@wtfalch/foundry 0.23.0 → 0.25.0

package/dist/plan/platform-diff.d.ts

@@ -694,6 +694,18 @@ export declare const PLATFORM_EDGE_CLOUDFLARE_TOKEN_REF = "cloudflare:edge:apiTo
  * reports it and never mints again. Neither key holds the secret itself.
  */
 export declare const PLATFORM_EDGE_PLATFORM_KEY_UNDELIVERED_SCOPE_KEY = "edge_platform_key_undelivered";
+/**
+ * #604: the ZITADEL client Cloudflare Access signs people in through. Its
+ * secret exists once, at creation, and goes to edge's `ensureProvider`. The
+ * client's app id is recorded here and persisted before the secret leaves;
+ * the guard, `ACCESS_PROVIDER_RECORD_KEY` (`gates.ts`), is recorded only
+ * after edge returned the provider's id. An undelivered id with no guard
+ * means the secret is lost: the planner reports it and never mints again.
+ */
+export declare const PLATFORM_ACCESS_PROVIDER_UNDELIVERED_SCOPE_KEY = "access_provider_client_undelivered";
+/** The sign-in hostname and the Access team address the provider was applied with. */
+export declare const PLATFORM_ACCESS_PROVIDER_APPLIED_HOSTNAME_SCOPE_KEY = "access_provider_applied_hostname";
+export declare const PLATFORM_ACCESS_PROVIDER_APPLIED_AUTH_DOMAIN_SCOPE_KEY = "access_provider_applied_auth_domain";
 export declare const PLATFORM_EDGE_PLATFORM_KEY_SET_SCOPE_KEY = "edge_platform_key_set";
 /**
  * #478: the hostname and `gitRef` the last successful names run applied.
@@ -810,6 +822,79 @@ export declare function heartbeatCheckUrlRef(name: string): string;
  * bootstrapping at all.
  */
 export declare const PLATFORM_HEARTBEATS_APPLIED_SCOPE_KEY = "heartbeats_applied_desired";
+/**
+ * foundry#542: the uptime Worker, Archon's outside prober, deployed from the
+ * built script Archon publishes with each release. The step is
+ * `cloudflare:worker` keyed {@link PLATFORM_UPTIME_KEY}; `runPlatformSteps`
+ * records the script name under `cloudflare:worker:platform:uptime` once it
+ * succeeds, which is what stops `planUptime` planning it again.
+ */
+export declare const PLATFORM_UPTIME_KEY = "platform:uptime";
+/** The Worker script's name at Cloudflare. */
+export declare const PLATFORM_UPTIME_SCRIPT_NAME = "platform-uptime";
+/** The Workers KV namespace title behind the Worker's `UPTIME_KV` binding. */
+export declare const PLATFORM_UPTIME_KV_TITLE = "platform-uptime";
+/**
+ * foundry#542: the held-key refs of the Worker's secrets. `UPTIME_TOKEN` is
+ * minted by the step (the token Archon's `UPTIME_TOKEN` env var also takes);
+ * the Access pair is minted through edge by the step, and the other two are held by a person. A missing one is reported as
+ * a blocked item, never a throw.
+ */
+export declare const PLATFORM_UPTIME_TOKEN_REF = "uptime:worker:token";
+export declare const PLATFORM_UPTIME_ACCESS_CLIENT_ID_REF = "uptime:worker:access-client-id";
+export declare const PLATFORM_UPTIME_ACCESS_CLIENT_SECRET_REF = "uptime:worker:access-client-secret";
+export declare const PLATFORM_UPTIME_CHAT_TOKEN_REF = "uptime:worker:chat-token";
+export declare const PLATFORM_UPTIME_MAIL_KEY_REF = "uptime:worker:mail-key";
+/**
+ * Worker secret name to the held-key ref it is read from, for the secrets a
+ * person holds. `UPTIME_TOKEN` and the two `CF_ACCESS_CLIENT_*` secrets are
+ * minted by the step and always set, so they are not listed.
+ */
+export declare const PLATFORM_UPTIME_OPTIONAL_SECRETS: Readonly<Record<string, string>>;
+/**
+ * foundry#542: scope keys (colon-free), the {@link PLATFORM_EDGE_PLATFORM_KEY_UNDELIVERED_SCOPE_KEY}
+ * pattern once. The undelivered id is recorded and persisted the moment the
+ * token is generated; the guard is recorded as soon as the value is durably
+ * held, before anything is sent to the Worker or Archon. Setting the value on
+ * the Worker and on Archon is repeated from the held value on every apply
+ * that needs it. Neither key holds the token; the id is the Worker secret's
+ * version label.
+ */
+export declare const PLATFORM_UPTIME_TOKEN_UNDELIVERED_SCOPE_KEY = "uptime_token_undelivered";
+export declare const PLATFORM_UPTIME_TOKEN_ID_SCOPE_KEY = "uptime_token_id";
+/** The token id Archon's env was last written with; `planArchon` plans again when it differs from {@link PLATFORM_UPTIME_TOKEN_ID_SCOPE_KEY}. */
+export declare const PLATFORM_ARCHON_UPTIME_TOKEN_SYNCED_SCOPE_KEY = "archon_uptime_token_synced";
+/** The tag, sha256 and Archon hostname the last successful run applied; a change plans the step again and mints nothing. */
+export declare const PLATFORM_UPTIME_APPLIED_TAG_SCOPE_KEY = "uptime_applied_tag";
+export declare const PLATFORM_UPTIME_APPLIED_SHA256_SCOPE_KEY = "uptime_applied_sha256";
+export declare const PLATFORM_UPTIME_APPLIED_HOSTNAME_SCOPE_KEY = "uptime_applied_hostname";
+/** The secret names (names only) the last run set, sorted and comma-joined: a newly held secret plans the step again. */
+export declare const PLATFORM_UPTIME_APPLIED_SECRETS_SCOPE_KEY = "uptime_applied_secrets";
+/** A digest of the plain text variables the last run uploaded (they are not secrets): a changed one plans the step again. */
+export declare const PLATFORM_UPTIME_APPLIED_VARS_SCOPE_KEY = "uptime_applied_vars";
+/** `'1'` once the step removed the Worker because the platform no longer enables it; cleared when it deploys again. */
+export declare const PLATFORM_UPTIME_REMOVED_SCOPE_KEY = "uptime_removed";
+/** The digest of the Worker's plain text variables that are set; empty when none is. */
+export declare function uptimeVarsDigest(vars?: Readonly<Record<string, string | undefined>>): string;
+/** The Worker secret names the step sets: the three it mints, and each held one. */
+export declare function uptimeSecretNames(held: readonly string[]): string;
+/** The Access service token's name at Cloudflare; edge answers `conflict` when a token of this name exists. */
+export declare const PLATFORM_UPTIME_ACCESS_TOKEN_NAME = "platform-uptime";
+/**
+ * The Access service token pair, minted through edge once: the same
+ * undelivered-then-guard pattern as the Worker token above. The undelivered
+ * id is recorded and persisted the moment edge returns the pair; the guard is
+ * recorded once both values are held. A pair that may be lost (the undelivered
+ * id without its guard, or the guard with nothing held) is repaired by the
+ * next apply: it removes that token through edge and mints again. Both are
+ * ids, never a value. Archon's step reads the guard to allow the token.
+ */
+export declare const PLATFORM_UPTIME_ACCESS_UNDELIVERED_SCOPE_KEY = "uptime_access_undelivered";
+export declare const PLATFORM_UPTIME_ACCESS_TOKEN_ID_SCOPE_KEY = "uptime_access_token_id";
+/** Why the pair cannot be minted: a token of the name exists and foundry has no id recorded for it. */
+export declare function uptimeAccessTokenConflict(): string;
+/** Whether anything of the uptime Worker is recorded that disabling it must remove. */
+export declare function uptimeRecorded(recordedIds: Readonly<Record<string, string>>): boolean;
 /**
  * Options for {@link planPlatform}, replacing four positional arguments that
  * shifted on every merge that added a platform service (#186, #187, #188) --
@@ -850,6 +935,8 @@ export interface PlanPlatformOptions {
         mail?: string;
         /** #478: why the edge host is blocked, or absent when it is not. */
         edge?: string;
+        /** #604: why the Access sign-in provider cannot be made yet (no dependencies, or edge cannot confirm Access is ready), or absent. */
+        accessProvider?: string;
         /**
          * #257: true once a service's database exists but the host built the
          * platform executor with no backup dependencies -- every such service's
@@ -884,6 +971,21 @@ export interface PlanPlatformOptions {
          * Not a block.
          */
         archonRunsInsideApp?: boolean;
+        /** foundry#542: why the uptime Worker is blocked, or absent when it is not. */
+        uptime?: string;
+        /** foundry#542: the optional Worker secret names (`CF_ACCESS_CLIENT_ID`, ...) that are held now; names only. */
+        uptimeSecretsHeld?: string[];
+        /**
+         * foundry#542: what the host reads back for the uptime Worker: whether the
+         * Worker token and the Access pair are held, and the digest of its plain
+         * text variables ({@link uptimeVarsDigest}). Nothing held plans the step
+         * again; it repairs that, it is not a block.
+         */
+        uptimeHeld?: {
+            token: boolean;
+            access: boolean;
+            vars: string;
+        };
         /** Why Archon's step must wait: the deployment it triggered is still running. Blocks even an applied step. */
         archonDeployRunning?: string;
     };

package/dist/plan/platform-diff.js

@@ -1,6 +1,8 @@
+import { createHash } from 'node:crypto';
 import { VERSIONS } from '../bootstrap/versions.js';
 import { APP_ENTRY_KEY } from '../org.js';
 import { VERSION_CHANGE_KIND, } from '../plan.js';
+import { ACCESS_PROVIDER_RECORD_KEY } from './gates.js';
 import { legacyAppHostname } from './hostnames.js';
 import { withStepSystem } from './step-system.js';
 /**
@@ -771,6 +773,18 @@ export const PLATFORM_EDGE_CLOUDFLARE_TOKEN_REF = 'cloudflare:edge:apiToken';
  * reports it and never mints again. Neither key holds the secret itself.
  */
 export const PLATFORM_EDGE_PLATFORM_KEY_UNDELIVERED_SCOPE_KEY = 'edge_platform_key_undelivered';
+/**
+ * #604: the ZITADEL client Cloudflare Access signs people in through. Its
+ * secret exists once, at creation, and goes to edge's `ensureProvider`. The
+ * client's app id is recorded here and persisted before the secret leaves;
+ * the guard, `ACCESS_PROVIDER_RECORD_KEY` (`gates.ts`), is recorded only
+ * after edge returned the provider's id. An undelivered id with no guard
+ * means the secret is lost: the planner reports it and never mints again.
+ */
+export const PLATFORM_ACCESS_PROVIDER_UNDELIVERED_SCOPE_KEY = 'access_provider_client_undelivered';
+/** The sign-in hostname and the Access team address the provider was applied with. */
+export const PLATFORM_ACCESS_PROVIDER_APPLIED_HOSTNAME_SCOPE_KEY = 'access_provider_applied_hostname';
+export const PLATFORM_ACCESS_PROVIDER_APPLIED_AUTH_DOMAIN_SCOPE_KEY = 'access_provider_applied_auth_domain';
 export const PLATFORM_EDGE_PLATFORM_KEY_SET_SCOPE_KEY = 'edge_platform_key_set';
 /**
  * #478: the hostname and `gitRef` the last successful names run applied.
@@ -907,6 +921,100 @@ export function heartbeatCheckUrlRef(name) {
  * bootstrapping at all.
  */
 export const PLATFORM_HEARTBEATS_APPLIED_SCOPE_KEY = 'heartbeats_applied_desired';
+/**
+ * foundry#542: the uptime Worker, Archon's outside prober, deployed from the
+ * built script Archon publishes with each release. The step is
+ * `cloudflare:worker` keyed {@link PLATFORM_UPTIME_KEY}; `runPlatformSteps`
+ * records the script name under `cloudflare:worker:platform:uptime` once it
+ * succeeds, which is what stops `planUptime` planning it again.
+ */
+export const PLATFORM_UPTIME_KEY = 'platform:uptime';
+/** The Worker script's name at Cloudflare. */
+export const PLATFORM_UPTIME_SCRIPT_NAME = 'platform-uptime';
+/** The Workers KV namespace title behind the Worker's `UPTIME_KV` binding. */
+export const PLATFORM_UPTIME_KV_TITLE = 'platform-uptime';
+/**
+ * foundry#542: the held-key refs of the Worker's secrets. `UPTIME_TOKEN` is
+ * minted by the step (the token Archon's `UPTIME_TOKEN` env var also takes);
+ * the Access pair is minted through edge by the step, and the other two are held by a person. A missing one is reported as
+ * a blocked item, never a throw.
+ */
+export const PLATFORM_UPTIME_TOKEN_REF = 'uptime:worker:token';
+export const PLATFORM_UPTIME_ACCESS_CLIENT_ID_REF = 'uptime:worker:access-client-id';
+export const PLATFORM_UPTIME_ACCESS_CLIENT_SECRET_REF = 'uptime:worker:access-client-secret';
+export const PLATFORM_UPTIME_CHAT_TOKEN_REF = 'uptime:worker:chat-token';
+export const PLATFORM_UPTIME_MAIL_KEY_REF = 'uptime:worker:mail-key';
+/**
+ * Worker secret name to the held-key ref it is read from, for the secrets a
+ * person holds. `UPTIME_TOKEN` and the two `CF_ACCESS_CLIENT_*` secrets are
+ * minted by the step and always set, so they are not listed.
+ */
+export const PLATFORM_UPTIME_OPTIONAL_SECRETS = {
+    CHAT_ACCESS_TOKEN: PLATFORM_UPTIME_CHAT_TOKEN_REF,
+    MAIL_API_KEY: PLATFORM_UPTIME_MAIL_KEY_REF,
+};
+/**
+ * foundry#542: scope keys (colon-free), the {@link PLATFORM_EDGE_PLATFORM_KEY_UNDELIVERED_SCOPE_KEY}
+ * pattern once. The undelivered id is recorded and persisted the moment the
+ * token is generated; the guard is recorded as soon as the value is durably
+ * held, before anything is sent to the Worker or Archon. Setting the value on
+ * the Worker and on Archon is repeated from the held value on every apply
+ * that needs it. Neither key holds the token; the id is the Worker secret's
+ * version label.
+ */
+export const PLATFORM_UPTIME_TOKEN_UNDELIVERED_SCOPE_KEY = 'uptime_token_undelivered';
+export const PLATFORM_UPTIME_TOKEN_ID_SCOPE_KEY = 'uptime_token_id';
+/** The token id Archon's env was last written with; `planArchon` plans again when it differs from {@link PLATFORM_UPTIME_TOKEN_ID_SCOPE_KEY}. */
+export const PLATFORM_ARCHON_UPTIME_TOKEN_SYNCED_SCOPE_KEY = 'archon_uptime_token_synced';
+/** The tag, sha256 and Archon hostname the last successful run applied; a change plans the step again and mints nothing. */
+export const PLATFORM_UPTIME_APPLIED_TAG_SCOPE_KEY = 'uptime_applied_tag';
+export const PLATFORM_UPTIME_APPLIED_SHA256_SCOPE_KEY = 'uptime_applied_sha256';
+export const PLATFORM_UPTIME_APPLIED_HOSTNAME_SCOPE_KEY = 'uptime_applied_hostname';
+/** The secret names (names only) the last run set, sorted and comma-joined: a newly held secret plans the step again. */
+export const PLATFORM_UPTIME_APPLIED_SECRETS_SCOPE_KEY = 'uptime_applied_secrets';
+/** A digest of the plain text variables the last run uploaded (they are not secrets): a changed one plans the step again. */
+export const PLATFORM_UPTIME_APPLIED_VARS_SCOPE_KEY = 'uptime_applied_vars';
+/** `'1'` once the step removed the Worker because the platform no longer enables it; cleared when it deploys again. */
+export const PLATFORM_UPTIME_REMOVED_SCOPE_KEY = 'uptime_removed';
+/** The digest of the Worker's plain text variables that are set; empty when none is. */
+export function uptimeVarsDigest(vars = {}) {
+    const set = Object.entries(vars)
+        .filter(([, value]) => Boolean(value))
+        .sort(([a], [b]) => a.localeCompare(b));
+    if (set.length === 0)
+        return '';
+    return createHash('sha256').update(JSON.stringify(set)).digest('hex').slice(0, 16);
+}
+/** The Worker secret names the step sets: the three it mints, and each held one. */
+export function uptimeSecretNames(held) {
+    return ['UPTIME_TOKEN', 'CF_ACCESS_CLIENT_ID', 'CF_ACCESS_CLIENT_SECRET', ...held]
+        .sort()
+        .join(',');
+}
+/** The Access service token's name at Cloudflare; edge answers `conflict` when a token of this name exists. */
+export const PLATFORM_UPTIME_ACCESS_TOKEN_NAME = 'platform-uptime';
+/**
+ * The Access service token pair, minted through edge once: the same
+ * undelivered-then-guard pattern as the Worker token above. The undelivered
+ * id is recorded and persisted the moment edge returns the pair; the guard is
+ * recorded once both values are held. A pair that may be lost (the undelivered
+ * id without its guard, or the guard with nothing held) is repaired by the
+ * next apply: it removes that token through edge and mints again. Both are
+ * ids, never a value. Archon's step reads the guard to allow the token.
+ */
+export const PLATFORM_UPTIME_ACCESS_UNDELIVERED_SCOPE_KEY = 'uptime_access_undelivered';
+export const PLATFORM_UPTIME_ACCESS_TOKEN_ID_SCOPE_KEY = 'uptime_access_token_id';
+/** Why the pair cannot be minted: a token of the name exists and foundry has no id recorded for it. */
+export function uptimeAccessTokenConflict() {
+    return `the uptime Worker is blocked, not planned: a Cloudflare Access service token named '${PLATFORM_UPTIME_ACCESS_TOKEN_NAME}' already exists and foundry did not make it; remove that token in Cloudflare Zero Trust (Access, Service Auth), then the next apply mints one through edge`;
+}
+/** Whether anything of the uptime Worker is recorded that disabling it must remove. */
+export function uptimeRecorded(recordedIds) {
+    return ((Boolean(recordedIds[resourceKey('cloudflare', 'worker', PLATFORM_UPTIME_KEY)]) &&
+        !recordedIds[PLATFORM_UPTIME_REMOVED_SCOPE_KEY]) ||
+        Boolean(recordedIds[PLATFORM_UPTIME_ACCESS_TOKEN_ID_SCOPE_KEY]) ||
+        Boolean(recordedIds[PLATFORM_UPTIME_ACCESS_UNDELIVERED_SCOPE_KEY]));
+}
 /**
  * #167: the platform's own diff engine, mirroring `diff.ts`'s
  * `computePlanDetail` for the one shared {@link DeclaredPlatform} record
@@ -999,6 +1107,11 @@ export function planPlatform(platform, live, options = {}) {
     const ai = planAi(platform, recordedIds, blocked.ai);
     if (ai.step)
         plannedSteps.push(ai.step);
+    // #604: after edge and sign-in, whose applied ids it reads; before Archon,
+    // whose redeploy can end the run.
+    const accessProvider = planAccessProvider(platform, recordedIds, blocked.accessProvider);
+    if (accessProvider.step)
+        plannedSteps.push(accessProvider.step);
     // #175: last, on purpose. Archon's sign-in client lives in the sign-in
     // `planAuth` builds, and its env reads what every other service's step
     // records or delivers, so in one apply it runs after all of them.
@@ -1017,6 +1130,11 @@ export function planPlatform(platform, live, options = {}) {
     const heartbeats = planHeartbeats(platform, recordedIds, hcReady, blocked.heartbeatsExecutorMissing ?? false, blocked.heartbeatsApiKeyMissing ?? false);
     if (heartbeats.step)
         plannedSteps.push(heartbeats.step);
+    // foundry#542: after Archon is applied (never merely planned): the Worker
+    // probes Archon, and Archon's env takes the token this step mints.
+    const uptime = planUptime(platform, recordedIds, blocked.uptime, blocked.uptimeSecretsHeld ?? [], Boolean(recordedIds[resourceKey('coolify', 'app', PLATFORM_ARCHON_KEY)]), blocked.uptimeHeld);
+    if (uptime.step)
+        plannedSteps.push(uptime.step);
     if (archon.step && blocked.archonRunsInsideApp)
         plannedSteps.push(archon.step);
     // #251: one line per service whose recorded applied ref no longer matches
@@ -1081,6 +1199,9 @@ export function planPlatform(platform, live, options = {}) {
         unmanaged.push({ description: ai.blocked, key: 'ai' });
     if (edge.blocked)
         unmanaged.push({ description: edge.blocked, key: 'edge' });
+    if (accessProvider.blocked) {
+        unmanaged.push({ description: accessProvider.blocked, key: 'access-provider' });
+    }
     if (hc.blocked)
         unmanaged.push({ description: hc.blocked, key: 'hc' });
     if (archon.blocked)
@@ -1099,6 +1220,8 @@ export function planPlatform(platform, live, options = {}) {
     unmanaged.push(...backups.blocked);
     if (heartbeats.blocked)
         unmanaged.push({ description: heartbeats.blocked, key: 'heartbeats' });
+    for (const description of uptime.blocked)
+        unmanaged.push({ description, key: 'uptime' });
     return { plannedSteps: plannedSteps.map(withStepSystem), unmanaged, versionChanges };
 }
 /**
@@ -2027,6 +2150,63 @@ function planEdge(platform, recordedIds, executorBlocked) {
         blocked: null,
     };
 }
+/**
+ * #604: the platform's ZITADEL as a sign-in provider in Cloudflare Access: a
+ * ZITADEL client for Cloudflare, then edge's `ensureProvider`. One
+ * `cloudflare:access-provider` step. It needs edge and the platform's sign-in
+ * applied (it reads the Access team address through the one and makes the
+ * client in the other). Done once `ACCESS_PROVIDER_RECORD_KEY` is recorded.
+ *
+ * Blocked, not planned: edge or sign-in not applied, a client minted but never
+ * delivered (its secret cannot be shown again), or `executorBlocked` (no
+ * dependencies, or edge cannot confirm Access is ready).
+ */
+function planAccessProvider(platform, recordedIds, executorBlocked) {
+    if (!platform.edge.enabled || !platform.auth.enabled)
+        return { step: null, blocked: null };
+    if (recordedIds[ACCESS_PROVIDER_RECORD_KEY]) {
+        // The secret is not stored, so a changed address cannot be re-sent: a person remakes the client.
+        const appliedHostname = recordedIds[PLATFORM_ACCESS_PROVIDER_APPLIED_HOSTNAME_SCOPE_KEY];
+        if (appliedHostname && appliedHostname !== platform.auth.hostname) {
+            return {
+                step: null,
+                blocked: `the Access sign-in provider is blocked, not planned: it was applied with the sign-in hostname ${appliedHostname} and ${platform.auth.hostname} is declared now; its secret is not stored, so delete the ZITADEL client cloudflare-access, remove the recorded keys ${ACCESS_PROVIDER_RECORD_KEY}, ${PLATFORM_ACCESS_PROVIDER_APPLIED_HOSTNAME_SCOPE_KEY} and ${PLATFORM_ACCESS_PROVIDER_APPLIED_AUTH_DOMAIN_SCOPE_KEY}, then apply again`,
+            };
+        }
+        return { step: null, blocked: null };
+    }
+    const undelivered = recordedIds[PLATFORM_ACCESS_PROVIDER_UNDELIVERED_SCOPE_KEY];
+    if (undelivered) {
+        return {
+            step: null,
+            blocked: `the Access sign-in provider is blocked, not planned: its ZITADEL client (${undelivered}) was made and its secret may or may not have reached edge; it cannot be shown again, so delete that client in ZITADEL and remove the recorded keys ${PLATFORM_ACCESS_PROVIDER_UNDELIVERED_SCOPE_KEY} and ${ACCESS_PROVIDER_RECORD_KEY}, then apply again to make both anew`,
+        };
+    }
+    const applied = Boolean(recordedIds[PLATFORM_EDGE_INTERNAL_URL_SCOPE_KEY]) &&
+        Boolean(recordedIds[resourceKey('coolify', 'app', PLATFORM_AUTH_KEY)]) &&
+        // The sibling ZITADEL steps need the delivered admin key (or the instance it came from).
+        (Boolean(recordedIds[PLATFORM_AUTH_ADMIN_USER_SCOPE_KEY]) ||
+            Boolean(recordedIds[PLATFORM_AUTH_INSTANCE_SCOPE_KEY]));
+    if (!applied) {
+        return {
+            step: null,
+            blocked: 'the Access sign-in provider is blocked, not planned: edge and the platform sign-in are not both applied yet',
+        };
+    }
+    if (executorBlocked)
+        return { step: null, blocked: executorBlocked };
+    return {
+        step: {
+            action: { system: 'cloudflare', kind: 'access-provider', key: 'platform', desired: {} },
+            step: {
+                description: "make the platform's ZITADEL the sign-in provider in Cloudflare Access, for company gates",
+                destroys: false,
+                migrates: false,
+            },
+        },
+        blocked: null,
+    };
+}
 /**
  * #540: a self-hosted heartbeat server (Healthchecks) for the platform, for
  * now -- a Coolify Postgres plus one Docker-image app
@@ -2157,6 +2337,106 @@ function planHeartbeats(platform, recordedIds, hcReady, executorMissing, apiKeyM
         blocked: null,
     };
 }
+/**
+ * foundry#542: the uptime Worker, one `cloudflare:worker` step. Blocked, not
+ * planned (rule 2), while no artifact is pinned, Archon is not applied, the
+ * executor lacks its dependencies, a Worker or Access token of the name exists
+ * that foundry did not make. A lost Worker token or Access pair is not a
+ * block: the step is planned and repairs it (rule 4). Planned again when the
+ * pinned tag or sha256, the Archon hostname (`ARCHON_BASE_URL`), the plain
+ * text variables or the set of secrets that can be set changed (rule 3), or
+ * when a half-made deploy never recorded its applied values; it mints nothing
+ * that is already held. When the platform no longer enables the Worker, a
+ * destructive step removes whatever of it is recorded (edge removes its KV
+ * namespace with the script).
+ *
+ * The returned `blocked` lines are reported in `unmanaged`; some accompany a
+ * planned step (a secret whose source does not exist yet), because the step
+ * still delivers everything that exists.
+ */
+function planUptime(platform, recordedIds, executorBlocked, heldOptional, archonApplied, uptimeHeld = {
+    token: true,
+    access: true,
+    vars: '',
+}) {
+    const { uptime } = platform;
+    const deployed = Boolean(recordedIds[resourceKey('cloudflare', 'worker', PLATFORM_UPTIME_KEY)]) &&
+        !recordedIds[PLATFORM_UPTIME_REMOVED_SCOPE_KEY];
+    const action = (desired) => ({
+        system: 'cloudflare',
+        kind: 'worker',
+        key: PLATFORM_UPTIME_KEY,
+        desired,
+    });
+    if (!uptime.enabled) {
+        if (!uptimeRecorded(recordedIds))
+            return { step: null, blocked: [] };
+        if (executorBlocked)
+            return { step: null, blocked: [executorBlocked] };
+        return {
+            step: {
+                action: action({ remove: true }),
+                step: {
+                    description: `remove the uptime Worker ${PLATFORM_UPTIME_SCRIPT_NAME} and, with it, its KV namespace, its Access service token and its held token`,
+                    destroys: true,
+                    migrates: false,
+                },
+            },
+            blocked: [],
+        };
+    }
+    if (!uptime.tag || !uptime.sha256) {
+        return {
+            step: null,
+            blocked: [
+                'the uptime Worker is blocked, not planned: no artifact is pinned; declare uptime.tag (an Archon release tag) and uptime.sha256 (the digest of archon-uptime-worker.js at that tag)',
+            ],
+        };
+    }
+    if (!archonApplied) {
+        return {
+            step: null,
+            blocked: [
+                'the uptime Worker is blocked, not planned: platform:archon has not been applied yet',
+            ],
+        };
+    }
+    if (executorBlocked)
+        return { step: null, blocked: [executorBlocked] };
+    const missing = [];
+    if (!heldOptional.includes('CHAT_ACCESS_TOKEN')) {
+        missing.push(`the uptime Worker has no chat credential (CHAT_ACCESS_TOKEN): hold one under ${PLATFORM_UPTIME_CHAT_TOKEN_REF} and it is set on the next apply; until then it sends no chat alerts`);
+    }
+    if (!heldOptional.includes('MAIL_API_KEY')) {
+        missing.push(`the uptime Worker has no mail API key (MAIL_API_KEY): hold one under ${PLATFORM_UPTIME_MAIL_KEY_REF} and it is set on the next apply; until then it sends no alert email`);
+    }
+    const hostname = platform.archon.hostname;
+    // Applied only once a run got to its end and recorded these: a Worker that
+    // was uploaded and then failed has its key but none of the applied values.
+    const applied = deployed &&
+        Boolean(recordedIds[PLATFORM_UPTIME_TOKEN_ID_SCOPE_KEY]) &&
+        uptimeHeld.token &&
+        Boolean(recordedIds[PLATFORM_UPTIME_ACCESS_TOKEN_ID_SCOPE_KEY]) &&
+        uptimeHeld.access &&
+        recordedIds[PLATFORM_UPTIME_APPLIED_TAG_SCOPE_KEY] === uptime.tag &&
+        recordedIds[PLATFORM_UPTIME_APPLIED_SHA256_SCOPE_KEY] === uptime.sha256 &&
+        recordedIds[PLATFORM_UPTIME_APPLIED_HOSTNAME_SCOPE_KEY] === hostname &&
+        (recordedIds[PLATFORM_UPTIME_APPLIED_VARS_SCOPE_KEY] ?? '') === uptimeHeld.vars &&
+        recordedIds[PLATFORM_UPTIME_APPLIED_SECRETS_SCOPE_KEY] === uptimeSecretNames(heldOptional);
+    if (applied)
+        return { step: null, blocked: missing };
+    return {
+        step: {
+            action: action({ hostname, gitRef: uptime.tag, sha256: uptime.sha256 }),
+            step: {
+                description: `deploy the uptime Worker ${PLATFORM_UPTIME_SCRIPT_NAME} from Archon release ${uptime.tag}, probing https://${hostname}, with its KV namespace, secrets and cron trigger`,
+                destroys: false,
+                migrates: false,
+            },
+        },
+        blocked: missing,
+    };
+}
 /**
  * #172: the platform's AI host (https://github.com/wtfalch/ai) -- a Coolify
  * Postgres plus three apps built from that repo's root Dockerfile, one per
@@ -2304,6 +2584,14 @@ function planArchon(platform, recordedIds, executorBlocked, authReady, drifted,
         // other drift reason.
         recordedIds[PLATFORM_ARCHON_APPLIED_ROLLING_UPDATE_SCOPE_KEY] === '1' &&
         !recordedIds[PLATFORM_ARCHON_GATE_CLOSED_SCOPE_KEY] &&
+        // foundry#542: the uptime token minted after Archon's last apply is not
+        // in Archon's env yet.
+        // A disabled Worker leaves the token in Archon's env until the step drops it.
+        (platform.uptime.enabled
+            ? !recordedIds[PLATFORM_UPTIME_TOKEN_ID_SCOPE_KEY] ||
+                recordedIds[PLATFORM_UPTIME_TOKEN_ID_SCOPE_KEY] ===
+                    recordedIds[PLATFORM_ARCHON_UPTIME_TOKEN_SYNCED_SCOPE_KEY]
+            : !recordedIds[PLATFORM_ARCHON_UPTIME_TOKEN_SYNCED_SCOPE_KEY]) &&
         // #398: a rotated integrations key id Archon's env was not yet written
         // with (see PLATFORM_ARCHON_INTEGRATIONS_KEY_SYNCED_SCOPE_KEY). Absent
         // before the first rotation on a platform applied before #398.

package/dist/plan/platform-org.d.ts

@@ -87,6 +87,8 @@ export interface OrgPlatformReadiness {
     callsReady: boolean;
     /** The platform's own sign-in (#168), which every org's own ZITADEL org lives inside. */
     authReady: boolean;
+    /** The Access provider id the platform recorded (`ACCESS_PROVIDER_RECORD_KEY`), which every gate requires. `null` or absent until the platform has recorded it. */
+    accessProviderId?: string | null;
     /** The jobs scheduler (#173) is enabled, applied, has recorded its internal address, and its admin token is held. */
     jobsReady: boolean;
     /**

package/dist/plan/platform-org.js

@@ -1,3 +1,4 @@
+import { ACCESS_PROVIDER_RECORD_KEY } from './gates.js';
 import { JOBS_INTERNAL_URL_SCOPE_KEY, JOBS_SCHEDULER_KEY, PLATFORM_AI_INTERNAL_URL_SCOPE_KEY, PLATFORM_AI_KEY, PLATFORM_AUTH_KEY, PLATFORM_EDGE_KEY, PLATFORM_FILES_INTERNAL_URL_SCOPE_KEY, PLATFORM_FILES_KEY, PLATFORM_MAIL_INTERNAL_URL_SCOPE_KEY, PLATFORM_MAIL_KEY, PLATFORM_MAIL_ZITADEL_PROJECT_SCOPE_KEY, platformMailMxHost, } from './platform-diff.js';
 import { FILES_MANAGEMENT_KEY_REF, JOBS_ADMIN_TOKEN_REF, PLATFORM_AI_MANAGEMENT_KEY_REF, } from './platform-providers.js';
 /**
@@ -129,6 +130,9 @@ edgePortPresent = false) {
         aiReady: aiApplied && missingKeys.ai === null,
         aiUrl: aiApplied ? (platformRecordedIds[PLATFORM_AI_INTERNAL_URL_SCOPE_KEY] ?? null) : null,
         callsReady: platform.sfu.enabled,
+        ...(platformRecordedIds[ACCESS_PROVIDER_RECORD_KEY]
+            ? { accessProviderId: platformRecordedIds[ACCESS_PROVIDER_RECORD_KEY] }
+            : {}),
         authReady: platform.auth.enabled && coolifyAppApplied(platformRecordedIds, PLATFORM_AUTH_KEY),
         jobsReady: jobsApplied && jobsUrl !== undefined && missingKeys.jobs === null,
         ...(jobsApplied && jobsUrl === undefined ? { jobsUrlMissing: true } : {}),

package/dist/plan/platform-providers.d.ts

@@ -12,6 +12,7 @@ import type { LiveResource, PlatformCloudflareReader, PlatformCoolifyReader } fr
 import type { PlatformStepExecutionContext, PlatformStepExecutor } from './plan-apply.js';
 import { type BrokerDeployRecord } from './platform-diff.js';
 import { type CallsSfuPlatformDeps } from './platform-sfu.js';
+import { type PlatformUptimeDeps } from './uptime-worker.js';
 /**
  * #168: everything {@link provisionPlatformAuth} needs beyond
  * {@link PlatformStepExecutionContext} -- a bundle, not more constructor
@@ -197,6 +198,18 @@ export interface FoundryPlatformStepExecutorOptions {
      * heartbeat checks reported as blocked rather than planned.
      */
     heartbeats?: PlatformHeartbeatsDeps;
+    /**
+     * foundry#542: dependencies for the uptime Worker step
+     * (`cloudflare:worker` keyed {@link PLATFORM_UPTIME_KEY}) -- optional for
+     * the same reason as `auth`; without it the step is reported blocked.
+     */
+    uptime?: PlatformUptimeDeps;
+    /**
+     * #604: dependencies for the `cloudflare:access-provider` step -- optional
+     * for the same reason as `auth`; edge and sign-in applied with this unset
+     * gets the step reported as blocked.
+     */
+    accessProvider?: PlatformAccessProviderDeps;
 }
 /**
  * The real {@link PlatformStepExecutor} for the two steps built so far:
@@ -279,6 +292,8 @@ export declare class FoundryPlatformStepExecutor implements PlatformStepExecutor
     private readonly backup?;
     private readonly hc?;
     private readonly heartbeats?;
+    private readonly uptime?;
+    private readonly accessProvider?;
     constructor(cloudflare: Pick<CloudflarePort, 'findZoneByApex' | 'createZone'>, declaredOrgStore: Pick<DeclaredOrgStore, 'findOrgIdForZone' | 'list' | 'get'>, options?: FoundryPlatformStepExecutorOptions);
     blockedSteps(platform: DeclaredPlatform, recordedIds?: Readonly<Record<string, string>>): Promise<{
         auth?: string;
@@ -290,13 +305,29 @@ export declare class FoundryPlatformStepExecutor implements PlatformStepExecutor
         edge?: string;
         archon?: string;
         mail?: string;
+        accessProvider?: string;
         backupExecutorMissing?: boolean;
         hc?: string;
         heartbeatsExecutorMissing?: boolean;
         heartbeatsApiKeyMissing?: boolean;
+        uptime?: string;
+        uptimeSecretsHeld?: string[];
+        uptimeHeld?: {
+            token: boolean;
+            access: boolean;
+            vars: string;
+        };
         archonRunsInsideApp?: boolean;
         archonDeployRunning?: string;
     }>;
+    /**
+     * foundry#542: why the uptime Worker cannot run yet, which optional secrets
+     * are held, and whether the minted values are held. A Worker token or Access
+     * pair that is gone is not a block here: the step repairs it. The planner
+     * checks the pin and Archon first, so none of the reads here happens before
+     * they hold.
+     */
+    private uptimeBlocked;
     /**
      * Whether Archon's live Access policy lets through anyone but the declared
      * emails, or (#211 round 4) the broker it last registered with no longer
@@ -959,6 +990,22 @@ export interface PlatformEdgeDeps {
     /** Clock, sleep and fetch for the readiness wait and delivery retries; real ones by default. */
     runtime?: PlatformEdgeRuntime;
 }
+/** The Access calls the provider step makes. */
+export type PlatformAccessProviderPort = Pick<AccessPort, 'readiness' | 'ensureProvider'>;
+/** #604: dependencies for {@link provisionPlatformAccessProvider}. */
+export interface PlatformAccessProviderDeps {
+    /** Edge's Access calls, at its recorded address (see {@link PlatformAccessFactory}). */
+    access: (edgeUrl: string) => PlatformAccessProviderPort | Promise<PlatformAccessProviderPort>;
+    /** Must target the platform's own ZITADEL instance, or `zitadelForInstance` must be set. */
+    zitadel: Pick<ZitadelPort, 'findOrCreateOrg' | 'findOrCreateProject' | 'listApps' | 'deleteApp'> & Required<Pick<ZitadelPort, 'createOidcAppWithSecret'>>;
+    /** {@link PlatformArchonDeps.zitadelForInstance}: the ZITADEL client for the sign-in at `issuerUrl`. */
+    zitadelForInstance?: (issuerUrl: string) => PlatformAccessProviderDeps['zitadel'];
+    /** Sleep and delivery tries for the one call that carries the secret; real ones by default. */
+    runtime?: {
+        sleep?: (ms: number) => Promise<void>;
+        deliverAttempts?: number;
+    };
+}
 export interface PlatformHcRuntime {
     fetch?: typeof fetch;
     sleep?: (ms: number) => Promise<void>;