@wtfalch/foundry 0.23.0 → 0.25.0

package/dist/plan/executor.d.ts

@@ -449,6 +449,19 @@ export interface WorkersRateLimitBinding {
         period: number;
     };
 }
+/** A Workers KV namespace binding (edge 0.11.0): edge reuses the namespace titled `title` or creates it, and deletes one it created with the script. */
+export interface WorkersKvBinding {
+    type: 'kv_namespace';
+    name: string;
+    title: string;
+}
+/** A plain text variable binding (edge 0.11.0). Never for a secret: those go through {@link PlatformWorkersPort.setSecrets}. */
+export interface WorkersPlainTextBinding {
+    type: 'plain_text';
+    name: string;
+    text: string;
+}
+export type WorkersBinding = WorkersRateLimitBinding | WorkersKvBinding | WorkersPlainTextBinding;
 /**
  * The Workers calls `cloudflareWorker` makes (#318, F8), served by edge's
  * `platform.workers` through `createEdgeWorkers` (`edge-workers.ts`): deploys
@@ -484,7 +497,7 @@ export interface WorkersPort {
         artifactUrl: string;
         artifactSha256: string;
         compatibilityDate: string;
-        bindings?: WorkersRateLimitBinding[];
+        bindings?: WorkersBinding[];
     }): Promise<void>;
     /** The script name currently bound to `pattern` in `zoneId`, or `undefined` for no route there. */
     findRoute(zoneId: string, pattern: string): Promise<{
@@ -747,6 +760,23 @@ export interface ZitadelPort {
         clientId: string;
         clientSecret: string;
     }>;
+    /**
+     * #604: a web client that signs in with a client secret (authorization
+     * code, `OIDC_AUTH_METHOD_TYPE_BASIC`), which Cloudflare Access needs.
+     * `createOidcApp` makes a public PKCE client with no secret, and
+     * `@wtfalch/providers` 0.7.5 has no call that makes this one, so the
+     * method is optional until it does; the platform's Access provider step
+     * is blocked without it. Like `createApiApp`, the secret is shown once.
+     */
+    createOidcAppWithSecret?(orgId: string, projectId: string, input: {
+        name: string;
+        redirectUris: string[];
+        postLogoutRedirectUris: string[];
+    }): Promise<{
+        appId: string;
+        clientId: string;
+        clientSecret: string;
+    }>;
     deleteApp(orgId: string, projectId: string, appId: string): Promise<void>;
     /**
      * `zitadelApp`'s kind-change path reads `apps` to find an app a prior,
@@ -1506,7 +1536,7 @@ export declare function callsHostnameFor(org: DeclaredOrg): string;
  * this file's hostname rules.
  */
 export declare function healthUrls(org: DeclaredOrg): string[];
-/** The one Access policy foundry puts on its own Access app (#84). */
+/** The one Access policy foundry puts on a platform Access app (#84). */
 export declare const ACCESS_POLICY_NAME = "foundry: allowed emails";
 /**
  * Whether an application's own Coolify `status` (`` `running:healthy`,
@@ -1562,23 +1592,26 @@ export declare class FoundryStepExecutor implements StepExecutor, StepDestroyer
         resourceId?: string;
     } | undefined>;
     /**
-     * `plan/diff.ts`'s `planAccess` (#84, widened by #246): puts a hostname
-     * behind a Cloudflare Access app. `action.key` tells the `app` entry's own
-     * gate (`accessEmails`, email-only) apart from a `hosting.access` rule on
-     * any other hostname -- `appStepKey` builds both, keyed by the entry's key
-     * or by the rule's hostname respectively, and the two never collide
-     * because an entry key never holds a `.` while a rule's hostname always
-     * does (`org.ts`'s `validateAccessRule`). The app-entry gate keeps the
-     * Access app name `foundry:<orgId>` it has always used, so a re-run
-     * against an org applied before #246 still finds the app it already
-     * created; a rule's own app is named `foundry:<orgId>:<hostname>` instead,
-     * since an org may declare more than one. Either way foundry reuses only
-     * an app with its own name (so a re-run after a crash does not duplicate
-     * it), refuses to adopt a hostname another Access app already holds
-     * (destroy would later delete it), and refuses when its own app carries
-     * any policy but foundry's, since that policy could let others in.
+     * `plan/diff.ts`'s `planAccess` (#246): puts a `hosting.access` rule's
+     * hostname behind a Cloudflare Access app named
+     * `foundry:<orgId>:<hostname>`, since an org may declare more than one.
+     * Foundry reuses only an app with its own name (so a re-run after a crash
+     * does not duplicate it), refuses to adopt a hostname another Access app
+     * already holds (destroy would later delete it), and refuses when its own
+     * app carries any policy but foundry's, since that policy could let others
+     * in.
      */
     private cloudflareAccess;
+    /**
+     * `plan/diff.ts`'s `planGates`: makes, changes or deletes one declared
+     * gate through edge. A create needs the platform's recorded Access provider,
+     * the company's sign-in organisation and an owner with an email, and fails
+     * plainly without edge being called when one is missing. The create seeds
+     * the list of people with the owners' emails; nothing here sets people
+     * again. The gate id is recorded from the return value, the hostnames it
+     * has last been made with as a scope id.
+     */
+    private cloudflareGate;
     /** The Cloudflare Access policy body for one `hosting.access` rule, by kind (#246). */
     private accessPolicyFor;
     /**

package/dist/plan/executor.js

@@ -11,7 +11,7 @@ import { ensureCloudflaredConnector } from './cloudflared-connector.js';
 import { CORE_FILES_COLLECTION_NAME, FILES_CORE_COLLECTION_SCOPE_KEY, ZITADEL_FILES_PROJECT_SCOPE_KEY, } from './core-files.js';
 import { waitForNewDeployment, } from './deploy-health.js';
 import { DEFAULT_AI_LIMIT_MICROS } from './diff.js';
-import { createEdgeAccess, } from './edge-access.js';
+import { createEdgeAccess, isNotFound as isEdgeNotFound, } from './edge-access.js';
 import { EDGE_DNS_WRITE_CONCURRENCY, createEdgeDns, limiter, } from './edge-dns.js';
 import { createEdgeRateLimits, } from './edge-ratelimits.js';
 import { createEdgeTunnels } from './edge-tunnels.js';
@@ -19,6 +19,7 @@ import { createEdgeZones } from './edge-zones.js';
 import { AI_ENTRY_RENEW_WINDOW_DAYS, entryAiAppliedScopeKey, entryAiClampedScopeKey, entryAiExpiresScopeKey, entryAiPendingExpiresScopeKey, entryAiRetiredScopeKey, entryAiUndeliveredScopeKey, entryAiUnrevokedScopeKey, entryAiWebhookPendingScopeKey, entryAiWrittenScopeKey, parseIdList, } from './entry-ai-key.js';
 import { BOULE_EDGE_ENTRY_KEY, EDGE_ENTRY_KEY_DAYS, EDGE_RESERVED_LABELS_APPLIED_SCOPE_KEY, ENTRY_EDGE_KEY_DELIVERY_ATTEMPTS, edgeKeyAppRecordKey, entryEdgeMintedAtScopeKey, entryEdgeRetiredScopeKey, entryEdgeUndeliveredScopeKey, } from './entry-edge-key.js';
 import { FILES_AGORA_KEY_SCOPE_KEY, FILES_AGORA_UNDELIVERED_SCOPE_KEY, FILES_KEY_DAYS, FILES_KEY_RENEW_WINDOW_DAYS, FILES_ORG_OWNER_SCOPE_KEY, FILES_ROOT_EXPIRES_SCOPE_KEY, FILES_ROOT_PREVIOUS_SCOPE_KEY, FILES_ROOT_UNDELIVERED_SCOPE_KEY, FILES_ROOT_UNREVOKED_SCOPE_KEY, entryFilesAppliedScopeKey, entryFilesExpiresScopeKey, entryFilesMinterScopeKey, entryFilesPendingExpiresScopeKey, entryFilesRetiredScopeKey, entryFilesUndeliveredScopeKey, entryFilesUnrevokedScopeKey, entryFilesWrittenScopeKey, filesOwnerUserId, parseIdList as parseFilesIdList, } from './entry-files-key.js';
+import { GATE_CLAIM_NAME, gateHostnamesScopeKey, gateIdRecordKey, isBehindGate } from './gates.js';
 import { healthCheckSettings } from './health-check-settings.js';
 import { appHostname, coolifyTunnelDomains, entryHostnames, tunnelDnsHostnames, tunnelDomainList, tunnelIngressHostnames, } from './hostnames.js';
 import { LOGIN_BINDING_SCOPE_KEY, LOGIN_HOST_PENDING_REMOVAL_SCOPE_KEY, LOGIN_HOST_SHARED_SCOPE_KEY, customersEntryKeys, loginBindingState, loginHostClientIds, pendingRemovalHosts, pendingRemovalState, } from './login-host.js';
@@ -184,18 +185,14 @@ function mailOrgFor(org, usesDomain, mode) {
  * value.
  */
 const COOLIFY_PROXY_ORIGIN = 'http://coolify-proxy:80';
-/** The one Access policy foundry puts on its own Access app (#84). */
+/** The one Access policy foundry puts on a platform Access app (#84). */
 export const ACCESS_POLICY_NAME = 'foundry: allowed emails';
 /**
  * The Access policy name for each `hosting.access` rule kind (#246),
  * `cloudflareAccess`'s way of telling its own policy apart from a foreign
- * one on the same app -- the same role {@link ACCESS_POLICY_NAME} plays for
- * the `app` entry's own email gate, which keeps that exact name so a
- * re-run against an org applied before #246 still recognises its own
- * policy.
+ * one on the same app.
  */
 const ACCESS_RULE_POLICY_NAMES = {
-    gate: ACCESS_POLICY_NAME,
     bypass: 'foundry: bypass',
     'service-token': 'foundry: service token',
 };
@@ -721,13 +718,10 @@ const defaultSleep = (ms) => new Promise((resolve) => setTimeout(resolve, ms));
  * redirect or 403.
  */
 function publicHealthCheck(org, recorded, hostname, path, options = {}) {
-    const app = appEntry(org.hosting);
-    const behindAccess = (org.hosting.access ?? []).some((rule) => rule.hostname === hostname) ||
-        (app !== undefined &&
-            app.accessEmails.length > 0 &&
-            entryHostnames(org, app).includes(hostname));
-    if (behindAccess)
+    if ((org.hosting.access ?? []).some((rule) => rule.hostname === hostname) ||
+        isBehindGate(org, hostname)) {
         return { kind: 'deployment-only' };
+    }
     const routed = (host) => !org.domain ||
         !(host === org.domain || host.endsWith(`.${org.domain}`)) ||
         (recorded[CLOUDFLARE_TUNNEL_DNS_HOSTNAMES_SCOPE_KEY] ?? '').split(',').includes(host);
@@ -798,6 +792,8 @@ export class FoundryStepExecutor {
                 return this.cloudflareZone(action, org, context);
             case 'cloudflare:access':
                 return this.cloudflareAccess(action, org);
+            case 'cloudflare:gate':
+                return this.cloudflareGate(action, org, context);
             case 'cloudflare:ratelimit':
                 return this.cloudflareRateLimit(org);
             case 'cloudflare:worker':
@@ -843,40 +839,27 @@ export class FoundryStepExecutor {
         }
     }
     /**
-     * `plan/diff.ts`'s `planAccess` (#84, widened by #246): puts a hostname
-     * behind a Cloudflare Access app. `action.key` tells the `app` entry's own
-     * gate (`accessEmails`, email-only) apart from a `hosting.access` rule on
-     * any other hostname -- `appStepKey` builds both, keyed by the entry's key
-     * or by the rule's hostname respectively, and the two never collide
-     * because an entry key never holds a `.` while a rule's hostname always
-     * does (`org.ts`'s `validateAccessRule`). The app-entry gate keeps the
-     * Access app name `foundry:<orgId>` it has always used, so a re-run
-     * against an org applied before #246 still finds the app it already
-     * created; a rule's own app is named `foundry:<orgId>:<hostname>` instead,
-     * since an org may declare more than one. Either way foundry reuses only
-     * an app with its own name (so a re-run after a crash does not duplicate
-     * it), refuses to adopt a hostname another Access app already holds
-     * (destroy would later delete it), and refuses when its own app carries
-     * any policy but foundry's, since that policy could let others in.
+     * `plan/diff.ts`'s `planAccess` (#246): puts a `hosting.access` rule's
+     * hostname behind a Cloudflare Access app named
+     * `foundry:<orgId>:<hostname>`, since an org may declare more than one.
+     * Foundry reuses only an app with its own name (so a re-run after a crash
+     * does not duplicate it), refuses to adopt a hostname another Access app
+     * already holds (destroy would later delete it), and refuses when its own
+     * app carries any policy but foundry's, since that policy could let others
+     * in.
      */
     async cloudflareAccess(action, org) {
-        // Only the `app` entry has a public name (`planAccess`); per-entry
-        // hostnames are issue 309.
-        const entry = appEntry(org.hosting);
-        if (!entry)
-            throw new Error(`cloudflare:access for ${org.slug}: no '${APP_ENTRY_KEY}' hosting entry`);
-        if (action.key === appStepKey(org, entry.key)) {
+        const rule = (org.hosting.access ?? []).find((r) => appStepKey(org, r.hostname) === action.key);
+        const owned = action.desired.ownedBypass;
+        if (!rule && owned && appStepKey(org, owned) === action.key) {
+            // A name foundry owns under a '*' gate: the same bypass a declared rule makes.
             return this.cloudflareAccessApp(org, {
-                appName: `foundry:${org.id}`,
-                domain: appHostname(org),
-                policyName: ACCESS_POLICY_NAME,
-                policy: {
-                    decision: 'allow',
-                    include: entry.accessEmails.map((email) => ({ email: { email } })),
-                },
+                appName: `foundry:${org.id}:${owned}`,
+                domain: owned,
+                policyName: ACCESS_RULE_POLICY_NAMES.bypass,
+                policy: await this.accessPolicyFor(org, { kind: 'bypass', hostname: owned }),
             });
         }
-        const rule = (org.hosting.access ?? []).find((r) => appStepKey(org, r.hostname) === action.key);
         if (!rule) {
             throw new Error(`cloudflare:access for ${org.slug}: no hosting.access rule matches step key '${action.key}'`);
         }
@@ -887,14 +870,74 @@ export class FoundryStepExecutor {
             policy: await this.accessPolicyFor(org, rule),
         });
     }
+    /**
+     * `plan/diff.ts`'s `planGates`: makes, changes or deletes one declared
+     * gate through edge. A create needs the platform's recorded Access provider,
+     * the company's sign-in organisation and an owner with an email, and fails
+     * plainly without edge being called when one is missing. The create seeds
+     * the list of people with the owners' emails; nothing here sets people
+     * again. The gate id is recorded from the return value, the hostnames it
+     * has last been made with as a scope id.
+     */
+    async cloudflareGate(action, org, context) {
+        const gateKey = action.key.slice(org.id.length + 1);
+        const at = `cloudflare:gate for ${org.slug} gate '${gateKey}'`;
+        const desired = action.desired;
+        const recorded = context.recordedIds();
+        const gateId = recorded[gateIdRecordKey(org.id, gateKey)];
+        const hostnamesKey = gateHostnamesScopeKey(gateKey);
+        if (desired.mode === 'delete') {
+            if (gateId)
+                await this.accessPort().deleteGate(gateId);
+            if (context.forgetId) {
+                context.forgetId(gateIdRecordKey(org.id, gateKey));
+                context.forgetId(hostnamesKey);
+            }
+            return {};
+        }
+        const hostnames = desired.hostnames ?? [];
+        if (gateId) {
+            try {
+                await this.accessPort().replaceGateHostnames(gateId, hostnames);
+            }
+            catch (error) {
+                if (!isEdgeNotFound(error))
+                    throw error;
+                // The gate is gone at edge: forget it, so the next plan creates it again.
+                context.forgetId?.(gateIdRecordKey(org.id, gateKey));
+                context.forgetId?.(hostnamesKey);
+                return {};
+            }
+            context.recordScopeId(hostnamesKey, JSON.stringify(hostnames));
+            return {};
+        }
+        if (!desired.providerId) {
+            throw new Error(`${at}: the platform's sign-in provider step has not been applied yet, so there is no Access provider to require`);
+        }
+        const claimValue = recorded[ZITADEL_ORG_SCOPE_KEY];
+        if (!claimValue) {
+            throw new Error(`${at}: ${org.slug} has no sign-in organisation recorded yet`);
+        }
+        const emails = org.owners.map((owner) => owner.email);
+        if (emails.length === 0) {
+            throw new Error(`${at}: ${org.slug} declares no owner with an email, and a gate nobody can pass is a mistake`);
+        }
+        const created = await this.accessPort().createGate({
+            organisationId: org.id,
+            key: gateKey,
+            entry: desired.entry,
+            hostnames,
+            providerId: desired.providerId,
+            claimName: GATE_CLAIM_NAME,
+            claimValue,
+            emails,
+        });
+        context.recordScopeId(hostnamesKey, JSON.stringify(hostnames));
+        return { resourceId: created.id };
+    }
     /** The Cloudflare Access policy body for one `hosting.access` rule, by kind (#246). */
     async accessPolicyFor(org, rule) {
         switch (rule.kind) {
-            case 'gate':
-                return {
-                    decision: 'allow',
-                    include: rule.emails.map((email) => ({ email: { email } })),
-                };
             case 'bypass':
                 // A bypass policy still needs an `include` rule to match against;
                 // `everyone` is Cloudflare's own shape for "match every visitor".
@@ -5996,6 +6039,9 @@ export class FoundryStepExecutor {
                 case 'cloudflare:access':
                     await this.accessPort().deleteAccessApp(target.id);
                     return;
+                case 'cloudflare:gate':
+                    await this.accessPort().deleteGate(target.id);
+                    return;
                 case 'ai:key': {
                     // F6a: an entry's key (`<orgId>:<entry>`). REVOKE SEAM (ai#157): a
                     // port with no `revokeKey` leaves it live until it expires.

package/dist/plan/gates.d.ts

@@ -0,0 +1,42 @@
+import type { DeclaredOrg } from '../org.js';
+import type { DraftStep } from './diff.js';
+/**
+ * A company's declared gates (`HostingEntry.gates`) as Cloudflare Access gates
+ * made through edge. Foundry sets who passes once, on create, from the
+ * company's owners; it never writes the list of people again, so a company's
+ * admin app owns it from then on.
+ */
+/**
+ * The platform's recorded id of the Access provider that signs people in
+ * through the platform's ZITADEL. The platform's sign-in provider step writes
+ * it; a gate is never made without it. A flat scope key, no `:`.
+ */
+export declare const ACCESS_PROVIDER_RECORD_KEY = "access_provider_id";
+/** The claim every gate requires: the company's ZITADEL organisation id, on every token ZITADEL issues. */
+export declare const GATE_CLAIM_NAME = "urn:zitadel:iam:user:resourceowner:id";
+/** The gate id edge returned, recorded by `runSteps` from the step's `resourceId`. */
+export declare const gateIdRecordKey: (orgId: string, gateKey: string) => string;
+/** The resolved, sorted hostnames the gate was last made or changed with, as JSON. */
+export declare const gateHostnamesScopeKey: (gateKey: string) => string;
+/** `'@'` is the domain, `'*'` is `*.<domain>`, a label is `<label>.<domain>`. Sorted. */
+export declare function resolveGateHostnames(domain: string, names: readonly string[]): string[];
+/** True when a declared gate resolves to `*.<domain>`. */
+export declare function hasWildcardGate(org: DeclaredOrg): boolean;
+/**
+ * True when a declared gate covers `hostname`, exactly or through a gated
+ * wildcard, unless a `bypass` rule names it exactly: that rule wins. A name
+ * foundry owns is never behind a gate: the plan bypasses it under a wildcard.
+ */
+export declare function isBehindGate(org: DeclaredOrg, hostname: string): boolean;
+/**
+ * One step per declared gate whose recorded id or hostnames differ from what
+ * is declared (a create, or a hostname change), and one destroying step per
+ * recorded gate no longer declared. `providerId` is the platform's recorded
+ * provider. A create needs it, the company's sign-in organisation and an
+ * owner with an email: when one is missing no create is planned and
+ * `blocked` says why (CLAUDE.md rule 2).
+ */
+export declare function planGates(org: DeclaredOrg, recordedIds: Readonly<Record<string, string>>, providerId: string | null): {
+    steps: DraftStep[];
+    blocked: string | null;
+};

package/dist/plan/gates.js

@@ -0,0 +1,126 @@
+import { ZITADEL_ORG_SCOPE_KEY } from './agora.js';
+import { lockedHostnames } from './locked-hostnames.js';
+import { appStepKey } from './platform-diff.js';
+/**
+ * A company's declared gates (`HostingEntry.gates`) as Cloudflare Access gates
+ * made through edge. Foundry sets who passes once, on create, from the
+ * company's owners; it never writes the list of people again, so a company's
+ * admin app owns it from then on.
+ */
+/**
+ * The platform's recorded id of the Access provider that signs people in
+ * through the platform's ZITADEL. The platform's sign-in provider step writes
+ * it; a gate is never made without it. A flat scope key, no `:`.
+ */
+export const ACCESS_PROVIDER_RECORD_KEY = 'access_provider_id';
+/** The claim every gate requires: the company's ZITADEL organisation id, on every token ZITADEL issues. */
+export const GATE_CLAIM_NAME = 'urn:zitadel:iam:user:resourceowner:id';
+/** The gate id edge returned, recorded by `runSteps` from the step's `resourceId`. */
+export const gateIdRecordKey = (orgId, gateKey) => `cloudflare:gate:${orgId}:${gateKey}`;
+/** The resolved, sorted hostnames the gate was last made or changed with, as JSON. */
+export const gateHostnamesScopeKey = (gateKey) => `gate_hostnames_${gateKey}`;
+/** `'@'` is the domain, `'*'` is `*.<domain>`, a label is `<label>.<domain>`. Sorted. */
+export function resolveGateHostnames(domain, names) {
+    return names
+        .map((name) => (name === '@' ? domain : name === '*' ? `*.${domain}` : `${name}.${domain}`))
+        .sort();
+}
+/** Every declared gate's key with its entry's key and resolved hostnames; none without hosting or a domain. */
+function declaredGates(org) {
+    const gates = new Map();
+    if (!org.hosting.enabled || !org.domain)
+        return gates;
+    for (const entry of org.hosting.entries) {
+        for (const gate of entry.gates) {
+            gates.set(gate.key, {
+                entry: entry.key,
+                hostnames: resolveGateHostnames(org.domain, gate.hostnames),
+            });
+        }
+    }
+    return gates;
+}
+/** True when a declared gate resolves to `*.<domain>`. */
+export function hasWildcardGate(org) {
+    return [...declaredGates(org).values()].some(({ hostnames }) => hostnames.some((name) => name.startsWith('*.')));
+}
+/**
+ * True when a declared gate covers `hostname`, exactly or through a gated
+ * wildcard, unless a `bypass` rule names it exactly: that rule wins. A name
+ * foundry owns is never behind a gate: the plan bypasses it under a wildcard.
+ */
+export function isBehindGate(org, hostname) {
+    if (lockedHostnames(org, []).has(hostname))
+        return false;
+    if ((org.hosting.access ?? []).some((r) => r.kind === 'bypass' && r.hostname === hostname)) {
+        return false;
+    }
+    return [...declaredGates(org).values()].some(({ hostnames }) => hostnames.some((name) => name.startsWith('*.') ? hostname.endsWith(name.slice(1)) : name === hostname));
+}
+/**
+ * One step per declared gate whose recorded id or hostnames differ from what
+ * is declared (a create, or a hostname change), and one destroying step per
+ * recorded gate no longer declared. `providerId` is the platform's recorded
+ * provider. A create needs it, the company's sign-in organisation and an
+ * owner with an email: when one is missing no create is planned and
+ * `blocked` says why (CLAUDE.md rule 2).
+ */
+export function planGates(org, recordedIds, providerId) {
+    const steps = [];
+    let blocked = null;
+    const missing = !providerId
+        ? "the platform's sign-in provider step has not been applied yet, so there is no Access provider to require"
+        : !recordedIds[ZITADEL_ORG_SCOPE_KEY]
+            ? `${org.slug} has no sign-in organisation recorded yet`
+            : org.owners.length === 0
+                ? `${org.slug} declares no owner with an email, and a gate nobody can pass is a mistake`
+                : null;
+    const declared = declaredGates(org);
+    const prefix = gateIdRecordKey(org.id, '');
+    for (const [name, id] of Object.entries(recordedIds)) {
+        if (!id || !name.startsWith(prefix))
+            continue;
+        const gateKey = name.slice(prefix.length);
+        if (declared.has(gateKey))
+            continue;
+        steps.push({
+            action: {
+                system: 'cloudflare',
+                kind: 'gate',
+                key: appStepKey(org, gateKey),
+                desired: { mode: 'delete' },
+            },
+            step: {
+                description: `delete ${org.slug}'s '${gateKey}' Cloudflare Access gate: it is no longer declared`,
+                destroys: true,
+                migrates: false,
+            },
+        });
+    }
+    for (const [gateKey, { entry, hostnames }] of declared) {
+        const recorded = recordedIds[gateIdRecordKey(org.id, gateKey)];
+        if (recorded && recordedIds[gateHostnamesScopeKey(gateKey)] === JSON.stringify(hostnames)) {
+            continue;
+        }
+        if (!recorded && missing) {
+            blocked = missing;
+            continue;
+        }
+        steps.push({
+            action: {
+                system: 'cloudflare',
+                kind: 'gate',
+                key: appStepKey(org, gateKey),
+                desired: { mode: 'apply', entry, hostnames, providerId },
+            },
+            step: {
+                description: recorded
+                    ? `change the hostnames of ${org.slug}'s '${gateKey}' Cloudflare Access gate to ${hostnames.join(', ')}`
+                    : `put ${hostnames.join(', ')} (${org.slug}'s '${gateKey}' gate) behind Cloudflare Access`,
+                destroys: false,
+                migrates: false,
+            },
+        });
+    }
+    return { steps, blocked };
+}

package/dist/plan/health-targets.js

@@ -1,7 +1,8 @@
-import { APP_ENTRY_KEY, appEntry } from '../org.js';
+import { appEntry } from '../org.js';
 import { agoraHostnameFor } from './agora.js';
 import { bouleHostnameFor } from './boule.js';
 import { callsHostnameFor, cmsHostnameFor } from './executor.js';
+import { isBehindGate } from './gates.js';
 import { entryHostnames } from './hostnames.js';
 import { loginHostnameFor } from './login-host.js';
 function okExpect() {
@@ -182,9 +183,7 @@ function hostingEntryTarget(org, entry) {
         expect: okExpect(),
         depth: entry.buildPack === 'static' ? 'page' : entry.database ? 'deep' : 'shallow',
         restartSafe: true,
-        // Only the `app` entry may be gated behind Cloudflare Access at all
-        // (`org.ts`'s own `HostingEntry.accessEmails` doc comment).
-        behindAccess: entry.key === APP_ENTRY_KEY && entry.accessEmails.length > 0,
+        behindAccess: isBehindGate(org, hostname),
     };
 }
 /**

package/dist/plan/index.d.ts

@@ -46,7 +46,8 @@ export type { DnsPort, DnsRecordInput, DnsRecordSummary, EdgePlatformDns } from
 export { createEdgeAccess } from './edge-access.js';
 export type { AccessAppSummary, AccessDecision, AccessPolicyRule, AccessPort, EdgePlatformAccess, } from './edge-access.js';
 export { createEdgeWorkers } from './edge-workers.js';
-export type { EdgePlatformWorkers, EdgeWorkersOptions } from './edge-workers.js';
+export type { EdgePlatformWorkers, EdgeWorkersOptions, PlatformWorkersPort, } from './edge-workers.js';
+export type { PlatformUptimeAccessFactory, PlatformUptimeAccessPort, PlatformUptimeDeps, PlatformWorkersFactory, } from './uptime-worker.js';
 export { createEdgeRateLimits } from './edge-ratelimits.js';
 export type { EdgePlatformRateLimits, EdgeRateLimitsOptions, RateLimitPort, RateLimitRuleInput, } from './edge-ratelimits.js';
 export { createEdgeZones } from './edge-zones.js';

package/dist/plan/plan-apply.d.ts

@@ -216,12 +216,18 @@ export interface PlatformStepExecutor {
         ai?: string;
         archon?: string;
         mail?: string;
+        /** #604: see `PlanPlatformOptions.blocked.accessProvider` (`platform-diff.ts`). */
+        accessProvider?: string;
         /** #257: see `PlanPlatformOptions.blocked.backupExecutorMissing` (`platform-diff.ts`). */
         backupExecutorMissing?: boolean;
         /** #540: see `PlanPlatformOptions.blocked.hc` (`platform-diff.ts`). */
         hc?: string;
         /** #540: see `PlanPlatformOptions.blocked.heartbeatsExecutorMissing` (`platform-diff.ts`). */
         heartbeatsExecutorMissing?: boolean;
+        /** foundry#542: see `PlanPlatformOptions.blocked.uptime` (`platform-diff.ts`). */
+        uptime?: string;
+        /** foundry#542: see `PlanPlatformOptions.blocked.uptimeSecretsHeld` (`platform-diff.ts`). */
+        uptimeSecretsHeld?: string[];
         /** See `PlanPlatformOptions.blocked.archonRunsInsideApp`. */
         archonRunsInsideApp?: boolean;
         /** See `PlanPlatformOptions.blocked.archonDeployRunning`. */

package/dist/plan/plan-apply.js

@@ -98,6 +98,7 @@ const HOSTNAME_STEPS = new Set([
     'coolify:database',
     'cloudflare:tunnel',
     'cloudflare:access',
+    'cloudflare:gate',
     'jobs:registration',
     // #318 (F8): the route is itself hostname-shaped, validated against the
     // org's own domain by `validateEntryWorker`.
@@ -1149,6 +1150,7 @@ function destroyTargets(serviceIds, orgId) {
         'zitadel:login-host:',
         'cloudflare:tunnel:',
         'cloudflare:access:',
+        'cloudflare:gate:',
         // #318: an entry's Worker and its route.
         'cloudflare:worker:',
         'coolify:database:',
@@ -1311,7 +1313,8 @@ const STEP_FIELDS = {
     'coolify:database': 'hosting.database',
     'cloudflare:tunnel': 'hosting.tunnel',
     'cloudflare:zone': 'hosting.usesDomain',
-    'cloudflare:access': 'hosting.accessEmails',
+    'cloudflare:access': 'hosting.access',
+    'cloudflare:gate': 'hosting.entries.gates',
     'cloudflare:ratelimit': 'hosting.usesDomain',
     'cloudflare:worker': 'hosting.entries.worker',
 };
@@ -1330,6 +1333,10 @@ function stepField(action) {
     if (action.system === 'zitadel' && action.kind === 'app') {
         return `hosting.issuerApps.${action.key}`;
     }
+    // A bypass on a name foundry owns serves the entry gates, not `hosting.access`.
+    if (action.system === 'cloudflare' && action.kind === 'access' && action.desired.ownedBypass) {
+        return 'hosting.entries.gates';
+    }
     return STEP_FIELDS[`${action.system}:${action.kind}`] ?? `${action.system}.${action.kind}`;
 }
 /**