@wtfalch/foundry 0.23.0 → 0.24.0

package/dist/plan/platform-providers.d.ts

@@ -197,6 +197,12 @@ export interface FoundryPlatformStepExecutorOptions {
      * heartbeat checks reported as blocked rather than planned.
      */
     heartbeats?: PlatformHeartbeatsDeps;
+    /**
+     * #604: dependencies for the `cloudflare:access-provider` step -- optional
+     * for the same reason as `auth`; edge and sign-in applied with this unset
+     * gets the step reported as blocked.
+     */
+    accessProvider?: PlatformAccessProviderDeps;
 }
 /**
  * The real {@link PlatformStepExecutor} for the two steps built so far:
@@ -279,6 +285,7 @@ export declare class FoundryPlatformStepExecutor implements PlatformStepExecutor
     private readonly backup?;
     private readonly hc?;
     private readonly heartbeats?;
+    private readonly accessProvider?;
     constructor(cloudflare: Pick<CloudflarePort, 'findZoneByApex' | 'createZone'>, declaredOrgStore: Pick<DeclaredOrgStore, 'findOrgIdForZone' | 'list' | 'get'>, options?: FoundryPlatformStepExecutorOptions);
     blockedSteps(platform: DeclaredPlatform, recordedIds?: Readonly<Record<string, string>>): Promise<{
         auth?: string;
@@ -290,6 +297,7 @@ export declare class FoundryPlatformStepExecutor implements PlatformStepExecutor
         edge?: string;
         archon?: string;
         mail?: string;
+        accessProvider?: string;
         backupExecutorMissing?: boolean;
         hc?: string;
         heartbeatsExecutorMissing?: boolean;
@@ -959,6 +967,22 @@ export interface PlatformEdgeDeps {
     /** Clock, sleep and fetch for the readiness wait and delivery retries; real ones by default. */
     runtime?: PlatformEdgeRuntime;
 }
+/** The Access calls the provider step makes. */
+export type PlatformAccessProviderPort = Pick<AccessPort, 'readiness' | 'ensureProvider'>;
+/** #604: dependencies for {@link provisionPlatformAccessProvider}. */
+export interface PlatformAccessProviderDeps {
+    /** Edge's Access calls, at its recorded address (see {@link PlatformAccessFactory}). */
+    access: (edgeUrl: string) => PlatformAccessProviderPort | Promise<PlatformAccessProviderPort>;
+    /** Must target the platform's own ZITADEL instance, or `zitadelForInstance` must be set. */
+    zitadel: Pick<ZitadelPort, 'findOrCreateOrg' | 'findOrCreateProject' | 'listApps' | 'deleteApp'> & Required<Pick<ZitadelPort, 'createOidcAppWithSecret'>>;
+    /** {@link PlatformArchonDeps.zitadelForInstance}: the ZITADEL client for the sign-in at `issuerUrl`. */
+    zitadelForInstance?: (issuerUrl: string) => PlatformAccessProviderDeps['zitadel'];
+    /** Sleep and delivery tries for the one call that carries the secret; real ones by default. */
+    runtime?: {
+        sleep?: (ms: number) => Promise<void>;
+        deliverAttempts?: number;
+    };
+}
 export interface PlatformHcRuntime {
     fetch?: typeof fetch;
     sleep?: (ms: number) => Promise<void>;

package/dist/plan/platform-providers.js

@@ -6,9 +6,10 @@ import { redactSecrets } from '../calls-sfu-deploy-support.js';
 import { ensureCloudflaredConnector } from './cloudflared-connector.js';
 import { waitForDeploymentFinished, waitForHealthyVersion, waitForNewDeployment, } from './deploy-health.js';
 import { ACCESS_POLICY_NAME, getDatabaseStarted, isNotFoundError, isRunningOrStarting, } from './executor.js';
+import { ACCESS_PROVIDER_RECORD_KEY, GATE_CLAIM_NAME } from './gates.js';
 import { healthCheckSettings } from './health-check-settings.js';
 import { coolifyDomains, coolifyTunnelDomains, filesShareHostname } from './hostnames.js';
-import { AUTH_ZITADEL_RUN_OPTIONS, JOBS_DEPLOY_PENDING_SCOPE_KEY, JOBS_INTERNAL_URL_SCOPE_KEY, JOBS_SCHEDULER_KEY, PLATFORM_AI_APPLIED_GITREF_SCOPE_KEY, PLATFORM_AI_APPLIED_HOSTNAME_SCOPE_KEY, PLATFORM_AI_DEPLOY_PENDING_SCOPE_KEY, PLATFORM_AI_INTERNAL_URL_SCOPE_KEY, PLATFORM_AI_KEY, PLATFORM_AI_MANAGEMENT_KEY_CONFLICT_SCOPE_KEY, PLATFORM_AI_MANAGEMENT_KEY_SCOPE_KEY, PLATFORM_AI_MANAGEMENT_KEY_UNDELIVERED_SCOPE_KEY, PLATFORM_AI_MIGRATE_BLOCKED_SCOPE_KEY, PLATFORM_AI_ORGANISATION_SCOPE_KEY, PLATFORM_AI_SIGNING_KEY_SET_SCOPE_KEY, PLATFORM_AI_SIGNING_KEY_UNDELIVERED_SCOPE_KEY, PLATFORM_ARCHON_APPLIED_BROKER_SCOPE_KEY, PLATFORM_ARCHON_APPLIED_GIT_REF_SCOPE_KEY, PLATFORM_ARCHON_APPLIED_HOSTNAME_SCOPE_KEY, PLATFORM_ARCHON_APPLIED_OPERATOR_SCOPE_KEY, PLATFORM_ARCHON_APPLIED_ROLLING_UPDATE_SCOPE_KEY, PLATFORM_ARCHON_CONNECTOR_APP_SCOPE_KEY, PLATFORM_ARCHON_COOLIFY_READ_TOKEN_REF, PLATFORM_ARCHON_DEPLOYMENT_SCOPE_KEY, PLATFORM_ARCHON_ENVS_DEPLOYED_SCOPE_KEY, PLATFORM_ARCHON_GATE_CLOSED_SCOPE_KEY, PLATFORM_ARCHON_INTEGRATIONS_KEY_SYNCED_SCOPE_KEY, PLATFORM_ARCHON_KEY, PLATFORM_ARCHON_MASTER_CLOUDFLARE_TOKEN_REF, PLATFORM_ARCHON_MASTER_COOLIFY_TOKEN_REF, PLATFORM_ARCHON_MASTER_COOLIFY_URL_REF, PLATFORM_AUTH_ADMIN_UNDELIVERED_SCOPE_KEY, PLATFORM_AUTH_ADMIN_USER_SCOPE_KEY, PLATFORM_AUTH_BROKER_DEPLOYED_SCOPE_KEY, PLATFORM_AUTH_BROKER_SCOPE_KEY, PLATFORM_AUTH_CONNECTOR_APP_SCOPE_KEY, PLATFORM_AUTH_INSTANCE_SCOPE_KEY, PLATFORM_AUTH_INSTANCE_UNDELIVERED_SCOPE_KEY, PLATFORM_AUTH_KEY, PLATFORM_AUTH_LOGIN_CLIENT_UNDELIVERED_SCOPE_KEY, PLATFORM_AUTH_LOGIN_CLIENT_USER_SCOPE_KEY, PLATFORM_AUTH_OWNER_INVITE_SCOPE_KEY, PLATFORM_AUTH_SMTP_SCOPE_KEY, PLATFORM_AUTH_ZITADEL_APPLIED_IMAGE_TAG_SCOPE_KEY, PLATFORM_AUTH_ZITADEL_RUN_OPTIONS_SCOPE_KEY, PLATFORM_BACKUP_DATABASE_SCOPE_KEYS, PLATFORM_BACKUP_SERVICE_KEYS, PLATFORM_EDGE_APPLIED_GIT_REF_SCOPE_KEY, PLATFORM_EDGE_APPLIED_HOSTNAME_SCOPE_KEY, PLATFORM_EDGE_CLOUDFLARE_TOKEN_REF, PLATFORM_EDGE_INTERNAL_URL_SCOPE_KEY, PLATFORM_EDGE_KEY, PLATFORM_EDGE_KEY_REF, PLATFORM_EDGE_PLATFORM_KEY_SET_SCOPE_KEY, PLATFORM_EDGE_PLATFORM_KEY_UNDELIVERED_SCOPE_KEY, PLATFORM_FILES_APPLIED_GIT_REF_SCOPE_KEY, PLATFORM_FILES_APPLIED_HOSTNAME_SCOPE_KEY, PLATFORM_FILES_INTERNAL_URL_SCOPE_KEY, PLATFORM_FILES_INTROSPECTION_SCOPE_KEY, PLATFORM_FILES_INTROSPECTION_UNDELIVERED_SCOPE_KEY, PLATFORM_FILES_KEY, PLATFORM_FILES_MANAGEMENT_KEY_SCOPE_KEY, PLATFORM_FILES_MANAGEMENT_UNDELIVERED_SCOPE_KEY, PLATFORM_FILES_ZITADEL_PROJECT_SCOPE_KEY, PLATFORM_HC_API_KEY_REF, PLATFORM_HC_APPLIED_GIT_REF_SCOPE_KEY, PLATFORM_HC_APPLIED_HOSTNAME_SCOPE_KEY, PLATFORM_HC_KEY, PLATFORM_HEARTBEATS_APPLIED_SCOPE_KEY, PLATFORM_INTEGRATIONS_APPLIED_GITREF_SCOPE_KEY, PLATFORM_INTEGRATIONS_APPLIED_HOSTNAME_SCOPE_KEY, PLATFORM_INTEGRATIONS_KEY, PLATFORM_INTEGRATIONS_KEY_ID_SCOPE_KEY, PLATFORM_INTEGRATIONS_KEY_ROTATION_PREVIOUS_SCOPE_KEY, PLATFORM_INTEGRATIONS_KEY_ROTATION_REQUESTED_SCOPE_KEY, PLATFORM_INTEGRATIONS_KEY_ROTATION_UNDELIVERED_SCOPE_KEY, PLATFORM_INTEGRATIONS_KEY_SET_SCOPE_KEY, PLATFORM_INTEGRATIONS_KEY_UNDELIVERED_SCOPE_KEY, PLATFORM_INTEGRATIONS_RUNNER_KEYRING_DEPLOYED_SCOPE_KEY, PLATFORM_MAIL_ADMIN_KEY_SCOPE_KEY, PLATFORM_MAIL_ADMIN_UNDELIVERED_SCOPE_KEY, PLATFORM_MAIL_APPLIED_GIT_REF_SCOPE_KEY, PLATFORM_MAIL_APPLIED_HOSTNAME_SCOPE_KEY, PLATFORM_MAIL_CONNECTOR_APP_SCOPE_KEY, PLATFORM_MAIL_INTERNAL_URL_SCOPE_KEY, PLATFORM_MAIL_KEY, PLATFORM_MAIL_ZITADEL_PROJECT_SCOPE_KEY, PLATFORM_UPTIME_HEARTBEAT_CHECK_NAME, archonBootstrapOperator, desiredHeartbeatCheckNames, heartbeatCheckUrlRef, parseBrokerDeployRecord, parseLoginClientRecord, platformBackupHeartbeatCheckName, platformMailMxHost, } from './platform-diff.js';
+import { AUTH_ZITADEL_RUN_OPTIONS, JOBS_DEPLOY_PENDING_SCOPE_KEY, JOBS_INTERNAL_URL_SCOPE_KEY, JOBS_SCHEDULER_KEY, PLATFORM_ACCESS_PROVIDER_APPLIED_AUTH_DOMAIN_SCOPE_KEY, PLATFORM_ACCESS_PROVIDER_APPLIED_HOSTNAME_SCOPE_KEY, PLATFORM_ACCESS_PROVIDER_UNDELIVERED_SCOPE_KEY, PLATFORM_AI_APPLIED_GITREF_SCOPE_KEY, PLATFORM_AI_APPLIED_HOSTNAME_SCOPE_KEY, PLATFORM_AI_DEPLOY_PENDING_SCOPE_KEY, PLATFORM_AI_INTERNAL_URL_SCOPE_KEY, PLATFORM_AI_KEY, PLATFORM_AI_MANAGEMENT_KEY_CONFLICT_SCOPE_KEY, PLATFORM_AI_MANAGEMENT_KEY_SCOPE_KEY, PLATFORM_AI_MANAGEMENT_KEY_UNDELIVERED_SCOPE_KEY, PLATFORM_AI_MIGRATE_BLOCKED_SCOPE_KEY, PLATFORM_AI_ORGANISATION_SCOPE_KEY, PLATFORM_AI_SIGNING_KEY_SET_SCOPE_KEY, PLATFORM_AI_SIGNING_KEY_UNDELIVERED_SCOPE_KEY, PLATFORM_ARCHON_APPLIED_BROKER_SCOPE_KEY, PLATFORM_ARCHON_APPLIED_GIT_REF_SCOPE_KEY, PLATFORM_ARCHON_APPLIED_HOSTNAME_SCOPE_KEY, PLATFORM_ARCHON_APPLIED_OPERATOR_SCOPE_KEY, PLATFORM_ARCHON_APPLIED_ROLLING_UPDATE_SCOPE_KEY, PLATFORM_ARCHON_CONNECTOR_APP_SCOPE_KEY, PLATFORM_ARCHON_COOLIFY_READ_TOKEN_REF, PLATFORM_ARCHON_DEPLOYMENT_SCOPE_KEY, PLATFORM_ARCHON_ENVS_DEPLOYED_SCOPE_KEY, PLATFORM_ARCHON_GATE_CLOSED_SCOPE_KEY, PLATFORM_ARCHON_INTEGRATIONS_KEY_SYNCED_SCOPE_KEY, PLATFORM_ARCHON_KEY, PLATFORM_ARCHON_MASTER_CLOUDFLARE_TOKEN_REF, PLATFORM_ARCHON_MASTER_COOLIFY_TOKEN_REF, PLATFORM_ARCHON_MASTER_COOLIFY_URL_REF, PLATFORM_AUTH_ADMIN_UNDELIVERED_SCOPE_KEY, PLATFORM_AUTH_ADMIN_USER_SCOPE_KEY, PLATFORM_AUTH_BROKER_DEPLOYED_SCOPE_KEY, PLATFORM_AUTH_BROKER_SCOPE_KEY, PLATFORM_AUTH_CONNECTOR_APP_SCOPE_KEY, PLATFORM_AUTH_INSTANCE_SCOPE_KEY, PLATFORM_AUTH_INSTANCE_UNDELIVERED_SCOPE_KEY, PLATFORM_AUTH_KEY, PLATFORM_AUTH_LOGIN_CLIENT_UNDELIVERED_SCOPE_KEY, PLATFORM_AUTH_LOGIN_CLIENT_USER_SCOPE_KEY, PLATFORM_AUTH_OWNER_INVITE_SCOPE_KEY, PLATFORM_AUTH_SMTP_SCOPE_KEY, PLATFORM_AUTH_ZITADEL_APPLIED_IMAGE_TAG_SCOPE_KEY, PLATFORM_AUTH_ZITADEL_RUN_OPTIONS_SCOPE_KEY, PLATFORM_BACKUP_DATABASE_SCOPE_KEYS, PLATFORM_BACKUP_SERVICE_KEYS, PLATFORM_EDGE_APPLIED_GIT_REF_SCOPE_KEY, PLATFORM_EDGE_APPLIED_HOSTNAME_SCOPE_KEY, PLATFORM_EDGE_CLOUDFLARE_TOKEN_REF, PLATFORM_EDGE_INTERNAL_URL_SCOPE_KEY, PLATFORM_EDGE_KEY, PLATFORM_EDGE_KEY_REF, PLATFORM_EDGE_PLATFORM_KEY_SET_SCOPE_KEY, PLATFORM_EDGE_PLATFORM_KEY_UNDELIVERED_SCOPE_KEY, PLATFORM_FILES_APPLIED_GIT_REF_SCOPE_KEY, PLATFORM_FILES_APPLIED_HOSTNAME_SCOPE_KEY, PLATFORM_FILES_INTERNAL_URL_SCOPE_KEY, PLATFORM_FILES_INTROSPECTION_SCOPE_KEY, PLATFORM_FILES_INTROSPECTION_UNDELIVERED_SCOPE_KEY, PLATFORM_FILES_KEY, PLATFORM_FILES_MANAGEMENT_KEY_SCOPE_KEY, PLATFORM_FILES_MANAGEMENT_UNDELIVERED_SCOPE_KEY, PLATFORM_FILES_ZITADEL_PROJECT_SCOPE_KEY, PLATFORM_HC_API_KEY_REF, PLATFORM_HC_APPLIED_GIT_REF_SCOPE_KEY, PLATFORM_HC_APPLIED_HOSTNAME_SCOPE_KEY, PLATFORM_HC_KEY, PLATFORM_HEARTBEATS_APPLIED_SCOPE_KEY, PLATFORM_INTEGRATIONS_APPLIED_GITREF_SCOPE_KEY, PLATFORM_INTEGRATIONS_APPLIED_HOSTNAME_SCOPE_KEY, PLATFORM_INTEGRATIONS_KEY, PLATFORM_INTEGRATIONS_KEY_ID_SCOPE_KEY, PLATFORM_INTEGRATIONS_KEY_ROTATION_PREVIOUS_SCOPE_KEY, PLATFORM_INTEGRATIONS_KEY_ROTATION_REQUESTED_SCOPE_KEY, PLATFORM_INTEGRATIONS_KEY_ROTATION_UNDELIVERED_SCOPE_KEY, PLATFORM_INTEGRATIONS_KEY_SET_SCOPE_KEY, PLATFORM_INTEGRATIONS_KEY_UNDELIVERED_SCOPE_KEY, PLATFORM_INTEGRATIONS_RUNNER_KEYRING_DEPLOYED_SCOPE_KEY, PLATFORM_MAIL_ADMIN_KEY_SCOPE_KEY, PLATFORM_MAIL_ADMIN_UNDELIVERED_SCOPE_KEY, PLATFORM_MAIL_APPLIED_GIT_REF_SCOPE_KEY, PLATFORM_MAIL_APPLIED_HOSTNAME_SCOPE_KEY, PLATFORM_MAIL_CONNECTOR_APP_SCOPE_KEY, PLATFORM_MAIL_INTERNAL_URL_SCOPE_KEY, PLATFORM_MAIL_KEY, PLATFORM_MAIL_ZITADEL_PROJECT_SCOPE_KEY, PLATFORM_UPTIME_HEARTBEAT_CHECK_NAME, archonBootstrapOperator, desiredHeartbeatCheckNames, heartbeatCheckUrlRef, parseBrokerDeployRecord, parseLoginClientRecord, platformBackupHeartbeatCheckName, platformMailMxHost, } from './platform-diff.js';
 import { applyCallsSfuPlatformStep } from './platform-sfu.js';
 import { CreateInstanceError, createZitadelInstance, generateSystemApiKeypair, instanceWithoutBearerMessage, systemApiUsersEnv, } from './zitadel-system-api.js';
 /** The key `runPlatformSteps` records the apex zone's id under (`system:kind:key`). */
@@ -155,6 +156,7 @@ export class FoundryPlatformStepExecutor {
     backup;
     hc;
     heartbeats;
+    accessProvider;
     constructor(cloudflare, declaredOrgStore, options = {}) {
         this.cloudflare = cloudflare;
         this.declaredOrgStore = declaredOrgStore;
@@ -172,6 +174,7 @@ export class FoundryPlatformStepExecutor {
         this.backup = options.backup;
         this.hc = options.hc;
         this.heartbeats = options.heartbeats;
+        this.accessProvider = options.accessProvider;
     }
     async blockedSteps(platform, recordedIds = {}) {
         const blocked = {};
@@ -323,6 +326,26 @@ export class FoundryPlatformStepExecutor {
             if (!apiKey)
                 blocked.heartbeatsApiKeyMissing = true;
         }
+        // #604: only once edge and sign-in are applied (the planner reports
+        // that case itself) and no provider is recorded yet.
+        if (platform.edge.enabled &&
+            platform.auth.enabled &&
+            !recordedIds[ACCESS_PROVIDER_RECORD_KEY] &&
+            recordedIds[PLATFORM_EDGE_INTERNAL_URL_SCOPE_KEY]) {
+            if (!this.accessProvider?.zitadel.createOidcAppWithSecret) {
+                blocked.accessProvider =
+                    'the Access sign-in provider is blocked, not planned: the host built the platform executor without its Access provider dependencies (a ZITADEL client that can make a client with a secret)';
+            }
+            else {
+                try {
+                    await (await platformAccess(this.accessProvider, recordedIds, 'platform:access')).readiness();
+                }
+                catch {
+                    blocked.accessProvider =
+                        'the Access sign-in provider is blocked, not planned: edge could not confirm that Cloudflare Access is ready (its Cloudflare token needs every Access right)';
+                }
+            }
+        }
         // Not a block: tells the planner to order Archon's step last (`PlanPlatformOptions.blocked.archonRunsInsideApp`).
         if (this.archon?.runsInsideApp) {
             blocked.archonRunsInsideApp = true;
@@ -490,6 +513,12 @@ export class FoundryPlatformStepExecutor {
             }
             return provisionPlatformHc(context, this.hc);
         }
+        if (action.system === 'cloudflare' && action.kind === 'access-provider') {
+            if (!this.accessProvider) {
+                throw new Error('cloudflare:access-provider needs FoundryPlatformStepExecutor to be constructed with its Access provider dependencies (#604)');
+            }
+            return provisionPlatformAccessProvider(context, this.accessProvider);
+        }
         if (action.system === 'heartbeats' && action.kind === 'reconcile') {
             if (!this.heartbeats) {
                 throw new Error('heartbeats:reconcile needs FoundryPlatformStepExecutor to be constructed with its heartbeats dependencies (#540)');
@@ -5668,6 +5697,85 @@ async function provisionPlatformEdge(context, deps) {
     await record(PLATFORM_EDGE_APPLIED_GIT_REF_SCOPE_KEY, gitRef);
     return { resourceId: appId };
 }
+/** The ZITADEL project and client the platform's Access provider signs in through (#604). */
+const PLATFORM_ACCESS_ZITADEL_PROJECT = 'cloudflare-access';
+const PLATFORM_ACCESS_ZITADEL_APP = 'cloudflare-access';
+/** The name edge finds the Cloudflare Access provider by. */
+const PLATFORM_ACCESS_PROVIDER_NAME = 'foundry';
+/**
+ * #604: makes the platform's ZITADEL a sign-in provider in Cloudflare Access.
+ * Reads the Access team address from edge, makes a ZITADEL client whose
+ * redirect is that address's callback, and hands its id and secret to edge's
+ * `ensureProvider`, which is the delivery. The client's secret exists once
+ * (CLAUDE.md rules 1 and 6): its app id is recorded and persisted before the
+ * secret leaves, the guard {@link ACCESS_PROVIDER_RECORD_KEY} only after edge
+ * returned the provider id, and a recorded undelivered id stops a second
+ * mint. The secret reaches only `ensureProvider`: no error, log or record
+ * holds it. A client app by this name with no recorded id is one whose create
+ * response was lost before anything saw its secret, so it is deleted and made
+ * again.
+ */
+async function provisionPlatformAccessProvider(context, deps) {
+    const { platform } = context;
+    const recorded = context.recordedIds();
+    const sleep = deps.runtime?.sleep ?? defaultSleep;
+    const attempts = deps.runtime?.deliverAttempts ?? 3;
+    const label = 'platform:access-provider';
+    if (recorded[ACCESS_PROVIDER_RECORD_KEY])
+        return {};
+    const lost = recorded[PLATFORM_ACCESS_PROVIDER_UNDELIVERED_SCOPE_KEY];
+    if (lost) {
+        throw new Error(`${label}: the ZITADEL client ${lost} was made and its secret may or may not have reached edge; delete it and remove the recorded keys ${PLATFORM_ACCESS_PROVIDER_UNDELIVERED_SCOPE_KEY} and ${ACCESS_PROVIDER_RECORD_KEY}, then apply again to make both anew`);
+    }
+    const access = await platformAccess(deps, recorded, label);
+    let authDomain;
+    try {
+        ({ authDomain } = await access.readiness());
+    }
+    catch {
+        throw new Error(`${label}: edge could not confirm that Cloudflare Access is ready`);
+    }
+    const issuer = `https://${platform.auth.hostname}`;
+    const zitadel = deps.zitadelForInstance?.(issuer) ?? deps.zitadel;
+    const { org } = await zitadel.findOrCreateOrg(PLATFORM_AUTH_ORG_NAME);
+    const { project } = await zitadel.findOrCreateProject(org.id, PLATFORM_ACCESS_ZITADEL_PROJECT);
+    const orphan = (await zitadel.listApps(org.id, project.id)).apps.find((a) => a.name === PLATFORM_ACCESS_ZITADEL_APP && a.state !== 'APP_STATE_REMOVED');
+    if (orphan) {
+        try {
+            await zitadel.deleteApp(org.id, project.id, orphan.id);
+        }
+        catch (error) {
+            if (!isNotFoundError(error))
+                throw error;
+        }
+    }
+    const client = await zitadel.createOidcAppWithSecret(org.id, project.id, {
+        name: PLATFORM_ACCESS_ZITADEL_APP,
+        redirectUris: [`https://${authDomain}/cdn-cgi/access/callback`],
+        postLogoutRedirectUris: [`https://${authDomain}/`],
+    });
+    context.recordScopeId(PLATFORM_ACCESS_PROVIDER_UNDELIVERED_SCOPE_KEY, client.appId);
+    await context.persist?.();
+    let providerId = '';
+    await deliverWithRetry(async (_ref, secret) => {
+        providerId = (await access.ensureProvider({
+            name: PLATFORM_ACCESS_PROVIDER_NAME,
+            clientId: client.clientId,
+            clientSecret: secret,
+            authUrl: `${issuer}/oauth/v2/authorize`,
+            tokenUrl: `${issuer}/oauth/v2/token`,
+            certsUrl: `${issuer}/oauth/v2/keys`,
+            scopes: ['openid', 'email', 'profile', 'urn:zitadel:iam:user:resourceowner'],
+            claims: [GATE_CLAIM_NAME],
+        })).id;
+    }, ACCESS_PROVIDER_RECORD_KEY, client.clientSecret, attempts, sleep, `the ZITADEL client ${client.appId}'s secret`, label);
+    // Last: the guard says the secret reached edge.
+    context.recordScopeId(PLATFORM_ACCESS_PROVIDER_APPLIED_HOSTNAME_SCOPE_KEY, platform.auth.hostname);
+    context.recordScopeId(PLATFORM_ACCESS_PROVIDER_APPLIED_AUTH_DOMAIN_SCOPE_KEY, authDomain);
+    context.recordScopeId(ACCESS_PROVIDER_RECORD_KEY, providerId);
+    await context.persist?.();
+    return {};
+}
 /** `healthchecks/healthchecks` on Docker Hub -- #540's own "third-party, not this estate's own repo" image. */
 const HC_IMAGE = 'healthchecks/healthchecks';
 const PLATFORM_HC_PROJECT = 'platform';
@@ -6022,7 +6130,7 @@ label = 'platform:files') {
         }
         catch {
             if (attempt >= attempts) {
-                throw new Error(`${label}: ${what} could not be delivered after ${attempts} tries; the next plan reports it as lost and mints no new one`);
+                throw new Error(`${label}: ${what} could not be delivered after ${attempts} tries; the next plan reports it as blocked and mints no new one`);
             }
             await sleep(1000 * attempt);
         }

package/dist/store/postgres.js

@@ -79,6 +79,30 @@ export class DeclaredOrgError extends Error {
         this.name = 'DeclaredOrgError';
     }
 }
+/**
+ * Reads one stored entry. `hostnames` defaults as migration 0030 set it, and
+ * `gates` to none. An entry stored before gates existed with a non-empty
+ * `accessEmails` was gated: read it as one gate on its first non-'*' hostname
+ * (as stored), or on '*' when that is its only hostname, so the read fails
+ * closed and never drops a declared gate. With no hostname it is not served
+ * and reads no gates. The emails are dropped (people are chosen
+ * elsewhere now), and the next write stores the new shape without them. An
+ * entry that already has `gates` keeps them. A converted company over
+ * `gateLimit` is not an error here; validation reports it on the next validate.
+ */
+function storedEntryToEntry(stored, usesDomain) {
+    const { accessEmails, ...rest } = stored;
+    const hostnames = stored.hostnames ?? (stored.key === APP_ENTRY_KEY && usesDomain ? ['@'] : []);
+    let gates = stored.gates;
+    if (gates === undefined) {
+        const first = hostnames.find((h) => h !== '*') ?? hostnames[0];
+        gates =
+            accessEmails !== undefined && accessEmails.length > 0 && first !== undefined
+                ? [{ key: stored.key, hostnames: [first] }]
+                : [];
+    }
+    return { ...rest, hostnames, gates };
+}
 function rowToOrg(row) {
     return {
         id: row.id,
@@ -117,11 +141,8 @@ function rowToOrg(row) {
             usesDomain: row.hostingUsesDomain,
             tunnel: row.hostingTunnel,
             issuerApps: row.hostingIssuerApps,
-            // Migration 0030's default for an entry stored before `hostnames`.
-            entries: row.hostingEntries.map((entry) => ({
-                ...entry,
-                hostnames: entry.hostnames ?? (entry.key === APP_ENTRY_KEY && row.hostingUsesDomain ? ['@'] : []),
-            })),
+            entries: row.hostingEntries.map((entry) => storedEntryToEntry(entry, row.hostingUsesDomain)),
+            gateLimit: row.hostingGateLimit,
         },
         sso: { enabled: row.ssoEnabled },
         guests: { enabled: row.guestsEnabled },
@@ -163,6 +184,7 @@ function orgToRow(org) {
         hostingTunnel: org.hosting.tunnel,
         hostingIssuerApps: org.hosting.issuerApps,
         hostingEntries: org.hosting.entries,
+        hostingGateLimit: org.hosting.gateLimit,
         ssoEnabled: org.sso.enabled,
         guestsEnabled: org.guests.enabled,
         soloEnabled: org.solo.enabled,

package/dist/store/schema.d.ts

@@ -533,6 +533,23 @@ export declare const declaredOrgs: import("drizzle-orm/pg-core").PgTableWithColu
         }, {}, {
             $type: HostingEntry[];
         }>;
+        hostingGateLimit: import("drizzle-orm/pg-core").PgColumn<{
+            name: "hosting_gate_limit";
+            tableName: "foundry_declared_orgs";
+            dataType: "number";
+            columnType: "PgInteger";
+            data: number;
+            driverParam: string | number;
+            notNull: true;
+            hasDefault: true;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: undefined;
+            baseColumn: never;
+            identity: undefined;
+            generated: undefined;
+        }, {}, {}>;
         ssoEnabled: import("drizzle-orm/pg-core").PgColumn<{
             name: "sso_enabled";
             tableName: "foundry_declared_orgs";

package/dist/store/schema.js

@@ -59,6 +59,8 @@ export const declaredOrgs = pgTable('foundry_declared_orgs', {
     // hosting_access_emails and hosting_app_env columns, which stay for an older
     // reader and are no longer written.
     hostingEntries: jsonb('hosting_entries').notNull().default([]).$type(),
+    // HostingConfig.gateLimit (org.ts, #603); migrations/0048. Default 3 is DEFAULT_GATE_LIMIT.
+    hostingGateLimit: integer('hosting_gate_limit').notNull().default(3),
     ssoEnabled: boolean('sso_enabled').notNull().default(false),
     guestsEnabled: boolean('guests_enabled').notNull().default(false),
     soloEnabled: boolean('solo_enabled').notNull().default(false),

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@wtfalch/foundry",
-  "version": "0.23.0",
+  "version": "0.24.0",
   "description": "Foundry's SDK: the declared org's types, the plan and apply contracts, and the state store's interface.",
   "repository": {
     "type": "git",
@@ -43,7 +43,7 @@
   "dependencies": {
     "@wtfalch/audit": "0.6.0",
     "@wtfalch/auth": "0.16.0",
-    "@wtfalch/edge": "0.9.0",
+    "@wtfalch/edge": "0.11.0",
     "@wtfalch/email": "^0.17.0",
     "@wtfalch/providers": "0.7.5",
     "ssh2": "1.17.0",