@wtfalch/foundry 0.23.0 → 0.24.0

package/dist/plan/executor.js

@@ -11,7 +11,7 @@ import { ensureCloudflaredConnector } from './cloudflared-connector.js';
 import { CORE_FILES_COLLECTION_NAME, FILES_CORE_COLLECTION_SCOPE_KEY, ZITADEL_FILES_PROJECT_SCOPE_KEY, } from './core-files.js';
 import { waitForNewDeployment, } from './deploy-health.js';
 import { DEFAULT_AI_LIMIT_MICROS } from './diff.js';
-import { createEdgeAccess, } from './edge-access.js';
+import { createEdgeAccess, isNotFound as isEdgeNotFound, } from './edge-access.js';
 import { EDGE_DNS_WRITE_CONCURRENCY, createEdgeDns, limiter, } from './edge-dns.js';
 import { createEdgeRateLimits, } from './edge-ratelimits.js';
 import { createEdgeTunnels } from './edge-tunnels.js';
@@ -19,6 +19,7 @@ import { createEdgeZones } from './edge-zones.js';
 import { AI_ENTRY_RENEW_WINDOW_DAYS, entryAiAppliedScopeKey, entryAiClampedScopeKey, entryAiExpiresScopeKey, entryAiPendingExpiresScopeKey, entryAiRetiredScopeKey, entryAiUndeliveredScopeKey, entryAiUnrevokedScopeKey, entryAiWebhookPendingScopeKey, entryAiWrittenScopeKey, parseIdList, } from './entry-ai-key.js';
 import { BOULE_EDGE_ENTRY_KEY, EDGE_ENTRY_KEY_DAYS, EDGE_RESERVED_LABELS_APPLIED_SCOPE_KEY, ENTRY_EDGE_KEY_DELIVERY_ATTEMPTS, edgeKeyAppRecordKey, entryEdgeMintedAtScopeKey, entryEdgeRetiredScopeKey, entryEdgeUndeliveredScopeKey, } from './entry-edge-key.js';
 import { FILES_AGORA_KEY_SCOPE_KEY, FILES_AGORA_UNDELIVERED_SCOPE_KEY, FILES_KEY_DAYS, FILES_KEY_RENEW_WINDOW_DAYS, FILES_ORG_OWNER_SCOPE_KEY, FILES_ROOT_EXPIRES_SCOPE_KEY, FILES_ROOT_PREVIOUS_SCOPE_KEY, FILES_ROOT_UNDELIVERED_SCOPE_KEY, FILES_ROOT_UNREVOKED_SCOPE_KEY, entryFilesAppliedScopeKey, entryFilesExpiresScopeKey, entryFilesMinterScopeKey, entryFilesPendingExpiresScopeKey, entryFilesRetiredScopeKey, entryFilesUndeliveredScopeKey, entryFilesUnrevokedScopeKey, entryFilesWrittenScopeKey, filesOwnerUserId, parseIdList as parseFilesIdList, } from './entry-files-key.js';
+import { GATE_CLAIM_NAME, gateHostnamesScopeKey, gateIdRecordKey, isBehindGate } from './gates.js';
 import { healthCheckSettings } from './health-check-settings.js';
 import { appHostname, coolifyTunnelDomains, entryHostnames, tunnelDnsHostnames, tunnelDomainList, tunnelIngressHostnames, } from './hostnames.js';
 import { LOGIN_BINDING_SCOPE_KEY, LOGIN_HOST_PENDING_REMOVAL_SCOPE_KEY, LOGIN_HOST_SHARED_SCOPE_KEY, customersEntryKeys, loginBindingState, loginHostClientIds, pendingRemovalHosts, pendingRemovalState, } from './login-host.js';
@@ -184,18 +185,14 @@ function mailOrgFor(org, usesDomain, mode) {
  * value.
  */
 const COOLIFY_PROXY_ORIGIN = 'http://coolify-proxy:80';
-/** The one Access policy foundry puts on its own Access app (#84). */
+/** The one Access policy foundry puts on a platform Access app (#84). */
 export const ACCESS_POLICY_NAME = 'foundry: allowed emails';
 /**
  * The Access policy name for each `hosting.access` rule kind (#246),
  * `cloudflareAccess`'s way of telling its own policy apart from a foreign
- * one on the same app -- the same role {@link ACCESS_POLICY_NAME} plays for
- * the `app` entry's own email gate, which keeps that exact name so a
- * re-run against an org applied before #246 still recognises its own
- * policy.
+ * one on the same app.
  */
 const ACCESS_RULE_POLICY_NAMES = {
-    gate: ACCESS_POLICY_NAME,
     bypass: 'foundry: bypass',
     'service-token': 'foundry: service token',
 };
@@ -721,13 +718,10 @@ const defaultSleep = (ms) => new Promise((resolve) => setTimeout(resolve, ms));
  * redirect or 403.
  */
 function publicHealthCheck(org, recorded, hostname, path, options = {}) {
-    const app = appEntry(org.hosting);
-    const behindAccess = (org.hosting.access ?? []).some((rule) => rule.hostname === hostname) ||
-        (app !== undefined &&
-            app.accessEmails.length > 0 &&
-            entryHostnames(org, app).includes(hostname));
-    if (behindAccess)
+    if ((org.hosting.access ?? []).some((rule) => rule.hostname === hostname) ||
+        isBehindGate(org, hostname)) {
         return { kind: 'deployment-only' };
+    }
     const routed = (host) => !org.domain ||
         !(host === org.domain || host.endsWith(`.${org.domain}`)) ||
         (recorded[CLOUDFLARE_TUNNEL_DNS_HOSTNAMES_SCOPE_KEY] ?? '').split(',').includes(host);
@@ -798,6 +792,8 @@ export class FoundryStepExecutor {
                 return this.cloudflareZone(action, org, context);
             case 'cloudflare:access':
                 return this.cloudflareAccess(action, org);
+            case 'cloudflare:gate':
+                return this.cloudflareGate(action, org, context);
             case 'cloudflare:ratelimit':
                 return this.cloudflareRateLimit(org);
             case 'cloudflare:worker':
@@ -843,40 +839,27 @@ export class FoundryStepExecutor {
         }
     }
     /**
-     * `plan/diff.ts`'s `planAccess` (#84, widened by #246): puts a hostname
-     * behind a Cloudflare Access app. `action.key` tells the `app` entry's own
-     * gate (`accessEmails`, email-only) apart from a `hosting.access` rule on
-     * any other hostname -- `appStepKey` builds both, keyed by the entry's key
-     * or by the rule's hostname respectively, and the two never collide
-     * because an entry key never holds a `.` while a rule's hostname always
-     * does (`org.ts`'s `validateAccessRule`). The app-entry gate keeps the
-     * Access app name `foundry:<orgId>` it has always used, so a re-run
-     * against an org applied before #246 still finds the app it already
-     * created; a rule's own app is named `foundry:<orgId>:<hostname>` instead,
-     * since an org may declare more than one. Either way foundry reuses only
-     * an app with its own name (so a re-run after a crash does not duplicate
-     * it), refuses to adopt a hostname another Access app already holds
-     * (destroy would later delete it), and refuses when its own app carries
-     * any policy but foundry's, since that policy could let others in.
+     * `plan/diff.ts`'s `planAccess` (#246): puts a `hosting.access` rule's
+     * hostname behind a Cloudflare Access app named
+     * `foundry:<orgId>:<hostname>`, since an org may declare more than one.
+     * Foundry reuses only an app with its own name (so a re-run after a crash
+     * does not duplicate it), refuses to adopt a hostname another Access app
+     * already holds (destroy would later delete it), and refuses when its own
+     * app carries any policy but foundry's, since that policy could let others
+     * in.
      */
     async cloudflareAccess(action, org) {
-        // Only the `app` entry has a public name (`planAccess`); per-entry
-        // hostnames are issue 309.
-        const entry = appEntry(org.hosting);
-        if (!entry)
-            throw new Error(`cloudflare:access for ${org.slug}: no '${APP_ENTRY_KEY}' hosting entry`);
-        if (action.key === appStepKey(org, entry.key)) {
+        const rule = (org.hosting.access ?? []).find((r) => appStepKey(org, r.hostname) === action.key);
+        const owned = action.desired.ownedBypass;
+        if (!rule && owned && appStepKey(org, owned) === action.key) {
+            // A name foundry owns under a '*' gate: the same bypass a declared rule makes.
             return this.cloudflareAccessApp(org, {
-                appName: `foundry:${org.id}`,
-                domain: appHostname(org),
-                policyName: ACCESS_POLICY_NAME,
-                policy: {
-                    decision: 'allow',
-                    include: entry.accessEmails.map((email) => ({ email: { email } })),
-                },
+                appName: `foundry:${org.id}:${owned}`,
+                domain: owned,
+                policyName: ACCESS_RULE_POLICY_NAMES.bypass,
+                policy: await this.accessPolicyFor(org, { kind: 'bypass', hostname: owned }),
             });
         }
-        const rule = (org.hosting.access ?? []).find((r) => appStepKey(org, r.hostname) === action.key);
         if (!rule) {
             throw new Error(`cloudflare:access for ${org.slug}: no hosting.access rule matches step key '${action.key}'`);
         }
@@ -887,14 +870,74 @@ export class FoundryStepExecutor {
             policy: await this.accessPolicyFor(org, rule),
         });
     }
+    /**
+     * `plan/diff.ts`'s `planGates`: makes, changes or deletes one declared
+     * gate through edge. A create needs the platform's recorded Access provider,
+     * the company's sign-in organisation and an owner with an email, and fails
+     * plainly without edge being called when one is missing. The create seeds
+     * the list of people with the owners' emails; nothing here sets people
+     * again. The gate id is recorded from the return value, the hostnames it
+     * has last been made with as a scope id.
+     */
+    async cloudflareGate(action, org, context) {
+        const gateKey = action.key.slice(org.id.length + 1);
+        const at = `cloudflare:gate for ${org.slug} gate '${gateKey}'`;
+        const desired = action.desired;
+        const recorded = context.recordedIds();
+        const gateId = recorded[gateIdRecordKey(org.id, gateKey)];
+        const hostnamesKey = gateHostnamesScopeKey(gateKey);
+        if (desired.mode === 'delete') {
+            if (gateId)
+                await this.accessPort().deleteGate(gateId);
+            if (context.forgetId) {
+                context.forgetId(gateIdRecordKey(org.id, gateKey));
+                context.forgetId(hostnamesKey);
+            }
+            return {};
+        }
+        const hostnames = desired.hostnames ?? [];
+        if (gateId) {
+            try {
+                await this.accessPort().replaceGateHostnames(gateId, hostnames);
+            }
+            catch (error) {
+                if (!isEdgeNotFound(error))
+                    throw error;
+                // The gate is gone at edge: forget it, so the next plan creates it again.
+                context.forgetId?.(gateIdRecordKey(org.id, gateKey));
+                context.forgetId?.(hostnamesKey);
+                return {};
+            }
+            context.recordScopeId(hostnamesKey, JSON.stringify(hostnames));
+            return {};
+        }
+        if (!desired.providerId) {
+            throw new Error(`${at}: the platform's sign-in provider step has not been applied yet, so there is no Access provider to require`);
+        }
+        const claimValue = recorded[ZITADEL_ORG_SCOPE_KEY];
+        if (!claimValue) {
+            throw new Error(`${at}: ${org.slug} has no sign-in organisation recorded yet`);
+        }
+        const emails = org.owners.map((owner) => owner.email);
+        if (emails.length === 0) {
+            throw new Error(`${at}: ${org.slug} declares no owner with an email, and a gate nobody can pass is a mistake`);
+        }
+        const created = await this.accessPort().createGate({
+            organisationId: org.id,
+            key: gateKey,
+            entry: desired.entry,
+            hostnames,
+            providerId: desired.providerId,
+            claimName: GATE_CLAIM_NAME,
+            claimValue,
+            emails,
+        });
+        context.recordScopeId(hostnamesKey, JSON.stringify(hostnames));
+        return { resourceId: created.id };
+    }
     /** The Cloudflare Access policy body for one `hosting.access` rule, by kind (#246). */
     async accessPolicyFor(org, rule) {
         switch (rule.kind) {
-            case 'gate':
-                return {
-                    decision: 'allow',
-                    include: rule.emails.map((email) => ({ email: { email } })),
-                };
             case 'bypass':
                 // A bypass policy still needs an `include` rule to match against;
                 // `everyone` is Cloudflare's own shape for "match every visitor".
@@ -5996,6 +6039,9 @@ export class FoundryStepExecutor {
                 case 'cloudflare:access':
                     await this.accessPort().deleteAccessApp(target.id);
                     return;
+                case 'cloudflare:gate':
+                    await this.accessPort().deleteGate(target.id);
+                    return;
                 case 'ai:key': {
                     // F6a: an entry's key (`<orgId>:<entry>`). REVOKE SEAM (ai#157): a
                     // port with no `revokeKey` leaves it live until it expires.

package/dist/plan/gates.d.ts

@@ -0,0 +1,42 @@
+import type { DeclaredOrg } from '../org.js';
+import type { DraftStep } from './diff.js';
+/**
+ * A company's declared gates (`HostingEntry.gates`) as Cloudflare Access gates
+ * made through edge. Foundry sets who passes once, on create, from the
+ * company's owners; it never writes the list of people again, so a company's
+ * admin app owns it from then on.
+ */
+/**
+ * The platform's recorded id of the Access provider that signs people in
+ * through the platform's ZITADEL. The platform's sign-in provider step writes
+ * it; a gate is never made without it. A flat scope key, no `:`.
+ */
+export declare const ACCESS_PROVIDER_RECORD_KEY = "access_provider_id";
+/** The claim every gate requires: the company's ZITADEL organisation id, on every token ZITADEL issues. */
+export declare const GATE_CLAIM_NAME = "urn:zitadel:iam:user:resourceowner:id";
+/** The gate id edge returned, recorded by `runSteps` from the step's `resourceId`. */
+export declare const gateIdRecordKey: (orgId: string, gateKey: string) => string;
+/** The resolved, sorted hostnames the gate was last made or changed with, as JSON. */
+export declare const gateHostnamesScopeKey: (gateKey: string) => string;
+/** `'@'` is the domain, `'*'` is `*.<domain>`, a label is `<label>.<domain>`. Sorted. */
+export declare function resolveGateHostnames(domain: string, names: readonly string[]): string[];
+/** True when a declared gate resolves to `*.<domain>`. */
+export declare function hasWildcardGate(org: DeclaredOrg): boolean;
+/**
+ * True when a declared gate covers `hostname`, exactly or through a gated
+ * wildcard, unless a `bypass` rule names it exactly: that rule wins. A name
+ * foundry owns is never behind a gate: the plan bypasses it under a wildcard.
+ */
+export declare function isBehindGate(org: DeclaredOrg, hostname: string): boolean;
+/**
+ * One step per declared gate whose recorded id or hostnames differ from what
+ * is declared (a create, or a hostname change), and one destroying step per
+ * recorded gate no longer declared. `providerId` is the platform's recorded
+ * provider. A create needs it, the company's sign-in organisation and an
+ * owner with an email: when one is missing no create is planned and
+ * `blocked` says why (CLAUDE.md rule 2).
+ */
+export declare function planGates(org: DeclaredOrg, recordedIds: Readonly<Record<string, string>>, providerId: string | null): {
+    steps: DraftStep[];
+    blocked: string | null;
+};

package/dist/plan/gates.js

@@ -0,0 +1,126 @@
+import { ZITADEL_ORG_SCOPE_KEY } from './agora.js';
+import { lockedHostnames } from './locked-hostnames.js';
+import { appStepKey } from './platform-diff.js';
+/**
+ * A company's declared gates (`HostingEntry.gates`) as Cloudflare Access gates
+ * made through edge. Foundry sets who passes once, on create, from the
+ * company's owners; it never writes the list of people again, so a company's
+ * admin app owns it from then on.
+ */
+/**
+ * The platform's recorded id of the Access provider that signs people in
+ * through the platform's ZITADEL. The platform's sign-in provider step writes
+ * it; a gate is never made without it. A flat scope key, no `:`.
+ */
+export const ACCESS_PROVIDER_RECORD_KEY = 'access_provider_id';
+/** The claim every gate requires: the company's ZITADEL organisation id, on every token ZITADEL issues. */
+export const GATE_CLAIM_NAME = 'urn:zitadel:iam:user:resourceowner:id';
+/** The gate id edge returned, recorded by `runSteps` from the step's `resourceId`. */
+export const gateIdRecordKey = (orgId, gateKey) => `cloudflare:gate:${orgId}:${gateKey}`;
+/** The resolved, sorted hostnames the gate was last made or changed with, as JSON. */
+export const gateHostnamesScopeKey = (gateKey) => `gate_hostnames_${gateKey}`;
+/** `'@'` is the domain, `'*'` is `*.<domain>`, a label is `<label>.<domain>`. Sorted. */
+export function resolveGateHostnames(domain, names) {
+    return names
+        .map((name) => (name === '@' ? domain : name === '*' ? `*.${domain}` : `${name}.${domain}`))
+        .sort();
+}
+/** Every declared gate's key with its entry's key and resolved hostnames; none without hosting or a domain. */
+function declaredGates(org) {
+    const gates = new Map();
+    if (!org.hosting.enabled || !org.domain)
+        return gates;
+    for (const entry of org.hosting.entries) {
+        for (const gate of entry.gates) {
+            gates.set(gate.key, {
+                entry: entry.key,
+                hostnames: resolveGateHostnames(org.domain, gate.hostnames),
+            });
+        }
+    }
+    return gates;
+}
+/** True when a declared gate resolves to `*.<domain>`. */
+export function hasWildcardGate(org) {
+    return [...declaredGates(org).values()].some(({ hostnames }) => hostnames.some((name) => name.startsWith('*.')));
+}
+/**
+ * True when a declared gate covers `hostname`, exactly or through a gated
+ * wildcard, unless a `bypass` rule names it exactly: that rule wins. A name
+ * foundry owns is never behind a gate: the plan bypasses it under a wildcard.
+ */
+export function isBehindGate(org, hostname) {
+    if (lockedHostnames(org, []).has(hostname))
+        return false;
+    if ((org.hosting.access ?? []).some((r) => r.kind === 'bypass' && r.hostname === hostname)) {
+        return false;
+    }
+    return [...declaredGates(org).values()].some(({ hostnames }) => hostnames.some((name) => name.startsWith('*.') ? hostname.endsWith(name.slice(1)) : name === hostname));
+}
+/**
+ * One step per declared gate whose recorded id or hostnames differ from what
+ * is declared (a create, or a hostname change), and one destroying step per
+ * recorded gate no longer declared. `providerId` is the platform's recorded
+ * provider. A create needs it, the company's sign-in organisation and an
+ * owner with an email: when one is missing no create is planned and
+ * `blocked` says why (CLAUDE.md rule 2).
+ */
+export function planGates(org, recordedIds, providerId) {
+    const steps = [];
+    let blocked = null;
+    const missing = !providerId
+        ? "the platform's sign-in provider step has not been applied yet, so there is no Access provider to require"
+        : !recordedIds[ZITADEL_ORG_SCOPE_KEY]
+            ? `${org.slug} has no sign-in organisation recorded yet`
+            : org.owners.length === 0
+                ? `${org.slug} declares no owner with an email, and a gate nobody can pass is a mistake`
+                : null;
+    const declared = declaredGates(org);
+    const prefix = gateIdRecordKey(org.id, '');
+    for (const [name, id] of Object.entries(recordedIds)) {
+        if (!id || !name.startsWith(prefix))
+            continue;
+        const gateKey = name.slice(prefix.length);
+        if (declared.has(gateKey))
+            continue;
+        steps.push({
+            action: {
+                system: 'cloudflare',
+                kind: 'gate',
+                key: appStepKey(org, gateKey),
+                desired: { mode: 'delete' },
+            },
+            step: {
+                description: `delete ${org.slug}'s '${gateKey}' Cloudflare Access gate: it is no longer declared`,
+                destroys: true,
+                migrates: false,
+            },
+        });
+    }
+    for (const [gateKey, { entry, hostnames }] of declared) {
+        const recorded = recordedIds[gateIdRecordKey(org.id, gateKey)];
+        if (recorded && recordedIds[gateHostnamesScopeKey(gateKey)] === JSON.stringify(hostnames)) {
+            continue;
+        }
+        if (!recorded && missing) {
+            blocked = missing;
+            continue;
+        }
+        steps.push({
+            action: {
+                system: 'cloudflare',
+                kind: 'gate',
+                key: appStepKey(org, gateKey),
+                desired: { mode: 'apply', entry, hostnames, providerId },
+            },
+            step: {
+                description: recorded
+                    ? `change the hostnames of ${org.slug}'s '${gateKey}' Cloudflare Access gate to ${hostnames.join(', ')}`
+                    : `put ${hostnames.join(', ')} (${org.slug}'s '${gateKey}' gate) behind Cloudflare Access`,
+                destroys: false,
+                migrates: false,
+            },
+        });
+    }
+    return { steps, blocked };
+}

package/dist/plan/health-targets.js

@@ -1,7 +1,8 @@
-import { APP_ENTRY_KEY, appEntry } from '../org.js';
+import { appEntry } from '../org.js';
 import { agoraHostnameFor } from './agora.js';
 import { bouleHostnameFor } from './boule.js';
 import { callsHostnameFor, cmsHostnameFor } from './executor.js';
+import { isBehindGate } from './gates.js';
 import { entryHostnames } from './hostnames.js';
 import { loginHostnameFor } from './login-host.js';
 function okExpect() {
@@ -182,9 +183,7 @@ function hostingEntryTarget(org, entry) {
         expect: okExpect(),
         depth: entry.buildPack === 'static' ? 'page' : entry.database ? 'deep' : 'shallow',
         restartSafe: true,
-        // Only the `app` entry may be gated behind Cloudflare Access at all
-        // (`org.ts`'s own `HostingEntry.accessEmails` doc comment).
-        behindAccess: entry.key === APP_ENTRY_KEY && entry.accessEmails.length > 0,
+        behindAccess: isBehindGate(org, hostname),
     };
 }
 /**

package/dist/plan/plan-apply.d.ts

@@ -216,6 +216,8 @@ export interface PlatformStepExecutor {
         ai?: string;
         archon?: string;
         mail?: string;
+        /** #604: see `PlanPlatformOptions.blocked.accessProvider` (`platform-diff.ts`). */
+        accessProvider?: string;
         /** #257: see `PlanPlatformOptions.blocked.backupExecutorMissing` (`platform-diff.ts`). */
         backupExecutorMissing?: boolean;
         /** #540: see `PlanPlatformOptions.blocked.hc` (`platform-diff.ts`). */

package/dist/plan/plan-apply.js

@@ -98,6 +98,7 @@ const HOSTNAME_STEPS = new Set([
     'coolify:database',
     'cloudflare:tunnel',
     'cloudflare:access',
+    'cloudflare:gate',
     'jobs:registration',
     // #318 (F8): the route is itself hostname-shaped, validated against the
     // org's own domain by `validateEntryWorker`.
@@ -1149,6 +1150,7 @@ function destroyTargets(serviceIds, orgId) {
         'zitadel:login-host:',
         'cloudflare:tunnel:',
         'cloudflare:access:',
+        'cloudflare:gate:',
         // #318: an entry's Worker and its route.
         'cloudflare:worker:',
         'coolify:database:',
@@ -1311,7 +1313,8 @@ const STEP_FIELDS = {
     'coolify:database': 'hosting.database',
     'cloudflare:tunnel': 'hosting.tunnel',
     'cloudflare:zone': 'hosting.usesDomain',
-    'cloudflare:access': 'hosting.accessEmails',
+    'cloudflare:access': 'hosting.access',
+    'cloudflare:gate': 'hosting.entries.gates',
     'cloudflare:ratelimit': 'hosting.usesDomain',
     'cloudflare:worker': 'hosting.entries.worker',
 };
@@ -1330,6 +1333,10 @@ function stepField(action) {
     if (action.system === 'zitadel' && action.kind === 'app') {
         return `hosting.issuerApps.${action.key}`;
     }
+    // A bypass on a name foundry owns serves the entry gates, not `hosting.access`.
+    if (action.system === 'cloudflare' && action.kind === 'access' && action.desired.ownedBypass) {
+        return 'hosting.entries.gates';
+    }
     return STEP_FIELDS[`${action.system}:${action.kind}`] ?? `${action.system}.${action.kind}`;
 }
 /**

package/dist/plan/platform-diff.d.ts

@@ -694,6 +694,18 @@ export declare const PLATFORM_EDGE_CLOUDFLARE_TOKEN_REF = "cloudflare:edge:apiTo
  * reports it and never mints again. Neither key holds the secret itself.
  */
 export declare const PLATFORM_EDGE_PLATFORM_KEY_UNDELIVERED_SCOPE_KEY = "edge_platform_key_undelivered";
+/**
+ * #604: the ZITADEL client Cloudflare Access signs people in through. Its
+ * secret exists once, at creation, and goes to edge's `ensureProvider`. The
+ * client's app id is recorded here and persisted before the secret leaves;
+ * the guard, `ACCESS_PROVIDER_RECORD_KEY` (`gates.ts`), is recorded only
+ * after edge returned the provider's id. An undelivered id with no guard
+ * means the secret is lost: the planner reports it and never mints again.
+ */
+export declare const PLATFORM_ACCESS_PROVIDER_UNDELIVERED_SCOPE_KEY = "access_provider_client_undelivered";
+/** The sign-in hostname and the Access team address the provider was applied with. */
+export declare const PLATFORM_ACCESS_PROVIDER_APPLIED_HOSTNAME_SCOPE_KEY = "access_provider_applied_hostname";
+export declare const PLATFORM_ACCESS_PROVIDER_APPLIED_AUTH_DOMAIN_SCOPE_KEY = "access_provider_applied_auth_domain";
 export declare const PLATFORM_EDGE_PLATFORM_KEY_SET_SCOPE_KEY = "edge_platform_key_set";
 /**
  * #478: the hostname and `gitRef` the last successful names run applied.
@@ -850,6 +862,8 @@ export interface PlanPlatformOptions {
         mail?: string;
         /** #478: why the edge host is blocked, or absent when it is not. */
         edge?: string;
+        /** #604: why the Access sign-in provider cannot be made yet (no dependencies, or edge cannot confirm Access is ready), or absent. */
+        accessProvider?: string;
         /**
          * #257: true once a service's database exists but the host built the
          * platform executor with no backup dependencies -- every such service's

package/dist/plan/platform-diff.js

@@ -1,6 +1,7 @@
 import { VERSIONS } from '../bootstrap/versions.js';
 import { APP_ENTRY_KEY } from '../org.js';
 import { VERSION_CHANGE_KIND, } from '../plan.js';
+import { ACCESS_PROVIDER_RECORD_KEY } from './gates.js';
 import { legacyAppHostname } from './hostnames.js';
 import { withStepSystem } from './step-system.js';
 /**
@@ -771,6 +772,18 @@ export const PLATFORM_EDGE_CLOUDFLARE_TOKEN_REF = 'cloudflare:edge:apiToken';
  * reports it and never mints again. Neither key holds the secret itself.
  */
 export const PLATFORM_EDGE_PLATFORM_KEY_UNDELIVERED_SCOPE_KEY = 'edge_platform_key_undelivered';
+/**
+ * #604: the ZITADEL client Cloudflare Access signs people in through. Its
+ * secret exists once, at creation, and goes to edge's `ensureProvider`. The
+ * client's app id is recorded here and persisted before the secret leaves;
+ * the guard, `ACCESS_PROVIDER_RECORD_KEY` (`gates.ts`), is recorded only
+ * after edge returned the provider's id. An undelivered id with no guard
+ * means the secret is lost: the planner reports it and never mints again.
+ */
+export const PLATFORM_ACCESS_PROVIDER_UNDELIVERED_SCOPE_KEY = 'access_provider_client_undelivered';
+/** The sign-in hostname and the Access team address the provider was applied with. */
+export const PLATFORM_ACCESS_PROVIDER_APPLIED_HOSTNAME_SCOPE_KEY = 'access_provider_applied_hostname';
+export const PLATFORM_ACCESS_PROVIDER_APPLIED_AUTH_DOMAIN_SCOPE_KEY = 'access_provider_applied_auth_domain';
 export const PLATFORM_EDGE_PLATFORM_KEY_SET_SCOPE_KEY = 'edge_platform_key_set';
 /**
  * #478: the hostname and `gitRef` the last successful names run applied.
@@ -999,6 +1012,11 @@ export function planPlatform(platform, live, options = {}) {
     const ai = planAi(platform, recordedIds, blocked.ai);
     if (ai.step)
         plannedSteps.push(ai.step);
+    // #604: after edge and sign-in, whose applied ids it reads; before Archon,
+    // whose redeploy can end the run.
+    const accessProvider = planAccessProvider(platform, recordedIds, blocked.accessProvider);
+    if (accessProvider.step)
+        plannedSteps.push(accessProvider.step);
     // #175: last, on purpose. Archon's sign-in client lives in the sign-in
     // `planAuth` builds, and its env reads what every other service's step
     // records or delivers, so in one apply it runs after all of them.
@@ -1081,6 +1099,9 @@ export function planPlatform(platform, live, options = {}) {
         unmanaged.push({ description: ai.blocked, key: 'ai' });
     if (edge.blocked)
         unmanaged.push({ description: edge.blocked, key: 'edge' });
+    if (accessProvider.blocked) {
+        unmanaged.push({ description: accessProvider.blocked, key: 'access-provider' });
+    }
     if (hc.blocked)
         unmanaged.push({ description: hc.blocked, key: 'hc' });
     if (archon.blocked)
@@ -2027,6 +2048,63 @@ function planEdge(platform, recordedIds, executorBlocked) {
         blocked: null,
     };
 }
+/**
+ * #604: the platform's ZITADEL as a sign-in provider in Cloudflare Access: a
+ * ZITADEL client for Cloudflare, then edge's `ensureProvider`. One
+ * `cloudflare:access-provider` step. It needs edge and the platform's sign-in
+ * applied (it reads the Access team address through the one and makes the
+ * client in the other). Done once `ACCESS_PROVIDER_RECORD_KEY` is recorded.
+ *
+ * Blocked, not planned: edge or sign-in not applied, a client minted but never
+ * delivered (its secret cannot be shown again), or `executorBlocked` (no
+ * dependencies, or edge cannot confirm Access is ready).
+ */
+function planAccessProvider(platform, recordedIds, executorBlocked) {
+    if (!platform.edge.enabled || !platform.auth.enabled)
+        return { step: null, blocked: null };
+    if (recordedIds[ACCESS_PROVIDER_RECORD_KEY]) {
+        // The secret is not stored, so a changed address cannot be re-sent: a person remakes the client.
+        const appliedHostname = recordedIds[PLATFORM_ACCESS_PROVIDER_APPLIED_HOSTNAME_SCOPE_KEY];
+        if (appliedHostname && appliedHostname !== platform.auth.hostname) {
+            return {
+                step: null,
+                blocked: `the Access sign-in provider is blocked, not planned: it was applied with the sign-in hostname ${appliedHostname} and ${platform.auth.hostname} is declared now; its secret is not stored, so delete the ZITADEL client cloudflare-access, remove the recorded keys ${ACCESS_PROVIDER_RECORD_KEY}, ${PLATFORM_ACCESS_PROVIDER_APPLIED_HOSTNAME_SCOPE_KEY} and ${PLATFORM_ACCESS_PROVIDER_APPLIED_AUTH_DOMAIN_SCOPE_KEY}, then apply again`,
+            };
+        }
+        return { step: null, blocked: null };
+    }
+    const undelivered = recordedIds[PLATFORM_ACCESS_PROVIDER_UNDELIVERED_SCOPE_KEY];
+    if (undelivered) {
+        return {
+            step: null,
+            blocked: `the Access sign-in provider is blocked, not planned: its ZITADEL client (${undelivered}) was made and its secret may or may not have reached edge; it cannot be shown again, so delete that client in ZITADEL and remove the recorded keys ${PLATFORM_ACCESS_PROVIDER_UNDELIVERED_SCOPE_KEY} and ${ACCESS_PROVIDER_RECORD_KEY}, then apply again to make both anew`,
+        };
+    }
+    const applied = Boolean(recordedIds[PLATFORM_EDGE_INTERNAL_URL_SCOPE_KEY]) &&
+        Boolean(recordedIds[resourceKey('coolify', 'app', PLATFORM_AUTH_KEY)]) &&
+        // The sibling ZITADEL steps need the delivered admin key (or the instance it came from).
+        (Boolean(recordedIds[PLATFORM_AUTH_ADMIN_USER_SCOPE_KEY]) ||
+            Boolean(recordedIds[PLATFORM_AUTH_INSTANCE_SCOPE_KEY]));
+    if (!applied) {
+        return {
+            step: null,
+            blocked: 'the Access sign-in provider is blocked, not planned: edge and the platform sign-in are not both applied yet',
+        };
+    }
+    if (executorBlocked)
+        return { step: null, blocked: executorBlocked };
+    return {
+        step: {
+            action: { system: 'cloudflare', kind: 'access-provider', key: 'platform', desired: {} },
+            step: {
+                description: "make the platform's ZITADEL the sign-in provider in Cloudflare Access, for company gates",
+                destroys: false,
+                migrates: false,
+            },
+        },
+        blocked: null,
+    };
+}
 /**
  * #540: a self-hosted heartbeat server (Healthchecks) for the platform, for
  * now -- a Coolify Postgres plus one Docker-image app

package/dist/plan/platform-org.d.ts

@@ -87,6 +87,8 @@ export interface OrgPlatformReadiness {
     callsReady: boolean;
     /** The platform's own sign-in (#168), which every org's own ZITADEL org lives inside. */
     authReady: boolean;
+    /** The Access provider id the platform recorded (`ACCESS_PROVIDER_RECORD_KEY`), which every gate requires. `null` or absent until the platform has recorded it. */
+    accessProviderId?: string | null;
     /** The jobs scheduler (#173) is enabled, applied, has recorded its internal address, and its admin token is held. */
     jobsReady: boolean;
     /**

package/dist/plan/platform-org.js

@@ -1,3 +1,4 @@
+import { ACCESS_PROVIDER_RECORD_KEY } from './gates.js';
 import { JOBS_INTERNAL_URL_SCOPE_KEY, JOBS_SCHEDULER_KEY, PLATFORM_AI_INTERNAL_URL_SCOPE_KEY, PLATFORM_AI_KEY, PLATFORM_AUTH_KEY, PLATFORM_EDGE_KEY, PLATFORM_FILES_INTERNAL_URL_SCOPE_KEY, PLATFORM_FILES_KEY, PLATFORM_MAIL_INTERNAL_URL_SCOPE_KEY, PLATFORM_MAIL_KEY, PLATFORM_MAIL_ZITADEL_PROJECT_SCOPE_KEY, platformMailMxHost, } from './platform-diff.js';
 import { FILES_MANAGEMENT_KEY_REF, JOBS_ADMIN_TOKEN_REF, PLATFORM_AI_MANAGEMENT_KEY_REF, } from './platform-providers.js';
 /**
@@ -129,6 +130,9 @@ edgePortPresent = false) {
         aiReady: aiApplied && missingKeys.ai === null,
         aiUrl: aiApplied ? (platformRecordedIds[PLATFORM_AI_INTERNAL_URL_SCOPE_KEY] ?? null) : null,
         callsReady: platform.sfu.enabled,
+        ...(platformRecordedIds[ACCESS_PROVIDER_RECORD_KEY]
+            ? { accessProviderId: platformRecordedIds[ACCESS_PROVIDER_RECORD_KEY] }
+            : {}),
         authReady: platform.auth.enabled && coolifyAppApplied(platformRecordedIds, PLATFORM_AUTH_KEY),
         jobsReady: jobsApplied && jobsUrl !== undefined && missingKeys.jobs === null,
         ...(jobsApplied && jobsUrl === undefined ? { jobsUrlMissing: true } : {}),