@wtfalch/foundry 0.23.0 → 0.25.0

package/dist/plan/platform-providers.js

@@ -6,10 +6,12 @@ import { redactSecrets } from '../calls-sfu-deploy-support.js';
 import { ensureCloudflaredConnector } from './cloudflared-connector.js';
 import { waitForDeploymentFinished, waitForHealthyVersion, waitForNewDeployment, } from './deploy-health.js';
 import { ACCESS_POLICY_NAME, getDatabaseStarted, isNotFoundError, isRunningOrStarting, } from './executor.js';
+import { ACCESS_PROVIDER_RECORD_KEY, GATE_CLAIM_NAME } from './gates.js';
 import { healthCheckSettings } from './health-check-settings.js';
 import { coolifyDomains, coolifyTunnelDomains, filesShareHostname } from './hostnames.js';
-import { AUTH_ZITADEL_RUN_OPTIONS, JOBS_DEPLOY_PENDING_SCOPE_KEY, JOBS_INTERNAL_URL_SCOPE_KEY, JOBS_SCHEDULER_KEY, PLATFORM_AI_APPLIED_GITREF_SCOPE_KEY, PLATFORM_AI_APPLIED_HOSTNAME_SCOPE_KEY, PLATFORM_AI_DEPLOY_PENDING_SCOPE_KEY, PLATFORM_AI_INTERNAL_URL_SCOPE_KEY, PLATFORM_AI_KEY, PLATFORM_AI_MANAGEMENT_KEY_CONFLICT_SCOPE_KEY, PLATFORM_AI_MANAGEMENT_KEY_SCOPE_KEY, PLATFORM_AI_MANAGEMENT_KEY_UNDELIVERED_SCOPE_KEY, PLATFORM_AI_MIGRATE_BLOCKED_SCOPE_KEY, PLATFORM_AI_ORGANISATION_SCOPE_KEY, PLATFORM_AI_SIGNING_KEY_SET_SCOPE_KEY, PLATFORM_AI_SIGNING_KEY_UNDELIVERED_SCOPE_KEY, PLATFORM_ARCHON_APPLIED_BROKER_SCOPE_KEY, PLATFORM_ARCHON_APPLIED_GIT_REF_SCOPE_KEY, PLATFORM_ARCHON_APPLIED_HOSTNAME_SCOPE_KEY, PLATFORM_ARCHON_APPLIED_OPERATOR_SCOPE_KEY, PLATFORM_ARCHON_APPLIED_ROLLING_UPDATE_SCOPE_KEY, PLATFORM_ARCHON_CONNECTOR_APP_SCOPE_KEY, PLATFORM_ARCHON_COOLIFY_READ_TOKEN_REF, PLATFORM_ARCHON_DEPLOYMENT_SCOPE_KEY, PLATFORM_ARCHON_ENVS_DEPLOYED_SCOPE_KEY, PLATFORM_ARCHON_GATE_CLOSED_SCOPE_KEY, PLATFORM_ARCHON_INTEGRATIONS_KEY_SYNCED_SCOPE_KEY, PLATFORM_ARCHON_KEY, PLATFORM_ARCHON_MASTER_CLOUDFLARE_TOKEN_REF, PLATFORM_ARCHON_MASTER_COOLIFY_TOKEN_REF, PLATFORM_ARCHON_MASTER_COOLIFY_URL_REF, PLATFORM_AUTH_ADMIN_UNDELIVERED_SCOPE_KEY, PLATFORM_AUTH_ADMIN_USER_SCOPE_KEY, PLATFORM_AUTH_BROKER_DEPLOYED_SCOPE_KEY, PLATFORM_AUTH_BROKER_SCOPE_KEY, PLATFORM_AUTH_CONNECTOR_APP_SCOPE_KEY, PLATFORM_AUTH_INSTANCE_SCOPE_KEY, PLATFORM_AUTH_INSTANCE_UNDELIVERED_SCOPE_KEY, PLATFORM_AUTH_KEY, PLATFORM_AUTH_LOGIN_CLIENT_UNDELIVERED_SCOPE_KEY, PLATFORM_AUTH_LOGIN_CLIENT_USER_SCOPE_KEY, PLATFORM_AUTH_OWNER_INVITE_SCOPE_KEY, PLATFORM_AUTH_SMTP_SCOPE_KEY, PLATFORM_AUTH_ZITADEL_APPLIED_IMAGE_TAG_SCOPE_KEY, PLATFORM_AUTH_ZITADEL_RUN_OPTIONS_SCOPE_KEY, PLATFORM_BACKUP_DATABASE_SCOPE_KEYS, PLATFORM_BACKUP_SERVICE_KEYS, PLATFORM_EDGE_APPLIED_GIT_REF_SCOPE_KEY, PLATFORM_EDGE_APPLIED_HOSTNAME_SCOPE_KEY, PLATFORM_EDGE_CLOUDFLARE_TOKEN_REF, PLATFORM_EDGE_INTERNAL_URL_SCOPE_KEY, PLATFORM_EDGE_KEY, PLATFORM_EDGE_KEY_REF, PLATFORM_EDGE_PLATFORM_KEY_SET_SCOPE_KEY, PLATFORM_EDGE_PLATFORM_KEY_UNDELIVERED_SCOPE_KEY, PLATFORM_FILES_APPLIED_GIT_REF_SCOPE_KEY, PLATFORM_FILES_APPLIED_HOSTNAME_SCOPE_KEY, PLATFORM_FILES_INTERNAL_URL_SCOPE_KEY, PLATFORM_FILES_INTROSPECTION_SCOPE_KEY, PLATFORM_FILES_INTROSPECTION_UNDELIVERED_SCOPE_KEY, PLATFORM_FILES_KEY, PLATFORM_FILES_MANAGEMENT_KEY_SCOPE_KEY, PLATFORM_FILES_MANAGEMENT_UNDELIVERED_SCOPE_KEY, PLATFORM_FILES_ZITADEL_PROJECT_SCOPE_KEY, PLATFORM_HC_API_KEY_REF, PLATFORM_HC_APPLIED_GIT_REF_SCOPE_KEY, PLATFORM_HC_APPLIED_HOSTNAME_SCOPE_KEY, PLATFORM_HC_KEY, PLATFORM_HEARTBEATS_APPLIED_SCOPE_KEY, PLATFORM_INTEGRATIONS_APPLIED_GITREF_SCOPE_KEY, PLATFORM_INTEGRATIONS_APPLIED_HOSTNAME_SCOPE_KEY, PLATFORM_INTEGRATIONS_KEY, PLATFORM_INTEGRATIONS_KEY_ID_SCOPE_KEY, PLATFORM_INTEGRATIONS_KEY_ROTATION_PREVIOUS_SCOPE_KEY, PLATFORM_INTEGRATIONS_KEY_ROTATION_REQUESTED_SCOPE_KEY, PLATFORM_INTEGRATIONS_KEY_ROTATION_UNDELIVERED_SCOPE_KEY, PLATFORM_INTEGRATIONS_KEY_SET_SCOPE_KEY, PLATFORM_INTEGRATIONS_KEY_UNDELIVERED_SCOPE_KEY, PLATFORM_INTEGRATIONS_RUNNER_KEYRING_DEPLOYED_SCOPE_KEY, PLATFORM_MAIL_ADMIN_KEY_SCOPE_KEY, PLATFORM_MAIL_ADMIN_UNDELIVERED_SCOPE_KEY, PLATFORM_MAIL_APPLIED_GIT_REF_SCOPE_KEY, PLATFORM_MAIL_APPLIED_HOSTNAME_SCOPE_KEY, PLATFORM_MAIL_CONNECTOR_APP_SCOPE_KEY, PLATFORM_MAIL_INTERNAL_URL_SCOPE_KEY, PLATFORM_MAIL_KEY, PLATFORM_MAIL_ZITADEL_PROJECT_SCOPE_KEY, PLATFORM_UPTIME_HEARTBEAT_CHECK_NAME, archonBootstrapOperator, desiredHeartbeatCheckNames, heartbeatCheckUrlRef, parseBrokerDeployRecord, parseLoginClientRecord, platformBackupHeartbeatCheckName, platformMailMxHost, } from './platform-diff.js';
+import { AUTH_ZITADEL_RUN_OPTIONS, JOBS_DEPLOY_PENDING_SCOPE_KEY, JOBS_INTERNAL_URL_SCOPE_KEY, JOBS_SCHEDULER_KEY, PLATFORM_ACCESS_PROVIDER_APPLIED_AUTH_DOMAIN_SCOPE_KEY, PLATFORM_ACCESS_PROVIDER_APPLIED_HOSTNAME_SCOPE_KEY, PLATFORM_ACCESS_PROVIDER_UNDELIVERED_SCOPE_KEY, PLATFORM_AI_APPLIED_GITREF_SCOPE_KEY, PLATFORM_AI_APPLIED_HOSTNAME_SCOPE_KEY, PLATFORM_AI_DEPLOY_PENDING_SCOPE_KEY, PLATFORM_AI_INTERNAL_URL_SCOPE_KEY, PLATFORM_AI_KEY, PLATFORM_AI_MANAGEMENT_KEY_CONFLICT_SCOPE_KEY, PLATFORM_AI_MANAGEMENT_KEY_SCOPE_KEY, PLATFORM_AI_MANAGEMENT_KEY_UNDELIVERED_SCOPE_KEY, PLATFORM_AI_MIGRATE_BLOCKED_SCOPE_KEY, PLATFORM_AI_ORGANISATION_SCOPE_KEY, PLATFORM_AI_SIGNING_KEY_SET_SCOPE_KEY, PLATFORM_AI_SIGNING_KEY_UNDELIVERED_SCOPE_KEY, PLATFORM_ARCHON_APPLIED_BROKER_SCOPE_KEY, PLATFORM_ARCHON_APPLIED_GIT_REF_SCOPE_KEY, PLATFORM_ARCHON_APPLIED_HOSTNAME_SCOPE_KEY, PLATFORM_ARCHON_APPLIED_OPERATOR_SCOPE_KEY, PLATFORM_ARCHON_APPLIED_ROLLING_UPDATE_SCOPE_KEY, PLATFORM_ARCHON_CONNECTOR_APP_SCOPE_KEY, PLATFORM_ARCHON_COOLIFY_READ_TOKEN_REF, PLATFORM_ARCHON_DEPLOYMENT_SCOPE_KEY, PLATFORM_ARCHON_ENVS_DEPLOYED_SCOPE_KEY, PLATFORM_ARCHON_GATE_CLOSED_SCOPE_KEY, PLATFORM_ARCHON_INTEGRATIONS_KEY_SYNCED_SCOPE_KEY, PLATFORM_ARCHON_KEY, PLATFORM_ARCHON_MASTER_CLOUDFLARE_TOKEN_REF, PLATFORM_ARCHON_MASTER_COOLIFY_TOKEN_REF, PLATFORM_ARCHON_MASTER_COOLIFY_URL_REF, PLATFORM_ARCHON_UPTIME_TOKEN_SYNCED_SCOPE_KEY, PLATFORM_AUTH_ADMIN_UNDELIVERED_SCOPE_KEY, PLATFORM_AUTH_ADMIN_USER_SCOPE_KEY, PLATFORM_AUTH_BROKER_DEPLOYED_SCOPE_KEY, PLATFORM_AUTH_BROKER_SCOPE_KEY, PLATFORM_AUTH_CONNECTOR_APP_SCOPE_KEY, PLATFORM_AUTH_INSTANCE_SCOPE_KEY, PLATFORM_AUTH_INSTANCE_UNDELIVERED_SCOPE_KEY, PLATFORM_AUTH_KEY, PLATFORM_AUTH_LOGIN_CLIENT_UNDELIVERED_SCOPE_KEY, PLATFORM_AUTH_LOGIN_CLIENT_USER_SCOPE_KEY, PLATFORM_AUTH_OWNER_INVITE_SCOPE_KEY, PLATFORM_AUTH_SMTP_SCOPE_KEY, PLATFORM_AUTH_ZITADEL_APPLIED_IMAGE_TAG_SCOPE_KEY, PLATFORM_AUTH_ZITADEL_RUN_OPTIONS_SCOPE_KEY, PLATFORM_BACKUP_DATABASE_SCOPE_KEYS, PLATFORM_BACKUP_SERVICE_KEYS, PLATFORM_EDGE_APPLIED_GIT_REF_SCOPE_KEY, PLATFORM_EDGE_APPLIED_HOSTNAME_SCOPE_KEY, PLATFORM_EDGE_CLOUDFLARE_TOKEN_REF, PLATFORM_EDGE_INTERNAL_URL_SCOPE_KEY, PLATFORM_EDGE_KEY, PLATFORM_EDGE_KEY_REF, PLATFORM_EDGE_PLATFORM_KEY_SET_SCOPE_KEY, PLATFORM_EDGE_PLATFORM_KEY_UNDELIVERED_SCOPE_KEY, PLATFORM_FILES_APPLIED_GIT_REF_SCOPE_KEY, PLATFORM_FILES_APPLIED_HOSTNAME_SCOPE_KEY, PLATFORM_FILES_INTERNAL_URL_SCOPE_KEY, PLATFORM_FILES_INTROSPECTION_SCOPE_KEY, PLATFORM_FILES_INTROSPECTION_UNDELIVERED_SCOPE_KEY, PLATFORM_FILES_KEY, PLATFORM_FILES_MANAGEMENT_KEY_SCOPE_KEY, PLATFORM_FILES_MANAGEMENT_UNDELIVERED_SCOPE_KEY, PLATFORM_FILES_ZITADEL_PROJECT_SCOPE_KEY, PLATFORM_HC_API_KEY_REF, PLATFORM_HC_APPLIED_GIT_REF_SCOPE_KEY, PLATFORM_HC_APPLIED_HOSTNAME_SCOPE_KEY, PLATFORM_HC_KEY, PLATFORM_HEARTBEATS_APPLIED_SCOPE_KEY, PLATFORM_INTEGRATIONS_APPLIED_GITREF_SCOPE_KEY, PLATFORM_INTEGRATIONS_APPLIED_HOSTNAME_SCOPE_KEY, PLATFORM_INTEGRATIONS_KEY, PLATFORM_INTEGRATIONS_KEY_ID_SCOPE_KEY, PLATFORM_INTEGRATIONS_KEY_ROTATION_PREVIOUS_SCOPE_KEY, PLATFORM_INTEGRATIONS_KEY_ROTATION_REQUESTED_SCOPE_KEY, PLATFORM_INTEGRATIONS_KEY_ROTATION_UNDELIVERED_SCOPE_KEY, PLATFORM_INTEGRATIONS_KEY_SET_SCOPE_KEY, PLATFORM_INTEGRATIONS_KEY_UNDELIVERED_SCOPE_KEY, PLATFORM_INTEGRATIONS_RUNNER_KEYRING_DEPLOYED_SCOPE_KEY, PLATFORM_MAIL_ADMIN_KEY_SCOPE_KEY, PLATFORM_MAIL_ADMIN_UNDELIVERED_SCOPE_KEY, PLATFORM_MAIL_APPLIED_GIT_REF_SCOPE_KEY, PLATFORM_MAIL_APPLIED_HOSTNAME_SCOPE_KEY, PLATFORM_MAIL_CONNECTOR_APP_SCOPE_KEY, PLATFORM_MAIL_INTERNAL_URL_SCOPE_KEY, PLATFORM_MAIL_KEY, PLATFORM_MAIL_ZITADEL_PROJECT_SCOPE_KEY, PLATFORM_UPTIME_ACCESS_CLIENT_ID_REF, PLATFORM_UPTIME_ACCESS_CLIENT_SECRET_REF, PLATFORM_UPTIME_ACCESS_TOKEN_ID_SCOPE_KEY, PLATFORM_UPTIME_ACCESS_TOKEN_NAME, PLATFORM_UPTIME_ACCESS_UNDELIVERED_SCOPE_KEY, PLATFORM_UPTIME_HEARTBEAT_CHECK_NAME, PLATFORM_UPTIME_KEY, PLATFORM_UPTIME_REMOVED_SCOPE_KEY, PLATFORM_UPTIME_SCRIPT_NAME, PLATFORM_UPTIME_TOKEN_ID_SCOPE_KEY, PLATFORM_UPTIME_TOKEN_REF, archonBootstrapOperator, desiredHeartbeatCheckNames, heartbeatCheckUrlRef, parseBrokerDeployRecord, parseLoginClientRecord, platformBackupHeartbeatCheckName, platformMailMxHost, uptimeAccessTokenConflict, uptimeRecorded, uptimeVarsDigest, } from './platform-diff.js';
 import { applyCallsSfuPlatformStep } from './platform-sfu.js';
+import { heldUptimeValues, provisionPlatformUptime, } from './uptime-worker.js';
 import { CreateInstanceError, createZitadelInstance, generateSystemApiKeypair, instanceWithoutBearerMessage, systemApiUsersEnv, } from './zitadel-system-api.js';
 /** The key `runPlatformSteps` records the apex zone's id under (`system:kind:key`). */
 function apexZoneKey(apex) {
@@ -155,6 +157,8 @@ export class FoundryPlatformStepExecutor {
     backup;
     hc;
     heartbeats;
+    uptime;
+    accessProvider;
     constructor(cloudflare, declaredOrgStore, options = {}) {
         this.cloudflare = cloudflare;
         this.declaredOrgStore = declaredOrgStore;
@@ -172,6 +176,8 @@ export class FoundryPlatformStepExecutor {
         this.backup = options.backup;
         this.hc = options.hc;
         this.heartbeats = options.heartbeats;
+        this.uptime = options.uptime;
+        this.accessProvider = options.accessProvider;
     }
     async blockedSteps(platform, recordedIds = {}) {
         const blocked = {};
@@ -323,6 +329,27 @@ export class FoundryPlatformStepExecutor {
             if (!apiKey)
                 blocked.heartbeatsApiKeyMissing = true;
         }
+        await this.uptimeBlocked(platform, recordedIds, blocked);
+        // #604: only once edge and sign-in are applied (the planner reports
+        // that case itself) and no provider is recorded yet.
+        if (platform.edge.enabled &&
+            platform.auth.enabled &&
+            !recordedIds[ACCESS_PROVIDER_RECORD_KEY] &&
+            recordedIds[PLATFORM_EDGE_INTERNAL_URL_SCOPE_KEY]) {
+            if (!this.accessProvider?.zitadel.createOidcAppWithSecret) {
+                blocked.accessProvider =
+                    'the Access sign-in provider is blocked, not planned: the host built the platform executor without its Access provider dependencies (a ZITADEL client that can make a client with a secret)';
+            }
+            else {
+                try {
+                    await (await platformAccess(this.accessProvider, recordedIds, 'platform:access')).readiness();
+                }
+                catch {
+                    blocked.accessProvider =
+                        'the Access sign-in provider is blocked, not planned: edge could not confirm that Cloudflare Access is ready (its Cloudflare token needs every Access right)';
+                }
+            }
+        }
         // Not a block: tells the planner to order Archon's step last (`PlanPlatformOptions.blocked.archonRunsInsideApp`).
         if (this.archon?.runsInsideApp) {
             blocked.archonRunsInsideApp = true;
@@ -337,6 +364,69 @@ export class FoundryPlatformStepExecutor {
         }
         return blocked;
     }
+    /**
+     * foundry#542: why the uptime Worker cannot run yet, which optional secrets
+     * are held, and whether the minted values are held. A Worker token or Access
+     * pair that is gone is not a block here: the step repairs it. The planner
+     * checks the pin and Archon first, so none of the reads here happens before
+     * they hold.
+     */
+    async uptimeBlocked(platform, recordedIds, blocked) {
+        const deployed = Boolean(recordedIds[`cloudflare:worker:${PLATFORM_UPTIME_KEY}`]) &&
+            !recordedIds[PLATFORM_UPTIME_REMOVED_SCOPE_KEY];
+        if (!platform.uptime.enabled && !uptimeRecorded(recordedIds))
+            return;
+        const deps = this.uptime;
+        if (!deps) {
+            blocked.uptime =
+                'the uptime Worker is blocked, not planned: the host built the platform executor without its uptime dependencies';
+            return;
+        }
+        if (!platform.uptime.enabled)
+            return;
+        blocked.uptimeSecretsHeld = Object.keys(await heldUptimeValues(deps));
+        const accessTokenId = recordedIds[PLATFORM_UPTIME_ACCESS_TOKEN_ID_SCOPE_KEY];
+        const accessHeld = Boolean((await deps.heldKeys.resolve(PLATFORM_UPTIME_ACCESS_CLIENT_ID_REF)) &&
+            (await deps.heldKeys.resolve(PLATFORM_UPTIME_ACCESS_CLIENT_SECRET_REF)));
+        blocked.uptimeHeld = {
+            token: Boolean(await deps.heldKeys.resolve(PLATFORM_UPTIME_TOKEN_REF)),
+            access: accessHeld,
+            vars: uptimeVarsDigest(deps.vars),
+        };
+        const edgeUrl = recordedIds[PLATFORM_EDGE_INTERNAL_URL_SCOPE_KEY];
+        // A token of the name with no id recorded cannot be minted over, and
+        // foundry does not remove what it did not make. With an id recorded the
+        // step removes that token through edge and mints again.
+        if (!accessTokenId &&
+            !recordedIds[PLATFORM_UPTIME_ACCESS_UNDELIVERED_SCOPE_KEY] &&
+            edgeUrl &&
+            platform.uptime.tag) {
+            try {
+                const access = await deps.access(edgeUrl);
+                if (await access.findServiceTokenByName(PLATFORM_UPTIME_ACCESS_TOKEN_NAME)) {
+                    blocked.uptime = uptimeAccessTokenConflict();
+                    return;
+                }
+            }
+            catch {
+                blocked.uptime =
+                    'the uptime Worker is blocked, not planned: edge could not be asked whether the Access service token exists';
+                return;
+            }
+        }
+        if (!deployed && edgeUrl && platform.uptime.tag) {
+            try {
+                const workers = await deps.workers(edgeUrl);
+                if (await workers.scriptExists(PLATFORM_UPTIME_SCRIPT_NAME)) {
+                    blocked.uptime = `the uptime Worker is blocked, not planned: a Worker named ${PLATFORM_UPTIME_SCRIPT_NAME} already exists at Cloudflare and foundry did not make it; remove it by hand`;
+                }
+            }
+            catch {
+                blocked.uptime =
+                    'the uptime Worker is blocked, not planned: edge could not be asked whether the Worker exists';
+            }
+        }
+    }
     /**
      * Whether Archon's live Access policy lets through anyone but the declared
      * emails, or (#211 round 4) the broker it last registered with no longer
@@ -349,7 +439,9 @@ export class FoundryPlatformStepExecutor {
         if (platform.archon.enabled &&
             this.archon &&
             recordedIds[`coolify:app:${PLATFORM_ARCHON_KEY}`]) {
-            const accessDrifted = await archonAccessDrifted(this.archon, recordedIds, platform.archon.hostname, this.archon.accessEmails);
+            const accessDrifted = await archonAccessDrifted(this.archon, recordedIds, platform.archon.hostname, this.archon.accessEmails, platform.uptime.enabled
+                ? recordedIds[PLATFORM_UPTIME_ACCESS_TOKEN_ID_SCOPE_KEY]
+                : undefined);
             const brokerDrifted = !accessDrifted && (await archonBrokerRegistrationDrifted(this.archon.coolify, recordedIds));
             const bootstrapOperatorDrifted = !accessDrifted &&
                 !brokerDrifted &&
@@ -490,12 +582,26 @@ export class FoundryPlatformStepExecutor {
             }
             return provisionPlatformHc(context, this.hc);
         }
+        if (action.system === 'cloudflare' && action.kind === 'access-provider') {
+            if (!this.accessProvider) {
+                throw new Error('cloudflare:access-provider needs FoundryPlatformStepExecutor to be constructed with its Access provider dependencies (#604)');
+            }
+            return provisionPlatformAccessProvider(context, this.accessProvider);
+        }
         if (action.system === 'heartbeats' && action.kind === 'reconcile') {
             if (!this.heartbeats) {
                 throw new Error('heartbeats:reconcile needs FoundryPlatformStepExecutor to be constructed with its heartbeats dependencies (#540)');
             }
             return provisionPlatformHeartbeats(context, this.heartbeats);
         }
+        if (action.system === 'cloudflare' &&
+            action.kind === 'worker' &&
+            action.key === PLATFORM_UPTIME_KEY) {
+            if (!this.uptime) {
+                throw new Error('platform:uptime needs FoundryPlatformStepExecutor to be constructed with its uptime dependencies (foundry#542)');
+            }
+            return provisionPlatformUptime(context, this.uptime);
+        }
         if (action.system === 'cloudflare' && action.kind === 'zone') {
             return this.cloudflareZone(action, context);
         }
@@ -2915,6 +3021,15 @@ async function provisionPlatformArchon(context, deps) {
             envs.push({ key: 'COOLIFY_URL', value: coolifyUrl }, { key: 'COOLIFY_READ_TOKEN', value: coolifyReadToken });
         }
     }
+    // foundry#542: the token the uptime Worker sends, once the Worker step has
+    // minted and delivered it. Absent until then; that step's guard makes
+    // `planArchon` plan this one again.
+    const uptimeTokenId = platform.uptime.enabled
+        ? recorded[PLATFORM_UPTIME_TOKEN_ID_SCOPE_KEY]
+        : undefined;
+    const uptimeToken = uptimeTokenId ? await deps.heldKeys.resolve(PLATFORM_UPTIME_TOKEN_REF) : null;
+    if (uptimeToken)
+        envs.push({ key: 'UPTIME_TOKEN', value: uptimeToken });
     const changed = await envsDiffer(deps.coolify, appId, envs);
     // #467: this run's intended env set, hashed before anything below writes
     // it -- compared against {@link PLATFORM_ARCHON_ENVS_DEPLOYED_SCOPE_KEY}
@@ -2943,7 +3058,9 @@ async function provisionPlatformArchon(context, deps) {
     // what either hash names (#467).
     let staleKeyDeleted = false;
     for (const stale of await deps.coolify.listEnvs(appId)) {
-        if (stale.key === 'FILES_MANAGEMENT_KEY' && stale.uuid) {
+        // foundry#542: a disabled Worker's token leaves Archon's env too.
+        const staleUptime = !platform.uptime.enabled && stale.key === 'UPTIME_TOKEN';
+        if ((stale.key === 'FILES_MANAGEMENT_KEY' || staleUptime) && stale.uuid) {
             await deps.coolify.deleteEnv(appId, stale.uuid);
             staleKeyDeleted = true;
         }
@@ -3035,7 +3152,10 @@ async function provisionPlatformArchon(context, deps) {
     const tunnels = await platformTunnels(deps, context.recordedIds(), 'platform:archon');
     const access = await platformAccess(deps, context.recordedIds(), 'platform:archon');
     let gateClosed = Boolean(recorded[PLATFORM_ARCHON_GATE_CLOSED_SCOPE_KEY]);
-    const accessAppId = await ensureArchonAccess(access, hostname, deps.accessEmails, async () => {
+    const uptimeAccessTokenId = platform.uptime.enabled
+        ? recorded[PLATFORM_UPTIME_ACCESS_TOKEN_ID_SCOPE_KEY]
+        : undefined;
+    const accessAppId = await ensureArchonAccess(access, hostname, deps.accessEmails, uptimeAccessTokenId, async () => {
         // The Access app is about to be rebuilt: answer 404 for every hostname
         // meanwhile, so it is never served without the gate. The marker is
         // persisted first: a failure before the real ingress is written back
@@ -3177,6 +3297,18 @@ async function provisionPlatformArchon(context, deps) {
     if (keyUnsynced && integrationsKeyId && (!selfRedeploy || deployState === 'finished')) {
         await record(PLATFORM_ARCHON_INTEGRATIONS_KEY_SYNCED_SCOPE_KEY, integrationsKeyId);
     }
+    // foundry#542: the same confirmation for the uptime token, and for its removal.
+    if (!platform.uptime.enabled &&
+        recorded[PLATFORM_ARCHON_UPTIME_TOKEN_SYNCED_SCOPE_KEY] &&
+        (!selfRedeploy || deployState === 'finished')) {
+        await record(PLATFORM_ARCHON_UPTIME_TOKEN_SYNCED_SCOPE_KEY, '');
+    }
+    if (uptimeToken &&
+        uptimeTokenId &&
+        recorded[PLATFORM_ARCHON_UPTIME_TOKEN_SYNCED_SCOPE_KEY] !== uptimeTokenId &&
+        (!selfRedeploy || deployState === 'finished')) {
+        await record(PLATFORM_ARCHON_UPTIME_TOKEN_SYNCED_SCOPE_KEY, uptimeTokenId);
+    }
     // #475: confirmed only now, after the health check above has passed on a
     // container that was deployed with the alias patch in place -- the same
     // confirm-after-health-check timing as the two records just above.
@@ -3496,14 +3628,18 @@ async function putArchonMasterKeys(heldKeys, masterKeys) {
         await heldKeys.put?.(ref, value);
     }
 }
+/** The policy that lets the uptime Worker's Access service token through Archon's app, beside {@link ACCESS_POLICY_NAME}. */
+const PLATFORM_ARCHON_UPTIME_POLICY_NAME = 'foundry: uptime service token';
 /**
  * `executor.ts`'s `cloudflareAccess`, for the platform's Archon: reuses only
  * an Access app named {@link PLATFORM_ARCHON_ACCESS_APP_NAME}, refuses to
  * adopt any other Access app already holding the hostname, and refuses when
  * its own app carries a policy foundry did not create, since that policy
- * could let others in.
+ * could let others in. foundry#542: with `uptimeTokenId` the app also carries
+ * a `non_identity` policy for the uptime Worker's service token; a missing one
+ * is added in place, one for another token rebuilds the app.
  */
-async function ensureArchonAccess(cf, domain, emails, closeGate) {
+async function ensureArchonAccess(cf, domain, emails, uptimeTokenId, closeGate) {
     const onDomain = (await cf.listAccessApps()).filter((a) => a.domain === domain);
     const foreign = onDomain.find((a) => a.name !== PLATFORM_ARCHON_ACCESS_APP_NAME);
     if (foreign) {
@@ -3516,22 +3652,31 @@ async function ensureArchonAccess(cf, domain, emails, closeGate) {
             type: 'self_hosted',
         });
         await cf.createAccessPolicy(created.id, archonAccessPolicy(emails));
+        if (uptimeTokenId) {
+            await cf.createAccessPolicy(created.id, archonUptimePolicy(uptimeTokenId));
+        }
         return created;
     };
     const existing = onDomain[0];
     if (!existing)
         return (await create()).id;
     const policies = await cf.listAccessPolicies(existing.id);
-    const other = policies.find((p) => p.name !== ACCESS_POLICY_NAME);
+    const other = policies.find((p) => p.name !== ACCESS_POLICY_NAME && p.name !== PLATFORM_ARCHON_UPTIME_POLICY_NAME);
     if (other) {
         throw new Error(`platform:archon: Access app ${existing.id} has policy '${other.name}' that foundry did not create`);
     }
-    if (policies.length === 0) {
-        await cf.createAccessPolicy(existing.id, archonAccessPolicy(emails));
+    const emailPolicies = policies.filter((p) => p.name === ACCESS_POLICY_NAME);
+    const tokenPolicies = policies.filter((p) => p.name === PLATFORM_ARCHON_UPTIME_POLICY_NAME);
+    const staleToken = tokenPolicies.some((p) => !uptimePolicyIntact(p, uptimeTokenId));
+    if (emailPolicies.every((p) => sameEmails(p.include, emails)) && !staleToken) {
+        if (emailPolicies.length === 0) {
+            await cf.createAccessPolicy(existing.id, archonAccessPolicy(emails));
+        }
+        if (uptimeTokenId && tokenPolicies.length === 0) {
+            await cf.createAccessPolicy(existing.id, archonUptimePolicy(uptimeTokenId));
+        }
         return existing.id;
     }
-    if (policies.every((p) => sameEmails(p.include, emails)))
-        return existing.id;
     // No call updates an app's policy: rebuild the app, hostname closed meanwhile.
     await closeGate();
     await cf.deleteAccessApp(existing.id);
@@ -3544,6 +3689,30 @@ function archonAccessPolicy(emails) {
         include: emails.map((email) => ({ email: { email } })),
     };
 }
+function archonUptimePolicy(tokenId) {
+    return {
+        name: PLATFORM_ARCHON_UPTIME_POLICY_NAME,
+        decision: 'non_identity',
+        include: [{ service_token: { token_id: tokenId } }],
+    };
+}
+/**
+ * Whether the uptime policy is what foundry makes: decision `non_identity` and
+ * exactly one include, a service token -- the recorded `tokenId` when there is
+ * one, any token when none is recorded (the Worker is off or not applied yet).
+ */
+function uptimePolicyIntact(policy, tokenId) {
+    if (policy.decision !== 'non_identity')
+        return false;
+    const include = policy.include;
+    if (!Array.isArray(include) || include.length !== 1)
+        return false;
+    const entry = include[0];
+    if (Object.keys(entry ?? {}).length !== 1)
+        return false;
+    const live = entry?.service_token?.token_id;
+    return typeof live === 'string' && live !== '' && (tokenId === undefined || live === tokenId);
+}
 /** Whether an Access policy's include list is exactly `emails` (case-insensitive) and nothing else. */
 function sameEmails(include, emails) {
     if (!Array.isArray(include))
@@ -3563,14 +3732,23 @@ function sameEmails(include, emails) {
  * exactly the declared emails. A failed read is not drift: the next plan reads
  * again.
  */
-async function archonAccessDrifted(deps, recorded, domain, emails) {
+async function archonAccessDrifted(deps, recorded, domain, emails, uptimeTokenId) {
     try {
         const cf = await platformAccess(deps, recorded, 'platform:archon');
         const app = (await cf.listAccessApps()).find((a) => a.domain === domain && a.name === PLATFORM_ARCHON_ACCESS_APP_NAME);
         if (!app)
             return true;
         const policies = await cf.listAccessPolicies(app.id);
-        return !(policies.length > 0 && policies.every((p) => sameEmails(p.include, emails)));
+        const emailPolicies = policies.filter((p) => p.name === ACCESS_POLICY_NAME);
+        const tokenPolicies = policies.filter((p) => p.name === PLATFORM_ARCHON_UPTIME_POLICY_NAME);
+        if (policies.length !== emailPolicies.length + tokenPolicies.length)
+            return true;
+        if (emailPolicies.length === 0 || !emailPolicies.every((p) => sameEmails(p.include, emails))) {
+            return true;
+        }
+        if (!tokenPolicies.every((p) => uptimePolicyIntact(p, uptimeTokenId)))
+            return true;
+        return uptimeTokenId !== undefined && tokenPolicies.length === 0;
     }
     catch {
         return false;
@@ -5668,6 +5846,85 @@ async function provisionPlatformEdge(context, deps) {
     await record(PLATFORM_EDGE_APPLIED_GIT_REF_SCOPE_KEY, gitRef);
     return { resourceId: appId };
 }
+/** The ZITADEL project and client the platform's Access provider signs in through (#604). */
+const PLATFORM_ACCESS_ZITADEL_PROJECT = 'cloudflare-access';
+const PLATFORM_ACCESS_ZITADEL_APP = 'cloudflare-access';
+/** The name edge finds the Cloudflare Access provider by. */
+const PLATFORM_ACCESS_PROVIDER_NAME = 'foundry';
+/**
+ * #604: makes the platform's ZITADEL a sign-in provider in Cloudflare Access.
+ * Reads the Access team address from edge, makes a ZITADEL client whose
+ * redirect is that address's callback, and hands its id and secret to edge's
+ * `ensureProvider`, which is the delivery. The client's secret exists once
+ * (CLAUDE.md rules 1 and 6): its app id is recorded and persisted before the
+ * secret leaves, the guard {@link ACCESS_PROVIDER_RECORD_KEY} only after edge
+ * returned the provider id, and a recorded undelivered id stops a second
+ * mint. The secret reaches only `ensureProvider`: no error, log or record
+ * holds it. A client app by this name with no recorded id is one whose create
+ * response was lost before anything saw its secret, so it is deleted and made
+ * again.
+ */
+async function provisionPlatformAccessProvider(context, deps) {
+    const { platform } = context;
+    const recorded = context.recordedIds();
+    const sleep = deps.runtime?.sleep ?? defaultSleep;
+    const attempts = deps.runtime?.deliverAttempts ?? 3;
+    const label = 'platform:access-provider';
+    if (recorded[ACCESS_PROVIDER_RECORD_KEY])
+        return {};
+    const lost = recorded[PLATFORM_ACCESS_PROVIDER_UNDELIVERED_SCOPE_KEY];
+    if (lost) {
+        throw new Error(`${label}: the ZITADEL client ${lost} was made and its secret may or may not have reached edge; delete it and remove the recorded keys ${PLATFORM_ACCESS_PROVIDER_UNDELIVERED_SCOPE_KEY} and ${ACCESS_PROVIDER_RECORD_KEY}, then apply again to make both anew`);
+    }
+    const access = await platformAccess(deps, recorded, label);
+    let authDomain;
+    try {
+        ({ authDomain } = await access.readiness());
+    }
+    catch {
+        throw new Error(`${label}: edge could not confirm that Cloudflare Access is ready`);
+    }
+    const issuer = `https://${platform.auth.hostname}`;
+    const zitadel = deps.zitadelForInstance?.(issuer) ?? deps.zitadel;
+    const { org } = await zitadel.findOrCreateOrg(PLATFORM_AUTH_ORG_NAME);
+    const { project } = await zitadel.findOrCreateProject(org.id, PLATFORM_ACCESS_ZITADEL_PROJECT);
+    const orphan = (await zitadel.listApps(org.id, project.id)).apps.find((a) => a.name === PLATFORM_ACCESS_ZITADEL_APP && a.state !== 'APP_STATE_REMOVED');
+    if (orphan) {
+        try {
+            await zitadel.deleteApp(org.id, project.id, orphan.id);
+        }
+        catch (error) {
+            if (!isNotFoundError(error))
+                throw error;
+        }
+    }
+    const client = await zitadel.createOidcAppWithSecret(org.id, project.id, {
+        name: PLATFORM_ACCESS_ZITADEL_APP,
+        redirectUris: [`https://${authDomain}/cdn-cgi/access/callback`],
+        postLogoutRedirectUris: [`https://${authDomain}/`],
+    });
+    context.recordScopeId(PLATFORM_ACCESS_PROVIDER_UNDELIVERED_SCOPE_KEY, client.appId);
+    await context.persist?.();
+    let providerId = '';
+    await deliverWithRetry(async (_ref, secret) => {
+        providerId = (await access.ensureProvider({
+            name: PLATFORM_ACCESS_PROVIDER_NAME,
+            clientId: client.clientId,
+            clientSecret: secret,
+            authUrl: `${issuer}/oauth/v2/authorize`,
+            tokenUrl: `${issuer}/oauth/v2/token`,
+            certsUrl: `${issuer}/oauth/v2/keys`,
+            scopes: ['openid', 'email', 'profile', 'urn:zitadel:iam:user:resourceowner'],
+            claims: [GATE_CLAIM_NAME],
+        })).id;
+    }, ACCESS_PROVIDER_RECORD_KEY, client.clientSecret, attempts, sleep, `the ZITADEL client ${client.appId}'s secret`, label);
+    // Last: the guard says the secret reached edge.
+    context.recordScopeId(PLATFORM_ACCESS_PROVIDER_APPLIED_HOSTNAME_SCOPE_KEY, platform.auth.hostname);
+    context.recordScopeId(PLATFORM_ACCESS_PROVIDER_APPLIED_AUTH_DOMAIN_SCOPE_KEY, authDomain);
+    context.recordScopeId(ACCESS_PROVIDER_RECORD_KEY, providerId);
+    await context.persist?.();
+    return {};
+}
 /** `healthchecks/healthchecks` on Docker Hub -- #540's own "third-party, not this estate's own repo" image. */
 const HC_IMAGE = 'healthchecks/healthchecks';
 const PLATFORM_HC_PROJECT = 'platform';
@@ -6022,7 +6279,7 @@ label = 'platform:files') {
         }
         catch {
             if (attempt >= attempts) {
-                throw new Error(`${label}: ${what} could not be delivered after ${attempts} tries; the next plan reports it as lost and mints no new one`);
+                throw new Error(`${label}: ${what} could not be delivered after ${attempts} tries; the next plan reports it as blocked and mints no new one`);
             }
             await sleep(1000 * attempt);
         }

package/dist/plan/uptime-worker.d.ts

@@ -0,0 +1,50 @@
+import type { AccessPort } from './edge-access.js';
+import type { PlatformWorkersPort } from './edge-workers.js';
+import type { PlatformStepExecutionContext } from './plan-apply.js';
+/** The optional plain text variables the Worker reads, supplied by the host (not secrets). */
+export declare const UPTIME_OPTIONAL_VARS: readonly ["CHAT_HOMESERVER_URL", "CHAT_ROOM_ID", "ALERT_EMAIL_FROM", "ALERT_EMAIL_TO"];
+/** Builds the Workers port at edge's recorded address, the {@link import('./platform-providers.js').PlatformDnsFactory} way. */
+export type PlatformWorkersFactory = (edgeUrl: string) => PlatformWorkersPort | Promise<PlatformWorkersPort>;
+/** The Access calls the uptime step makes: it mints, finds and removes its one service token. */
+export type PlatformUptimeAccessPort = Pick<AccessPort, 'createServiceToken' | 'removeServiceToken' | 'findServiceTokenByName'>;
+/** Builds the Access port at edge's recorded address, the {@link PlatformWorkersFactory} way. */
+export type PlatformUptimeAccessFactory = (edgeUrl: string) => PlatformUptimeAccessPort | Promise<PlatformUptimeAccessPort>;
+/**
+ * Dependencies of the uptime Worker step. `deliverSecret` and `heldKeys` are
+ * the host's: the minted token goes only to `deliverSecret`, and every secret
+ * is read back only to be handed to edge, which never returns one.
+ */
+export interface PlatformUptimeDeps {
+    workers: PlatformWorkersFactory;
+    /** The Access service token the Worker passes Archon's gate with, minted through edge. */
+    access: PlatformUptimeAccessFactory;
+    /**
+     * Holds `secret` under `ref`. An empty `secret` clears it, which is how the
+     * step forgets the Access pair when the Worker is removed.
+     */
+    deliverSecret: (ref: string, secret: string) => Promise<void>;
+    heldKeys: {
+        resolve(ref: string): Promise<string | null>;
+    };
+    /** Host config for the Worker's optional plain text variables; an absent one is left unset. */
+    vars?: Partial<Record<(typeof UPTIME_OPTIONAL_VARS)[number], string>>;
+}
+/**
+ * What is held now: the optional secrets, and `UPTIME_HEARTBEAT_URL` (a ping
+ * URL that works as a capability, so a secret too), name to value. Callers
+ * that report or record take the names only.
+ */
+export declare function heldUptimeValues(deps: Pick<PlatformUptimeDeps, 'heldKeys'>): Promise<Record<string, string>>;
+/**
+ * foundry#542: makes the uptime Worker true, in an order where every failure
+ * is repaired by the next apply and none needs a hand edit. Upload the pinned
+ * Archon release (the host fetches and verifies it) and record the script at
+ * once, so a later failure is a half-made Worker foundry owns. Then hold the
+ * Worker token and the Access pair (minted once each, each guard recorded as
+ * soon as its value is held), set every held secret on the Worker, and last
+ * the cron trigger, so the Worker never runs a round without its token. The
+ * applied values are recorded only when all of it succeeded.
+ */
+export declare function provisionPlatformUptime(context: PlatformStepExecutionContext, deps: PlatformUptimeDeps): Promise<{
+    resourceId?: string;
+}>;