SCOPE_KEY, FILES_KEY_DAYS, FILES_KEY_RENEW_WINDOW_DAYS, FILES_ORG_OWNER_SCOPE_KEY, FILES_ROOT_EXPIRES_SCOPE_KEY, FILES_ROOT_PREVIOUS_SCOPE_KEY, FILES_ROOT_UNDELIVERED_SCOPE_KEY, FILES_ROOT_UNREVOKED_SCOPE_KEY, entryFilesAppliedScopeKey, entryFilesExpiresScopeKey, entryFilesMinterScopeKey, entryFilesPendingExpiresScopeKey, entryFilesRetiredScopeKey, entryFilesUndeliveredScopeKey, entryFilesUnrevokedScopeKey, entryFilesWrittenScopeKey, filesOwnerUserId, parseIdList as parseFilesIdList, } from './entry-files-key.js';
 import { appHostname, coolifyDomains, entryHostnames, tunnelDnsHostnames, tunnelIngressHostnames, } from './hostnames.js';
 import { LOGIN_BINDING_SCOPE_KEY, LOGIN_HOST_PENDING_REMOVAL_SCOPE_KEY, LOGIN_HOST_SHARED_SCOPE_KEY, loginBindingState, loginHostClientIds, pendingRemovalHosts, pendingRemovalState, } from './login-host.js';
@@ -479,6 +484,16 @@ const MAIL_ROLE_MAILBOXES_SCOPE_KEY = 'mail_role_mailboxes';
 const AI_KEY_UNDELIVERED_SCOPE_KEY = 'ai_key_undelivered';
 /** How many times `aiKey` tries `deliverSecret` before giving up. */
 const AI_KEY_DELIVERY_ATTEMPTS = 3;
+/**
+ * #515: the limit `aiBudget` last applied, a flat scope id (no `:`) alongside
+ * `AI_KEY_UNDELIVERED_SCOPE_KEY`'s own. AI's `updateBudget` offers no read
+ * back, so nothing else can tell `diff.ts`'s `planAiBudget` the limit is
+ * already live -- without this, every plan for an applied org proposed
+ * setting it again. `providers-readers.ts`'s `ProvidersAiReader` keeps its
+ * own copy of this literal, the same "restated, not shared" choice this
+ * codebase already makes for `cloudflare_zone`/`zitadel_org`.
+ */
+const AI_BUDGET_LIMIT_SCOPE_KEY = 'ai_budget_limit_micros';
 const DAY_MS = 24 * 60 * 60 * 1000;
 /** What a failed files call says about itself: its HTTP status, never its message, which can echo a value. */
 function filesErrorCause(error) {
@@ -640,6 +655,12 @@ export const databaseStartWait = {
 // ---------------------------------------------------------------------------
 export class FoundryStepExecutor {
     ports;
+    edgeDns;
+    edgeTunnels;
+    edgeAccess;
+    edgeRateLimits;
+    edgeZones;
+    edgeWriteSlot;
     constructor(ports) {
         this.ports = ports;
     }
@@ -686,7 +707,7 @@ export class FoundryStepExecutor {
             case 'ai:organisation':
                 return this.aiOrganisation(action, org);
             case 'ai:budget':
-                return this.aiBudget(action, org);
+                return this.aiBudget(action, org, context);
             case 'ai:key':
                 // The org's own key is keyed `<orgId>`, an entry's `<orgId>:<entry>` (F6a).
                 return action.key.includes(':')
@@ -774,7 +795,7 @@ export class FoundryStepExecutor {
                 // `everyone` is Cloudflare's own shape for "match every visitor".
                 return { decision: 'bypass', include: [{ everyone: {} }] };
             case 'service-token': {
-                const token = await this.ports.cloudflare.findServiceTokenByName(rule.serviceTokenName);
+                const token = await this.accessPort().findServiceTokenByName(rule.serviceTokenName);
                 if (!token) {
                     throw new Error(`cloudflare:access for ${org.slug}: no Cloudflare Access service token named '${rule.serviceTokenName}'`);
                 }
@@ -788,7 +809,7 @@ export class FoundryStepExecutor {
      */
     async cloudflareAccessApp(org, opts) {
         const { appName, domain, policyName, policy } = opts;
-        const cf = this.ports.cloudflare;
+        const cf = this.accessPort();
         const onDomain = (await cf.listAccessApps()).filter((a) => a.domain === domain);
         const foreign = onDomain.find((a) => a.name !== appName);
         if (foreign) {
@@ -812,12 +833,10 @@ export class FoundryStepExecutor {
      * gate), so `org.domain` is set and that zone is the org's alone, never
      * shared with another org the way `oikos.host` is.
      *
-     * Rate limiting rules attach to a zone's `http_ratelimit` phase entry
-     * point ruleset, one `GET`/`PUT` pair per zone (`@wtfalch/providers` 0.5.0
-     * has no typed method for either -- `CloudflarePort.request`'s own doc
-     * comment) -- so "find by name" here means reading that one ruleset's
-     * `rules[]` and matching `RATE_LIMIT_RULE_DESCRIPTION`, the same shape
-     * `cloudflareAccess` above finds its own Access app by name. The Free
+     * Rate limiting rules go through edge (`RateLimitPort`) -- so "find by
+     * name" here means listing the zone's rules and matching
+     * `RATE_LIMIT_RULE_DESCRIPTION`, the same shape `cloudflareAccess` above
+     * finds its own Access app by name. The Free
      * plan allows exactly one rule per zone, so a rule already there under a
      * different description is refused, never adopted or replaced, mirroring
      * `cloudflareAccess`'s own refusal when a foreign Access app already
@@ -827,40 +846,33 @@ export class FoundryStepExecutor {
         if (!org.domain) {
             throw new Error(`cloudflare:ratelimit for ${org.slug}: hosting.usesDomain is set but domain is null`);
         }
-        const cf = this.ports.cloudflare;
+        const cf = this.zonePort();
         const zone = await cf.findZoneByApex(org.domain);
         if (!zone) {
             throw new Error(`cloudflare:ratelimit for ${org.slug}: no Cloudflare zone found for ${org.domain} -- cloudflare:zone must provision it first`);
         }
-        const path = `/zones/${zone.id}/rulesets/phases/http_ratelimit/entrypoint`;
-        const existing = await cf.request('GET', path, undefined, true);
-        const rules = existing?.rules ?? [];
+        const rateLimits = this.rateLimitPort();
+        const rules = await rateLimits.listRateLimitRules(zone.id);
         const own = rules.find((r) => r.description === RATE_LIMIT_RULE_DESCRIPTION);
-        if (own)
-            return { resourceId: own.id };
-        const foreign = rules.find((r) => r.description !== RATE_LIMIT_RULE_DESCRIPTION);
-        if (foreign) {
-            throw new Error(`cloudflare:ratelimit for ${org.slug}: zone ${org.domain} already has a rate limiting rule ('${foreign.description ?? foreign.id}') foundry did not create; the Free plan allows only one rule per zone, so foundry does not adopt or replace it`);
-        }
-        const updated = await cf.request('PUT', path, {
-            rules: [
-                {
-                    description: RATE_LIMIT_RULE_DESCRIPTION,
-                    expression: SIGN_IN_PATH_EXPRESSION,
-                    action: 'block',
-                    ratelimit: {
-                        characteristics: ['cf.colo.id', 'ip.src'],
-                        period: RATE_LIMIT_FREE_PLAN_PERIOD_SECONDS,
-                        requests_per_period: RATE_LIMIT_REQUESTS_PER_PERIOD,
-                        mitigation_timeout: RATE_LIMIT_FREE_PLAN_PERIOD_SECONDS,
-                    },
-                },
-            ],
-        });
-        const created = updated.rules?.[0];
-        if (!created) {
-            throw new Error(`cloudflare:ratelimit for ${org.slug}: PUT ${path} did not return the created rule`);
+        if (!own) {
+            const foreign = rules[0];
+            if (foreign) {
+                throw new Error(`cloudflare:ratelimit for ${org.slug}: zone ${org.domain} already has a rate limiting rule ('${foreign.description ?? foreign.id}') foundry did not create; the Free plan allows only one rule per zone, so foundry does not adopt or replace it`);
+            }
         }
+        // Edge adopts a live rule with no edge row (made before edge owned rate
+        // limits) and then makes the rule once: a repeat returns it unchanged.
+        const created = await rateLimits.createRateLimitRule(zone.id, {
+            description: RATE_LIMIT_RULE_DESCRIPTION,
+            expression: SIGN_IN_PATH_EXPRESSION,
+            action: 'block',
+            ratelimit: {
+                characteristics: ['cf.colo.id', 'ip.src'],
+                period: RATE_LIMIT_FREE_PLAN_PERIOD_SECONDS,
+                requests_per_period: RATE_LIMIT_REQUESTS_PER_PERIOD,
+                mitigation_timeout: RATE_LIMIT_FREE_PLAN_PERIOD_SECONDS,
+            },
+        });
         return { resourceId: created.id };
     }
     /**
@@ -913,7 +925,7 @@ export class FoundryStepExecutor {
         if (!org.domain) {
             throw new Error(`${at}: worker needs org.domain, and validateHosting already refuses it without one`);
         }
-        const zone = await this.ports.cloudflare.findZoneByApex(org.domain);
+        const zone = await this.zonePort().findZoneByApex(org.domain);
         if (!zone) {
             throw new Error(`${at}: no Cloudflare zone found for ${org.domain} -- cloudflare:zone must provision it first`);
         }
@@ -1066,7 +1078,7 @@ export class FoundryStepExecutor {
             throw new Error(`${at}: a route is recorded but its zone is not, so foundry cannot tell which zone holds it; refuses to forget it`);
         }
         const { id, apex } = JSON.parse(recordedZone);
-        const zone = await this.ports.cloudflare.findZoneByApex(apex);
+        const zone = await this.zonePort().findZoneByApex(apex);
         return zone && zone.id === id ? id : undefined;
     }
     /** Deletes the route an interrupted apply was creating, if `findRoute` shows it exists, points at that apply's script, and is not `keepRouteId`. */
@@ -2481,11 +2493,11 @@ export class FoundryStepExecutor {
             scopedProjectIds.push(platformLettermintProjectId);
         }
         await this.ports.lettermint.restrictDomainToProjects(domain.id, scopedProjectIds);
-        const zone = await this.ports.cloudflare.findZoneByApex(mailDomain);
+        const zone = await this.zonePort().findZoneByApex(mailDomain);
         if (!zone) {
             throw new Error(`Lettermint for ${org.slug}: no Cloudflare zone found for ${mailDomain}`);
         }
-        await this.publishLettermintDnsRecords(zone.id, domain.dnsRecords);
+        await this.publishLettermintDnsRecords(zone.name, domain.dnsRecords);
         await this.ports.lettermint.verifyDomain(domain.id);
     }
     /**
@@ -3934,6 +3946,87 @@ export class FoundryStepExecutor {
             throw new Error('ai: this executor was built without an ai port (#177)');
         return port;
     }
+    /**
+     * Every DNS record call runs through edge (`edge.dns`, the platform
+     * credential), adopting live records before it first changes them. `dns` on
+     * the ports is a seam for a host or test that supplies its own {@link DnsPort}.
+     */
+    dnsPort() {
+        if (this.ports.dns)
+            return this.ports.dns;
+        if (!this.ports.edge) {
+            throw new Error('dns: this executor was built without an EdgePort (F4.dns)');
+        }
+        this.edgeWriteSlot ??= limiter(EDGE_DNS_WRITE_CONCURRENCY);
+        this.edgeDns ??= createEdgeDns(this.ports.edge.dns, { writeSlot: this.edgeWriteSlot });
+        return this.edgeDns;
+    }
+    /**
+     * Every tunnel call runs through edge (`edge.tunnels`, the platform
+     * credential), adopting a live tunnel before it first configures, reads the
+     * token of or deletes it. Shares edge's write slot with {@link dnsPort}.
+     */
+    tunnelPort() {
+        if (this.ports.tunnels)
+            return this.ports.tunnels;
+        if (!this.ports.edge) {
+            throw new Error('tunnels: this executor was built without an EdgePort (F4.tunnels)');
+        }
+        this.edgeWriteSlot ??= limiter(EDGE_DNS_WRITE_CONCURRENCY);
+        this.edgeTunnels ??= createEdgeTunnels(this.ports.edge.tunnels, {
+            writeSlot: this.edgeWriteSlot,
+        });
+        return this.edgeTunnels;
+    }
+    /**
+     * Every Access call runs through edge (`edge.access`, the platform
+     * credential), adopting a live app before it first adds a policy to or
+     * deletes it. Shares edge's write slot with {@link dnsPort}.
+     */
+    accessPort() {
+        if (this.ports.access)
+            return this.ports.access;
+        if (!this.ports.edge) {
+            throw new Error('access: this executor was built without an EdgePort (F4.access)');
+        }
+        this.edgeWriteSlot ??= limiter(EDGE_DNS_WRITE_CONCURRENCY);
+        this.edgeAccess ??= createEdgeAccess(this.ports.edge.access, {
+            writeSlot: this.edgeWriteSlot,
+        });
+        return this.edgeAccess;
+    }
+    /**
+     * Every rate limiting rule call runs through edge (`edge.ratelimits`, the
+     * platform credential), adopting the live rule before it first creates it.
+     * Shares edge's write slot with {@link dnsPort}.
+     */
+    rateLimitPort() {
+        if (this.ports.ratelimits)
+            return this.ports.ratelimits;
+        if (!this.ports.edge) {
+            throw new Error('ratelimits: this executor was built without an EdgePort (F4.ratelimits)');
+        }
+        this.edgeWriteSlot ??= limiter(EDGE_DNS_WRITE_CONCURRENCY);
+        this.edgeRateLimits ??= createEdgeRateLimits(this.ports.edge.ratelimits, {
+            writeSlot: this.edgeWriteSlot,
+        });
+        return this.edgeRateLimits;
+    }
+    /**
+     * Every zone lookup and create runs through edge (`edge.zones`, the
+     * platform credential), adopting a live zone before it first creates it.
+     * Shares edge's write slot with {@link dnsPort}.
+     */
+    zonePort() {
+        if (this.ports.zones)
+            return this.ports.zones;
+        if (!this.ports.edge) {
+            throw new Error('zones: this executor was built without an EdgePort (F4.zones)');
+        }
+        this.edgeWriteSlot ??= limiter(EDGE_DNS_WRITE_CONCURRENCY);
+        this.edgeZones ??= createEdgeZones(this.ports.edge.zones, { writeSlot: this.edgeWriteSlot });
+        return this.edgeZones;
+    }
     async jobsPort(org) {
         const port = this.ports.jobsScheduler ?? (await this.ports.platformOrg?.jobs());
         if (!port) {
@@ -4002,7 +4095,7 @@ export class FoundryStepExecutor {
             }
             // Cleared, not deleted (#7 corrections 1): an ingress with only the
             // mandatory catch-all routes nothing.
-            await this.ports.cloudflare.putTunnelConfig(tunnelId, {
+            await this.tunnelPort().putTunnelConfig(tunnelId, {
                 ingress: [{ service: 'http_status:404' }],
             });
             // #235: park stops the connector too -- an ingress with nothing
@@ -4028,8 +4121,9 @@ export class FoundryStepExecutor {
         // domain declared still leaves `destroy` a way to recognise the old
         // id's CNAMEs as this tunnel's own rather than a foreign record.
         const recordedTunnelId = context.recordedIds()[`cloudflare:tunnel:${action.key}`];
-        const existing = await this.ports.cloudflare.findTunnelByName(tunnelName);
-        const tunnel = existing ?? (await this.ports.cloudflare.createTunnel(tunnelName));
+        const tunnels = this.tunnelPort();
+        const existing = await tunnels.findTunnelByName(tunnelName);
+        const tunnel = existing ?? (await tunnels.createTunnel(tunnelName));
         const previousIds = parseTunnelPreviousIds(context.recordedIds());
         if (recordedTunnelId && recordedTunnelId !== tunnel.id) {
             previousIds.add(recordedTunnelId);
@@ -4056,7 +4150,7 @@ export class FoundryStepExecutor {
             hostname,
             service: COOLIFY_PROXY_ORIGIN,
         }));
-        await this.ports.cloudflare.putTunnelConfig(tunnel.id, {
+        await this.tunnelPort().putTunnelConfig(tunnel.id, {
             ingress: [...ingress, { service: 'http_status:404' }],
         });
         // #235: a connector for this org's own tunnel, the same call every
@@ -4070,7 +4164,7 @@ export class FoundryStepExecutor {
         const { environment } = await this.ports.coolify.findOrCreateEnvironment(projectUuid, 'production');
         await ensureCloudflaredConnector({
             coolify: this.ports.coolify,
-            cloudflare: this.ports.cloudflare,
+            tunnels: this.tunnelPort(),
             tunnelId: tunnel.id,
             appName: `${org.slug}-cloudflared`,
             projectUuid,
@@ -4201,7 +4295,7 @@ export class FoundryStepExecutor {
      * nothing of this domain's left in that set either way.
      */
     async deleteStaleTunnelDnsRecords(tunnelId, previousIds, previousDomain, previousHostnames, context) {
-        const zone = await this.ports.cloudflare.findZoneByApex(previousDomain);
+        const zone = await this.zonePort().findZoneByApex(previousDomain);
         if (!zone)
             return;
         const dnsTargets = new Set([`${tunnelId}.cfargotunnel.com`]);
@@ -4209,13 +4303,13 @@ export class FoundryStepExecutor {
             if (id !== tunnelId)
                 dnsTargets.add(`${id}.cfargotunnel.com`);
         }
-        const cf = this.ports.cloudflare;
+        const dns = this.dnsPort();
         const records = previousHostnames.length > 0
-            ? (await Promise.all(previousHostnames.map((hostname) => cf.findDnsRecord(zone.id, hostname, 'CNAME')))).flat()
-            : await cf.listDnsRecords(zone.id, { type: 'CNAME' });
+            ? (await Promise.all(previousHostnames.map((hostname) => dns.findDnsRecord(zone.name, hostname, 'CNAME')))).flat()
+            : await dns.listDnsRecords(zone.name, { type: 'CNAME' });
         for (const record of records) {
             if (dnsTargets.has(record.content)) {
-                await cf.deleteDnsRecord(zone.id, record.id);
+                await dns.deleteDnsRecord(zone.name, record.id);
             }
         }
         if (previousHostnames.length > 0) {
@@ -4283,8 +4377,8 @@ export class FoundryStepExecutor {
      * both read this set.
      */
     async publishTunnelDnsRecords(org, domain, tunnelId, previousIds, previousHostnames, context) {
-        const cf = this.ports.cloudflare;
-        const zone = await cf.findZoneByApex(domain);
+        const dns = this.dnsPort();
+        const zone = await this.zonePort().findZoneByApex(domain);
         if (!zone) {
             throw new Error(`cloudflare:tunnel for ${org.slug}: no Cloudflare zone found for ${domain} to point its hostnames at -- cloudflare:zone must provision it first`);
         }
@@ -4296,14 +4390,14 @@ export class FoundryStepExecutor {
         const toCreate = [];
         const toRepoint = [];
         for (const hostname of hostnames) {
-            const [a] = await cf.findDnsRecord(zone.id, hostname, 'A');
-            const [aaaa] = await cf.findDnsRecord(zone.id, hostname, 'AAAA');
+            const [a] = await dns.findDnsRecord(zone.name, hostname, 'A');
+            const [aaaa] = await dns.findDnsRecord(zone.name, hostname, 'AAAA');
             const foreign = a ?? aaaa;
             if (foreign) {
                 conflicts.push(`${hostname} already has a ${foreign.type} record`);
                 continue;
             }
-            const [cname] = await cf.findDnsRecord(zone.id, hostname, 'CNAME');
+            const [cname] = await dns.findDnsRecord(zone.name, hostname, 'CNAME');
             if (cname && cname.content !== dnsTarget) {
                 if (previousTargets.has(cname.content)) {
                     toRepoint.push({ hostname, recordId: cname.id });
@@ -4335,7 +4429,7 @@ export class FoundryStepExecutor {
         for (const hostname of settled)
             recordTracked(hostname);
         for (const hostname of toCreate) {
-            await cf.createDnsRecord(zone.id, {
+            await dns.createDnsRecord(zone.name, {
                 type: 'CNAME',
                 name: hostname,
                 content: dnsTarget,
@@ -4344,7 +4438,7 @@ export class FoundryStepExecutor {
             recordTracked(hostname);
         }
         for (const { hostname, recordId } of toRepoint) {
-            await cf.updateDnsRecord(zone.id, recordId, {
+            await dns.updateDnsRecord(zone.name, recordId, {
                 type: 'CNAME',
                 name: hostname,
                 content: dnsTarget,
@@ -4363,9 +4457,9 @@ export class FoundryStepExecutor {
         // tracking under `domain`, so it is dropped from the shared set either
         // way.
         for (const hostname of droppedHostnames) {
-            const [cname] = await cf.findDnsRecord(zone.id, hostname, 'CNAME');
+            const [cname] = await dns.findDnsRecord(zone.name, hostname, 'CNAME');
             if (cname && (cname.content === dnsTarget || previousTargets.has(cname.content))) {
-                await cf.deleteDnsRecord(zone.id, cname.id);
+                await dns.deleteDnsRecord(zone.name, cname.id);
             }
             tracked.delete(trackedTunnelDnsEntry(domain, hostname));
             context.recordScopeId(CLOUDFLARE_TUNNEL_DNS_TRACKED_SCOPE_KEY, trackedTunnelDnsState(tracked));
@@ -4399,7 +4493,7 @@ export class FoundryStepExecutor {
      */
     async cloudflareZone(action, org, context) {
         const domain = action.key;
-        const cf = this.ports.cloudflare;
+        const cf = this.zonePort();
         const existing = await cf.findZoneByApex(domain);
         if (existing) {
             const owner = await this.ports.declaredOrgStore.findOrgIdForZone(existing.id);
@@ -4600,12 +4694,12 @@ export class FoundryStepExecutor {
      * publishes it.
      */
     async publishMailDnsRecords(org, result) {
-        const zone = await this.ports.cloudflare.findZoneByApex(result.domain);
+        const zone = await this.zonePort().findZoneByApex(result.domain);
         if (!zone) {
             throw new Error(`coolify:mail for ${org.slug}: no Cloudflare zone found for ${result.domain}`);
         }
         for (const record of result.records) {
-            await this.upsertMailDnsRecord(zone.id, record);
+            await this.upsertMailDnsRecord(zone.name, record);
         }
     }
     /**
@@ -4619,7 +4713,7 @@ export class FoundryStepExecutor {
      * a record someone proxied by hand is put back. An `MX` record carries the
      * priority it was given, which Cloudflare requires.
      *
-     * Found by an exact name+type match (`CloudflarePort.findDnsRecord`'s own
+     * Found by an exact name+type match (`DnsPort.findDnsRecord`'s own
      * doc comment) so a stale record of a different type is never taken for a
      * match. A name can hold several `TXT` records (an apex often holds a site
      * verification beside SPF), so a `TXT` record only replaces one that
@@ -4628,8 +4722,8 @@ export class FoundryStepExecutor {
      * whatever it was.
      */
     async upsertMailDnsRecord(zoneId, record) {
-        const cf = this.ports.cloudflare;
-        const found = await cf.findDnsRecord(zoneId, record.name, record.type);
+        const dns = this.dnsPort();
+        const found = await dns.findDnsRecord(zoneId, record.name, record.type);
         const existing = record.type === 'TXT'
             ? found.find((r) => txtRecordTag(r.content) === txtRecordTag(record.value))
             : found[0];
@@ -4641,10 +4735,10 @@ export class FoundryStepExecutor {
             ...(record.priority === undefined ? {} : { priority: record.priority }),
         };
         if (existing) {
-            await cf.updateDnsRecord(zoneId, existing.id, rec);
+            await dns.updateDnsRecord(zoneId, existing.id, rec);
         }
         else {
-            await cf.createDnsRecord(zoneId, rec);
+            await dns.createDnsRecord(zoneId, rec);
         }
     }
     /**
@@ -4700,13 +4794,13 @@ export class FoundryStepExecutor {
      * `dkim_secondary`, none of them SPF -- so that merge has no case left to
      * handle here and is dropped rather than kept as dead code.
      */
-    async publishLettermintDnsRecords(zoneId, records) {
+    async publishLettermintDnsRecords(zone, records) {
         for (const record of records) {
             if (record.type === 'TXT' && record.value.toLowerCase().startsWith('v=dmarc1')) {
-                await this.ensureLettermintDmarcRecord(this.ports.cloudflare, zoneId, record);
+                await this.ensureLettermintDmarcRecord(this.dnsPort(), zone, record);
                 continue;
             }
-            await this.upsertMailDnsRecord(zoneId, record);
+            await this.upsertMailDnsRecord(zone, record);
         }
     }
     /**
@@ -4714,11 +4808,11 @@ export class FoundryStepExecutor {
      * already set (`p=quarantine`/`p=reject`) should not be relaxed back to
      * Lettermint's own `p=none` default.
      */
-    async ensureLettermintDmarcRecord(cf, zoneId, record) {
-        const hasDmarc = (await cf.findDnsRecord(zoneId, record.name, 'TXT')).some((r) => txtRecordTag(r.content) === 'v=dmarc1');
+    async ensureLettermintDmarcRecord(dns, zoneId, record) {
+        const hasDmarc = (await dns.findDnsRecord(zoneId, record.name, 'TXT')).some((r) => txtRecordTag(r.content) === 'v=dmarc1');
         if (hasDmarc)
             return;
-        await cf.createDnsRecord(zoneId, {
+        await dns.createDnsRecord(zoneId, {
             type: 'TXT',
             name: record.name,
             content: record.value,
@@ -4845,7 +4939,7 @@ export class FoundryStepExecutor {
         await ai.setOrganisationOffers(org.id, action.desired.offers ?? []);
         return { resourceId: provisioned.organisationId };
     }
-    async aiBudget(action, org) {
+    async aiBudget(action, org, context) {
         // #484: ai/packages/sdk/src/types.ts:134-137's UpdateBudget.limitMicros
         // is a required string -- there is no "uncapped" this API can express
         // yet (Finding, this campaign's report) -- so a null `desired.limitMicros`
@@ -4856,6 +4950,10 @@ export class FoundryStepExecutor {
         const limitMicros = action.desired.limitMicros ?? DEFAULT_AI_LIMIT_MICROS;
         const ai = await this.aiPort();
         await ai.updateBudget(org.id, { keyId: null, limitMicros });
+        // #515: recorded only once `updateBudget` has actually succeeded, so a
+        // crash or a thrown call before this line leaves nothing recorded and
+        // the step replans, rather than recording a limit that was never applied.
+        context.recordScopeId(AI_BUDGET_LIMIT_SCOPE_KEY, limitMicros);
         return { resourceId: org.id };
     }
     /**
@@ -5115,7 +5213,7 @@ export class FoundryStepExecutor {
                         throw error;
                 }
             }
-            const appId = recorded[`coolify:app:${action.key}`];
+            const appId = recorded[edgeKeyAppRecordKey(org, entryKey)];
             if (appId) {
                 // A revoked key's env values are dead, not merely stale -- remove
                 // them so nothing reads a credential edge has already revoked. A
@@ -5149,10 +5247,14 @@ export class FoundryStepExecutor {
             context.recordScopeId(entryEdgeRetiredScopeKey(entryKey), keyId);
             return {};
         }
-        const entry = org.hosting.entries.find((e) => e.key === entryKey && e.uses?.edge);
-        if (!entry)
+        if (entryKey === BOULE_EDGE_ENTRY_KEY) {
+            if (!org.domain)
+                throw new Error(`${at}: Boule's edge key needs org.domain`);
+        }
+        else if (!org.hosting.entries.some((e) => e.key === entryKey && e.uses?.edge)) {
             throw new Error(`${at}: the entry no longer declares uses.edge`);
-        const appId = context.recordedIds()[`coolify:app:${action.key}`];
+        }
+        const appId = context.recordedIds()[edgeKeyAppRecordKey(org, entryKey)];
         if (!appId)
             throw new Error(`${at}: the entry's app is not recorded yet`);
         if (!org.domain) {
@@ -5590,15 +5692,15 @@ export class FoundryStepExecutor {
                     }
                     for (const [dnsDomain, dnsHostnames] of hostnamesByDomain) {
                         try {
-                            const zone = await this.ports.cloudflare.findZoneByApex(dnsDomain);
+                            const zone = await this.zonePort().findZoneByApex(dnsDomain);
                             if (zone) {
-                                const cf = this.ports.cloudflare;
+                                const dns = this.dnsPort();
                                 const records = dnsHostnames.length > 0
-                                    ? (await Promise.all(dnsHostnames.map((hostname) => cf.findDnsRecord(zone.id, hostname, 'CNAME')))).flat()
-                                    : await cf.listDnsRecords(zone.id, { type: 'CNAME' });
+                                    ? (await Promise.all(dnsHostnames.map((hostname) => dns.findDnsRecord(zone.name, hostname, 'CNAME')))).flat()
+                                    : await dns.listDnsRecords(zone.name, { type: 'CNAME' });
                                 for (const record of records) {
                                     if (dnsTargets.has(record.content)) {
-                                        await cf.deleteDnsRecord(zone.id, record.id);
+                                        await dns.deleteDnsRecord(zone.name, record.id);
                                     }
                                 }
                             }
@@ -5608,11 +5710,11 @@ export class FoundryStepExecutor {
                                 throw error;
                         }
                     }
-                    await this.ports.cloudflare.deleteTunnel(target.id);
+                    await this.tunnelPort().deleteTunnel(target.id);
                     return;
                 }
                 case 'cloudflare:access':
-                    await this.ports.cloudflare.deleteAccessApp(target.id);
+                    await this.accessPort().deleteAccessApp(target.id);
                     return;
                 case 'ai:key': {
                     // F6a: an entry's key (`<orgId>:<entry>`). REVOKE SEAM (ai#157): a

package/dist/plan/index.d.ts

@@ -5,7 +5,7 @@ export { computePlanDetail, toPlan } from './diff.js';
 export type { StepSystem } from './step-system.js';
 export { stepSystemOf } from './step-system.js';
 export type { PlatformPlanDetail } from './platform-diff.js';
-export { planPlatform, toPlatformPlan, JOBS_SCHEDULER_KEY, PLATFORM_AI_KEY, PLATFORM_AI_INTERNAL_URL_SCOPE_KEY, PLATFORM_AI_MANAGEMENT_KEY_SCOPE_KEY, PLATFORM_AI_ORGANISATION_SCOPE_KEY, PLATFORM_AUTH_KEY, PLATFORM_FILES_KEY, PLATFORM_FILES_INTERNAL_URL_SCOPE_KEY, PLATFORM_FILES_ZITADEL_PROJECT_SCOPE_KEY, PLATFORM_MAIL_KEY, PLATFORM_MAIL_INTERNAL_URL_SCOPE_KEY, PLATFORM_MAIL_ZITADEL_PROJECT_SCOPE_KEY, PLATFORM_EDGE_KEY, PLATFORM_EDGE_KEY_REF, PLATFORM_EDGE_CLOUDFLARE_TOKEN_REF, } from './platform-diff.js';
+export { planPlatform, toPlatformPlan, JOBS_SCHEDULER_KEY, PLATFORM_AI_KEY, PLATFORM_AI_INTERNAL_URL_SCOPE_KEY, PLATFORM_AI_MANAGEMENT_KEY_SCOPE_KEY, PLATFORM_AI_ORGANISATION_SCOPE_KEY, PLATFORM_AUTH_KEY, PLATFORM_FILES_KEY, PLATFORM_FILES_INTERNAL_URL_SCOPE_KEY, PLATFORM_FILES_ZITADEL_PROJECT_SCOPE_KEY, PLATFORM_MAIL_KEY, PLATFORM_MAIL_INTERNAL_URL_SCOPE_KEY, PLATFORM_MAIL_ZITADEL_PROJECT_SCOPE_KEY, PLATFORM_EDGE_KEY, PLATFORM_EDGE_INTERNAL_URL_SCOPE_KEY, PLATFORM_EDGE_KEY_REF, PLATFORM_EDGE_CLOUDFLARE_TOKEN_REF, } from './platform-diff.js';
 export type { HeldKeyResolver, OrgPlatformReadiness } from './platform-org.js';
 export { DEFAULT_ORG_PLATFORM_READINESS, ORG_PLATFORM_KEY_REFS, agoraHostValuesFromPlatform, heldPlatformKeyRefs, orgPlatformReadinessFrom, } from './platform-org.js';
 export type { PlatformOrgClientFactories } from './platform-org-ports.js';
@@ -15,7 +15,7 @@ export { AdoptRefusedError } from './adopt.js';
 export type { AuditActor, AuditLog, AuthzGate, StepExecutor, StepDestroyer, DestroyTarget, StepExecutionContext, PlatformStepExecutor, PlatformStepExecutionContext, FoundryPlanApplyOptions, } from './plan-apply.js';
 export { FoundryPlanApply, DeclaredOrgNotFoundError, StalePlanError, ConfirmationRequiredError, NotAuthorizedError, NotATestOrgError, DeclaredPlatformNotFoundError, PlatformStalePlanError, PlatformConfirmationRequiredError, planNeedsConfirmation, } from './plan-apply.js';
 export { FoundryPlatformStepExecutor, ProvidersPlatformCloudflareReader, ProvidersPlatformCoolifyReader, PLATFORM_MAIL_ADMIN_KEY_DESCRIPTION, filesPublicHostsValue, filesShareDomains, } from './platform-providers.js';
-export type { PlatformAuthDeps, PlatformAuthRuntime, PlatformFilesDeps, PlatformFilesRuntime, PlatformEdgeDeps, PlatformEdgeRuntime, } from './platform-providers.js';
+export type { PlatformAuthDeps, PlatformAuthRuntime, PlatformFilesDeps, PlatformFilesRuntime, PlatformEdgeDeps, PlatformDnsFactory, PlatformAccessFactory, PlatformAccessPort, PlatformTunnelsFactory, PlatformEdgeRuntime, } from './platform-providers.js';
 export type { PlatformMailDeps, PlatformMailAdminPort, PlatformMailRuntime, } from './platform-providers.js';
 export { FILES_INTROSPECTION_SECRET_REF, FILES_MANAGEMENT_ISSUER, FILES_MANAGEMENT_KEY_ID, FILES_MANAGEMENT_KEY_REF, PLATFORM_AUTH_INSTANCE_BEARER_REF, } from './platform-providers.js';
 export { AI_MANAGEMENT_ISSUER, AI_MANAGEMENT_KEY_ID, AI_SIGNING_KEY_REF, AiManagementKeyExistsError, createAiManagementKeyMinter, PLATFORM_AI_MANAGEMENT_KEY_REF, PLATFORM_AI_MANAGEMENT_PERMISSIONS, } from './platform-providers.js';
@@ -27,7 +27,7 @@ export { MissingCallsSfuConnectionError, applyCallsSfuPlatformStep } from './pla
 export type { MailCopyJob, MailCopyPort, MailCopyStepResult } from './mail-copy.js';
 export { MAIL_COPY_COMPLETED_SCOPE_KEY, MAIL_COPY_DONE_SCOPE_KEY, MissingMailCopyAccountsError, MissingMailCopySourceTokenError, MissingMailCopyStalwartTokenError, parseMailCopyCompleted, runMailCopyStep, } from './mail-copy.js';
 export type { ScopeResolver, RecordedIds } from './providers-readers.js';
-export { ProvidersCloudflareReader, ProvidersCmsReader, ProvidersCoolifyReader, ProvidersZitadelReader, storeScopeResolver, storeRecordedIds, } from './providers-readers.js';
+export { ProvidersAiReader, ProvidersCloudflareReader, ProvidersCmsReader, ProvidersCoolifyReader, ProvidersZitadelReader, storeScopeResolver, storeRecordedIds, } from './providers-readers.js';
 export type { AgoraHostPort, AgoraHostValues } from './agora.js';
 export type { BrokerPort } from './broker-entries.js';
 export { PlatformBrokerPort } from './broker-entries.js';
@@ -39,6 +39,18 @@ export type { MailAllowlistApp } from './mail-identity-allowlist.js';
 export { checkMailAppsAllowlist } from './mail-identity-allowlist.js';
 export type { CoolifyPort, CloudflarePort, ZitadelPort, CallsSfuPort, JobsSchedulerPort, FilesOrganisationPort, AiOrganisationPort, FoundryStepExecutorPorts, PlatformOrgPortSource, } from './executor.js';
 export { FoundryStepExecutor, NotBuiltError, healthUrls } from './executor.js';
+export { createEdgeDns, EDGE_DNS_WRITE_CONCURRENCY } from './edge-dns.js';
+export type { DnsPort, DnsRecordInput, DnsRecordSummary, EdgePlatformDns } from './edge-dns.js';
+export { createEdgeAccess } from './edge-access.js';
+export type { AccessAppSummary, AccessDecision, AccessPolicyRule, AccessPort, EdgePlatformAccess, } from './edge-access.js';
+export { createEdgeWorkers } from './edge-workers.js';
+export type { EdgePlatformWorkers, EdgeWorkersOptions } from './edge-workers.js';
+export { createEdgeRateLimits } from './edge-ratelimits.js';
+export type { EdgePlatformRateLimits, EdgeRateLimitsOptions, RateLimitPort, RateLimitRuleInput, } from './edge-ratelimits.js';
+export { createEdgeZones } from './edge-zones.js';
+export type { EdgePlatformZones, EdgeZonesOptions, ZonePort } from './edge-zones.js';
+export { createEdgeTunnels } from './edge-tunnels.js';
+export type { EdgePlatformTunnels, TunnelIngress, TunnelPort, TunnelSummary, } from './edge-tunnels.js';
 export type { ZitadelListAppsRawApp } from './executor.js';
 export { adaptZitadelListApps } from './executor.js';
 export { HttpJobsSchedulerClient } from './jobs-scheduler-http.js';

package/dist/plan/index.js

@@ -1,7 +1,7 @@
 export { readLiveResources, readLivePlatformResources } from './live.js';
 export { computePlanDetail, toPlan } from './diff.js';
 export { stepSystemOf } from './step-system.js';
-export { planPlatform, toPlatformPlan, JOBS_SCHEDULER_KEY, PLATFORM_AI_KEY, PLATFORM_AI_INTERNAL_URL_SCOPE_KEY, PLATFORM_AI_MANAGEMENT_KEY_SCOPE_KEY, PLATFORM_AI_ORGANISATION_SCOPE_KEY, PLATFORM_AUTH_KEY, PLATFORM_FILES_KEY, PLATFORM_FILES_INTERNAL_URL_SCOPE_KEY, PLATFORM_FILES_ZITADEL_PROJECT_SCOPE_KEY, PLATFORM_MAIL_KEY, PLATFORM_MAIL_INTERNAL_URL_SCOPE_KEY, PLATFORM_MAIL_ZITADEL_PROJECT_SCOPE_KEY, PLATFORM_EDGE_KEY, PLATFORM_EDGE_KEY_REF, PLATFORM_EDGE_CLOUDFLARE_TOKEN_REF, } from './platform-diff.js';
+export { planPlatform, toPlatformPlan, JOBS_SCHEDULER_KEY, PLATFORM_AI_KEY, PLATFORM_AI_INTERNAL_URL_SCOPE_KEY, PLATFORM_AI_MANAGEMENT_KEY_SCOPE_KEY, PLATFORM_AI_ORGANISATION_SCOPE_KEY, PLATFORM_AUTH_KEY, PLATFORM_FILES_KEY, PLATFORM_FILES_INTERNAL_URL_SCOPE_KEY, PLATFORM_FILES_ZITADEL_PROJECT_SCOPE_KEY, PLATFORM_MAIL_KEY, PLATFORM_MAIL_INTERNAL_URL_SCOPE_KEY, PLATFORM_MAIL_ZITADEL_PROJECT_SCOPE_KEY, PLATFORM_EDGE_KEY, PLATFORM_EDGE_INTERNAL_URL_SCOPE_KEY, PLATFORM_EDGE_KEY_REF, PLATFORM_EDGE_CLOUDFLARE_TOKEN_REF, } from './platform-diff.js';
 export { DEFAULT_ORG_PLATFORM_READINESS, ORG_PLATFORM_KEY_REFS, agoraHostValuesFromPlatform, heldPlatformKeyRefs, orgPlatformReadinessFrom, } from './platform-org.js';
 export { PlatformOrgBlockedError, PlatformOrgPorts } from './platform-org-ports.js';
 export { AdoptRefusedError } from './adopt.js';
@@ -14,11 +14,17 @@ export { createZitadelAdminMinter } from './zitadel-machine-user.js';
 export { createZitadelProjectRoles } from './zitadel-project-roles.js';
 export { MissingCallsSfuConnectionError, applyCallsSfuPlatformStep } from './platform-sfu.js';
 export { MAIL_COPY_COMPLETED_SCOPE_KEY, MAIL_COPY_DONE_SCOPE_KEY, MissingMailCopyAccountsError, MissingMailCopySourceTokenError, MissingMailCopyStalwartTokenError, parseMailCopyCompleted, runMailCopyStep, } from './mail-copy.js';
-export { ProvidersCloudflareReader, ProvidersCmsReader, ProvidersCoolifyReader, ProvidersZitadelReader, storeScopeResolver, storeRecordedIds, } from './providers-readers.js';
+export { ProvidersAiReader, ProvidersCloudflareReader, ProvidersCmsReader, ProvidersCoolifyReader, ProvidersZitadelReader, storeScopeResolver, storeRecordedIds, } from './providers-readers.js';
 export { PlatformBrokerPort } from './broker-entries.js';
 export { loginHostnameFor } from './login-host.js';
 export { checkMailIdentityAudience } from './mail-identity.js';
 export { checkMailAppsAllowlist } from './mail-identity-allowlist.js';
 export { FoundryStepExecutor, NotBuiltError, healthUrls } from './executor.js';
+export { createEdgeDns, EDGE_DNS_WRITE_CONCURRENCY } from './edge-dns.js';
+export { createEdgeAccess } from './edge-access.js';
+export { createEdgeWorkers } from './edge-workers.js';
+export { createEdgeRateLimits } from './edge-ratelimits.js';
+export { createEdgeZones } from './edge-zones.js';
+export { createEdgeTunnels } from './edge-tunnels.js';
 export { adaptZitadelListApps } from './executor.js';
 export { HttpJobsSchedulerClient } from './jobs-scheduler-http.js';