@mriekki/project-forge 4.20.0 → 4.22.0

package/assets/generated/deployment/src/project_forge_deployment/cloudflare_ingress_remote.py

@@ -2,6 +2,7 @@
 
 REMOTE_SCRIPT = r"""#!/usr/bin/env bash
 set -Eeuo pipefail
+export LC_ALL=C
 
 ACTION="$1"
 SCOPE="$2"
@@ -43,6 +44,9 @@ AUTH_ROOT="$PLATFORM_ROOT/proxy/data/authenticated/$SCOPE"
 AUTH_ROUTES="$AUTH_ROOT/routes"
 AUTH_CADDY="$PLATFORM_ROOT/proxy/conf.d/90-project-forge-auth-$SCOPE.caddy"
 AUTH_SOCKET="$AUTH_ROOT/origin.sock"
+MIGRATION_MARKER_BACKUP="$ROOT/.authenticated-origin-migration.marker"
+MIGRATION_COMPOSE_BACKUP="$ROOT/.authenticated-origin-migration.compose"
+MIGRATION_RECEIPT="$ROOT/.authenticated-origin-migration.receipt"
 CONTAINER="project-forge-cloudflared-$SCOPE"
 LOCK_FILE="/run/lock/project-forge-cloudflare-$SCOPE.lock"
 
@@ -204,6 +208,7 @@ http://:19078 {
 EOF
     chmod 0644 "$tmp"
     mv -f "$tmp" "$AUTH_CADDY"
+    MIGRATION_CADDY_HASH="$(sha256sum "$AUTH_CADDY" | cut -d' ' -f1)"
     docker exec "$CADDY_CONTAINER" caddy reload --config /etc/caddy/Caddyfile >/dev/null
     [[ -S "$AUTH_SOCKET" ]] || {
         echo "Authenticated private origin socket did not appear." >&2; exit 27;
@@ -245,7 +250,19 @@ auth_route_write() {
     tmp="$file.tmp.$BASHPID"
     backup="$file.backup.$BASHPID"
     [[ ! -f "$file" ]] || cp -a "$file" "$backup"
-    cat > "$tmp" <<EOF
+    auth_route_content > "$tmp"
+    chmod 0644 "$tmp"
+    mv -f "$tmp" "$file"
+    if ! docker exec "$CADDY_CONTAINER" caddy reload --config /etc/caddy/Caddyfile >/dev/null; then
+        if [[ -f "$backup" ]]; then mv -f "$backup" "$file"; else rm -f "$file"; fi
+        docker exec "$CADDY_CONTAINER" caddy reload --config /etc/caddy/Caddyfile >/dev/null 2>&1 || true
+        echo "Authenticated Caddy route failed validation; restored previous state." >&2
+        exit 35
+    fi
+    rm -f "$backup"
+}
+auth_route_content() {
+    cat <<EOF
 @pf_$R_ROUTE host $R_PUBLIC
 handle @pf_$R_ROUTE {
     reverse_proxy $AUTH_UPSTREAM:$AUTH_PORT {
@@ -263,15 +280,6 @@ handle @pf_$R_ROUTE {
     }
 }
 EOF
-    chmod 0644 "$tmp"
-    mv -f "$tmp" "$file"
-    if ! docker exec "$CADDY_CONTAINER" caddy reload --config /etc/caddy/Caddyfile >/dev/null; then
-        if [[ -f "$backup" ]]; then mv -f "$backup" "$file"; else rm -f "$file"; fi
-        docker exec "$CADDY_CONTAINER" caddy reload --config /etc/caddy/Caddyfile >/dev/null 2>&1 || true
-        echo "Authenticated Caddy route failed validation; restored previous state." >&2
-        exit 35
-    fi
-    rm -f "$backup"
 }
 auth_route_remove() {
     [[ "$(marker_value AUTHENTICATED_ORIGIN)" == true ]] || return 0
@@ -364,6 +372,320 @@ route_inventory() {
     return 0
 }
 
+route_inventory_digest() {
+    route_inventory | sha256sum | cut -d' ' -f1
+}
+
+auth_files_digest() {
+    if [[ ! -d "$AUTH_ROOT" ]]; then
+        printf ''
+        return
+    fi
+    (
+        cd "$AUTH_ROOT"
+        find . -type f -print0 | sort -z | xargs -0r sha256sum
+    ) | sha256sum | cut -d' ' -f1
+}
+
+receipt_value() {
+    local key="$1"
+    [[ -f "$MIGRATION_RECEIPT" && ! -L "$MIGRATION_RECEIPT" ]] || return 1
+    sed -n "s/^${key}=//p" "$MIGRATION_RECEIPT" | head -n1
+}
+
+migration_pending_valid() {
+    [[ -f "$MIGRATION_MARKER_BACKUP" && ! -L "$MIGRATION_MARKER_BACKUP" &&
+       -f "$MIGRATION_COMPOSE_BACKUP" && ! -L "$MIGRATION_COMPOSE_BACKUP" &&
+       -f "$MIGRATION_RECEIPT" && ! -L "$MIGRATION_RECEIPT" &&
+       -f "$MARKER" && ! -L "$MARKER" &&
+       -f "$COMPOSE_FILE" && ! -L "$COMPOSE_FILE" &&
+       -f "$AUTH_CADDY" && ! -L "$AUTH_CADDY" &&
+       -d "$AUTH_ROOT" && ! -L "$AUTH_ROOT" &&
+       -d "$AUTH_ROUTES" && ! -L "$AUTH_ROUTES" ]] || return 1
+    [[ "$(marker_value AUTHENTICATED_ORIGIN 2>/dev/null || true)" == true ]] || return 1
+    [[ "$(route_inventory_digest)" == "$(receipt_value ROUTE_SNAPSHOT_SHA256)" ]] || return 1
+    [[ "$(sha256sum "$MARKER" | cut -d' ' -f1)" == "$(receipt_value MARKER_SHA256)" ]] || return 1
+    [[ "$(sha256sum "$COMPOSE_FILE" | cut -d' ' -f1)" == "$(receipt_value COMPOSE_SHA256)" ]] || return 1
+    [[ "$(sha256sum "$AUTH_CADDY" | cut -d' ' -f1)" == "$(receipt_value CADDY_SHA256)" ]] || return 1
+    [[ "$(auth_files_digest)" == "$(receipt_value AUTH_FILES_SHA256)" ]] || return 1
+    return 0
+}
+
+migration_inspect() {
+    local mode state
+    mode="$(marker_value AUTHENTICATED_ORIGIN 2>/dev/null || true)"
+    if [[ "$mode" == true ]]; then
+        if migration_pending_valid; then
+            state=pending
+        elif [[ ! -e "$MIGRATION_MARKER_BACKUP" && ! -e "$MIGRATION_COMPOSE_BACKUP" &&
+                ! -e "$MIGRATION_RECEIPT" ]]; then
+            state=complete
+        else
+            echo "Authenticated-origin migration recovery evidence is incomplete or changed." >&2
+            exit 37
+        fi
+    elif [[ "$mode" == false && ! -e "$MIGRATION_MARKER_BACKUP" &&
+            ! -e "$MIGRATION_COMPOSE_BACKUP" && ! -e "$MIGRATION_RECEIPT" &&
+            ! -e "$AUTH_ROOT" && ! -e "$AUTH_CADDY" ]]; then
+        state=clean
+    else
+        echo "Authenticated-origin migration paths conflict with unowned or incomplete state." >&2
+        exit 37
+    fi
+    printf 'migrationState=%s\n' "$state"
+}
+
+migration_rollback_on_error() {
+    local original_status="$1" rollback_failed=false path
+    trap - ERR EXIT
+    set +e
+    if [[ -f "$MIGRATION_MARKER_BACKUP" && ! -L "$MIGRATION_MARKER_BACKUP" ]]; then
+        cp -p "$MIGRATION_MARKER_BACKUP" "$MARKER.rollback.$$" &&
+            mv -f "$MARKER.rollback.$$" "$MARKER" || rollback_failed=true
+    fi
+    if [[ -f "$MIGRATION_COMPOSE_BACKUP" && ! -L "$MIGRATION_COMPOSE_BACKUP" ]]; then
+        cp -p "$MIGRATION_COMPOSE_BACKUP" "$COMPOSE_FILE.rollback.$$" &&
+            mv -f "$COMPOSE_FILE.rollback.$$" "$COMPOSE_FILE" || rollback_failed=true
+        docker compose -f "$COMPOSE_FILE" up -d --force-recreate >/dev/null 2>&1 || rollback_failed=true
+    fi
+    if [[ -e "$AUTH_CADDY" ]]; then
+        if [[ -f "$AUTH_CADDY" && ! -L "$AUTH_CADDY" &&
+              "$(sha256sum "$AUTH_CADDY" | cut -d' ' -f1)" == "${MIGRATION_CADDY_HASH:-}" ]]; then
+            rm -f "$AUTH_CADDY"
+            docker exec "$CADDY_CONTAINER" caddy reload --config /etc/caddy/Caddyfile >/dev/null 2>&1 ||
+                rollback_failed=true
+        else
+            rollback_failed=true
+        fi
+    fi
+    local index
+    for index in "${!MIGRATION_CREATED_ROUTES[@]}"; do
+        path="${MIGRATION_CREATED_ROUTES[$index]}"
+        if [[ "$path" == "$AUTH_ROUTES/"*.caddy && -f "$path" && ! -L "$path" &&
+              "$(sha256sum "$path" | cut -d' ' -f1)" == "${MIGRATION_CREATED_ROUTE_HASHES[$index]}" ]]; then
+            rm -f "$path"
+        else
+            rollback_failed=true
+        fi
+    done
+    if [[ -e "$AUTH_SOCKET" ]]; then
+        if [[ -S "$AUTH_SOCKET" && "$(stat -c '%u:%g:%a' "$AUTH_SOCKET")" == "65532:65532:222" ]]; then
+            rm -f "$AUTH_SOCKET"
+        else
+            rollback_failed=true
+        fi
+    fi
+    if [[ -d "$AUTH_ROUTES" ]] && ! rmdir "$AUTH_ROUTES" 2>/dev/null; then rollback_failed=true; fi
+    if [[ -d "$AUTH_ROOT" ]] && ! rmdir "$AUTH_ROOT" 2>/dev/null; then rollback_failed=true; fi
+    if [[ "$rollback_failed" == false ]]; then
+        rm -f "$MIGRATION_MARKER_BACKUP" "$MIGRATION_COMPOSE_BACKUP" "$MIGRATION_RECEIPT"
+        echo "Authenticated-origin host preparation failed and was rolled back." >&2
+    else
+        echo "Authenticated-origin host preparation failed; rollback is incomplete and recovery evidence was retained." >&2
+    fi
+    exit "$original_status"
+}
+
+migrate_authenticated_origin() {
+    local expected_route_digest="$EXPECTED" state path route_spec
+    [[ "$AUTHENTICATED_ORIGIN" == true ]] || { echo "Authenticated-origin migration must opt in explicitly." >&2; exit 37; }
+    [[ "$(status | sed -n 's/^state=//p' | head -n1)" == ready &&
+       "$(marker_value AUTHENTICATED_ORIGIN 2>/dev/null || true)" == false ]] || {
+        echo "Authenticated-origin migration requires a ready legacy scope." >&2; exit 37;
+    }
+    [[ "$(route_inventory_digest)" == "$expected_route_digest" ]] || {
+        echo "Managed public-route inventory changed after planning." >&2; exit 37;
+    }
+    state="$(migration_inspect | sed -n 's/^migrationState=//p')"
+    [[ "$state" == clean ]] || { echo "Authenticated-origin migration is not in a clean host state." >&2; exit 37; }
+    parse_meta
+    [[ "$(marker_value ACCOUNT_ID)" == "$M_ACCOUNT" &&
+       "$(marker_value ZONE_ID)" == "$M_ZONE_ID" &&
+       "$(marker_value ZONE_NAME)" == "$M_ZONE_NAME" &&
+       "$(marker_value TUNNEL_ID)" == "$M_TUNNEL_ID" &&
+       "$(marker_value TUNNEL_NAME)" == "$M_TUNNEL_NAME" ]] || {
+        echo "Existing host tunnel binding changed after planning." >&2; exit 37;
+    }
+    [[ -f "$MARKER" && ! -L "$MARKER" && -f "$COMPOSE_FILE" && ! -L "$COMPOSE_FILE" &&
+       -f "$TOKEN_FILE" && ! -L "$TOKEN_FILE" && -d "$ROUTE_ROOT" && ! -L "$ROUTE_ROOT" ]] || {
+        echo "Existing ingress host files are incomplete or unsafe." >&2; exit 37;
+    }
+    local route_count=0
+    MIGRATION_CREATED_ROUTES=()
+    MIGRATION_CREATED_ROUTE_HASHES=()
+    trap 'migration_rollback_on_error "$?"' EXIT
+    cp -p "$MARKER" "$MIGRATION_MARKER_BACKUP"
+    cp -p "$COMPOSE_FILE" "$MIGRATION_COMPOSE_BACKUP"
+    chmod 0600 "$MIGRATION_MARKER_BACKUP" "$MIGRATION_COMPOSE_BACKUP"
+    setup_authenticated_origin
+    AUTHENTICATED_ORIGIN=true
+    write_marker
+    write_compose
+    for path in "$ROUTE_ROOT"/*.route; do
+        [[ -f "$path" ]] || continue
+        route_spec="$(printf '%s\t%s\t%s\t%s\t%s\t%s\t%s' \
+            "$(route_value "$path" SCHEMA_VERSION)" "$(route_value "$path" OWNER_REPO)" \
+            "$(route_value "$path" ENVIRONMENT)" "$(route_value "$path" APP_SLUG)" \
+            "$(route_value "$path" ROUTE_ID)" "$(route_value "$path" PUBLIC_HOSTNAME)" \
+            "$(route_value "$path" ORIGIN_HOSTNAME)")"
+        parse_spec_value "$route_spec"
+        [[ "$(basename "$path")" == "$R_ROUTE.route" ]] || {
+            echo "Managed public-route identity is malformed." >&2; exit 37;
+        }
+        SPEC="$route_spec"
+        auth_route_write
+        MIGRATION_CREATED_ROUTES+=("$(auth_route_path "$R_ROUTE")")
+        MIGRATION_CREATED_ROUTE_HASHES+=("$(sha256sum "$(auth_route_path "$R_ROUTE")" | cut -d' ' -f1)")
+        route_count=$((route_count + 1))
+    done
+    (( route_count > 0 )) || { echo "No managed public routes are available to migrate." >&2; exit 37; }
+    docker compose -f "$COMPOSE_FILE" up -d --force-recreate >/dev/null
+    [[ "$(status | sed -n 's/^state=//p' | head -n1)" == ready &&
+       "$(marker_value AUTHENTICATED_ORIGIN)" == true ]] || {
+        echo "Authenticated-origin connector did not become ready." >&2; exit 37;
+    }
+    cat > "$MIGRATION_RECEIPT.tmp.$$" <<EOF
+ROUTE_SNAPSHOT_SHA256=$expected_route_digest
+MARKER_SHA256=$(sha256sum "$MARKER" | cut -d' ' -f1)
+COMPOSE_SHA256=$(sha256sum "$COMPOSE_FILE" | cut -d' ' -f1)
+CADDY_SHA256=$(sha256sum "$AUTH_CADDY" | cut -d' ' -f1)
+AUTH_FILES_SHA256=$(auth_files_digest)
+EOF
+    chmod 0600 "$MIGRATION_RECEIPT.tmp.$$"
+    mv -f "$MIGRATION_RECEIPT.tmp.$$" "$MIGRATION_RECEIPT"
+    migration_pending_valid || { echo "Authenticated-origin recovery receipt validation failed." >&2; exit 37; }
+    trap - ERR EXIT
+    printf 'migrationState=pending\n'
+}
+
+rollback_authenticated_origin() {
+    migration_pending_valid || { echo "Authenticated-origin migration rollback evidence is stale or unsafe." >&2; exit 38; }
+    [[ "$(status | sed -n 's/^state=//p' | head -n1)" == ready ]] || {
+        echo "Authenticated-origin host is not ready for rollback." >&2; exit 38;
+    }
+    cp -p "$MIGRATION_MARKER_BACKUP" "$MARKER.rollback.$$"
+    mv -f "$MARKER.rollback.$$" "$MARKER"
+    cp -p "$MIGRATION_COMPOSE_BACKUP" "$COMPOSE_FILE.rollback.$$"
+    mv -f "$COMPOSE_FILE.rollback.$$" "$COMPOSE_FILE"
+    docker compose -f "$COMPOSE_FILE" up -d --force-recreate >/dev/null
+    [[ "$(status | sed -n 's/^state=//p' | head -n1)" == ready &&
+       "$(marker_value AUTHENTICATED_ORIGIN 2>/dev/null || true)" == false ]] || {
+        echo "Legacy connector did not become ready after authenticated-origin rollback." >&2; exit 38;
+    }
+    [[ -f "$AUTH_CADDY" && ! -L "$AUTH_CADDY" ]] || {
+        echo "Authenticated Caddy configuration changed before rollback." >&2; exit 38;
+    }
+    rm -f "$AUTH_CADDY"
+    docker exec "$CADDY_CONTAINER" caddy reload --config /etc/caddy/Caddyfile >/dev/null
+    for path in "$AUTH_ROUTES"/*.caddy; do [[ -f "$path" ]] && rm -f "$path"; done
+    if [[ -e "$AUTH_SOCKET" ]]; then
+        [[ -S "$AUTH_SOCKET" && "$(stat -c '%u:%g:%a' "$AUTH_SOCKET")" == "65532:65532:222" ]] || {
+            echo "Authenticated origin socket changed before rollback." >&2; exit 38;
+        }
+        rm -f "$AUTH_SOCKET"
+    fi
+    rmdir "$AUTH_ROUTES" "$AUTH_ROOT"
+    rm -f "$MIGRATION_MARKER_BACKUP" "$MIGRATION_COMPOSE_BACKUP" "$MIGRATION_RECEIPT"
+    printf 'migrationState=rolled-back\n'
+}
+
+finalize_authenticated_origin() {
+    migration_pending_valid || { echo "Authenticated-origin migration receipt is stale or unsafe." >&2; exit 39; }
+    [[ "$(status | sed -n 's/^state=//p' | head -n1)" == ready ]] || {
+        echo "Authenticated-origin host is not ready for finalization." >&2; exit 39;
+    }
+    rm -f "$MIGRATION_MARKER_BACKUP" "$MIGRATION_COMPOSE_BACKUP" "$MIGRATION_RECEIPT"
+    printf 'migrationState=complete\n'
+}
+
+verify_authenticated_origin() {
+    local expected_route_digest="$EXPECTED" path route_spec
+    [[ "$(status | sed -n 's/^state=//p' | head -n1)" == ready &&
+       "$(marker_value AUTHENTICATED_ORIGIN 2>/dev/null || true)" == true &&
+       -S "$AUTH_SOCKET" && -d "$AUTH_ROOT" && ! -L "$AUTH_ROOT" &&
+       "$(stat -c '%u:%g:%a' "$AUTH_ROOT")" == "65532:65532:700" &&
+       "$(stat -c '%u:%g:%a' "$AUTH_SOCKET")" == "65532:65532:222" ]] || {
+        echo "Authenticated-origin socket or scope is not ready." >&2; exit 40;
+    }
+    [[ "$(route_inventory_digest)" == "$expected_route_digest" ]] || {
+        echo "Managed public-route inventory changed during migration." >&2; exit 40;
+    }
+    grep -Fqx "      - $AUTH_ROOT:/run/project-forge-origin:ro" "$COMPOSE_FILE" || {
+        echo "Connector Compose file does not grant the exact read-only origin mount." >&2; exit 40;
+    }
+    path_overlap() {
+        local left="${1%/}" right="${2%/}"
+        [[ "$left" == "$right" || "$left" == "$right/"* || "$right" == "$left/"* ]]
+    }
+    local connector_id caddy_id mount_count other_id mounts source destination writable source_mount
+    connector_id="$(docker inspect --format '{{.Id}}' "$CONTAINER")"
+    caddy_id="$(docker inspect --format '{{.Id}}' "$CADDY_CONTAINER")"
+    mapfile -t mounts < <(docker inspect --format '{{range .Mounts}}{{printf "%s|%s|%t\n" .Source .Destination .RW}}{{end}}' "$CONTAINER")
+    mount_count=0
+    for source_mount in "${mounts[@]}"; do
+        IFS='|' read -r source destination writable <<< "$source_mount"
+        if path_overlap "$source" "$AUTH_ROOT" || path_overlap "$destination" "/run/project-forge-origin"; then
+            [[ "$source" == "$AUTH_ROOT" && "$destination" == "/run/project-forge-origin" &&
+               "$writable" == false ]] || {
+                echo "Connector has an unexpected mount overlapping the authenticated-origin socket." >&2; exit 40;
+            }
+            mount_count=$((mount_count + 1))
+        fi
+    done
+    [[ "$mount_count" == 1 ]] || {
+        echo "Running connector does not have exactly the expected read-only origin mount." >&2; exit 40;
+    }
+    while IFS= read -r other_id; do
+        [[ -n "$other_id" && "$other_id" != "$connector_id" && "$other_id" != "$caddy_id" ]] || continue
+        mapfile -t mounts < <(docker inspect --format '{{range .Mounts}}{{printf "%s|%s\n" .Source .Destination}}{{end}}' "$other_id")
+        for source_mount in "${mounts[@]}"; do
+            IFS='|' read -r source destination <<< "$source_mount"
+            if path_overlap "$source" "$AUTH_ROOT" ||
+               path_overlap "$destination" "/run/project-forge-origin"; then
+                echo "Authenticated-origin mount is present on a non-connector container." >&2
+                exit 40
+            fi
+        done
+    done < <(docker ps -aq)
+    [[ -f "$AUTH_CADDY" && ! -L "$AUTH_CADDY" ]] &&
+        grep -Fqx "    bind unix//data/authenticated/$SCOPE/origin.sock|0222" "$AUTH_CADDY" &&
+        grep -Fqx "    import /data/authenticated/$SCOPE/routes/*.caddy" "$AUTH_CADDY" || {
+        echo "Authenticated Caddy Unix listener configuration is missing or changed." >&2; exit 40;
+    }
+    docker exec "$CADDY_CONTAINER" caddy validate --config /etc/caddy/Caddyfile >/dev/null
+    local route_count=0
+    for path in "$ROUTE_ROOT"/*.route; do
+        [[ -f "$path" ]] || continue
+        route_spec="$(printf '%s\t%s\t%s\t%s\t%s\t%s\t%s' \
+            "$(route_value "$path" SCHEMA_VERSION)" "$(route_value "$path" OWNER_REPO)" \
+            "$(route_value "$path" ENVIRONMENT)" "$(route_value "$path" APP_SLUG)" \
+            "$(route_value "$path" ROUTE_ID)" "$(route_value "$path" PUBLIC_HOSTNAME)" \
+            "$(route_value "$path" ORIGIN_HOSTNAME)")"
+        parse_spec_value "$route_spec"
+        auth_route_verify_lan
+        local expected_file tmp
+        expected_file="$(auth_route_path "$R_ROUTE")"
+        [[ -f "$expected_file" && ! -L "$expected_file" ]] || {
+            echo "Authenticated Caddy route file is missing or unsafe." >&2; exit 40;
+        }
+        tmp="$AUTH_ROUTES/.verify-$R_ROUTE.$$"
+        auth_route_content > "$tmp"
+        if ! cmp -s "$tmp" "$expected_file"; then
+            rm -f "$tmp"
+            echo "Authenticated Caddy route differs from the sanitized reviewed contract." >&2
+            exit 40
+        fi
+        rm -f "$tmp"
+        route_count=$((route_count + 1))
+    done
+    printf 'evidenceLevel=structural-only\n'
+    printf 'connectorOriginMount=read-only\n'
+    printf 'socketMetadataVerified=true\n'
+    printf 'caddyConfigValidated=true\n'
+    printf 'sanitizedRouteConfigVerified=true\n'
+    printf 'managedRouteCount=%s\n' "$route_count"
+}
+
 metadata_matches() {
     local path="$1" encoded="$2"
     parse_spec_value "$encoded"
@@ -449,6 +771,21 @@ case "$ACTION" in
     route-inventory)
         route_inventory
         ;;
+    migration-inspect)
+        migration_inspect
+        ;;
+    migrate-authenticated)
+        migrate_authenticated_origin
+        ;;
+    rollback-authenticated)
+        rollback_authenticated_origin
+        ;;
+    finalize-authenticated)
+        finalize_authenticated_origin
+        ;;
+    verify-authenticated)
+        verify_authenticated_origin
+        ;;
     route-register|route-remove)
         exec 9>>"$LOCK_FILE"
         flock -n 9 || { echo "Another Cloudflare ingress operation holds the lock." >&2; exit 75; }

package/assets/generated/deployment/src/project_forge_deployment/ingress_cli.py

@@ -9,14 +9,18 @@ import sys
 from typing import Any
 
 from .cloudflare_ingress import (
+    AUTHENTICATED_ORIGIN_CHANGE_FREEZE_PHRASE,
+    AUTHENTICATED_ORIGIN_MIGRATION_PHRASE,
     CLOUDFLARE_API_TOKEN_ENV,
     HOST_PUBLIC_INGRESS_WRITE_PHRASE,
     PUBLIC_INGRESS_ROUTE_REMOVE_PHRASE,
     PUBLIC_INGRESS_ROUTE_WRITE_PHRASE,
+    apply_authenticated_origin_migration,
     apply_cloudflare_ingress,
     cloudflare_ingress_doctor,
     cloudflare_ingress_status,
     cloudflare_route_inventory,
+    plan_authenticated_origin_migration,
     plan_cloudflare_ingress,
     plan_public_route,
     plan_public_route_removal,
@@ -50,7 +54,7 @@ def _token() -> str:
 
 
 def _confirm(args: argparse.Namespace, phrase: str, action: str) -> None:
-    if args.yes:
+    if getattr(args, "yes", False):
         return
     entered = input(f"Type {phrase} to {action}: ").strip()
     if entered != phrase:
@@ -81,6 +85,15 @@ def build_parser() -> argparse.ArgumentParser:
     configure.add_argument("--json", action="store_true")
     configure.add_argument("--yes", action="store_true")
 
+    migrate = commands.add_parser(
+        "migrate-authenticated-origin",
+        help="Migrate an existing managed scope to connector-exclusive Unix-socket origins",
+    )
+    migrate.add_argument("name")
+    migrate.add_argument("--scope", required=True)
+    migrate.add_argument("--zone", required=True, help="Existing bound Cloudflare zone")
+    migrate.add_argument("--json", action="store_true")
+
     route = commands.add_parser("route", help="Project-owned public hostname/DNS routes")
     route_commands = route.add_subparsers(dest="route_command", required=True)
 
@@ -143,6 +156,43 @@ def main(argv: list[str] | None = None) -> int:
             )
             _print(apply_cloudflare_ingress(plan, api_token=token), as_json=args.json)
             return 0
+        if args.command == "migrate-authenticated-origin":
+            token = _token()
+            preplan_freeze_acknowledgement = (
+                f"{AUTHENTICATED_ORIGIN_CHANGE_FREEZE_PHRASE} ACTIVE scope={args.scope}"
+            )
+            _confirm(
+                args,
+                preplan_freeze_acknowledgement,
+                "confirm that all external Cloudflare tunnel-configuration writers are frozen for this scope before planning",
+            )
+            plan = plan_authenticated_origin_migration(
+                args.name,
+                scope=args.scope,
+                zone_name=args.zone,
+                api_token=token,
+                change_freeze_active_acknowledgement=preplan_freeze_acknowledgement,
+            )
+            _print(plan, as_json=False)
+            _confirm(
+                args,
+                AUTHENTICATED_ORIGIN_MIGRATION_PHRASE,
+                f"migrate existing Cloudflare ingress scope {args.scope} on target {args.name}",
+            )
+            _confirm(
+                args,
+                plan["requiredChangeFreezeAcknowledgement"],
+                "acknowledge the operator-controlled Cloudflare change freeze for this migration plan",
+            )
+            _print(
+                apply_authenticated_origin_migration(
+                    plan,
+                    api_token=token,
+                    change_freeze_acknowledgement=plan["requiredChangeFreezeAcknowledgement"],
+                ),
+                as_json=args.json,
+            )
+            return 0
         if args.command == "route" and args.route_command == "inventory":
             _print(cloudflare_route_inventory(args.name, args.scope), as_json=args.json)
             return 0

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@mriekki/project-forge",
-  "version": "4.20.0",
+  "version": "4.22.0",
   "description": "Public consumer distribution and updater for Project Forge engineering assets.",
   "type": "module",
   "bin": {