@wtfalch/foundry 0.23.0 → 0.25.0

package/dist/bootstrap/declare.js

@@ -1,4 +1,4 @@
-import { validateOwners } from '../org.js';
+import { DEFAULT_GATE_LIMIT, validateOwners } from '../org.js';
 import { PLATFORM_SERVICE_KEYS, defaultPlatformHostname } from '../platform.js';
 import { VERSIONS } from './versions.js';
 /**
@@ -107,6 +107,7 @@ export function declaredCompanyOrg(company, owner) {
             tunnel: false,
             issuerApps: [],
             entries: [],
+            gateLimit: DEFAULT_GATE_LIMIT,
         },
         sso: { enabled: false },
         guests: { enabled: false },
@@ -145,5 +146,9 @@ export function declaredPlatformFor(apex, serverIpv4) {
         apex,
         ...(serverIpv4 ? { serverIpv4 } : {}),
         ...services,
+        // Off, like `sfu`: the pin is an Archon release tag and digest, which exist
+        // only after Archon runs. Declared on with no pin, it would be reported
+        // blocked and the bootstrap would never be complete.
+        uptime: { enabled: false, tag: '', sha256: '' },
     };
 }

package/dist/index.d.ts

@@ -1,5 +1,5 @@
-export type { OrgId, MailMode, MailConfig, ChatConfig, CallsConfig, IssuerConfig, SiteConfig, IssuerAppKind, IssuerApp, HostingConfig, HostingEntry, HostingEntryUses, EntryAuth, EntryFiles, EntryAi, EnvValue, SsoConfig, GuestsConfig, SoloConfig, StorageConfig, AiConfig, BuyerAddress, BuyerIdentity, AdoptedAppForm, AdoptedApp, OwnerIdentity, OwnerMailbox, DeclaredOrg, } from './org.js';
-export { APP_ENTRY_KEY, FILES_ENTRY_PERMISSIONS, AI_ENTRY_PERMISSIONS, DEFAULT_MAIL_APPS, appEntry, ownerMailboxes, validateBuyerIdentity, validateHosting, validateMail, validateOwners, validateSite, } from './org.js';
+export type { OrgId, MailMode, MailConfig, ChatConfig, CallsConfig, IssuerConfig, SiteConfig, IssuerAppKind, IssuerApp, HostingConfig, HostingEntry, EntryGate, HostingEntryUses, EntryAuth, EntryFiles, EntryAi, EnvValue, SsoConfig, GuestsConfig, SoloConfig, StorageConfig, AiConfig, BuyerAddress, BuyerIdentity, AdoptedAppForm, AdoptedApp, OwnerIdentity, OwnerMailbox, DeclaredOrg, } from './org.js';
+export { APP_ENTRY_KEY, DEFAULT_GATE_LIMIT, FILES_ENTRY_PERMISSIONS, AI_ENTRY_PERMISSIONS, DEFAULT_MAIL_APPS, appEntry, ownerMailboxes, validateBuyerIdentity, validateHosting, validateMail, validateOwners, validateSite, } from './org.js';
 export type { DeclaredPlatform, PlatformService, PlatformServiceKey } from './platform.js';
 export { PLATFORM_SERVICE_KEYS, defaultPlatformHostname, validatePlatform, } from './platform.js';
 import { type PinnedVersions } from './bootstrap/versions.js';
@@ -41,7 +41,7 @@ export { checkMailIdentityAudience } from './plan/index.js';
 export type { MailAllowlistApp } from './plan/index.js';
 export { checkMailAppsAllowlist } from './plan/index.js';
 export { FoundryPlatformStepExecutor, ProvidersPlatformCloudflareReader, ProvidersPlatformCoolifyReader, createZitadelAdminMinter, createZitadelProjectRoles, PLATFORM_AUTH_KEY, PLATFORM_MAIL_KEY, PLATFORM_MAIL_ADMIN_KEY_DESCRIPTION, } from './plan/index.js';
-export type { PlatformAuthDeps, PlatformAuthRuntime, PlatformFilesDeps, PlatformFilesRuntime, PlatformEdgeDeps, PlatformDnsFactory, PlatformAccessFactory, PlatformAccessPort, PlatformTunnelsFactory, PlatformEdgeRuntime, } from './plan/index.js';
+export type { PlatformAuthDeps, PlatformAuthRuntime, PlatformFilesDeps, PlatformFilesRuntime, PlatformEdgeDeps, PlatformDnsFactory, PlatformAccessFactory, PlatformUptimeAccessFactory, PlatformUptimeAccessPort, PlatformUptimeDeps, PlatformWorkersFactory, PlatformWorkersPort, PlatformAccessPort, PlatformTunnelsFactory, PlatformEdgeRuntime, } from './plan/index.js';
 export type { PlatformMailDeps, PlatformMailAdminPort, PlatformMailRuntime, } from './plan/index.js';
 export { FILES_INTROSPECTION_SECRET_REF, FILES_MANAGEMENT_ISSUER, FILES_MANAGEMENT_KEY_ID, FILES_MANAGEMENT_KEY_REF, PLATFORM_AUTH_INSTANCE_BEARER_REF, } from './plan/index.js';
 export { AI_MANAGEMENT_ISSUER, AI_MANAGEMENT_KEY_ID, AI_SIGNING_KEY_REF, AiManagementKeyExistsError, createAiManagementKeyMinter, PLATFORM_AI_MANAGEMENT_KEY_REF, PLATFORM_AI_MANAGEMENT_PERMISSIONS, } from './plan/index.js';

package/dist/index.js

@@ -1,4 +1,4 @@
-export { APP_ENTRY_KEY, FILES_ENTRY_PERMISSIONS, AI_ENTRY_PERMISSIONS, DEFAULT_MAIL_APPS, appEntry, ownerMailboxes, validateBuyerIdentity, validateHosting, validateMail, validateOwners, validateSite, } from './org.js';
+export { APP_ENTRY_KEY, DEFAULT_GATE_LIMIT, FILES_ENTRY_PERMISSIONS, AI_ENTRY_PERMISSIONS, DEFAULT_MAIL_APPS, appEntry, ownerMailboxes, validateBuyerIdentity, validateHosting, validateMail, validateOwners, validateSite, } from './org.js';
 export { PLATFORM_SERVICE_KEYS, defaultPlatformHostname, validatePlatform, } from './platform.js';
 // archon#273: the pinned platform service versions the planner deploys, so a
 // host can show declared against running. Readonly: it is the planner's own

package/dist/migrations/0048_hosting_gate_limit.sql

@@ -0,0 +1,7 @@
+-- @wtfalch/foundry: the per-company limit on Access gates (#603), persisted.
+-- Mirrors `src/store/schema.ts`'s `hostingGateLimit`. Additive: an older
+-- reader ignores the column, and a row written before it reads the default, 3
+-- (`DEFAULT_GATE_LIMIT` in `src/org.ts`).
+
+alter table foundry_declared_orgs
+  add column if not exists hosting_gate_limit integer not null default 3;

package/dist/migrations/0049_platform_uptime.sql

@@ -0,0 +1,11 @@
+-- @wtfalch/foundry: the uptime Worker on the declared platform (foundry#542).
+-- Mirrors `src/store/schema.ts`'s `foundryDeclaredPlatform` additions.
+-- `uptime_tag` and `uptime_sha256` are the pin of the Archon release whose
+-- built Worker foundry deploys; both empty means nothing is pinned yet, and
+-- the planner reports that instead of planning the step. The Worker is on by
+-- default, like every service except sfu and coolify.
+
+alter table foundry_declared_platform
+  add column if not exists uptime_enabled boolean not null default true,
+  add column if not exists uptime_tag text not null default '',
+  add column if not exists uptime_sha256 text not null default '';

package/dist/org.d.ts

@@ -242,25 +242,26 @@ export interface HostingConfig {
     /** One entry per app the org runs. */
     entries: HostingEntry[];
     /**
-     * Cloudflare Access rules for hostnames besides the `app` entry's own
-     * (#246): `accessEmails` above already gates that one hostname by an
-     * email list; this says what any other hostname an org serves (e.g.
-     * `share.<domain>`, `storage.<domain>`) gets instead of an operator
-     * setting it up by hand in the Cloudflare dashboard, which is how it is
-     * done today. Empty or absent: no additional Access apps.
+     * How a hostname the org serves gets past Cloudflare Access (#246): a name
+     * that is public (`bypass`) or admits a machine (`service-token`) instead
+     * of an operator setting it up by hand in the Cloudflare dashboard. Who
+     * passes for people is an entry's `gates`. Empty or absent: no additional
+     * Access apps.
      */
     access?: AccessRule[];
+    /** How many gates the org may declare across all its entries. Only the platform operator sets it. Default: `3`. */
+    gateLimit: number;
 }
-/** The three Cloudflare Access rule kinds {@link HostingConfig.access} supports (#246). */
-export type AccessRuleKind = 'gate' | 'bypass' | 'service-token';
+/** The two Cloudflare Access rule kinds {@link HostingConfig.access} supports (#246). */
+export type AccessRuleKind = 'bypass' | 'service-token';
 export declare const ACCESS_RULE_KINDS: ReadonlySet<AccessRuleKind>;
+/** The gates an org may declare when it has no `gateLimit` of its own. */
+export declare const DEFAULT_GATE_LIMIT = 3;
 /**
- * One Cloudflare Access rule on a hostname besides the `app` entry's own
- * (#246, `HostingConfig.access`). `hostname` is the full hostname Access
- * gates (e.g. `share.<domain>`), never an entry key.
+ * One Cloudflare Access rule on a hostname the org serves under its own
+ * domain (#246, `HostingConfig.access`). `hostname` is the full hostname
+ * Access acts on (e.g. `share.<domain>`), never an entry key.
  *
- * - `gate`: an email allowlist, the same shape `accessEmails` already
- *   applies to the app's own hostname.
  * - `bypass`: no login at all -- the hostname is public through Access.
  * - `service-token`: only a request carrying the named Cloudflare Access
  *   service token's headers gets through, no human login flow. The token
@@ -270,10 +271,6 @@ export declare const ACCESS_RULE_KINDS: ReadonlySet<AccessRuleKind>;
  *   second one.
  */
 export type AccessRule = {
-    hostname: string;
-    kind: 'gate';
-    emails: string[];
-} | {
     hostname: string;
     kind: 'bypass';
 } | {
@@ -284,9 +281,9 @@ export type AccessRule = {
 /** The key of the entry that is today's one app: the Coolify app named `<slug>`. */
 export declare const APP_ENTRY_KEY = "app";
 /**
- * One app the org runs. `database` and `accessEmails` are meaningless
- * without `HostingConfig.enabled`, so `validateHosting` requires it before
- * either is set.
+ * One app the org runs. `database` and `gates` are meaningless without
+ * `HostingConfig.enabled`, so `validateHosting` requires it before either is
+ * set.
  */
 export interface HostingEntry {
     /** A DNS label, unique per org. It goes into step ids and scope keys, so it never holds `:` or `.`. */
@@ -317,10 +314,10 @@ export interface HostingEntry {
     /** Deploy on every push to `branch`. Default: `true`. */
     autoDeploy: boolean;
     /**
-     * Emails Cloudflare Access lets through to the app's hostname (#84). Empty
-     * means no Access gate. Only the entry keyed {@link APP_ENTRY_KEY} may set it.
+     * Cloudflare Access gates on this entry's own `hostnames`. Empty means no
+     * gate. Who passes is not declared here.
      */
-    accessEmails: string[];
+    gates: EntryGate[];
     /**
      * The app's own env var names and what they hold (#243). Each bespoke app
      * names the values the plan mints (Files, AI, mail) differently (lokessmie
@@ -341,6 +338,13 @@ export interface HostingEntry {
      */
     worker?: WorkerConfig;
 }
+/** One Cloudflare Access gate over some of an entry's `hostnames`. */
+export interface EntryGate {
+    /** A DNS label, unique in the org. It names the plan step and the edge gate. */
+    key: string;
+    /** Values from the same entry's `hostnames`: `'@'`, a label or `'*'`. The whole domain is `['@', '*']`. */
+    hostnames: string[];
+}
 /**
  * One Cloudflare rate limiting binding on a Worker (#318) -- Cloudflare's own
  * "simple" shape: a fixed number of requests per period, where `period` is

package/dist/org.js

@@ -3,11 +3,9 @@ import { floatingTagBlocked } from './bootstrap/versions.js';
 export const DEFAULT_MAIL_APPS = ['agora', 'webmail'];
 /** {@link MailConfig.noReplyLocalPart}'s own default, restated wherever it is read rather than imported (this file's `LOG_DIR`-style convention, named in `plan/executor.ts`'s own doc comments). */
 export const DEFAULT_NO_REPLY_LOCAL_PART = 'no-reply';
-export const ACCESS_RULE_KINDS = new Set([
-    'gate',
-    'bypass',
-    'service-token',
-]);
+export const ACCESS_RULE_KINDS = new Set(['bypass', 'service-token']);
+/** The gates an org may declare when it has no `gateLimit` of its own. */
+export const DEFAULT_GATE_LIMIT = 3;
 /** The key of the entry that is today's one app: the Coolify app named `<slug>`. */
 export const APP_ENTRY_KEY = 'app';
 /** What an entry's ai key may hold: the most the org's own key holds. */
@@ -162,9 +160,12 @@ export function validateHosting(hosting, names) {
     if (hosting.entries.filter((entry) => entry.database).length > 1) {
         return 'at most one hosting entry may set database: the one runtime database role cannot serve two apps';
     }
+    const invalidGates = validateGates(hosting, names?.domain, names?.locked);
+    if (invalidGates)
+        return invalidGates;
     const seenAccessHostnames = new Set();
     for (const rule of hosting.access ?? []) {
-        const invalidRule = validateAccessRule(rule, hosting.enabled);
+        const invalidRule = validateAccessRule(rule, hosting, names);
         if (invalidRule)
             return invalidRule;
         if (seenAccessHostnames.has(rule.hostname)) {
@@ -176,30 +177,85 @@ export function validateHosting(hosting, names) {
 }
 /** A full DNS hostname, at least two labels -- distinct from an entry's single-label `key`. */
 const ACCESS_RULE_HOSTNAME = /^[a-z0-9]([a-z0-9-]{0,61}[a-z0-9])?(\.[a-z0-9]([a-z0-9-]{0,61}[a-z0-9])?)+$/;
-/** The rules for one {@link AccessRule}; `null` when it is valid. */
-function validateAccessRule(rule, enabled) {
+/**
+ * The rules for one {@link AccessRule}; `null` when it is valid. The hostname
+ * must be a name the org serves under its own domain and never a locked one;
+ * without `names` only the checks that need no domain run.
+ */
+function validateAccessRule(rule, hosting, names) {
     const at = `hosting.access '${rule.hostname}'`;
     if (!rule.hostname || !ACCESS_RULE_HOSTNAME.test(rule.hostname)) {
         return `hosting.access entries need a full hostname ('${rule.hostname}' is not one)`;
     }
-    if (!enabled) {
+    if (!hosting.enabled) {
         return `${at} requires hosting.enabled`;
     }
     if (!ACCESS_RULE_KINDS.has(rule.kind)) {
         return `${at} has an unknown kind '${rule.kind}'`;
     }
-    if (rule.kind === 'gate') {
-        if (rule.emails.length === 0) {
-            return `${at} kind 'gate' needs at least one email`;
+    if (rule.kind === 'service-token' && !rule.serviceTokenName) {
+        return `${at} kind 'service-token' needs a non-empty serviceTokenName`;
+    }
+    if (names) {
+        if (names.locked.has(rule.hostname)) {
+            return `${at} is a name foundry owns`;
         }
-        for (const email of rule.emails) {
-            if (!EMAIL.test(email)) {
-                return `${at} has an invalid email '${email}'`;
+        const { domain } = names;
+        const served = hosting.usesDomain &&
+            domain !== null &&
+            hosting.entries.some((entry) => entry.hostnames.some((name) => name === '*'
+                ? rule.hostname.endsWith(`.${domain}`)
+                : rule.hostname === (name === '@' ? domain : `${name}.${domain}`)));
+        if (!served) {
+            return `${at} is not a name the org serves under its own domain`;
+        }
+    }
+    return null;
+}
+/**
+ * The rules for every entry's `gates` and for `gateLimit`: the limit is a
+ * positive whole number; gates need `enabled`, `usesDomain` and (when the
+ * caller knows it) a domain; each key is a DNS label unique in the org; each
+ * gate names at least one of its own entry's hostnames, none in two gates;
+ * and the org holds at most `gateLimit` of them.
+ */
+function validateGates(hosting, domain, locked) {
+    if (!Number.isInteger(hosting.gateLimit) || hosting.gateLimit < 1) {
+        return 'hosting.gateLimit must be a positive whole number';
+    }
+    const seenKeys = new Set();
+    for (const entry of hosting.entries) {
+        const taken = new Set();
+        for (const gate of entry.gates) {
+            const at = `hosting.entries '${entry.key}' gate '${gate.key}'`;
+            if (!hosting.enabled || !hosting.usesDomain || domain === null) {
+                return `${at} needs hosting.enabled, hosting.usesDomain and an org domain`;
+            }
+            if (!ENTRY_KEY.test(gate.key)) {
+                return `${at} key must be a DNS label (lowercase letters, digits and hyphens, 1-63 characters)`;
+            }
+            if (seenKeys.has(gate.key))
+                return `${at} key is used by two gates`;
+            seenKeys.add(gate.key);
+            if (gate.hostnames.length === 0)
+                return `${at} needs at least one hostname`;
+            for (const name of gate.hostnames) {
+                if (!entry.hostnames.includes(name)) {
+                    return `${at} hostname '${name}' is not one of the entry's hostnames`;
+                }
+                if (taken.has(name))
+                    return `${at} hostname '${name}' is held by two gates or listed twice`;
+                taken.add(name);
+                if (domain && name !== '*') {
+                    const full = name === '@' ? domain : `${name}.${domain}`;
+                    if (locked?.has(full))
+                        return `${at} hostname '${name}' is a name foundry owns: ${full}`;
+                }
             }
         }
     }
-    if (rule.kind === 'service-token' && !rule.serviceTokenName) {
-        return `${at} kind 'service-token' needs a non-empty serviceTokenName`;
+    if (seenKeys.size > hosting.gateLimit) {
+        return `hosting declares ${seenKeys.size} gates, over its limit of ${hosting.gateLimit}`;
     }
     return null;
 }
@@ -247,7 +303,6 @@ function validateEntryHostnames(hosting, names) {
     return null;
 }
 const ENTRY_KEY = /^[a-z0-9]([a-z0-9-]{0,61}[a-z0-9])?$/;
-const EMAIL = /^[^@\s]+@[^@\s]+$/;
 const REPO = /^wtfalch\/[A-Za-z0-9._-]+$/;
 // The env names `pushAppEnv` and `pushDatabaseUrl` set themselves.
 const FOUNDRY_ENV_NAME = /^(APP_URL|LOG_DIR|OWNER_USER_ID|AUTH_.*|DATABASE_URL.*)$/;
@@ -284,17 +339,6 @@ function validateHostingEntry(entry, enabled) {
     if (entry.database && !enabled) {
         return `${at} database requires hosting.enabled`;
     }
-    if (entry.accessEmails.length > 0 && !enabled) {
-        return `${at} accessEmails requires hosting.enabled`;
-    }
-    if (entry.accessEmails.length > 0 && entry.key !== APP_ENTRY_KEY) {
-        return `${at} accessEmails is only available on the '${APP_ENTRY_KEY}' entry for now`;
-    }
-    for (const email of entry.accessEmails) {
-        if (!EMAIL.test(email)) {
-            return `${at} accessEmails has an invalid email '${email}'`;
-        }
-    }
     for (const [name, value] of Object.entries(entry.env)) {
         if (!name) {
             return `${at} env needs a non-empty env var name`;

package/dist/plan/diff.js

@@ -7,7 +7,9 @@ import { chatInternalNames } from './chat-matrix.js';
 import { planEntryAiKeys } from './entry-ai-key.js';
 import { planEdgeReservedLabels, planEntryEdgeKeys } from './entry-edge-key.js';
 import { planFilesKeys } from './entry-files-key.js';
+import { hasWildcardGate, planGates } from './gates.js';
 import { appHostname, entryHostnames, tunnelDnsHostnames, tunnelDomainList } from './hostnames.js';
+import { lockedHostnames } from './locked-hostnames.js';
 import { LOGIN_BINDING_SCOPE_KEY, companyLoginTunnelHost, loginBindingState, loginHostClientIds, loginHostnameFor, pendingRemovalHosts, } from './login-host.js';
 import { MAIL_COPY_COMPLETED_SCOPE_KEY, MAIL_COPY_DONE_SCOPE_KEY, parseMailCopyCompleted, } from './mail-copy.js';
 import { CALLS_MAS_APPLIED_IMAGE_TAG_SCOPE_KEY, CALLS_SYNAPSE_APPLIED_IMAGE_TAG_SCOPE_KEY, ORG_MAIL_APPLIED_APEX_SCOPE_KEY, ORG_MAIL_APPLIED_HOST_SCOPE_KEY, ORG_MAIL_APPLIED_MODE_SCOPE_KEY, ORG_MAIL_APPLIED_USES_DOMAIN_SCOPE_KEY, appEnvAppliedScopeKey, appFolderDiffers, appSettingsOf, appStepKey, appliedAppDomains, appliedAppSettings, dbEnvAppliedScopeKey, resolveAppEnv, serviceDbEnvAppliedScopeKey, versionNotAppliedLine, } from './platform-diff.js';
@@ -286,7 +288,15 @@ export function computePlanDetail(org, live, recordedIds = {}, agoraHost = NO_AG
     // An Access gate that cannot be planned must not leave the hostname it
     // guards routed: the tunnel (and its DNS) that exposes it waits too.
     let accessGateBlocked = false;
-    for (const step of planAccess(org, recordedIds)) {
+    const access = planAccess(org, recordedIds, platformReadiness.accessProviderId ?? null, options.platformHostnames ?? []);
+    if (access.blocked) {
+        accessGateBlocked = true;
+        dnsBlocked.push({
+            description: `${org.slug}'s Access gate is blocked, not planned: ${access.blocked}`,
+            key: 'cloudflare:gate',
+        });
+    }
+    for (const step of access.steps) {
         const reason = edgeNeeded(platformReadiness, ['access']);
         if (reason) {
             accessGateBlocked = true;
@@ -503,6 +513,14 @@ export function computePlanDetail(org, live, recordedIds = {}, agoraHost = NO_AG
         unmanaged.push({ description: zone.blocked, key: 'cloudflare:zone' });
     unmanaged.push(...zoneBlocked);
     unmanaged.push(...dnsBlocked);
+    // A legacy email-list Access app is no longer planned or removed: an operator deletes it by hand.
+    const legacyAccessKey = resourceKey('cloudflare', 'access', appStepKey(org, APP_ENTRY_KEY));
+    if (recordedIds[legacyAccessKey]) {
+        unmanaged.push({
+            description: `${org.slug}'s old Cloudflare Access app (${recordedIds[legacyAccessKey]}, recorded as ${legacyAccessKey}) is no longer managed; remove it in Cloudflare by hand, then remove the recorded key`,
+            key: 'cloudflare:access',
+        });
+    }
     // #243: an appEnv source nothing will record is reported, not silently skipped.
     unmanaged.push(...app.blocked);
     unmanaged.push(...brokerEntries.blocked);
@@ -2912,41 +2930,33 @@ function planCustomers(org, live, claimed, recordedIds) {
     };
 }
 /**
- * #84: a Cloudflare Access gate on the org's app hostname, letting only
- * each entry's `accessEmails` through. Idempotent on the recorded Access app id,
- * like `planOwners`: Cloudflare's live listing has no Access apps. A later
- * change to the email list is not reconciled yet.
- *
- * #246: widened to also plan one step per `hosting.access` rule -- a
- * `gate`, `bypass` or `service-token` Access policy on a hostname besides
- * the app's own (`share.<domain>`, `storage.<domain>`, ...), which the
- * `accessEmails` gate above has no way to express: it is email-only, and
- * only for the `app` entry. With no rules declared this plans exactly what
- * it planned before #246 -- no regression for an org that never set
- * `hosting.access`.
+ * #246: one step per `hosting.access` rule -- a `bypass` or `service-token`
+ * Access policy on a hostname the org serves (`share.<domain>`,
+ * `storage.<domain>`, ...). Idempotent on the recorded Access app id, like
+ * `planOwners`: Cloudflare's live listing has no Access apps. The declared
+ * gates (`planGates`) come first. Under a `'*'` gate, a bypass on each name
+ * foundry owns comes before them, so no owned name is ever gated.
  */
-function planAccess(org, recordedIds) {
+function planAccess(org, recordedIds, providerId, platformHostnames) {
+    const { steps: gates, blocked } = planGates(org, recordedIds, providerId);
     if (!org.hosting.enabled)
-        return [];
-    // Only the `app` entry has a public name, and so only it can sit behind
-    // Access; per-entry hostnames are issue 309.
-    const appGate = org.hosting.entries
-        .filter((entry) => entry.key === APP_ENTRY_KEY && entry.accessEmails.length > 0)
-        .filter((entry) => !recordedIds[resourceKey('cloudflare', 'access', appStepKey(org, entry.key))])
-        .map((entry) => ({
+        return { steps: gates, blocked };
+    const owned = (hasWildcardGate(org) ? [...lockedHostnames(org, platformHostnames)].sort() : [])
+        .filter((hostname) => !recordedIds[resourceKey('cloudflare', 'access', appStepKey(org, hostname))])
+        .map((hostname) => ({
         action: {
             system: 'cloudflare',
             kind: 'access',
-            key: appStepKey(org, entry.key),
-            desired: {},
+            key: appStepKey(org, hostname),
+            desired: { ownedBypass: hostname },
         },
         step: {
-            description: `put ${org.slug}'s ${entry.key === APP_ENTRY_KEY ? 'app' : `${entry.key} app`} behind Cloudflare Access`,
+            description: `let ${hostname} (${org.slug}) bypass Cloudflare Access: foundry owns the name and the '*' gate would cover it`,
             destroys: false,
             migrates: false,
         },
     }));
-    const ruleSteps = (org.hosting.access ?? [])
+    const rules = (org.hosting.access ?? [])
         .filter((rule) => !recordedIds[resourceKey('cloudflare', 'access', appStepKey(org, rule.hostname))])
         .map((rule) => ({
         action: {
@@ -2961,13 +2971,11 @@ function planAccess(org, recordedIds) {
             migrates: false,
         },
     }));
-    return [...appGate, ...ruleSteps];
+    return { steps: [...owned, ...gates, ...rules], blocked };
 }
 /** The plan description for one `hosting.access` rule, by kind (#246). */
 function accessRuleDescription(org, rule) {
     switch (rule.kind) {
-        case 'gate':
-            return `gate ${org.slug}'s ${rule.hostname} behind Cloudflare Access`;
         case 'bypass':
             return `let ${rule.hostname} (${org.slug}) bypass Cloudflare Access`;
         case 'service-token':

package/dist/plan/edge-access.d.ts

@@ -1,4 +1,4 @@
-import type { AccessDecision, createEdgeClient } from '@wtfalch/edge';
+import type { AccessDecision, EnsureAccessProviderRequest, createEdgeClient } from '@wtfalch/edge';
 import { type WriteSlot } from './edge-dns.js';
 /** The edge SDK's platform Access client: `createEdgeClient({ ... }).platform.access`. */
 export type EdgePlatformAccess = ReturnType<typeof createEdgeClient>['platform']['access'];
@@ -29,6 +29,7 @@ export interface AccessPort {
     listAccessPolicies(appId: string): Promise<Array<{
         id: string;
         name: string;
+        decision?: AccessDecision;
         include?: AccessPolicyRule[];
     }>>;
     createAccessPolicy(appId: string, policy: {
@@ -46,8 +47,54 @@ export interface AccessPort {
     findServiceTokenByName(name: string): Promise<{
         id: string;
     } | undefined>;
+    /**
+     * Mints a service token through edge (edge 0.12.0). `clientId` and
+     * `clientSecret` come back once and are never returned again; a token of that
+     * name, made by edge or not, answers `EdgeApiError` `conflict`.
+     */
+    createServiceToken(name: string): Promise<{
+        id: string;
+        name: string;
+        clientId: string;
+        clientSecret: string;
+    }>;
+    /** Removes a token edge created. `not_found` for any other; a token already gone is success. */
+    removeServiceToken(id: string): Promise<void>;
     deleteAccessApp(appId: string): Promise<void>;
+    /**
+     * A company's gate: an Access application over `hostnames`, one policy
+     * that requires the provider and the claim, and a first list of `emails`.
+     * A repeat with the same settings returns the stored gate. Foundry never
+     * changes the list of people after this call.
+     */
+    createGate(gate: AccessGateInput): Promise<{
+        id: string;
+    }>;
+    replaceGateHostnames(gateId: string, hostnames: string[]): Promise<void>;
+    /** Deletes the gate with its application, policy and list; a gate already gone is done. */
+    deleteGate(gateId: string): Promise<void>;
+    /** The Cloudflare Access team address (`<team>.cloudflareaccess.com`); rejects with `not_configured` while the Cloudflare token lacks an Access right. */
+    readiness(): Promise<{
+        authDomain: string;
+    }>;
+    /** Makes the OIDC sign-in provider, or updates the one of that name. Safe to repeat. The secret is sent to Cloudflare and never returned. */
+    ensureProvider(input: EnsureAccessProviderRequest): Promise<{
+        id: string;
+    }>;
+}
+export interface AccessGateInput {
+    organisationId: string;
+    /** The gate's key in the company. */
+    key: string;
+    /** The key of the app entry that declared the gate. */
+    entry: string;
+    hostnames: string[];
+    providerId: string;
+    claimName: string;
+    claimValue: string;
+    emails: string[];
 }
+export declare const isNotFound: (error: unknown) => boolean;
 /**
  * Edge answers a policy, delete or create call for a live Access app with no
  * edge row `not_found` or 409 `exists` ("create or adopt it first"). So the

package/dist/plan/edge-access.js

@@ -1,6 +1,6 @@
 import { EdgeApiError } from '@wtfalch/edge';
 import { EDGE_DNS_WRITE_CONCURRENCY, limiter, rateLimitRetrier, } from './edge-dns.js';
-const isNotFound = (error) => error instanceof EdgeApiError && error.code === 'not_found';
+export const isNotFound = (error) => error instanceof EdgeApiError && error.code === 'not_found';
 /** Edge's 409 for a live app on the domain with no edge row. */
 const isExists = (error) => error instanceof EdgeApiError && error.code === 'conflict' && error.reason === 'exists';
 /**
@@ -26,7 +26,14 @@ export function createEdgeAccess(client, options = {}) {
         listPolicies: (appId) => retrying(() => client.listPolicies(appId)),
         createPolicy: (appId, input) => retrying(() => client.createPolicy(appId, input)),
         findServiceToken: (name) => retrying(() => client.findServiceToken(name)),
+        createServiceToken: (input) => retrying(() => client.createServiceToken(input)),
+        removeServiceToken: (id) => retrying(() => client.removeServiceToken(id)),
         adopt: (input) => retrying(() => client.adopt(input)),
+        readiness: () => retrying(() => client.readiness()),
+        ensureProvider: (input) => retrying(() => client.ensureProvider(input)),
+        createGate: (input) => retrying(() => client.createGate(input)),
+        replaceGateHostnames: (id, input) => retrying(() => client.replaceGateHostnames(id, input)),
+        deleteGate: (id) => retrying(() => client.deleteGate(id)),
     };
     const writeSlot = options.writeSlot ?? limiter(EDGE_DNS_WRITE_CONCURRENCY);
     /** app id -> a seen live app with no edge row yet. */
@@ -98,7 +105,12 @@ export function createEdgeAccess(client, options = {}) {
         },
         async listAccessPolicies(appId) {
             const { policies } = await onApp(appId, () => access.listPolicies(appId));
-            return policies.map((p) => ({ id: p.id, name: p.name, include: p.include }));
+            return policies.map((p) => ({
+                id: p.id,
+                name: p.name,
+                decision: p.decision,
+                include: p.include,
+            }));
         },
         async createAccessPolicy(appId, policy) {
             const created = await onApp(appId, () => writeSlot(() => access.createPolicy(appId, policy)));
@@ -116,8 +128,45 @@ export function createEdgeAccess(client, options = {}) {
                 throw error;
             }
         },
+        async createServiceToken(name) {
+            // Not retried on anything but `rate_limited`: a second mint would be a second token.
+            const minted = await writeSlot(() => access.createServiceToken({ name }));
+            return {
+                id: minted.token.id,
+                name: minted.token.name,
+                clientId: minted.clientId,
+                clientSecret: minted.clientSecret,
+            };
+        },
+        async removeServiceToken(id) {
+            await writeSlot(() => access.removeServiceToken(id));
+        },
         async deleteAccessApp(appId) {
             await onApp(appId, () => writeSlot(() => access.remove(appId)));
         },
+        async createGate(gate) {
+            const created = await writeSlot(() => access.createGate(gate));
+            return { id: created.id };
+        },
+        async replaceGateHostnames(gateId, hostnames) {
+            await writeSlot(() => access.replaceGateHostnames(gateId, { hostnames }));
+        },
+        async readiness() {
+            const { authDomain } = await access.readiness();
+            return { authDomain };
+        },
+        async ensureProvider(input) {
+            const { id } = await writeSlot(() => access.ensureProvider(input));
+            return { id };
+        },
+        async deleteGate(gateId) {
+            try {
+                await writeSlot(() => access.deleteGate(gateId));
+            }
+            catch (error) {
+                if (!isNotFound(error))
+                    throw error;
+            }
+        },
     };
 }

package/dist/plan/edge-workers.d.ts

@@ -5,6 +5,21 @@ import type { WorkersPort } from './executor.js';
 export type EdgePlatformWorkers = ReturnType<typeof createEdgeClient>['platform']['workers'];
 /** Edge answers a first upload of a name that another upload is making, or a delete in flight, `conflict` + `busy`. */
 export declare const EDGE_WORKERS_BUSY_ATTEMPTS = 5;
+/**
+ * What the platform's uptime Worker step needs beyond {@link WorkersPort}
+ * (edge 0.11.0): cron triggers and write-only secrets, both for a script edge
+ * owns. A secret with a `version` edge already holds is skipped; a new
+ * `version` sets the value again. Edge never returns a value, and nothing here
+ * keeps one.
+ */
+export interface PlatformWorkersPort extends WorkersPort {
+    setSchedules(name: string, crons: readonly string[]): Promise<void>;
+    setSecrets(name: string, secrets: readonly {
+        name: string;
+        value: string;
+        version: string;
+    }[]): Promise<void>;
+}
 /** What the host supplies: fetches the artifact and returns its bytes, verified against `sha256`. Foundry never fetches. */
 export interface EdgeWorkersOptions {
     fetchArtifact: (url: string, sha256: string) => Promise<Uint8Array>;
@@ -28,4 +43,4 @@ export interface EdgeWorkersOptions {
  * foundry refuses to overwrite is never adopted. A 404 on a delete means gone.
  * A `rate_limited` or `busy` answer is retried.
  */
-export declare function createEdgeWorkers(client: EdgePlatformWorkers, options: EdgeWorkersOptions): WorkersPort;
+export declare function createEdgeWorkers(client: EdgePlatformWorkers, options: EdgeWorkersOptions): PlatformWorkersPort;

package/dist/plan/edge-workers.js

@@ -149,6 +149,14 @@ export function createEdgeWorkers(client, options) {
             }
             adoptedRoutes.delete(`${zoneId}/${routeId}`);
         },
+        async setSchedules(name, crons) {
+            await adoptScript(name);
+            await writeSlot(() => retrying(() => client.setSchedules(name, { crons: [...crons] })));
+        },
+        async setSecrets(name, secrets) {
+            await adoptScript(name);
+            await writeSlot(() => retrying(() => client.setSecrets(name, { secrets: secrets.map((s) => ({ ...s })) })));
+        },
         async deleteScript(name) {
             if (!(await adoptScript(name)))
                 return;