@wtfalch/foundry 0.22.5 → 0.24.0

package/dist/bootstrap/declare.js

@@ -1,4 +1,4 @@
-import { validateOwners } from '../org.js';
+import { DEFAULT_GATE_LIMIT, validateOwners } from '../org.js';
 import { PLATFORM_SERVICE_KEYS, defaultPlatformHostname } from '../platform.js';
 import { VERSIONS } from './versions.js';
 /**
@@ -107,6 +107,7 @@ export function declaredCompanyOrg(company, owner) {
             tunnel: false,
             issuerApps: [],
             entries: [],
+            gateLimit: DEFAULT_GATE_LIMIT,
         },
         sso: { enabled: false },
         guests: { enabled: false },

package/dist/index.d.ts

@@ -1,5 +1,5 @@
-export type { OrgId, MailMode, MailConfig, ChatConfig, CallsConfig, IssuerConfig, SiteConfig, IssuerAppKind, IssuerApp, HostingConfig, HostingEntry, HostingEntryUses, EntryAuth, EntryFiles, EntryAi, EnvValue, SsoConfig, GuestsConfig, SoloConfig, StorageConfig, AiConfig, BuyerAddress, BuyerIdentity, AdoptedAppForm, AdoptedApp, OwnerIdentity, OwnerMailbox, DeclaredOrg, } from './org.js';
-export { APP_ENTRY_KEY, FILES_ENTRY_PERMISSIONS, AI_ENTRY_PERMISSIONS, DEFAULT_MAIL_APPS, appEntry, ownerMailboxes, validateBuyerIdentity, validateHosting, validateMail, validateOwners, validateSite, } from './org.js';
+export type { OrgId, MailMode, MailConfig, ChatConfig, CallsConfig, IssuerConfig, SiteConfig, IssuerAppKind, IssuerApp, HostingConfig, HostingEntry, EntryGate, HostingEntryUses, EntryAuth, EntryFiles, EntryAi, EnvValue, SsoConfig, GuestsConfig, SoloConfig, StorageConfig, AiConfig, BuyerAddress, BuyerIdentity, AdoptedAppForm, AdoptedApp, OwnerIdentity, OwnerMailbox, DeclaredOrg, } from './org.js';
+export { APP_ENTRY_KEY, DEFAULT_GATE_LIMIT, FILES_ENTRY_PERMISSIONS, AI_ENTRY_PERMISSIONS, DEFAULT_MAIL_APPS, appEntry, ownerMailboxes, validateBuyerIdentity, validateHosting, validateMail, validateOwners, validateSite, } from './org.js';
 export type { DeclaredPlatform, PlatformService, PlatformServiceKey } from './platform.js';
 export { PLATFORM_SERVICE_KEYS, defaultPlatformHostname, validatePlatform, } from './platform.js';
 import { type PinnedVersions } from './bootstrap/versions.js';

package/dist/index.js

@@ -1,4 +1,4 @@
-export { APP_ENTRY_KEY, FILES_ENTRY_PERMISSIONS, AI_ENTRY_PERMISSIONS, DEFAULT_MAIL_APPS, appEntry, ownerMailboxes, validateBuyerIdentity, validateHosting, validateMail, validateOwners, validateSite, } from './org.js';
+export { APP_ENTRY_KEY, DEFAULT_GATE_LIMIT, FILES_ENTRY_PERMISSIONS, AI_ENTRY_PERMISSIONS, DEFAULT_MAIL_APPS, appEntry, ownerMailboxes, validateBuyerIdentity, validateHosting, validateMail, validateOwners, validateSite, } from './org.js';
 export { PLATFORM_SERVICE_KEYS, defaultPlatformHostname, validatePlatform, } from './platform.js';
 // archon#273: the pinned platform service versions the planner deploys, so a
 // host can show declared against running. Readonly: it is the planner's own

package/dist/migrations/0047_platform_coolify.sql

@@ -0,0 +1,20 @@
+-- @wtfalch/foundry: the Coolify panel's address, added to the declared
+-- platform so the platform's hostnames include it. Mirrors `src/store/schema.ts`'s
+-- `foundryDeclaredPlatform` table additions. Foundry never deploys the panel:
+-- `coolify_enabled` stays false and `coolify_git_ref` empty. Backfills
+-- `coolify_hostname` the same way `0046_platform_hc.sql` backfilled
+-- `hc_hostname`: the column must not be empty (`src/platform.ts`'s
+-- `validatePlatform`), and the table already carries its one live row by the
+-- time this runs.
+
+alter table foundry_declared_platform
+  add column if not exists coolify_enabled boolean not null default false,
+  add column if not exists coolify_hostname text,
+  add column if not exists coolify_git_ref text not null default '';
+
+update foundry_declared_platform
+  set coolify_hostname = 'coolify.' || apex
+  where coolify_hostname is null;
+
+alter table foundry_declared_platform
+  alter column coolify_hostname set not null;

package/dist/migrations/0048_hosting_gate_limit.sql

@@ -0,0 +1,7 @@
+-- @wtfalch/foundry: the per-company limit on Access gates (#603), persisted.
+-- Mirrors `src/store/schema.ts`'s `hostingGateLimit`. Additive: an older
+-- reader ignores the column, and a row written before it reads the default, 3
+-- (`DEFAULT_GATE_LIMIT` in `src/org.ts`).
+
+alter table foundry_declared_orgs
+  add column if not exists hosting_gate_limit integer not null default 3;

package/dist/org.d.ts

@@ -242,25 +242,26 @@ export interface HostingConfig {
     /** One entry per app the org runs. */
     entries: HostingEntry[];
     /**
-     * Cloudflare Access rules for hostnames besides the `app` entry's own
-     * (#246): `accessEmails` above already gates that one hostname by an
-     * email list; this says what any other hostname an org serves (e.g.
-     * `share.<domain>`, `storage.<domain>`) gets instead of an operator
-     * setting it up by hand in the Cloudflare dashboard, which is how it is
-     * done today. Empty or absent: no additional Access apps.
+     * How a hostname the org serves gets past Cloudflare Access (#246): a name
+     * that is public (`bypass`) or admits a machine (`service-token`) instead
+     * of an operator setting it up by hand in the Cloudflare dashboard. Who
+     * passes for people is an entry's `gates`. Empty or absent: no additional
+     * Access apps.
      */
     access?: AccessRule[];
+    /** How many gates the org may declare across all its entries. Only the platform operator sets it. Default: `3`. */
+    gateLimit: number;
 }
-/** The three Cloudflare Access rule kinds {@link HostingConfig.access} supports (#246). */
-export type AccessRuleKind = 'gate' | 'bypass' | 'service-token';
+/** The two Cloudflare Access rule kinds {@link HostingConfig.access} supports (#246). */
+export type AccessRuleKind = 'bypass' | 'service-token';
 export declare const ACCESS_RULE_KINDS: ReadonlySet<AccessRuleKind>;
+/** The gates an org may declare when it has no `gateLimit` of its own. */
+export declare const DEFAULT_GATE_LIMIT = 3;
 /**
- * One Cloudflare Access rule on a hostname besides the `app` entry's own
- * (#246, `HostingConfig.access`). `hostname` is the full hostname Access
- * gates (e.g. `share.<domain>`), never an entry key.
+ * One Cloudflare Access rule on a hostname the org serves under its own
+ * domain (#246, `HostingConfig.access`). `hostname` is the full hostname
+ * Access acts on (e.g. `share.<domain>`), never an entry key.
  *
- * - `gate`: an email allowlist, the same shape `accessEmails` already
- *   applies to the app's own hostname.
  * - `bypass`: no login at all -- the hostname is public through Access.
  * - `service-token`: only a request carrying the named Cloudflare Access
  *   service token's headers gets through, no human login flow. The token
@@ -270,10 +271,6 @@ export declare const ACCESS_RULE_KINDS: ReadonlySet<AccessRuleKind>;
  *   second one.
  */
 export type AccessRule = {
-    hostname: string;
-    kind: 'gate';
-    emails: string[];
-} | {
     hostname: string;
     kind: 'bypass';
 } | {
@@ -284,9 +281,9 @@ export type AccessRule = {
 /** The key of the entry that is today's one app: the Coolify app named `<slug>`. */
 export declare const APP_ENTRY_KEY = "app";
 /**
- * One app the org runs. `database` and `accessEmails` are meaningless
- * without `HostingConfig.enabled`, so `validateHosting` requires it before
- * either is set.
+ * One app the org runs. `database` and `gates` are meaningless without
+ * `HostingConfig.enabled`, so `validateHosting` requires it before either is
+ * set.
  */
 export interface HostingEntry {
     /** A DNS label, unique per org. It goes into step ids and scope keys, so it never holds `:` or `.`. */
@@ -317,10 +314,10 @@ export interface HostingEntry {
     /** Deploy on every push to `branch`. Default: `true`. */
     autoDeploy: boolean;
     /**
-     * Emails Cloudflare Access lets through to the app's hostname (#84). Empty
-     * means no Access gate. Only the entry keyed {@link APP_ENTRY_KEY} may set it.
+     * Cloudflare Access gates on this entry's own `hostnames`. Empty means no
+     * gate. Who passes is not declared here.
      */
-    accessEmails: string[];
+    gates: EntryGate[];
     /**
      * The app's own env var names and what they hold (#243). Each bespoke app
      * names the values the plan mints (Files, AI, mail) differently (lokessmie
@@ -341,6 +338,13 @@ export interface HostingEntry {
      */
     worker?: WorkerConfig;
 }
+/** One Cloudflare Access gate over some of an entry's `hostnames`. */
+export interface EntryGate {
+    /** A DNS label, unique in the org. It names the plan step and the edge gate. */
+    key: string;
+    /** Values from the same entry's `hostnames`: `'@'`, a label or `'*'`. The whole domain is `['@', '*']`. */
+    hostnames: string[];
+}
 /**
  * One Cloudflare rate limiting binding on a Worker (#318) -- Cloudflare's own
  * "simple" shape: a fixed number of requests per period, where `period` is

package/dist/org.js

@@ -3,11 +3,9 @@ import { floatingTagBlocked } from './bootstrap/versions.js';
 export const DEFAULT_MAIL_APPS = ['agora', 'webmail'];
 /** {@link MailConfig.noReplyLocalPart}'s own default, restated wherever it is read rather than imported (this file's `LOG_DIR`-style convention, named in `plan/executor.ts`'s own doc comments). */
 export const DEFAULT_NO_REPLY_LOCAL_PART = 'no-reply';
-export const ACCESS_RULE_KINDS = new Set([
-    'gate',
-    'bypass',
-    'service-token',
-]);
+export const ACCESS_RULE_KINDS = new Set(['bypass', 'service-token']);
+/** The gates an org may declare when it has no `gateLimit` of its own. */
+export const DEFAULT_GATE_LIMIT = 3;
 /** The key of the entry that is today's one app: the Coolify app named `<slug>`. */
 export const APP_ENTRY_KEY = 'app';
 /** What an entry's ai key may hold: the most the org's own key holds. */
@@ -162,9 +160,12 @@ export function validateHosting(hosting, names) {
     if (hosting.entries.filter((entry) => entry.database).length > 1) {
         return 'at most one hosting entry may set database: the one runtime database role cannot serve two apps';
     }
+    const invalidGates = validateGates(hosting, names?.domain, names?.locked);
+    if (invalidGates)
+        return invalidGates;
     const seenAccessHostnames = new Set();
     for (const rule of hosting.access ?? []) {
-        const invalidRule = validateAccessRule(rule, hosting.enabled);
+        const invalidRule = validateAccessRule(rule, hosting, names);
         if (invalidRule)
             return invalidRule;
         if (seenAccessHostnames.has(rule.hostname)) {
@@ -176,30 +177,85 @@ export function validateHosting(hosting, names) {
 }
 /** A full DNS hostname, at least two labels -- distinct from an entry's single-label `key`. */
 const ACCESS_RULE_HOSTNAME = /^[a-z0-9]([a-z0-9-]{0,61}[a-z0-9])?(\.[a-z0-9]([a-z0-9-]{0,61}[a-z0-9])?)+$/;
-/** The rules for one {@link AccessRule}; `null` when it is valid. */
-function validateAccessRule(rule, enabled) {
+/**
+ * The rules for one {@link AccessRule}; `null` when it is valid. The hostname
+ * must be a name the org serves under its own domain and never a locked one;
+ * without `names` only the checks that need no domain run.
+ */
+function validateAccessRule(rule, hosting, names) {
     const at = `hosting.access '${rule.hostname}'`;
     if (!rule.hostname || !ACCESS_RULE_HOSTNAME.test(rule.hostname)) {
         return `hosting.access entries need a full hostname ('${rule.hostname}' is not one)`;
     }
-    if (!enabled) {
+    if (!hosting.enabled) {
         return `${at} requires hosting.enabled`;
     }
     if (!ACCESS_RULE_KINDS.has(rule.kind)) {
         return `${at} has an unknown kind '${rule.kind}'`;
     }
-    if (rule.kind === 'gate') {
-        if (rule.emails.length === 0) {
-            return `${at} kind 'gate' needs at least one email`;
+    if (rule.kind === 'service-token' && !rule.serviceTokenName) {
+        return `${at} kind 'service-token' needs a non-empty serviceTokenName`;
+    }
+    if (names) {
+        if (names.locked.has(rule.hostname)) {
+            return `${at} is a name foundry owns`;
         }
-        for (const email of rule.emails) {
-            if (!EMAIL.test(email)) {
-                return `${at} has an invalid email '${email}'`;
+        const { domain } = names;
+        const served = hosting.usesDomain &&
+            domain !== null &&
+            hosting.entries.some((entry) => entry.hostnames.some((name) => name === '*'
+                ? rule.hostname.endsWith(`.${domain}`)
+                : rule.hostname === (name === '@' ? domain : `${name}.${domain}`)));
+        if (!served) {
+            return `${at} is not a name the org serves under its own domain`;
+        }
+    }
+    return null;
+}
+/**
+ * The rules for every entry's `gates` and for `gateLimit`: the limit is a
+ * positive whole number; gates need `enabled`, `usesDomain` and (when the
+ * caller knows it) a domain; each key is a DNS label unique in the org; each
+ * gate names at least one of its own entry's hostnames, none in two gates;
+ * and the org holds at most `gateLimit` of them.
+ */
+function validateGates(hosting, domain, locked) {
+    if (!Number.isInteger(hosting.gateLimit) || hosting.gateLimit < 1) {
+        return 'hosting.gateLimit must be a positive whole number';
+    }
+    const seenKeys = new Set();
+    for (const entry of hosting.entries) {
+        const taken = new Set();
+        for (const gate of entry.gates) {
+            const at = `hosting.entries '${entry.key}' gate '${gate.key}'`;
+            if (!hosting.enabled || !hosting.usesDomain || domain === null) {
+                return `${at} needs hosting.enabled, hosting.usesDomain and an org domain`;
+            }
+            if (!ENTRY_KEY.test(gate.key)) {
+                return `${at} key must be a DNS label (lowercase letters, digits and hyphens, 1-63 characters)`;
+            }
+            if (seenKeys.has(gate.key))
+                return `${at} key is used by two gates`;
+            seenKeys.add(gate.key);
+            if (gate.hostnames.length === 0)
+                return `${at} needs at least one hostname`;
+            for (const name of gate.hostnames) {
+                if (!entry.hostnames.includes(name)) {
+                    return `${at} hostname '${name}' is not one of the entry's hostnames`;
+                }
+                if (taken.has(name))
+                    return `${at} hostname '${name}' is held by two gates or listed twice`;
+                taken.add(name);
+                if (domain && name !== '*') {
+                    const full = name === '@' ? domain : `${name}.${domain}`;
+                    if (locked?.has(full))
+                        return `${at} hostname '${name}' is a name foundry owns: ${full}`;
+                }
             }
         }
     }
-    if (rule.kind === 'service-token' && !rule.serviceTokenName) {
-        return `${at} kind 'service-token' needs a non-empty serviceTokenName`;
+    if (seenKeys.size > hosting.gateLimit) {
+        return `hosting declares ${seenKeys.size} gates, over its limit of ${hosting.gateLimit}`;
     }
     return null;
 }
@@ -247,7 +303,6 @@ function validateEntryHostnames(hosting, names) {
     return null;
 }
 const ENTRY_KEY = /^[a-z0-9]([a-z0-9-]{0,61}[a-z0-9])?$/;
-const EMAIL = /^[^@\s]+@[^@\s]+$/;
 const REPO = /^wtfalch\/[A-Za-z0-9._-]+$/;
 // The env names `pushAppEnv` and `pushDatabaseUrl` set themselves.
 const FOUNDRY_ENV_NAME = /^(APP_URL|LOG_DIR|OWNER_USER_ID|AUTH_.*|DATABASE_URL.*)$/;
@@ -284,17 +339,6 @@ function validateHostingEntry(entry, enabled) {
     if (entry.database && !enabled) {
         return `${at} database requires hosting.enabled`;
     }
-    if (entry.accessEmails.length > 0 && !enabled) {
-        return `${at} accessEmails requires hosting.enabled`;
-    }
-    if (entry.accessEmails.length > 0 && entry.key !== APP_ENTRY_KEY) {
-        return `${at} accessEmails is only available on the '${APP_ENTRY_KEY}' entry for now`;
-    }
-    for (const email of entry.accessEmails) {
-        if (!EMAIL.test(email)) {
-            return `${at} accessEmails has an invalid email '${email}'`;
-        }
-    }
     for (const [name, value] of Object.entries(entry.env)) {
         if (!name) {
             return `${at} env needs a non-empty env var name`;

package/dist/plan/diff.js

@@ -7,7 +7,9 @@ import { chatInternalNames } from './chat-matrix.js';
 import { planEntryAiKeys } from './entry-ai-key.js';
 import { planEdgeReservedLabels, planEntryEdgeKeys } from './entry-edge-key.js';
 import { planFilesKeys } from './entry-files-key.js';
+import { hasWildcardGate, planGates } from './gates.js';
 import { appHostname, entryHostnames, tunnelDnsHostnames, tunnelDomainList } from './hostnames.js';
+import { lockedHostnames } from './locked-hostnames.js';
 import { LOGIN_BINDING_SCOPE_KEY, companyLoginTunnelHost, loginBindingState, loginHostClientIds, loginHostnameFor, pendingRemovalHosts, } from './login-host.js';
 import { MAIL_COPY_COMPLETED_SCOPE_KEY, MAIL_COPY_DONE_SCOPE_KEY, parseMailCopyCompleted, } from './mail-copy.js';
 import { CALLS_MAS_APPLIED_IMAGE_TAG_SCOPE_KEY, CALLS_SYNAPSE_APPLIED_IMAGE_TAG_SCOPE_KEY, ORG_MAIL_APPLIED_APEX_SCOPE_KEY, ORG_MAIL_APPLIED_HOST_SCOPE_KEY, ORG_MAIL_APPLIED_MODE_SCOPE_KEY, ORG_MAIL_APPLIED_USES_DOMAIN_SCOPE_KEY, appEnvAppliedScopeKey, appFolderDiffers, appSettingsOf, appStepKey, appliedAppDomains, appliedAppSettings, dbEnvAppliedScopeKey, resolveAppEnv, serviceDbEnvAppliedScopeKey, versionNotAppliedLine, } from './platform-diff.js';
@@ -286,7 +288,15 @@ export function computePlanDetail(org, live, recordedIds = {}, agoraHost = NO_AG
     // An Access gate that cannot be planned must not leave the hostname it
     // guards routed: the tunnel (and its DNS) that exposes it waits too.
     let accessGateBlocked = false;
-    for (const step of planAccess(org, recordedIds)) {
+    const access = planAccess(org, recordedIds, platformReadiness.accessProviderId ?? null, options.platformHostnames ?? []);
+    if (access.blocked) {
+        accessGateBlocked = true;
+        dnsBlocked.push({
+            description: `${org.slug}'s Access gate is blocked, not planned: ${access.blocked}`,
+            key: 'cloudflare:gate',
+        });
+    }
+    for (const step of access.steps) {
         const reason = edgeNeeded(platformReadiness, ['access']);
         if (reason) {
             accessGateBlocked = true;
@@ -503,6 +513,14 @@ export function computePlanDetail(org, live, recordedIds = {}, agoraHost = NO_AG
         unmanaged.push({ description: zone.blocked, key: 'cloudflare:zone' });
     unmanaged.push(...zoneBlocked);
     unmanaged.push(...dnsBlocked);
+    // A legacy email-list Access app is no longer planned or removed: an operator deletes it by hand.
+    const legacyAccessKey = resourceKey('cloudflare', 'access', appStepKey(org, APP_ENTRY_KEY));
+    if (recordedIds[legacyAccessKey]) {
+        unmanaged.push({
+            description: `${org.slug}'s old Cloudflare Access app (${recordedIds[legacyAccessKey]}, recorded as ${legacyAccessKey}) is no longer managed; remove it in Cloudflare by hand, then remove the recorded key`,
+            key: 'cloudflare:access',
+        });
+    }
     // #243: an appEnv source nothing will record is reported, not silently skipped.
     unmanaged.push(...app.blocked);
     unmanaged.push(...brokerEntries.blocked);
@@ -2912,41 +2930,33 @@ function planCustomers(org, live, claimed, recordedIds) {
     };
 }
 /**
- * #84: a Cloudflare Access gate on the org's app hostname, letting only
- * each entry's `accessEmails` through. Idempotent on the recorded Access app id,
- * like `planOwners`: Cloudflare's live listing has no Access apps. A later
- * change to the email list is not reconciled yet.
- *
- * #246: widened to also plan one step per `hosting.access` rule -- a
- * `gate`, `bypass` or `service-token` Access policy on a hostname besides
- * the app's own (`share.<domain>`, `storage.<domain>`, ...), which the
- * `accessEmails` gate above has no way to express: it is email-only, and
- * only for the `app` entry. With no rules declared this plans exactly what
- * it planned before #246 -- no regression for an org that never set
- * `hosting.access`.
+ * #246: one step per `hosting.access` rule -- a `bypass` or `service-token`
+ * Access policy on a hostname the org serves (`share.<domain>`,
+ * `storage.<domain>`, ...). Idempotent on the recorded Access app id, like
+ * `planOwners`: Cloudflare's live listing has no Access apps. The declared
+ * gates (`planGates`) come first. Under a `'*'` gate, a bypass on each name
+ * foundry owns comes before them, so no owned name is ever gated.
  */
-function planAccess(org, recordedIds) {
+function planAccess(org, recordedIds, providerId, platformHostnames) {
+    const { steps: gates, blocked } = planGates(org, recordedIds, providerId);
     if (!org.hosting.enabled)
-        return [];
-    // Only the `app` entry has a public name, and so only it can sit behind
-    // Access; per-entry hostnames are issue 309.
-    const appGate = org.hosting.entries
-        .filter((entry) => entry.key === APP_ENTRY_KEY && entry.accessEmails.length > 0)
-        .filter((entry) => !recordedIds[resourceKey('cloudflare', 'access', appStepKey(org, entry.key))])
-        .map((entry) => ({
+        return { steps: gates, blocked };
+    const owned = (hasWildcardGate(org) ? [...lockedHostnames(org, platformHostnames)].sort() : [])
+        .filter((hostname) => !recordedIds[resourceKey('cloudflare', 'access', appStepKey(org, hostname))])
+        .map((hostname) => ({
         action: {
             system: 'cloudflare',
             kind: 'access',
-            key: appStepKey(org, entry.key),
-            desired: {},
+            key: appStepKey(org, hostname),
+            desired: { ownedBypass: hostname },
         },
         step: {
-            description: `put ${org.slug}'s ${entry.key === APP_ENTRY_KEY ? 'app' : `${entry.key} app`} behind Cloudflare Access`,
+            description: `let ${hostname} (${org.slug}) bypass Cloudflare Access: foundry owns the name and the '*' gate would cover it`,
             destroys: false,
             migrates: false,
         },
     }));
-    const ruleSteps = (org.hosting.access ?? [])
+    const rules = (org.hosting.access ?? [])
         .filter((rule) => !recordedIds[resourceKey('cloudflare', 'access', appStepKey(org, rule.hostname))])
         .map((rule) => ({
         action: {
@@ -2961,13 +2971,11 @@ function planAccess(org, recordedIds) {
             migrates: false,
         },
     }));
-    return [...appGate, ...ruleSteps];
+    return { steps: [...owned, ...gates, ...rules], blocked };
 }
 /** The plan description for one `hosting.access` rule, by kind (#246). */
 function accessRuleDescription(org, rule) {
     switch (rule.kind) {
-        case 'gate':
-            return `gate ${org.slug}'s ${rule.hostname} behind Cloudflare Access`;
         case 'bypass':
             return `let ${rule.hostname} (${org.slug}) bypass Cloudflare Access`;
         case 'service-token':

package/dist/plan/edge-access.d.ts

@@ -1,4 +1,4 @@
-import type { AccessDecision, createEdgeClient } from '@wtfalch/edge';
+import type { AccessDecision, EnsureAccessProviderRequest, createEdgeClient } from '@wtfalch/edge';
 import { type WriteSlot } from './edge-dns.js';
 /** The edge SDK's platform Access client: `createEdgeClient({ ... }).platform.access`. */
 export type EdgePlatformAccess = ReturnType<typeof createEdgeClient>['platform']['access'];
@@ -47,7 +47,40 @@ export interface AccessPort {
         id: string;
     } | undefined>;
     deleteAccessApp(appId: string): Promise<void>;
+    /**
+     * A company's gate: an Access application over `hostnames`, one policy
+     * that requires the provider and the claim, and a first list of `emails`.
+     * A repeat with the same settings returns the stored gate. Foundry never
+     * changes the list of people after this call.
+     */
+    createGate(gate: AccessGateInput): Promise<{
+        id: string;
+    }>;
+    replaceGateHostnames(gateId: string, hostnames: string[]): Promise<void>;
+    /** Deletes the gate with its application, policy and list; a gate already gone is done. */
+    deleteGate(gateId: string): Promise<void>;
+    /** The Cloudflare Access team address (`<team>.cloudflareaccess.com`); rejects with `not_configured` while the Cloudflare token lacks an Access right. */
+    readiness(): Promise<{
+        authDomain: string;
+    }>;
+    /** Makes the OIDC sign-in provider, or updates the one of that name. Safe to repeat. The secret is sent to Cloudflare and never returned. */
+    ensureProvider(input: EnsureAccessProviderRequest): Promise<{
+        id: string;
+    }>;
+}
+export interface AccessGateInput {
+    organisationId: string;
+    /** The gate's key in the company. */
+    key: string;
+    /** The key of the app entry that declared the gate. */
+    entry: string;
+    hostnames: string[];
+    providerId: string;
+    claimName: string;
+    claimValue: string;
+    emails: string[];
 }
+export declare const isNotFound: (error: unknown) => boolean;
 /**
  * Edge answers a policy, delete or create call for a live Access app with no
  * edge row `not_found` or 409 `exists` ("create or adopt it first"). So the

package/dist/plan/edge-access.js

@@ -1,6 +1,6 @@
 import { EdgeApiError } from '@wtfalch/edge';
 import { EDGE_DNS_WRITE_CONCURRENCY, limiter, rateLimitRetrier, } from './edge-dns.js';
-const isNotFound = (error) => error instanceof EdgeApiError && error.code === 'not_found';
+export const isNotFound = (error) => error instanceof EdgeApiError && error.code === 'not_found';
 /** Edge's 409 for a live app on the domain with no edge row. */
 const isExists = (error) => error instanceof EdgeApiError && error.code === 'conflict' && error.reason === 'exists';
 /**
@@ -27,6 +27,11 @@ export function createEdgeAccess(client, options = {}) {
         createPolicy: (appId, input) => retrying(() => client.createPolicy(appId, input)),
         findServiceToken: (name) => retrying(() => client.findServiceToken(name)),
         adopt: (input) => retrying(() => client.adopt(input)),
+        readiness: () => retrying(() => client.readiness()),
+        ensureProvider: (input) => retrying(() => client.ensureProvider(input)),
+        createGate: (input) => retrying(() => client.createGate(input)),
+        replaceGateHostnames: (id, input) => retrying(() => client.replaceGateHostnames(id, input)),
+        deleteGate: (id) => retrying(() => client.deleteGate(id)),
     };
     const writeSlot = options.writeSlot ?? limiter(EDGE_DNS_WRITE_CONCURRENCY);
     /** app id -> a seen live app with no edge row yet. */
@@ -119,5 +124,29 @@ export function createEdgeAccess(client, options = {}) {
         async deleteAccessApp(appId) {
             await onApp(appId, () => writeSlot(() => access.remove(appId)));
         },
+        async createGate(gate) {
+            const created = await writeSlot(() => access.createGate(gate));
+            return { id: created.id };
+        },
+        async replaceGateHostnames(gateId, hostnames) {
+            await writeSlot(() => access.replaceGateHostnames(gateId, { hostnames }));
+        },
+        async readiness() {
+            const { authDomain } = await access.readiness();
+            return { authDomain };
+        },
+        async ensureProvider(input) {
+            const { id } = await writeSlot(() => access.ensureProvider(input));
+            return { id };
+        },
+        async deleteGate(gateId) {
+            try {
+                await writeSlot(() => access.deleteGate(gateId));
+            }
+            catch (error) {
+                if (!isNotFound(error))
+                    throw error;
+            }
+        },
     };
 }

package/dist/plan/executor.d.ts

@@ -747,6 +747,23 @@ export interface ZitadelPort {
         clientId: string;
         clientSecret: string;
     }>;
+    /**
+     * #604: a web client that signs in with a client secret (authorization
+     * code, `OIDC_AUTH_METHOD_TYPE_BASIC`), which Cloudflare Access needs.
+     * `createOidcApp` makes a public PKCE client with no secret, and
+     * `@wtfalch/providers` 0.7.5 has no call that makes this one, so the
+     * method is optional until it does; the platform's Access provider step
+     * is blocked without it. Like `createApiApp`, the secret is shown once.
+     */
+    createOidcAppWithSecret?(orgId: string, projectId: string, input: {
+        name: string;
+        redirectUris: string[];
+        postLogoutRedirectUris: string[];
+    }): Promise<{
+        appId: string;
+        clientId: string;
+        clientSecret: string;
+    }>;
     deleteApp(orgId: string, projectId: string, appId: string): Promise<void>;
     /**
      * `zitadelApp`'s kind-change path reads `apps` to find an app a prior,
@@ -1506,7 +1523,7 @@ export declare function callsHostnameFor(org: DeclaredOrg): string;
  * this file's hostname rules.
  */
 export declare function healthUrls(org: DeclaredOrg): string[];
-/** The one Access policy foundry puts on its own Access app (#84). */
+/** The one Access policy foundry puts on a platform Access app (#84). */
 export declare const ACCESS_POLICY_NAME = "foundry: allowed emails";
 /**
  * Whether an application's own Coolify `status` (`` `running:healthy`,
@@ -1562,23 +1579,26 @@ export declare class FoundryStepExecutor implements StepExecutor, StepDestroyer
         resourceId?: string;
     } | undefined>;
     /**
-     * `plan/diff.ts`'s `planAccess` (#84, widened by #246): puts a hostname
-     * behind a Cloudflare Access app. `action.key` tells the `app` entry's own
-     * gate (`accessEmails`, email-only) apart from a `hosting.access` rule on
-     * any other hostname -- `appStepKey` builds both, keyed by the entry's key
-     * or by the rule's hostname respectively, and the two never collide
-     * because an entry key never holds a `.` while a rule's hostname always
-     * does (`org.ts`'s `validateAccessRule`). The app-entry gate keeps the
-     * Access app name `foundry:<orgId>` it has always used, so a re-run
-     * against an org applied before #246 still finds the app it already
-     * created; a rule's own app is named `foundry:<orgId>:<hostname>` instead,
-     * since an org may declare more than one. Either way foundry reuses only
-     * an app with its own name (so a re-run after a crash does not duplicate
-     * it), refuses to adopt a hostname another Access app already holds
-     * (destroy would later delete it), and refuses when its own app carries
-     * any policy but foundry's, since that policy could let others in.
+     * `plan/diff.ts`'s `planAccess` (#246): puts a `hosting.access` rule's
+     * hostname behind a Cloudflare Access app named
+     * `foundry:<orgId>:<hostname>`, since an org may declare more than one.
+     * Foundry reuses only an app with its own name (so a re-run after a crash
+     * does not duplicate it), refuses to adopt a hostname another Access app
+     * already holds (destroy would later delete it), and refuses when its own
+     * app carries any policy but foundry's, since that policy could let others
+     * in.
      */
     private cloudflareAccess;
+    /**
+     * `plan/diff.ts`'s `planGates`: makes, changes or deletes one declared
+     * gate through edge. A create needs the platform's recorded Access provider,
+     * the company's sign-in organisation and an owner with an email, and fails
+     * plainly without edge being called when one is missing. The create seeds
+     * the list of people with the owners' emails; nothing here sets people
+     * again. The gate id is recorded from the return value, the hostnames it
+     * has last been made with as a scope id.
+     */
+    private cloudflareGate;
     /** The Cloudflare Access policy body for one `hosting.access` rule, by kind (#246). */
     private accessPolicyFor;
     /**