@wtfalch/foundry 0.16.7 → 0.16.9

package/dist/bootstrap/bootstrap.d.ts

@@ -4,6 +4,8 @@ import type { FoundryStoreDb } from '../store/postgres.js';
 import type { BootstrapCompany, BootstrapOwner } from './declare.js';
 export interface BootstrapPlatformInput {
     company: BootstrapCompany;
+    /** The Coolify server's public IPv4, saved as `platform.serverIpv4` (`../platform.ts`); absent leaves a stored value alone. */
+    serverIpv4?: string;
     owner: BootstrapOwner;
 }
 /**

package/dist/bootstrap/bootstrap.js

@@ -198,9 +198,17 @@ export async function bootstrapPlatform(input, deps) {
         const existing = await platformStore.get();
         if (existing) {
             emit({ phase: 'declare', message: `declared platform already written for ${existing.apex}` });
+            // Only serverIpv4, through the validating `put`; no other field is touched.
+            if (input.serverIpv4 && input.serverIpv4 !== existing.serverIpv4) {
+                await platformStore.put({ ...existing, serverIpv4: input.serverIpv4 });
+                emit({
+                    phase: 'declare',
+                    message: `declared platform serverIpv4 set to ${input.serverIpv4}`,
+                });
+            }
         }
         else {
-            await platformStore.put(declaredPlatformFor(input.company.apex));
+            await platformStore.put(declaredPlatformFor(input.company.apex, input.serverIpv4));
             emit({
                 phase: 'declare',
                 message: `declared platform written for ${input.company.apex}`,

package/dist/bootstrap/declare.d.ts

@@ -35,4 +35,4 @@ export declare function declaredCompanyOrg(company: BootstrapCompany, owner: Boo
  * The declared platform under `apex`. A disabled service keeps an empty
  * `gitRef`, which `validatePlatform` allows.
  */
-export declare function declaredPlatformFor(apex: string): DeclaredPlatform;
+export declare function declaredPlatformFor(apex: string, serverIpv4?: string): DeclaredPlatform;

package/dist/bootstrap/declare.js

@@ -85,7 +85,7 @@ export function declaredCompanyOrg(company, owner) {
  * The declared platform under `apex`. A disabled service keeps an empty
  * `gitRef`, which `validatePlatform` allows.
  */
-export function declaredPlatformFor(apex) {
+export function declaredPlatformFor(apex, serverIpv4) {
     const services = {};
     for (const key of PLATFORM_SERVICE_KEYS) {
         const enabled = SERVICES_ENABLED_BY_DEFAULT.has(key);
@@ -95,5 +95,10 @@ export function declaredPlatformFor(apex) {
             gitRef: !enabled ? '' : key === 'mail' ? DEFAULT_MAIL_IMAGE_TAG : DEFAULT_GIT_REF,
         };
     }
-    return { ownerOrgId: COMPANY_INCLUDED_ORG_ID, apex, ...services };
+    return {
+        ownerOrgId: COMPANY_INCLUDED_ORG_ID,
+        apex,
+        ...(serverIpv4 ? { serverIpv4 } : {}),
+        ...services,
+    };
 }

package/dist/index.d.ts

@@ -8,12 +8,12 @@ export type { SlugRejectionReason, SlugRejection } from './slug.js';
 export { validateSlug, slugFromName, RESERVED_SLUGS } from './slug.js';
 export type { Checkpoint, LastApplied, AppliedState } from './state.js';
 export type { PlanStep, UnmanagedItem, Plan } from './plan.js';
-export type { DeclaredOrgStore, PlatformStore, RequestedChangeStore, StaleUpdate, UpdateOptions, } from './store.js';
+export type { AppliedVersion, AppliedVersionsStore, DeclaredOrgStore, PlatformStore, RequestedChangeStore, StaleUpdate, UpdateOptions, } from './store.js';
 export type { PlanApply } from './apply.js';
-export { createPostgresDeclaredOrgStore, createPostgresPlatformStore, createPostgresRequestedChangeStore, DeclaredOrgError, PlatformError, } from './store/postgres.js';
+export { createPostgresAppliedVersionsStore, createPostgresDeclaredOrgStore, createPostgresPlatformStore, createPostgresRequestedChangeStore, DeclaredOrgError, PlatformError, } from './store/postgres.js';
 export { createPostgresAuditLog } from './store/audit.js';
 export type { FoundryStoreDb } from './store/postgres.js';
-export { declaredOrgs, foundryAppliedState, foundryAuditEvents, foundryDeclaredPlatform, foundryRequestedChanges, type AuditEventRow, type DeclaredOrgRow, type NewDeclaredOrgRow, type AppliedStateRow, type NewAppliedStateRow, type DeclaredPlatformRow, type NewDeclaredPlatformRow, type RequestedChangeRow, type NewRequestedChangeRow, } from './store/schema.js';
+export { declaredOrgs, foundryAppliedState, foundryAppliedVersions, foundryAuditEvents, foundryDeclaredPlatform, foundryRequestedChanges, type AuditEventRow, type DeclaredOrgRow, type NewDeclaredOrgRow, type AppliedStateRow, type NewAppliedStateRow, type AppliedVersionRow, type NewAppliedVersionRow, type DeclaredPlatformRow, type NewDeclaredPlatformRow, type RequestedChangeRow, type NewRequestedChangeRow, } from './store/schema.js';
 export type { LiveResource, ZitadelReader, CoolifyReader, CloudflareReader, FilesReader, AiReader, CmsReader, LiveReaders, PlatformCloudflareReader, PlatformCoolifyReader, PlatformLiveReaders, StepAction, PlannedStep, PlanDetail, PlatformPlanDetail, AuditActor, AuditLog, AuthzGate, StepExecutor, StepDestroyer, DestroyTarget, StepExecutionContext, PlatformStepExecutor, PlatformStepExecutionContext, FoundryPlanApplyOptions, } from './plan/index.js';
 export { readLiveResources, readLivePlatformResources, computePlanDetail, toPlan, planPlatform, toPlatformPlan, JOBS_SCHEDULER_KEY, PLATFORM_AI_KEY, PLATFORM_AI_INTERNAL_URL_SCOPE_KEY, PLATFORM_AI_MANAGEMENT_KEY_SCOPE_KEY, PLATFORM_AI_ORGANISATION_SCOPE_KEY, PLATFORM_FILES_KEY, PLATFORM_FILES_INTERNAL_URL_SCOPE_KEY, PLATFORM_FILES_ZITADEL_PROJECT_SCOPE_KEY, PLATFORM_MAIL_INTERNAL_URL_SCOPE_KEY, PLATFORM_MAIL_ZITADEL_PROJECT_SCOPE_KEY, FoundryPlanApply, DeclaredOrgNotFoundError, StalePlanError, ConfirmationRequiredError, NotAuthorizedError, NotATestOrgError, DeclaredPlatformNotFoundError, PlatformStalePlanError, PlatformConfirmationRequiredError, planNeedsConfirmation, } from './plan/index.js';
 export type { HeldKeyResolver, OrgPlatformReadiness } from './plan/index.js';

package/dist/index.js

@@ -2,9 +2,9 @@ export { APP_ENTRY_KEY, FILES_ENTRY_PERMISSIONS, AI_ENTRY_PERMISSIONS, DEFAULT_M
 export { PLATFORM_SERVICE_KEYS, defaultPlatformHostname, validatePlatform, } from './platform.js';
 export { REQUESTABLE_FIELDS, classifyChange, RequestedChangeError } from './requested-changes.js';
 export { validateSlug, slugFromName, RESERVED_SLUGS } from './slug.js';
-export { createPostgresDeclaredOrgStore, createPostgresPlatformStore, createPostgresRequestedChangeStore, DeclaredOrgError, PlatformError, } from './store/postgres.js';
+export { createPostgresAppliedVersionsStore, createPostgresDeclaredOrgStore, createPostgresPlatformStore, createPostgresRequestedChangeStore, DeclaredOrgError, PlatformError, } from './store/postgres.js';
 export { createPostgresAuditLog } from './store/audit.js';
-export { declaredOrgs, foundryAppliedState, foundryAuditEvents, foundryDeclaredPlatform, foundryRequestedChanges, } from './store/schema.js';
+export { declaredOrgs, foundryAppliedState, foundryAppliedVersions, foundryAuditEvents, foundryDeclaredPlatform, foundryRequestedChanges, } from './store/schema.js';
 export { readLiveResources, readLivePlatformResources, computePlanDetail, toPlan, planPlatform, toPlatformPlan, JOBS_SCHEDULER_KEY, PLATFORM_AI_KEY, PLATFORM_AI_INTERNAL_URL_SCOPE_KEY, PLATFORM_AI_MANAGEMENT_KEY_SCOPE_KEY, PLATFORM_AI_ORGANISATION_SCOPE_KEY, PLATFORM_FILES_KEY, PLATFORM_FILES_INTERNAL_URL_SCOPE_KEY, PLATFORM_FILES_ZITADEL_PROJECT_SCOPE_KEY, PLATFORM_MAIL_INTERNAL_URL_SCOPE_KEY, PLATFORM_MAIL_ZITADEL_PROJECT_SCOPE_KEY, FoundryPlanApply, DeclaredOrgNotFoundError, StalePlanError, ConfirmationRequiredError, NotAuthorizedError, NotATestOrgError, DeclaredPlatformNotFoundError, PlatformStalePlanError, PlatformConfirmationRequiredError, planNeedsConfirmation, } from './plan/index.js';
 export { DEFAULT_ORG_PLATFORM_READINESS, ORG_PLATFORM_KEY_REFS, agoraHostValuesFromPlatform, heldPlatformKeyRefs, orgPlatformReadinessFrom, } from './plan/index.js';
 export { PlatformOrgBlockedError, PlatformOrgPorts } from './plan/index.js';

package/dist/migrations/0036_applied_versions.sql

@@ -0,0 +1,45 @@
+-- @wtfalch/foundry: a history of recorded applies, sitting beside
+-- `0002_applied_state.sql`'s single current snapshot (#253, building on the
+-- upgrade-safety map, #237). `foundry_applied_state` (and the platform's own
+-- `foundry_declared_platform.service_ids`) replace their one row in place on
+-- every apply, so once a new version is recorded the one it replaced is
+-- gone -- there is no "previous version" to show or to roll back to, and a
+-- failed apply leaves no trail of what came before it either. This table
+-- never replaces a row; every recorded version is a new one, appended.
+--
+-- `service` names whatever was just recorded as applied -- today, an org's
+-- id, from the same point in `plan/plan-apply.ts`'s `runSteps` that writes
+-- `AppliedState.lastApplied` (mirrors `0002`'s `last_applied_declared_org_version`
+-- renamed generically, since #237's platform services -- mail, archon, ai,
+-- files, integrations and the rest -- record an applied ref of their own and
+-- can write rows here the same way once they do). `ref` is whatever version
+-- identifier that apply recorded (an org's declared-org hash today; a git
+-- ref or image tag for a platform service).
+--
+-- `run_id` and `backup_id` are both nullable: nothing in today's code ties
+-- an apply to a run id (the job runner, `src/runner`, is not yet wired to
+-- plan/apply -- #17's own module, standing alone), and no apply takes a
+-- backup before recording a version yet -- #256 ("Back up before a stateful
+-- upgrade") is the later issue that starts writing `backup_id`. Both columns
+-- exist now so that issue, and a future run-id wiring, are additive: a new
+-- column would be, this is a new row shape instead.
+--
+-- Read back by `previousAppliedRef` (`../store.ts`): the ref of the
+-- second-most-recent row for a service is what a rollback has to roll back
+-- to. No foreign key to `foundry_declared_orgs` -- `foundry_runs.org_id`
+-- makes the same choice (`0003_foundry_runs.sql`) -- because `service` is
+-- not always an org id, and a history row for a destroyed org (or a
+-- platform service, which is no org at all) must survive the org going away.
+
+create table if not exists foundry_applied_versions (
+  id          bigserial primary key,
+  service     text not null,
+  ref         text not null,
+  applied_at  timestamptz not null default now(),
+  run_id      text,
+  backup_id   text
+);
+
+-- `previousAppliedRef`'s read: the most recent rows for one service, newest first.
+create index if not exists foundry_applied_versions_service_idx
+  on foundry_applied_versions (service, applied_at desc, id desc);

package/dist/migrations/0037_platform_server_ipv4.sql

@@ -0,0 +1,8 @@
+-- @wtfalch/foundry: the declared platform's optional public server IPv4.
+-- Coolify's localhost server reports `host.docker.internal` as its ip, which
+-- cannot be a DNS A record, so the operator declares the real address here
+-- instead of hand-setting it in Coolify. Format is validated by
+-- src/platform.ts's `validatePlatform`, not here (same split as `apex`).
+-- Null: use the Coolify server's own ip when it is an IPv4.
+
+alter table foundry_declared_platform add column if not exists server_ipv4 text;

package/dist/org.d.ts

@@ -209,7 +209,46 @@ export interface HostingConfig {
     issuerApps: IssuerApp[];
     /** One entry per app the org runs. */
     entries: HostingEntry[];
+    /**
+     * Cloudflare Access rules for hostnames besides the `app` entry's own
+     * (#246): `accessEmails` above already gates that one hostname by an
+     * email list; this says what any other hostname an org serves (e.g.
+     * `share.<domain>`, `storage.<domain>`) gets instead of an operator
+     * setting it up by hand in the Cloudflare dashboard, which is how it is
+     * done today. Empty or absent: no additional Access apps.
+     */
+    access?: AccessRule[];
 }
+/** The three Cloudflare Access rule kinds {@link HostingConfig.access} supports (#246). */
+export type AccessRuleKind = 'gate' | 'bypass' | 'service-token';
+export declare const ACCESS_RULE_KINDS: ReadonlySet<AccessRuleKind>;
+/**
+ * One Cloudflare Access rule on a hostname besides the `app` entry's own
+ * (#246, `HostingConfig.access`). `hostname` is the full hostname Access
+ * gates (e.g. `share.<domain>`), never an entry key.
+ *
+ * - `gate`: an email allowlist, the same shape `accessEmails` already
+ *   applies to the app's own hostname.
+ * - `bypass`: no login at all -- the hostname is public through Access.
+ * - `service-token`: only a request carrying the named Cloudflare Access
+ *   service token's headers gets through, no human login flow. The token
+ *   itself is not minted by this rule -- it names a live Cloudflare Access
+ *   service token that `executor.ts` looks up by name, the same way its
+ *   `app`-entry gate finds its Access app by name rather than creating a
+ *   second one.
+ */
+export type AccessRule = {
+    hostname: string;
+    kind: 'gate';
+    emails: string[];
+} | {
+    hostname: string;
+    kind: 'bypass';
+} | {
+    hostname: string;
+    kind: 'service-token';
+    serviceTokenName: string;
+};
 /** The key of the entry that is today's one app: the Coolify app named `<slug>`. */
 export declare const APP_ENTRY_KEY = "app";
 /**

package/dist/org.js

@@ -2,6 +2,11 @@
 export const DEFAULT_MAIL_APPS = ['agora', 'webmail'];
 /** {@link MailConfig.noReplyLocalPart}'s own default, restated wherever it is read rather than imported (this file's `LOG_DIR`-style convention, named in `plan/executor.ts`'s own doc comments). */
 export const DEFAULT_NO_REPLY_LOCAL_PART = 'no-reply';
+export const ACCESS_RULE_KINDS = new Set([
+    'gate',
+    'bypass',
+    'service-token',
+]);
 /** The key of the entry that is today's one app: the Coolify app named `<slug>`. */
 export const APP_ENTRY_KEY = 'app';
 /** What an entry's ai key may hold: the most the org's own key holds. */
@@ -118,6 +123,45 @@ export function validateHosting(hosting, names) {
     if (hosting.entries.filter((entry) => entry.database).length > 1) {
         return 'at most one hosting entry may set database: the one runtime database role cannot serve two apps';
     }
+    const seenAccessHostnames = new Set();
+    for (const rule of hosting.access ?? []) {
+        const invalidRule = validateAccessRule(rule, hosting.enabled);
+        if (invalidRule)
+            return invalidRule;
+        if (seenAccessHostnames.has(rule.hostname)) {
+            return `hosting.access hostname '${rule.hostname}' is listed twice`;
+        }
+        seenAccessHostnames.add(rule.hostname);
+    }
+    return null;
+}
+/** A full DNS hostname, at least two labels -- distinct from an entry's single-label `key`. */
+const ACCESS_RULE_HOSTNAME = /^[a-z0-9]([a-z0-9-]{0,61}[a-z0-9])?(\.[a-z0-9]([a-z0-9-]{0,61}[a-z0-9])?)+$/;
+/** The rules for one {@link AccessRule}; `null` when it is valid. */
+function validateAccessRule(rule, enabled) {
+    const at = `hosting.access '${rule.hostname}'`;
+    if (!rule.hostname || !ACCESS_RULE_HOSTNAME.test(rule.hostname)) {
+        return `hosting.access entries need a full hostname ('${rule.hostname}' is not one)`;
+    }
+    if (!enabled) {
+        return `${at} requires hosting.enabled`;
+    }
+    if (!ACCESS_RULE_KINDS.has(rule.kind)) {
+        return `${at} has an unknown kind '${rule.kind}'`;
+    }
+    if (rule.kind === 'gate') {
+        if (rule.emails.length === 0) {
+            return `${at} kind 'gate' needs at least one email`;
+        }
+        for (const email of rule.emails) {
+            if (!EMAIL.test(email)) {
+                return `${at} has an invalid email '${email}'`;
+            }
+        }
+    }
+    if (rule.kind === 'service-token' && !rule.serviceTokenName) {
+        return `${at} kind 'service-token' needs a non-empty serviceTokenName`;
+    }
     return null;
 }
 /**
@@ -164,6 +208,7 @@ function validateEntryHostnames(hosting, names) {
     return null;
 }
 const ENTRY_KEY = /^[a-z0-9]([a-z0-9-]{0,61}[a-z0-9])?$/;
+const EMAIL = /^[^@\s]+@[^@\s]+$/;
 const REPO = /^wtfalch\/[A-Za-z0-9._-]+$/;
 // The env names `pushAppEnv` and `pushDatabaseUrl` set themselves.
 const FOUNDRY_ENV_NAME = /^(APP_URL|LOG_DIR|OWNER_USER_ID|AUTH_.*|DATABASE_URL.*)$/;
@@ -207,7 +252,7 @@ function validateHostingEntry(entry, enabled) {
         return `${at} accessEmails is only available on the '${APP_ENTRY_KEY}' entry for now`;
     }
     for (const email of entry.accessEmails) {
-        if (!/^[^@\s]+@[^@\s]+$/.test(email)) {
+        if (!EMAIL.test(email)) {
             return `${at} accessEmails has an invalid email '${email}'`;
         }
     }

package/dist/plan/boule.d.ts

@@ -29,7 +29,7 @@ export declare const BOULE_DATABASE_SCOPE_KEY = "coolify_boule_database";
  */
 export declare function bouleHostnameFor(org: DeclaredOrg): string;
 /** The env names `desiredBouleEnv` can write, so the live reader knows which to read back. */
-export declare const BOULE_MANAGED_ENV_KEYS: readonly ["APP_URL", "AUTH_ISSUER", "AUTH_ORGANIZATION_ID", "AUTH_CLIENT_ID", "BOULE_ORG_NAME", "AUTHZ_BOOTSTRAP_OPERATOR"];
+export declare const BOULE_MANAGED_ENV_KEYS: readonly ["APP_URL", "AUTH_ISSUER", "AUTH_ORGANIZATION_ID", "AUTH_CLIENT_ID", "BOULE_ORG_NAME", "AUTHZ_BOOTSTRAP_OPERATOR", "ARCHON_URL"];
 /**
  * The env vars an org's Boule app should carry, and every input still missing
  * to build them. Callers that write must refuse on a non-empty `missing`: a
@@ -41,11 +41,17 @@ export declare const BOULE_MANAGED_ENV_KEYS: readonly ["APP_URL", "AUTH_ISSUER",
  * id, never an email), present once `zitadel:owner` has recorded it. It is not
  * `missing` while absent: Boule runs without an operator until then.
  *
+ * `archonUrl` (#374) is the Archon that bills this org -- `https://` plus the
+ * declared platform's `archon.hostname` (`plan-apply.ts`'s `orgArchonUrl`),
+ * runtime only, read by Boule's Prices card (boule#228). Not `missing` while
+ * absent: Boule has no platform wired in every test and every org-only
+ * caller, same as `issuer` before #177.
+ *
  * Not here, and written by the executor instead: the database URLs
  * (`DATABASE_URL_OWNER`, `DATABASE_URL`, minted once) and `AUTH_COOKIE_SECRET`
  * (generated once, never rotated).
  */
-export declare function desiredBouleEnv(org: DeclaredOrg, recorded: Readonly<Record<string, string>>, issuer: string | null): {
+export declare function desiredBouleEnv(org: DeclaredOrg, recorded: Readonly<Record<string, string>>, issuer: string | null, archonUrl: string | null): {
     env: Record<string, string>;
     missing: string[];
 };

package/dist/plan/boule.js

@@ -37,6 +37,7 @@ export const BOULE_MANAGED_ENV_KEYS = [
     'AUTH_CLIENT_ID',
     'BOULE_ORG_NAME',
     'AUTHZ_BOOTSTRAP_OPERATOR',
+    'ARCHON_URL',
 ];
 /**
  * The env vars an org's Boule app should carry, and every input still missing
@@ -49,11 +50,17 @@ export const BOULE_MANAGED_ENV_KEYS = [
  * id, never an email), present once `zitadel:owner` has recorded it. It is not
  * `missing` while absent: Boule runs without an operator until then.
  *
+ * `archonUrl` (#374) is the Archon that bills this org -- `https://` plus the
+ * declared platform's `archon.hostname` (`plan-apply.ts`'s `orgArchonUrl`),
+ * runtime only, read by Boule's Prices card (boule#228). Not `missing` while
+ * absent: Boule has no platform wired in every test and every org-only
+ * caller, same as `issuer` before #177.
+ *
  * Not here, and written by the executor instead: the database URLs
  * (`DATABASE_URL_OWNER`, `DATABASE_URL`, minted once) and `AUTH_COOKIE_SECRET`
  * (generated once, never rotated).
  */
-export function desiredBouleEnv(org, recorded, issuer) {
+export function desiredBouleEnv(org, recorded, issuer, archonUrl) {
     const zitadelOrgId = recorded[ZITADEL_ORG_SCOPE_KEY];
     const clientId = recorded[BOULE_CLIENT_ID_SCOPE_KEY];
     const missing = [];
@@ -73,6 +80,8 @@ export function desiredBouleEnv(org, recorded, issuer) {
         env.AUTH_ORGANIZATION_ID = zitadelOrgId;
     if (clientId)
         env.AUTH_CLIENT_ID = clientId;
+    if (archonUrl)
+        env.ARCHON_URL = archonUrl;
     const owner = org.owners[0];
     const ownerUserId = owner
         ? recorded[`zitadel:owner:${org.id}:${owner.email.toLowerCase()}`]

package/dist/plan/diff.d.ts

@@ -40,6 +40,8 @@ export interface PlanOrgOptions {
     otherSlugs?: readonly string[];
     /** F6a, F6b: the clock `planEntryAiKeys` and `planFilesKeys` read for the renewal window. Default `Date.now`. */
     now?: () => number;
+    /** #374: the Archon that bills this org (`plan-apply.ts`'s `orgArchonUrl`), written into Boule's env as `ARCHON_URL`. `null` with no platform wired. */
+    archonUrl?: string | null;
 }
 export interface PlanDetail {
     orgId: OrgId;

package/dist/plan/diff.js

@@ -1,6 +1,6 @@
 import { VERSIONS, floatingTagBlocked } from '../bootstrap/versions.js';
 import { APP_ENTRY_KEY, ownerMailboxRecorded, ownerMailboxes } from '../org.js';
-import { CALLS_INTROSPECTION_SCOPE_KEY, CALLS_INTROSPECTION_UNDELIVERED_SCOPE_KEY, NO_AGORA_HOST_VALUES, ZITADEL_ORG_SCOPE_KEY, agoraEnvDrift, agoraHostMissing, callsServiceHasName, callsServiceHasTokenEnv, callsTokenEnvMovedMessage, callsTokenHostFrom, desiredAgoraEnv, withRecordedMessagingProject, } from './agora.js';
+import { CALLS_INTROSPECTION_SCOPE_KEY, CALLS_INTROSPECTION_UNDELIVERED_SCOPE_KEY, NO_AGORA_HOST_VALUES, ZITADEL_ORG_SCOPE_KEY, agoraEnvDrift, agoraHostMissing, agoraHostnameFor, callsServiceHasName, callsServiceHasTokenEnv, callsTokenEnvMovedMessage, callsTokenHostFrom, desiredAgoraEnv, withRecordedMessagingProject, } from './agora.js';
 import { BOULE_BROKER_ENTRY_KEY, bouleEnvDrift, desiredBouleEnv, wantedBouleBrokerEntry, } from './boule.js';
 import { brokerEntryAppliedScopeKey, brokerEntryWarningsScopeKey, entryAuthEnv, entryAuthEnvAppliedScopeKey, wantedBrokerEntry, } from './broker-entries.js';
 import { planEntryAiKeys } from './entry-ai-key.js';
@@ -242,7 +242,7 @@ export function computePlanDetail(org, live, recordedIds = {}, agoraHost = NO_AG
     const bouleClient = planBouleClient(org, byKey, claimed);
     if (bouleClient)
         plannedSteps.push(bouleClient);
-    const boule = planBoule(org, byKey, claimed, recordedIds, authIssuer, options.otherSlugs ?? []);
+    const boule = planBoule(org, byKey, claimed, recordedIds, authIssuer, options.otherSlugs ?? [], options.archonUrl ?? null);
     if (boule.step)
         plannedSteps.push(boule.step);
     // Boule's own broker entry, after its app: the entry needs the AUTH_APP_KEY
@@ -1003,6 +1003,15 @@ function notReadyReason(service, keyName, missingKeyRef, noKeyReader) {
  * #177: blocked, not planned, while `filesReady` is false -- the platform's
  * own files host (#171) is off or not yet applied, so there is nothing here
  * for `FilesOrganisationPort.provisionOrganisation` to reach.
+ *
+ * #273: `desired.agoraOrigin` is every org's own Agora origin (#164's
+ * `agoraHostnameFor`, always on, never blocked on anything this step
+ * doesn't already wait for) -- `executor.ts`'s `filesOrganisation` adds it
+ * to the files host's CORS allowlist alongside provisioning. Known gap: a
+ * later domain change that moves Agora's hostname is not replanned here,
+ * since this step (like `planIssuer`) has nothing to diff once the org's
+ * Files organisation already exists -- the old origin is left allowed
+ * rather than silently dropped.
  */
 function planFilesOrganisation(org, byKey, claimed, filesReady, missingKeyRef, noKeyReader = false) {
     const key = resourceKey('files', 'organisation', org.id);
@@ -1023,7 +1032,12 @@ function planFilesOrganisation(org, byKey, claimed, filesReady, missingKeyRef, n
                 system: 'files',
                 kind: 'organisation',
                 key: org.id,
-                desired: { provision: true, ceilingBytes: null, ceilingMicros: null },
+                desired: {
+                    provision: true,
+                    ceilingBytes: null,
+                    ceilingMicros: null,
+                    agoraOrigin: `https://${agoraHostnameFor(org)}`,
+                },
             },
             step: {
                 description: `provision ${org.slug}'s own organisation on Files`,
@@ -1498,7 +1512,7 @@ function planBouleClient(org, byKey, claimed) {
  * address (the one Agora signs in at); without it the Boule is blocked, not
  * planned, so every other step still applies.
  */
-function planBoule(org, byKey, claimed, recordedIds, issuer, otherSlugs) {
+function planBoule(org, byKey, claimed, recordedIds, issuer, otherSlugs, archonUrl) {
     const key = resourceKey('coolify', 'boule', org.id);
     const live = byKey.get(key);
     if (live)
@@ -1532,7 +1546,7 @@ function planBoule(org, byKey, claimed, recordedIds, issuer, otherSlugs) {
         system: 'coolify',
         kind: 'boule',
         key: org.id,
-        desired: { issuer },
+        desired: { issuer, archonUrl },
     };
     if (!live) {
         return {
@@ -1544,7 +1558,7 @@ function planBoule(org, byKey, claimed, recordedIds, issuer, otherSlugs) {
         };
     }
     const liveEnv = (live.config.env ?? {});
-    const { env } = desiredBouleEnv(org, recordedIds, issuer);
+    const { env } = desiredBouleEnv(org, recordedIds, issuer, archonUrl);
     const drift = bouleEnvDrift(env, liveEnv);
     if (drift.length === 0)
         return { step: null, blocked: null };
@@ -2320,13 +2334,21 @@ function planCustomers(org, live, claimed, recordedIds) {
  * each entry's `accessEmails` through. Idempotent on the recorded Access app id,
  * like `planOwners`: Cloudflare's live listing has no Access apps. A later
  * change to the email list is not reconciled yet.
+ *
+ * #246: widened to also plan one step per `hosting.access` rule -- a
+ * `gate`, `bypass` or `service-token` Access policy on a hostname besides
+ * the app's own (`share.<domain>`, `storage.<domain>`, ...), which the
+ * `accessEmails` gate above has no way to express: it is email-only, and
+ * only for the `app` entry. With no rules declared this plans exactly what
+ * it planned before #246 -- no regression for an org that never set
+ * `hosting.access`.
  */
 function planAccess(org, recordedIds) {
     if (!org.hosting.enabled)
         return [];
     // Only the `app` entry has a public name, and so only it can sit behind
     // Access; per-entry hostnames are issue 309.
-    return org.hosting.entries
+    const appGate = org.hosting.entries
         .filter((entry) => entry.key === APP_ENTRY_KEY && entry.accessEmails.length > 0)
         .filter((entry) => !recordedIds[resourceKey('cloudflare', 'access', appStepKey(org, entry.key))])
         .map((entry) => ({
@@ -2342,6 +2364,33 @@ function planAccess(org, recordedIds) {
             migrates: false,
         },
     }));
+    const ruleSteps = (org.hosting.access ?? [])
+        .filter((rule) => !recordedIds[resourceKey('cloudflare', 'access', appStepKey(org, rule.hostname))])
+        .map((rule) => ({
+        action: {
+            system: 'cloudflare',
+            kind: 'access',
+            key: appStepKey(org, rule.hostname),
+            desired: {},
+        },
+        step: {
+            description: accessRuleDescription(org, rule),
+            destroys: false,
+            migrates: false,
+        },
+    }));
+    return [...appGate, ...ruleSteps];
+}
+/** The plan description for one `hosting.access` rule, by kind (#246). */
+function accessRuleDescription(org, rule) {
+    switch (rule.kind) {
+        case 'gate':
+            return `gate ${org.slug}'s ${rule.hostname} behind Cloudflare Access`;
+        case 'bypass':
+            return `let ${rule.hostname} (${org.slug}) bypass Cloudflare Access`;
+        case 'service-token':
+            return `let only the '${rule.serviceTokenName}' service token through Cloudflare Access on ${rule.hostname} (${org.slug})`;
+    }
 }
 /**
  * https://github.com/wtfalch/foundry/issues/43: one Cloudflare rate-limiting

package/dist/plan/executor.d.ts

@@ -420,6 +420,15 @@ export interface CloudflarePort {
     }): Promise<{
         id: string;
     }>;
+    /**
+     * `cloudflareAccess` resolves a `kind: 'service-token'` rule's named
+     * token to its id (#246) -- the token itself is a live Cloudflare
+     * resource this package never mints; `undefined` when no token by that
+     * name exists yet.
+     */
+    findServiceTokenByName(name: string): Promise<{
+        id: string;
+    } | undefined>;
     deleteAccessApp(appId: string): Promise<void>;
     /**
      * `FoundryPlanApply.destroy`'s teardown of any DNS record foundry created
@@ -1105,6 +1114,20 @@ export interface FilesOrganisationPort {
         name: string;
         created: boolean;
     }>;
+    /**
+     * #273: adds `origin` to the files host's `FILES_ALLOWED_ORIGINS`
+     * allowlist (`wtfalch/files#109`) -- additively, never removing another
+     * organisation's entry already there. That list is a Coolify env var on
+     * the files runner app, not a database row the files management API
+     * reports back (files#109's own reasoning: a database round trip on the
+     * unauthenticated CORS preflight is both a hot-path cost and a new way to
+     * fail closed), so there is nothing here to diff against a live value --
+     * the host decides how `origin` actually reaches that env var, the same
+     * way every other method on this port decides how to speak the service's
+     * protocol. Safely repeatable: calling it again with an origin already on
+     * the list is a no-op.
+     */
+    ensureAllowedOrigin(organisationId: string, origin: string): Promise<void>;
 }
 /**
  * Provisions one org's organisation on AI and switches its AI use on (#80),
@@ -1394,15 +1417,30 @@ export declare class FoundryStepExecutor implements StepExecutor, StepDestroyer
         resourceId?: string;
     } | undefined>;
     /**
-     * `plan/diff.ts`'s `planAccess` (#84): puts the org's app hostname behind a
-     * Cloudflare Access app that lets only the `app` entry's `accessEmails` through.
-     * foundry names its Access app `foundry:<orgId>` and reuses only an app with
-     * that name, so a re-run after a crash does not duplicate it. It refuses,
-     * rather than adopt, when another Access app already holds the hostname:
-     * destroy would later delete it. It also refuses when its own app carries
+     * `plan/diff.ts`'s `planAccess` (#84, widened by #246): puts a hostname
+     * behind a Cloudflare Access app. `action.key` tells the `app` entry's own
+     * gate (`accessEmails`, email-only) apart from a `hosting.access` rule on
+     * any other hostname -- `appStepKey` builds both, keyed by the entry's key
+     * or by the rule's hostname respectively, and the two never collide
+     * because an entry key never holds a `.` while a rule's hostname always
+     * does (`org.ts`'s `validateAccessRule`). The app-entry gate keeps the
+     * Access app name `foundry:<orgId>` it has always used, so a re-run
+     * against an org applied before #246 still finds the app it already
+     * created; a rule's own app is named `foundry:<orgId>:<hostname>` instead,
+     * since an org may declare more than one. Either way foundry reuses only
+     * an app with its own name (so a re-run after a crash does not duplicate
+     * it), refuses to adopt a hostname another Access app already holds
+     * (destroy would later delete it), and refuses when its own app carries
      * any policy but foundry's, since that policy could let others in.
      */
     private cloudflareAccess;
+    /** The Cloudflare Access policy body for one `hosting.access` rule, by kind (#246). */
+    private accessPolicyFor;
+    /**
+     * The create-or-adopt-refusal logic `cloudflareAccess` shares between the
+     * `app` entry's own gate and every `hosting.access` rule (#84, #246).
+     */
+    private cloudflareAccessApp;
     /**
      * `plan/diff.ts`'s `planRateLimit` (#43): one Cloudflare rate limiting
      * rule, scoped to `SIGN_IN_PATH_EXPRESSION`, on the org's own Cloudflare
@@ -2321,6 +2359,12 @@ export declare class FoundryStepExecutor implements StepExecutor, StepDestroyer
      * safely repeatable on its own (`FilesOrganisationPort`'s doc comment), so
      * this is called every time regardless of whether it already ran --
      * idempotent by find-or-create, not by checking `recordedIds` first.
+     *
+     * #273: also ensures the org's Agora origin is on the files host's CORS
+     * allowlist (`FilesOrganisationPort.ensureAllowedOrigin`), the same
+     * repeat-is-a-no-op shape as `provisionOrganisation` itself -- every org
+     * gets an Agora (#164), so `diff.ts`'s `planFilesOrganisation` always sets
+     * `desired.agoraOrigin`.
      */
     private filesOrganisation;
     /**