@wtfalch/foundry 0.16.7 → 0.16.8

package/dist/bootstrap/bootstrap.d.ts

@@ -4,6 +4,8 @@ import type { FoundryStoreDb } from '../store/postgres.js';
 import type { BootstrapCompany, BootstrapOwner } from './declare.js';
 export interface BootstrapPlatformInput {
     company: BootstrapCompany;
+    /** The Coolify server's public IPv4, saved as `platform.serverIpv4` (`../platform.ts`); absent leaves a stored value alone. */
+    serverIpv4?: string;
     owner: BootstrapOwner;
 }
 /**

package/dist/bootstrap/bootstrap.js

@@ -198,9 +198,17 @@ export async function bootstrapPlatform(input, deps) {
         const existing = await platformStore.get();
         if (existing) {
             emit({ phase: 'declare', message: `declared platform already written for ${existing.apex}` });
+            // Only serverIpv4, through the validating `put`; no other field is touched.
+            if (input.serverIpv4 && input.serverIpv4 !== existing.serverIpv4) {
+                await platformStore.put({ ...existing, serverIpv4: input.serverIpv4 });
+                emit({
+                    phase: 'declare',
+                    message: `declared platform serverIpv4 set to ${input.serverIpv4}`,
+                });
+            }
         }
         else {
-            await platformStore.put(declaredPlatformFor(input.company.apex));
+            await platformStore.put(declaredPlatformFor(input.company.apex, input.serverIpv4));
             emit({
                 phase: 'declare',
                 message: `declared platform written for ${input.company.apex}`,

package/dist/bootstrap/declare.d.ts

@@ -35,4 +35,4 @@ export declare function declaredCompanyOrg(company: BootstrapCompany, owner: Boo
  * The declared platform under `apex`. A disabled service keeps an empty
  * `gitRef`, which `validatePlatform` allows.
  */
-export declare function declaredPlatformFor(apex: string): DeclaredPlatform;
+export declare function declaredPlatformFor(apex: string, serverIpv4?: string): DeclaredPlatform;

package/dist/bootstrap/declare.js

@@ -85,7 +85,7 @@ export function declaredCompanyOrg(company, owner) {
  * The declared platform under `apex`. A disabled service keeps an empty
  * `gitRef`, which `validatePlatform` allows.
  */
-export function declaredPlatformFor(apex) {
+export function declaredPlatformFor(apex, serverIpv4) {
     const services = {};
     for (const key of PLATFORM_SERVICE_KEYS) {
         const enabled = SERVICES_ENABLED_BY_DEFAULT.has(key);
@@ -95,5 +95,10 @@ export function declaredPlatformFor(apex) {
             gitRef: !enabled ? '' : key === 'mail' ? DEFAULT_MAIL_IMAGE_TAG : DEFAULT_GIT_REF,
         };
     }
-    return { ownerOrgId: COMPANY_INCLUDED_ORG_ID, apex, ...services };
+    return {
+        ownerOrgId: COMPANY_INCLUDED_ORG_ID,
+        apex,
+        ...(serverIpv4 ? { serverIpv4 } : {}),
+        ...services,
+    };
 }

package/dist/index.d.ts

@@ -8,12 +8,12 @@ export type { SlugRejectionReason, SlugRejection } from './slug.js';
 export { validateSlug, slugFromName, RESERVED_SLUGS } from './slug.js';
 export type { Checkpoint, LastApplied, AppliedState } from './state.js';
 export type { PlanStep, UnmanagedItem, Plan } from './plan.js';
-export type { DeclaredOrgStore, PlatformStore, RequestedChangeStore, StaleUpdate, UpdateOptions, } from './store.js';
+export type { AppliedVersion, AppliedVersionsStore, DeclaredOrgStore, PlatformStore, RequestedChangeStore, StaleUpdate, UpdateOptions, } from './store.js';
 export type { PlanApply } from './apply.js';
-export { createPostgresDeclaredOrgStore, createPostgresPlatformStore, createPostgresRequestedChangeStore, DeclaredOrgError, PlatformError, } from './store/postgres.js';
+export { createPostgresAppliedVersionsStore, createPostgresDeclaredOrgStore, createPostgresPlatformStore, createPostgresRequestedChangeStore, DeclaredOrgError, PlatformError, } from './store/postgres.js';
 export { createPostgresAuditLog } from './store/audit.js';
 export type { FoundryStoreDb } from './store/postgres.js';
-export { declaredOrgs, foundryAppliedState, foundryAuditEvents, foundryDeclaredPlatform, foundryRequestedChanges, type AuditEventRow, type DeclaredOrgRow, type NewDeclaredOrgRow, type AppliedStateRow, type NewAppliedStateRow, type DeclaredPlatformRow, type NewDeclaredPlatformRow, type RequestedChangeRow, type NewRequestedChangeRow, } from './store/schema.js';
+export { declaredOrgs, foundryAppliedState, foundryAppliedVersions, foundryAuditEvents, foundryDeclaredPlatform, foundryRequestedChanges, type AuditEventRow, type DeclaredOrgRow, type NewDeclaredOrgRow, type AppliedStateRow, type NewAppliedStateRow, type AppliedVersionRow, type NewAppliedVersionRow, type DeclaredPlatformRow, type NewDeclaredPlatformRow, type RequestedChangeRow, type NewRequestedChangeRow, } from './store/schema.js';
 export type { LiveResource, ZitadelReader, CoolifyReader, CloudflareReader, FilesReader, AiReader, CmsReader, LiveReaders, PlatformCloudflareReader, PlatformCoolifyReader, PlatformLiveReaders, StepAction, PlannedStep, PlanDetail, PlatformPlanDetail, AuditActor, AuditLog, AuthzGate, StepExecutor, StepDestroyer, DestroyTarget, StepExecutionContext, PlatformStepExecutor, PlatformStepExecutionContext, FoundryPlanApplyOptions, } from './plan/index.js';
 export { readLiveResources, readLivePlatformResources, computePlanDetail, toPlan, planPlatform, toPlatformPlan, JOBS_SCHEDULER_KEY, PLATFORM_AI_KEY, PLATFORM_AI_INTERNAL_URL_SCOPE_KEY, PLATFORM_AI_MANAGEMENT_KEY_SCOPE_KEY, PLATFORM_AI_ORGANISATION_SCOPE_KEY, PLATFORM_FILES_KEY, PLATFORM_FILES_INTERNAL_URL_SCOPE_KEY, PLATFORM_FILES_ZITADEL_PROJECT_SCOPE_KEY, PLATFORM_MAIL_INTERNAL_URL_SCOPE_KEY, PLATFORM_MAIL_ZITADEL_PROJECT_SCOPE_KEY, FoundryPlanApply, DeclaredOrgNotFoundError, StalePlanError, ConfirmationRequiredError, NotAuthorizedError, NotATestOrgError, DeclaredPlatformNotFoundError, PlatformStalePlanError, PlatformConfirmationRequiredError, planNeedsConfirmation, } from './plan/index.js';
 export type { HeldKeyResolver, OrgPlatformReadiness } from './plan/index.js';

package/dist/index.js

@@ -2,9 +2,9 @@ export { APP_ENTRY_KEY, FILES_ENTRY_PERMISSIONS, AI_ENTRY_PERMISSIONS, DEFAULT_M
 export { PLATFORM_SERVICE_KEYS, defaultPlatformHostname, validatePlatform, } from './platform.js';
 export { REQUESTABLE_FIELDS, classifyChange, RequestedChangeError } from './requested-changes.js';
 export { validateSlug, slugFromName, RESERVED_SLUGS } from './slug.js';
-export { createPostgresDeclaredOrgStore, createPostgresPlatformStore, createPostgresRequestedChangeStore, DeclaredOrgError, PlatformError, } from './store/postgres.js';
+export { createPostgresAppliedVersionsStore, createPostgresDeclaredOrgStore, createPostgresPlatformStore, createPostgresRequestedChangeStore, DeclaredOrgError, PlatformError, } from './store/postgres.js';
 export { createPostgresAuditLog } from './store/audit.js';
-export { declaredOrgs, foundryAppliedState, foundryAuditEvents, foundryDeclaredPlatform, foundryRequestedChanges, } from './store/schema.js';
+export { declaredOrgs, foundryAppliedState, foundryAppliedVersions, foundryAuditEvents, foundryDeclaredPlatform, foundryRequestedChanges, } from './store/schema.js';
 export { readLiveResources, readLivePlatformResources, computePlanDetail, toPlan, planPlatform, toPlatformPlan, JOBS_SCHEDULER_KEY, PLATFORM_AI_KEY, PLATFORM_AI_INTERNAL_URL_SCOPE_KEY, PLATFORM_AI_MANAGEMENT_KEY_SCOPE_KEY, PLATFORM_AI_ORGANISATION_SCOPE_KEY, PLATFORM_FILES_KEY, PLATFORM_FILES_INTERNAL_URL_SCOPE_KEY, PLATFORM_FILES_ZITADEL_PROJECT_SCOPE_KEY, PLATFORM_MAIL_INTERNAL_URL_SCOPE_KEY, PLATFORM_MAIL_ZITADEL_PROJECT_SCOPE_KEY, FoundryPlanApply, DeclaredOrgNotFoundError, StalePlanError, ConfirmationRequiredError, NotAuthorizedError, NotATestOrgError, DeclaredPlatformNotFoundError, PlatformStalePlanError, PlatformConfirmationRequiredError, planNeedsConfirmation, } from './plan/index.js';
 export { DEFAULT_ORG_PLATFORM_READINESS, ORG_PLATFORM_KEY_REFS, agoraHostValuesFromPlatform, heldPlatformKeyRefs, orgPlatformReadinessFrom, } from './plan/index.js';
 export { PlatformOrgBlockedError, PlatformOrgPorts } from './plan/index.js';

package/dist/migrations/0036_applied_versions.sql

@@ -0,0 +1,45 @@
+-- @wtfalch/foundry: a history of recorded applies, sitting beside
+-- `0002_applied_state.sql`'s single current snapshot (#253, building on the
+-- upgrade-safety map, #237). `foundry_applied_state` (and the platform's own
+-- `foundry_declared_platform.service_ids`) replace their one row in place on
+-- every apply, so once a new version is recorded the one it replaced is
+-- gone -- there is no "previous version" to show or to roll back to, and a
+-- failed apply leaves no trail of what came before it either. This table
+-- never replaces a row; every recorded version is a new one, appended.
+--
+-- `service` names whatever was just recorded as applied -- today, an org's
+-- id, from the same point in `plan/plan-apply.ts`'s `runSteps` that writes
+-- `AppliedState.lastApplied` (mirrors `0002`'s `last_applied_declared_org_version`
+-- renamed generically, since #237's platform services -- mail, archon, ai,
+-- files, integrations and the rest -- record an applied ref of their own and
+-- can write rows here the same way once they do). `ref` is whatever version
+-- identifier that apply recorded (an org's declared-org hash today; a git
+-- ref or image tag for a platform service).
+--
+-- `run_id` and `backup_id` are both nullable: nothing in today's code ties
+-- an apply to a run id (the job runner, `src/runner`, is not yet wired to
+-- plan/apply -- #17's own module, standing alone), and no apply takes a
+-- backup before recording a version yet -- #256 ("Back up before a stateful
+-- upgrade") is the later issue that starts writing `backup_id`. Both columns
+-- exist now so that issue, and a future run-id wiring, are additive: a new
+-- column would be, this is a new row shape instead.
+--
+-- Read back by `previousAppliedRef` (`../store.ts`): the ref of the
+-- second-most-recent row for a service is what a rollback has to roll back
+-- to. No foreign key to `foundry_declared_orgs` -- `foundry_runs.org_id`
+-- makes the same choice (`0003_foundry_runs.sql`) -- because `service` is
+-- not always an org id, and a history row for a destroyed org (or a
+-- platform service, which is no org at all) must survive the org going away.
+
+create table if not exists foundry_applied_versions (
+  id          bigserial primary key,
+  service     text not null,
+  ref         text not null,
+  applied_at  timestamptz not null default now(),
+  run_id      text,
+  backup_id   text
+);
+
+-- `previousAppliedRef`'s read: the most recent rows for one service, newest first.
+create index if not exists foundry_applied_versions_service_idx
+  on foundry_applied_versions (service, applied_at desc, id desc);

package/dist/migrations/0037_platform_server_ipv4.sql

@@ -0,0 +1,8 @@
+-- @wtfalch/foundry: the declared platform's optional public server IPv4.
+-- Coolify's localhost server reports `host.docker.internal` as its ip, which
+-- cannot be a DNS A record, so the operator declares the real address here
+-- instead of hand-setting it in Coolify. Format is validated by
+-- src/platform.ts's `validatePlatform`, not here (same split as `apex`).
+-- Null: use the Coolify server's own ip when it is an IPv4.
+
+alter table foundry_declared_platform add column if not exists server_ipv4 text;

package/dist/org.d.ts

@@ -209,7 +209,46 @@ export interface HostingConfig {
     issuerApps: IssuerApp[];
     /** One entry per app the org runs. */
     entries: HostingEntry[];
+    /**
+     * Cloudflare Access rules for hostnames besides the `app` entry's own
+     * (#246): `accessEmails` above already gates that one hostname by an
+     * email list; this says what any other hostname an org serves (e.g.
+     * `share.<domain>`, `storage.<domain>`) gets instead of an operator
+     * setting it up by hand in the Cloudflare dashboard, which is how it is
+     * done today. Empty or absent: no additional Access apps.
+     */
+    access?: AccessRule[];
 }
+/** The three Cloudflare Access rule kinds {@link HostingConfig.access} supports (#246). */
+export type AccessRuleKind = 'gate' | 'bypass' | 'service-token';
+export declare const ACCESS_RULE_KINDS: ReadonlySet<AccessRuleKind>;
+/**
+ * One Cloudflare Access rule on a hostname besides the `app` entry's own
+ * (#246, `HostingConfig.access`). `hostname` is the full hostname Access
+ * gates (e.g. `share.<domain>`), never an entry key.
+ *
+ * - `gate`: an email allowlist, the same shape `accessEmails` already
+ *   applies to the app's own hostname.
+ * - `bypass`: no login at all -- the hostname is public through Access.
+ * - `service-token`: only a request carrying the named Cloudflare Access
+ *   service token's headers gets through, no human login flow. The token
+ *   itself is not minted by this rule -- it names a live Cloudflare Access
+ *   service token that `executor.ts` looks up by name, the same way its
+ *   `app`-entry gate finds its Access app by name rather than creating a
+ *   second one.
+ */
+export type AccessRule = {
+    hostname: string;
+    kind: 'gate';
+    emails: string[];
+} | {
+    hostname: string;
+    kind: 'bypass';
+} | {
+    hostname: string;
+    kind: 'service-token';
+    serviceTokenName: string;
+};
 /** The key of the entry that is today's one app: the Coolify app named `<slug>`. */
 export declare const APP_ENTRY_KEY = "app";
 /**

package/dist/org.js

@@ -2,6 +2,11 @@
 export const DEFAULT_MAIL_APPS = ['agora', 'webmail'];
 /** {@link MailConfig.noReplyLocalPart}'s own default, restated wherever it is read rather than imported (this file's `LOG_DIR`-style convention, named in `plan/executor.ts`'s own doc comments). */
 export const DEFAULT_NO_REPLY_LOCAL_PART = 'no-reply';
+export const ACCESS_RULE_KINDS = new Set([
+    'gate',
+    'bypass',
+    'service-token',
+]);
 /** The key of the entry that is today's one app: the Coolify app named `<slug>`. */
 export const APP_ENTRY_KEY = 'app';
 /** What an entry's ai key may hold: the most the org's own key holds. */
@@ -118,6 +123,45 @@ export function validateHosting(hosting, names) {
     if (hosting.entries.filter((entry) => entry.database).length > 1) {
         return 'at most one hosting entry may set database: the one runtime database role cannot serve two apps';
     }
+    const seenAccessHostnames = new Set();
+    for (const rule of hosting.access ?? []) {
+        const invalidRule = validateAccessRule(rule, hosting.enabled);
+        if (invalidRule)
+            return invalidRule;
+        if (seenAccessHostnames.has(rule.hostname)) {
+            return `hosting.access hostname '${rule.hostname}' is listed twice`;
+        }
+        seenAccessHostnames.add(rule.hostname);
+    }
+    return null;
+}
+/** A full DNS hostname, at least two labels -- distinct from an entry's single-label `key`. */
+const ACCESS_RULE_HOSTNAME = /^[a-z0-9]([a-z0-9-]{0,61}[a-z0-9])?(\.[a-z0-9]([a-z0-9-]{0,61}[a-z0-9])?)+$/;
+/** The rules for one {@link AccessRule}; `null` when it is valid. */
+function validateAccessRule(rule, enabled) {
+    const at = `hosting.access '${rule.hostname}'`;
+    if (!rule.hostname || !ACCESS_RULE_HOSTNAME.test(rule.hostname)) {
+        return `hosting.access entries need a full hostname ('${rule.hostname}' is not one)`;
+    }
+    if (!enabled) {
+        return `${at} requires hosting.enabled`;
+    }
+    if (!ACCESS_RULE_KINDS.has(rule.kind)) {
+        return `${at} has an unknown kind '${rule.kind}'`;
+    }
+    if (rule.kind === 'gate') {
+        if (rule.emails.length === 0) {
+            return `${at} kind 'gate' needs at least one email`;
+        }
+        for (const email of rule.emails) {
+            if (!EMAIL.test(email)) {
+                return `${at} has an invalid email '${email}'`;
+            }
+        }
+    }
+    if (rule.kind === 'service-token' && !rule.serviceTokenName) {
+        return `${at} kind 'service-token' needs a non-empty serviceTokenName`;
+    }
     return null;
 }
 /**
@@ -164,6 +208,7 @@ function validateEntryHostnames(hosting, names) {
     return null;
 }
 const ENTRY_KEY = /^[a-z0-9]([a-z0-9-]{0,61}[a-z0-9])?$/;
+const EMAIL = /^[^@\s]+@[^@\s]+$/;
 const REPO = /^wtfalch\/[A-Za-z0-9._-]+$/;
 // The env names `pushAppEnv` and `pushDatabaseUrl` set themselves.
 const FOUNDRY_ENV_NAME = /^(APP_URL|LOG_DIR|OWNER_USER_ID|AUTH_.*|DATABASE_URL.*)$/;
@@ -207,7 +252,7 @@ function validateHostingEntry(entry, enabled) {
         return `${at} accessEmails is only available on the '${APP_ENTRY_KEY}' entry for now`;
     }
     for (const email of entry.accessEmails) {
-        if (!/^[^@\s]+@[^@\s]+$/.test(email)) {
+        if (!EMAIL.test(email)) {
             return `${at} accessEmails has an invalid email '${email}'`;
         }
     }

package/dist/plan/boule.d.ts

@@ -29,7 +29,7 @@ export declare const BOULE_DATABASE_SCOPE_KEY = "coolify_boule_database";
  */
 export declare function bouleHostnameFor(org: DeclaredOrg): string;
 /** The env names `desiredBouleEnv` can write, so the live reader knows which to read back. */
-export declare const BOULE_MANAGED_ENV_KEYS: readonly ["APP_URL", "AUTH_ISSUER", "AUTH_ORGANIZATION_ID", "AUTH_CLIENT_ID", "BOULE_ORG_NAME", "AUTHZ_BOOTSTRAP_OPERATOR"];
+export declare const BOULE_MANAGED_ENV_KEYS: readonly ["APP_URL", "AUTH_ISSUER", "AUTH_ORGANIZATION_ID", "AUTH_CLIENT_ID", "BOULE_ORG_NAME", "AUTHZ_BOOTSTRAP_OPERATOR", "ARCHON_URL"];
 /**
  * The env vars an org's Boule app should carry, and every input still missing
  * to build them. Callers that write must refuse on a non-empty `missing`: a
@@ -41,11 +41,17 @@ export declare const BOULE_MANAGED_ENV_KEYS: readonly ["APP_URL", "AUTH_ISSUER",
  * id, never an email), present once `zitadel:owner` has recorded it. It is not
  * `missing` while absent: Boule runs without an operator until then.
  *
+ * `archonUrl` (#374) is the Archon that bills this org -- `https://` plus the
+ * declared platform's `archon.hostname` (`plan-apply.ts`'s `orgArchonUrl`),
+ * runtime only, read by Boule's Prices card (boule#228). Not `missing` while
+ * absent: Boule has no platform wired in every test and every org-only
+ * caller, same as `issuer` before #177.
+ *
  * Not here, and written by the executor instead: the database URLs
  * (`DATABASE_URL_OWNER`, `DATABASE_URL`, minted once) and `AUTH_COOKIE_SECRET`
  * (generated once, never rotated).
  */
-export declare function desiredBouleEnv(org: DeclaredOrg, recorded: Readonly<Record<string, string>>, issuer: string | null): {
+export declare function desiredBouleEnv(org: DeclaredOrg, recorded: Readonly<Record<string, string>>, issuer: string | null, archonUrl: string | null): {
     env: Record<string, string>;
     missing: string[];
 };

package/dist/plan/boule.js

@@ -37,6 +37,7 @@ export const BOULE_MANAGED_ENV_KEYS = [
     'AUTH_CLIENT_ID',
     'BOULE_ORG_NAME',
     'AUTHZ_BOOTSTRAP_OPERATOR',
+    'ARCHON_URL',
 ];
 /**
  * The env vars an org's Boule app should carry, and every input still missing
@@ -49,11 +50,17 @@ export const BOULE_MANAGED_ENV_KEYS = [
  * id, never an email), present once `zitadel:owner` has recorded it. It is not
  * `missing` while absent: Boule runs without an operator until then.
  *
+ * `archonUrl` (#374) is the Archon that bills this org -- `https://` plus the
+ * declared platform's `archon.hostname` (`plan-apply.ts`'s `orgArchonUrl`),
+ * runtime only, read by Boule's Prices card (boule#228). Not `missing` while
+ * absent: Boule has no platform wired in every test and every org-only
+ * caller, same as `issuer` before #177.
+ *
  * Not here, and written by the executor instead: the database URLs
  * (`DATABASE_URL_OWNER`, `DATABASE_URL`, minted once) and `AUTH_COOKIE_SECRET`
  * (generated once, never rotated).
  */
-export function desiredBouleEnv(org, recorded, issuer) {
+export function desiredBouleEnv(org, recorded, issuer, archonUrl) {
     const zitadelOrgId = recorded[ZITADEL_ORG_SCOPE_KEY];
     const clientId = recorded[BOULE_CLIENT_ID_SCOPE_KEY];
     const missing = [];
@@ -73,6 +80,8 @@ export function desiredBouleEnv(org, recorded, issuer) {
         env.AUTH_ORGANIZATION_ID = zitadelOrgId;
     if (clientId)
         env.AUTH_CLIENT_ID = clientId;
+    if (archonUrl)
+        env.ARCHON_URL = archonUrl;
     const owner = org.owners[0];
     const ownerUserId = owner
         ? recorded[`zitadel:owner:${org.id}:${owner.email.toLowerCase()}`]

package/dist/plan/diff.d.ts

@@ -40,6 +40,8 @@ export interface PlanOrgOptions {
     otherSlugs?: readonly string[];
     /** F6a, F6b: the clock `planEntryAiKeys` and `planFilesKeys` read for the renewal window. Default `Date.now`. */
     now?: () => number;
+    /** #374: the Archon that bills this org (`plan-apply.ts`'s `orgArchonUrl`), written into Boule's env as `ARCHON_URL`. `null` with no platform wired. */
+    archonUrl?: string | null;
 }
 export interface PlanDetail {
     orgId: OrgId;

package/dist/plan/diff.js

@@ -242,7 +242,7 @@ export function computePlanDetail(org, live, recordedIds = {}, agoraHost = NO_AG
     const bouleClient = planBouleClient(org, byKey, claimed);
     if (bouleClient)
         plannedSteps.push(bouleClient);
-    const boule = planBoule(org, byKey, claimed, recordedIds, authIssuer, options.otherSlugs ?? []);
+    const boule = planBoule(org, byKey, claimed, recordedIds, authIssuer, options.otherSlugs ?? [], options.archonUrl ?? null);
     if (boule.step)
         plannedSteps.push(boule.step);
     // Boule's own broker entry, after its app: the entry needs the AUTH_APP_KEY
@@ -1498,7 +1498,7 @@ function planBouleClient(org, byKey, claimed) {
  * address (the one Agora signs in at); without it the Boule is blocked, not
  * planned, so every other step still applies.
  */
-function planBoule(org, byKey, claimed, recordedIds, issuer, otherSlugs) {
+function planBoule(org, byKey, claimed, recordedIds, issuer, otherSlugs, archonUrl) {
     const key = resourceKey('coolify', 'boule', org.id);
     const live = byKey.get(key);
     if (live)
@@ -1532,7 +1532,7 @@ function planBoule(org, byKey, claimed, recordedIds, issuer, otherSlugs) {
         system: 'coolify',
         kind: 'boule',
         key: org.id,
-        desired: { issuer },
+        desired: { issuer, archonUrl },
     };
     if (!live) {
         return {
@@ -1544,7 +1544,7 @@ function planBoule(org, byKey, claimed, recordedIds, issuer, otherSlugs) {
         };
     }
     const liveEnv = (live.config.env ?? {});
-    const { env } = desiredBouleEnv(org, recordedIds, issuer);
+    const { env } = desiredBouleEnv(org, recordedIds, issuer, archonUrl);
     const drift = bouleEnvDrift(env, liveEnv);
     if (drift.length === 0)
         return { step: null, blocked: null };
@@ -2320,13 +2320,21 @@ function planCustomers(org, live, claimed, recordedIds) {
  * each entry's `accessEmails` through. Idempotent on the recorded Access app id,
  * like `planOwners`: Cloudflare's live listing has no Access apps. A later
  * change to the email list is not reconciled yet.
+ *
+ * #246: widened to also plan one step per `hosting.access` rule -- a
+ * `gate`, `bypass` or `service-token` Access policy on a hostname besides
+ * the app's own (`share.<domain>`, `storage.<domain>`, ...), which the
+ * `accessEmails` gate above has no way to express: it is email-only, and
+ * only for the `app` entry. With no rules declared this plans exactly what
+ * it planned before #246 -- no regression for an org that never set
+ * `hosting.access`.
  */
 function planAccess(org, recordedIds) {
     if (!org.hosting.enabled)
         return [];
     // Only the `app` entry has a public name, and so only it can sit behind
     // Access; per-entry hostnames are issue 309.
-    return org.hosting.entries
+    const appGate = org.hosting.entries
         .filter((entry) => entry.key === APP_ENTRY_KEY && entry.accessEmails.length > 0)
         .filter((entry) => !recordedIds[resourceKey('cloudflare', 'access', appStepKey(org, entry.key))])
         .map((entry) => ({
@@ -2342,6 +2350,33 @@ function planAccess(org, recordedIds) {
             migrates: false,
         },
     }));
+    const ruleSteps = (org.hosting.access ?? [])
+        .filter((rule) => !recordedIds[resourceKey('cloudflare', 'access', appStepKey(org, rule.hostname))])
+        .map((rule) => ({
+        action: {
+            system: 'cloudflare',
+            kind: 'access',
+            key: appStepKey(org, rule.hostname),
+            desired: {},
+        },
+        step: {
+            description: accessRuleDescription(org, rule),
+            destroys: false,
+            migrates: false,
+        },
+    }));
+    return [...appGate, ...ruleSteps];
+}
+/** The plan description for one `hosting.access` rule, by kind (#246). */
+function accessRuleDescription(org, rule) {
+    switch (rule.kind) {
+        case 'gate':
+            return `gate ${org.slug}'s ${rule.hostname} behind Cloudflare Access`;
+        case 'bypass':
+            return `let ${rule.hostname} (${org.slug}) bypass Cloudflare Access`;
+        case 'service-token':
+            return `let only the '${rule.serviceTokenName}' service token through Cloudflare Access on ${rule.hostname} (${org.slug})`;
+    }
 }
 /**
  * https://github.com/wtfalch/foundry/issues/43: one Cloudflare rate-limiting

package/dist/plan/executor.d.ts

@@ -420,6 +420,15 @@ export interface CloudflarePort {
     }): Promise<{
         id: string;
     }>;
+    /**
+     * `cloudflareAccess` resolves a `kind: 'service-token'` rule's named
+     * token to its id (#246) -- the token itself is a live Cloudflare
+     * resource this package never mints; `undefined` when no token by that
+     * name exists yet.
+     */
+    findServiceTokenByName(name: string): Promise<{
+        id: string;
+    } | undefined>;
     deleteAccessApp(appId: string): Promise<void>;
     /**
      * `FoundryPlanApply.destroy`'s teardown of any DNS record foundry created
@@ -1394,15 +1403,30 @@ export declare class FoundryStepExecutor implements StepExecutor, StepDestroyer
         resourceId?: string;
     } | undefined>;
     /**
-     * `plan/diff.ts`'s `planAccess` (#84): puts the org's app hostname behind a
-     * Cloudflare Access app that lets only the `app` entry's `accessEmails` through.
-     * foundry names its Access app `foundry:<orgId>` and reuses only an app with
-     * that name, so a re-run after a crash does not duplicate it. It refuses,
-     * rather than adopt, when another Access app already holds the hostname:
-     * destroy would later delete it. It also refuses when its own app carries
+     * `plan/diff.ts`'s `planAccess` (#84, widened by #246): puts a hostname
+     * behind a Cloudflare Access app. `action.key` tells the `app` entry's own
+     * gate (`accessEmails`, email-only) apart from a `hosting.access` rule on
+     * any other hostname -- `appStepKey` builds both, keyed by the entry's key
+     * or by the rule's hostname respectively, and the two never collide
+     * because an entry key never holds a `.` while a rule's hostname always
+     * does (`org.ts`'s `validateAccessRule`). The app-entry gate keeps the
+     * Access app name `foundry:<orgId>` it has always used, so a re-run
+     * against an org applied before #246 still finds the app it already
+     * created; a rule's own app is named `foundry:<orgId>:<hostname>` instead,
+     * since an org may declare more than one. Either way foundry reuses only
+     * an app with its own name (so a re-run after a crash does not duplicate
+     * it), refuses to adopt a hostname another Access app already holds
+     * (destroy would later delete it), and refuses when its own app carries
      * any policy but foundry's, since that policy could let others in.
      */
     private cloudflareAccess;
+    /** The Cloudflare Access policy body for one `hosting.access` rule, by kind (#246). */
+    private accessPolicyFor;
+    /**
+     * The create-or-adopt-refusal logic `cloudflareAccess` shares between the
+     * `app` entry's own gate and every `hosting.access` rule (#84, #246).
+     */
+    private cloudflareAccessApp;
     /**
      * `plan/diff.ts`'s `planRateLimit` (#43): one Cloudflare rate limiting
      * rule, scoped to `SIGN_IN_PATH_EXPRESSION`, on the org's own Cloudflare

package/dist/plan/executor.js

@@ -143,6 +143,19 @@ function mailOrgFor(org, usesDomain, mode) {
 const COOLIFY_PROXY_ORIGIN = 'http://coolify-proxy:80';
 /** The one Access policy foundry puts on its own Access app (#84). */
 export const ACCESS_POLICY_NAME = 'foundry: allowed emails';
+/**
+ * The Access policy name for each `hosting.access` rule kind (#246),
+ * `cloudflareAccess`'s way of telling its own policy apart from a foreign
+ * one on the same app -- the same role {@link ACCESS_POLICY_NAME} plays for
+ * the `app` entry's own email gate, which keeps that exact name so a
+ * re-run against an org applied before #246 still recognises its own
+ * policy.
+ */
+const ACCESS_RULE_POLICY_NAMES = {
+    gate: ACCESS_POLICY_NAME,
+    bypass: 'foundry: bypass',
+    'service-token': 'foundry: service token',
+};
 /**
  * The sign-in broker's own route mount (`@wtfalch/auth`'s `NextAuth`,
  * `dist/next.d.ts`'s `handlers` doc comment: "`export const { GET, POST } =
@@ -635,7 +648,7 @@ export class FoundryStepExecutor {
             case 'cloudflare:zone':
                 return this.cloudflareZone(action, org);
             case 'cloudflare:access':
-                return this.cloudflareAccess(org);
+                return this.cloudflareAccess(action, org);
             case 'cloudflare:ratelimit':
                 return this.cloudflareRateLimit(org);
             case 'files:organisation':
@@ -677,40 +690,91 @@ export class FoundryStepExecutor {
         }
     }
     /**
-     * `plan/diff.ts`'s `planAccess` (#84): puts the org's app hostname behind a
-     * Cloudflare Access app that lets only the `app` entry's `accessEmails` through.
-     * foundry names its Access app `foundry:<orgId>` and reuses only an app with
-     * that name, so a re-run after a crash does not duplicate it. It refuses,
-     * rather than adopt, when another Access app already holds the hostname:
-     * destroy would later delete it. It also refuses when its own app carries
+     * `plan/diff.ts`'s `planAccess` (#84, widened by #246): puts a hostname
+     * behind a Cloudflare Access app. `action.key` tells the `app` entry's own
+     * gate (`accessEmails`, email-only) apart from a `hosting.access` rule on
+     * any other hostname -- `appStepKey` builds both, keyed by the entry's key
+     * or by the rule's hostname respectively, and the two never collide
+     * because an entry key never holds a `.` while a rule's hostname always
+     * does (`org.ts`'s `validateAccessRule`). The app-entry gate keeps the
+     * Access app name `foundry:<orgId>` it has always used, so a re-run
+     * against an org applied before #246 still finds the app it already
+     * created; a rule's own app is named `foundry:<orgId>:<hostname>` instead,
+     * since an org may declare more than one. Either way foundry reuses only
+     * an app with its own name (so a re-run after a crash does not duplicate
+     * it), refuses to adopt a hostname another Access app already holds
+     * (destroy would later delete it), and refuses when its own app carries
      * any policy but foundry's, since that policy could let others in.
      */
-    async cloudflareAccess(org) {
+    async cloudflareAccess(action, org) {
         // Only the `app` entry has a public name (`planAccess`); per-entry
         // hostnames are issue 309.
         const entry = appEntry(org.hosting);
         if (!entry)
             throw new Error(`cloudflare:access for ${org.slug}: no '${APP_ENTRY_KEY}' hosting entry`);
-        const domain = appHostname(org);
-        const name = `foundry:${org.id}`;
+        if (action.key === appStepKey(org, entry.key)) {
+            return this.cloudflareAccessApp(org, {
+                appName: `foundry:${org.id}`,
+                domain: appHostname(org),
+                policyName: ACCESS_POLICY_NAME,
+                policy: {
+                    decision: 'allow',
+                    include: entry.accessEmails.map((email) => ({ email: { email } })),
+                },
+            });
+        }
+        const rule = (org.hosting.access ?? []).find((r) => appStepKey(org, r.hostname) === action.key);
+        if (!rule) {
+            throw new Error(`cloudflare:access for ${org.slug}: no hosting.access rule matches step key '${action.key}'`);
+        }
+        return this.cloudflareAccessApp(org, {
+            appName: `foundry:${org.id}:${rule.hostname}`,
+            domain: rule.hostname,
+            policyName: ACCESS_RULE_POLICY_NAMES[rule.kind],
+            policy: await this.accessPolicyFor(org, rule),
+        });
+    }
+    /** The Cloudflare Access policy body for one `hosting.access` rule, by kind (#246). */
+    async accessPolicyFor(org, rule) {
+        switch (rule.kind) {
+            case 'gate':
+                return {
+                    decision: 'allow',
+                    include: rule.emails.map((email) => ({ email: { email } })),
+                };
+            case 'bypass':
+                // A bypass policy still needs an `include` rule to match against;
+                // `everyone` is Cloudflare's own shape for "match every visitor".
+                return { decision: 'bypass', include: [{ everyone: {} }] };
+            case 'service-token': {
+                const token = await this.ports.cloudflare.findServiceTokenByName(rule.serviceTokenName);
+                if (!token) {
+                    throw new Error(`cloudflare:access for ${org.slug}: no Cloudflare Access service token named '${rule.serviceTokenName}'`);
+                }
+                return { decision: 'non_identity', include: [{ service_token: { token_id: token.id } }] };
+            }
+        }
+    }
+    /**
+     * The create-or-adopt-refusal logic `cloudflareAccess` shares between the
+     * `app` entry's own gate and every `hosting.access` rule (#84, #246).
+     */
+    async cloudflareAccessApp(org, opts) {
+        const { appName, domain, policyName, policy } = opts;
         const cf = this.ports.cloudflare;
         const onDomain = (await cf.listAccessApps()).filter((a) => a.domain === domain);
-        const foreign = onDomain.find((a) => a.name !== name);
+        const foreign = onDomain.find((a) => a.name !== appName);
         if (foreign) {
             throw new Error(`cloudflare:access for ${org.slug}: Access app '${foreign.name}' already holds ${domain}; foundry does not adopt it`);
         }
-        const app = onDomain[0] ?? (await cf.createAccessApp({ name, domain, type: 'self_hosted' }));
+        const app = onDomain[0] ?? (await cf.createAccessApp({ name: appName, domain, type: 'self_hosted' }));
         const policies = await cf.listAccessPolicies(app.id);
-        const other = policies.find((p) => p.name !== ACCESS_POLICY_NAME);
+        const other = policies.find((p) => p.name !== policyName);
         if (other) {
             throw new Error(`cloudflare:access for ${org.slug}: Access app ${app.id} has policy '${other.name}' that foundry did not create`);
         }
         if (policies.length === 0) {
-            await cf.createAccessPolicy(app.id, {
-                name: ACCESS_POLICY_NAME,
-                decision: 'allow',
-                include: entry.accessEmails.map((email) => ({ email: { email } })),
-            });
+            await cf.createAccessPolicy(app.id, { name: policyName, ...policy });
         }
         return { resourceId: app.id };
     }
@@ -3055,10 +3119,11 @@ export class FoundryStepExecutor {
      * (`bouleBrokerEntry`).
      */
     async coolifyBoule(action, org, context) {
-        // The issuer the plan read, carried in the step: the env written is the
-        // env the plan showed.
+        // The issuer and Archon URL the plan read, carried in the step: the env
+        // written is the env the plan showed.
         const issuer = action.desired.issuer ?? null;
-        const { env, missing } = desiredBouleEnv(org, context.recordedIds(), issuer);
+        const archonUrl = action.desired.archonUrl ?? null;
+        const { env, missing } = desiredBouleEnv(org, context.recordedIds(), issuer, archonUrl);
         if (missing.length > 0) {
             throw new Error(`Boule for ${org.slug} cannot be configured: missing ${missing.join(', ')}. Nothing was written.`);
         }