Payload
{
"action": "edited",
"changes": {
"body": {
"from": "## Vault analytics preview deployed\n\n- Preview URL: \n- Health: /healthz\n\nProduction routing: https://vault.dm.foo (behind gateway, internal-only).\n\nBuilt from f2dcedf."
}
},
"issue": {
"url": "https://api.github.com/repos/darkmatter/platform/issues/21",
"repository_url": "https://api.github.com/repos/darkmatter/platform",
"labels_url": "https://api.github.com/repos/darkmatter/platform/issues/21/labels{/name}",
"comments_url": "https://api.github.com/repos/darkmatter/platform/issues/21/comments",
"events_url": "https://api.github.com/repos/darkmatter/platform/issues/21/events",
"html_url": "https://github.com/darkmatter/platform/pull/21",
"id": 4523296526,
"node_id": "PR_kwDOSKDio87fXJgt",
"number": 21,
"title": "feat: consolidate Access onto gateway, split public/internal zones",
"user": {
"login": "czxtm",
"id": 1325802,
"node_id": "MDQ6VXNlcjEzMjU4MDI=",
"avatar_url": "https://avatars.githubusercontent.com/u/1325802?v=4",
"gravatar_id": "",
"url": "https://api.github.com/users/czxtm",
"html_url": "https://github.com/czxtm",
"followers_url": "https://api.github.com/users/czxtm/followers",
"following_url": "https://api.github.com/users/czxtm/following{/other_user}",
"gists_url": "https://api.github.com/users/czxtm/gists{/gist_id}",
"starred_url": "https://api.github.com/users/czxtm/starred{/owner}{/repo}",
"subscriptions_url": "https://api.github.com/users/czxtm/subscriptions",
"organizations_url": "https://api.github.com/users/czxtm/orgs",
"repos_url": "https://api.github.com/users/czxtm/repos",
"events_url": "https://api.github.com/users/czxtm/events{/privacy}",
"received_events_url": "https://api.github.com/users/czxtm/received_events",
"type": "User",
"user_view_type": "public",
"site_admin": false
},
"labels": [],
"state": "open",
"locked": false,
"assignees": [],
"milestone": null,
"comments": 6,
"created_at": "2026-05-26T10:02:57Z",
"updated_at": "2026-05-26T10:03:35Z",
"closed_at": null,
"assignee": null,
"author_association": "MEMBER",
"issue_field_values": [],
"type": null,
"active_lock_reason": null,
"draft": false,
"pull_request": {
"url": "https://api.github.com/repos/darkmatter/platform/pulls/21",
"html_url": "https://github.com/darkmatter/platform/pull/21",
"diff_url": "https://github.com/darkmatter/platform/pull/21.diff",
"patch_url": "https://github.com/darkmatter/platform/pull/21.patch",
"merged_at": null
},
"body": "## Architecture\n\n```\n*.darkmatter.io → PUBLIC (no Cloudflare Access)\n*.dm.foo → INTERNAL (single Access app on the gateway)\n```\n\n| Hostname | Surface | Routes to |\n|---|---|---|\n| `github-bot.darkmatter.io` | **PUBLIC** | github-bot worker (webhook, HMAC-validated) |\n| `dm.foo` | INTERNAL | site (apex / app launcher) |\n| `api.dm.foo` | INTERNAL | api |\n| `cli.dm.foo` | INTERNAL | cli |\n| `trader.dm.foo` | INTERNAL | trader |\n| `vault.dm.foo` | INTERNAL | vault-analytics |\n| `platform.dm.foo` | INTERNAL | site |\n| `dashboard.dm.foo` | INTERNAL | github-bot `/dashboard/*` (gateway prepends the path) |\n\n## What changes\n\n### `@drkmttr/access-guard` (`apps/access-guard/src/alchemy.ts`)\n\n`AccessApplication` gains `extraDomains: readonly string[]`. When set, they're emitted as additional `destinations` on the self_hosted Access app body. The gateway uses this to cover `dm.foo` + `*.dm.foo` in one app.\n\n### Gateway (`apps/gateway/...`)\n\n- Custom domains: `[\"dm.foo\", \"api.dm.foo\", \"cli.dm.foo\", \"trader.dm.foo\", \"vault.dm.foo\", \"platform.dm.foo\", \"dashboard.dm.foo\"]`.\n- Single `AccessApplication` covering `dm.foo` + `*.dm.foo` via `extraDomains`.\n- Worker switches to **subdomain routing** in prod (`Host` header → service binding). Path-prefix routing kept as fallback for the workers.dev preview URL.\n- `VAULT_ANALYTICS` binding renamed to `VAULT` to match the subdomain.\n- Dashboard requests get their path rewritten to `/dashboard/<orig>` before forwarding to the github-bot service binding.\n\n### Internal apps (`api`, `cli`, `site`, `trader`, `vault-analytics`)\n\n- Drop `AccessApplication` (gateway handles it).\n- Drop `customDomain` (no public hostname — only reachable via gateway service binding).\n- `subdomain.enabled: false` in prod (kept on for previews).\n- `accessGuardEnv(\"\", { disabled: true })` so the in-worker `requireAccess` short-circuits to ok without env vars (defense-in-depth — gateway is the real gate).\n\n### `github-bot`\n\n- `customDomain = \"github-bot.darkmatter.io\"` (public surface).\n- Dropped the standalone `github-bot-dashboard-access` Access app — the gateway's single Access app gates `dashboard.dm.foo` instead.\n- Webhook stays public + HMAC-validated.\n- Dashboard remains protected: direct hits to `github-bot.darkmatter.io/dashboard` are still gated by the in-worker `requireAccess` (no shared-secret token), while legitimate dashboard traffic arrives via `dashboard.dm.foo` with the gateway token.\n\n## Why this is better than the per-app design we just shipped\n\n- 1 Access app instead of 7. One policy, one AUD.\n- 1 Access surface on `dm.foo` (+ wildcard). DNS / cert provisioning happens once. Zone inference fires once per deploy (and `dm.foo` happens to be on page 1 of /zones anyway, so the listzones patch from #20 isn't load-bearing for this code path).\n- Internal workers have no public hostname → defense-in-depth doesn't need JWT validation, just shared-secret check.\n- Token scoping gets simpler: only gateway needs Zone+DNS on `dm.foo`; only github-bot needs Zone+DNS on `darkmatter.io`. The other 5 workers need only `Account → Workers Scripts: Edit`.\n- New \"public\" apps just attach a `darkmatter.io` hostname. New \"internal\" apps add a subdomain entry to the gateway and a service binding.\n\n## Operational follow-up (not in this PR)\n\n- Delete the 6 existing per-app Cloudflare Access apps (`api-access`, `cli-access`, `gateway-access` if pointing at `gateway.drkmttr.dev`, `site-access`, `trader-access`, `vault-analytics-access`, `github-bot-dashboard-access`) from the CF dashboard. Alchemy state will recreate the gateway one with the new destinations.\n- Remove orphaned `*.drkmttr.dev` worker custom-domain bindings.\n- Narrow the `CLOUDFLARE_API_TOKEN` Zone-scoped permissions to `dm.foo` + `darkmatter.io` only.\n\n## Verification\n\n- `tsc` exit 0 on all 8 apps.\n- `eslint` exit 0 on all 8 apps.\n- `vitest` for access-guard: 2/2 passing.",
"reactions": {
"url": "https://api.github.com/repos/darkmatter/platform/issues/21/reactions",
"total_count": 0,
"+1": 0,
"-1": 0,
"laugh": 0,
"hooray": 0,
"confused": 0,
"heart": 0,
"rocket": 0,
"eyes": 0
},
"timeline_url": "https://api.github.com/repos/darkmatter/platform/issues/21/timeline",
"performed_via_github_app": null,
"state_reason": null
},
"comment": {
"url": "https://api.github.com/repos/darkmatter/platform/issues/comments/4543163488",
"html_url": "https://github.com/darkmatter/platform/pull/21#issuecomment-4543163488",
"issue_url": "https://api.github.com/repos/darkmatter/platform/issues/21",
"id": 4543163488,
"node_id": "IC_kwDOSKDio88AAAABDsssYA",
"user": {
"login": "github-actions[bot]",
"id": 41898282,
"node_id": "MDM6Qm90NDE4OTgyODI=",
"avatar_url": "https://avatars.githubusercontent.com/in/15368?v=4",
"gravatar_id": "",
"url": "https://api.github.com/users/github-actions%5Bbot%5D",
"html_url": "https://github.com/apps/github-actions",
"followers_url": "https://api.github.com/users/github-actions%5Bbot%5D/followers",
"following_url": "https://api.github.com/users/github-actions%5Bbot%5D/following{/other_user}",
"gists_url": "https://api.github.com/users/github-actions%5Bbot%5D/gists{/gist_id}",
"starred_url": "https://api.github.com/users/github-actions%5Bbot%5D/starred{/owner}{/repo}",
"subscriptions_url": "https://api.github.com/users/github-actions%5Bbot%5D/subscriptions",
"organizations_url": "https://api.github.com/users/github-actions%5Bbot%5D/orgs",
"repos_url": "https://api.github.com/users/github-actions%5Bbot%5D/repos",
"events_url": "https://api.github.com/users/github-actions%5Bbot%5D/events{/privacy}",
"received_events_url": "https://api.github.com/users/github-actions%5Bbot%5D/received_events",
"type": "Bot",
"user_view_type": "public",
"site_admin": false
},
"created_at": "2026-05-26T10:03:30Z",
"updated_at": "2026-05-26T10:03:39Z",
"body": "## Vault analytics preview deployed\n\n- Preview URL: https://darkmatter-vault-analytics-pr-21.drtkmttr.workers.dev\n- Health: https://darkmatter-vault-analytics-pr-21.drtkmttr.workers.dev/healthz\n\nProduction routing: https://vault.dm.foo (behind gateway, internal-only).\n\nBuilt from f2dcedf.",
"author_association": "NONE",
"reactions": {
"url": "https://api.github.com/repos/darkmatter/platform/issues/comments/4543163488/reactions",
"total_count": 0,
"+1": 0,
"-1": 0,
"laugh": 0,
"hooray": 0,
"confused": 0,
"heart": 0,
"rocket": 0,
"eyes": 0
},
"performed_via_github_app": {
"id": 15368,
"client_id": "Iv1.05c79e9ad1f6bdfa",
"slug": "github-actions",
"node_id": "MDM6QXBwMTUzNjg=",
"owner": {
"login": "github",
"id": 9919,
"node_id": "MDEyOk9yZ2FuaXphdGlvbjk5MTk=",
"avatar_url": "https://avatars.githubusercontent.com/u/9919?v=4",
"gravatar_id": "",
"url": "https://api.github.com/users/github",
"html_url": "https://github.com/github",
"followers_url": "https://api.github.com/users/github/followers",
"following_url": "https://api.github.com/users/github/following{/other_user}",
"gists_url": "https://api.github.com/users/github/gists{/gist_id}",
"starred_url": "https://api.github.com/users/github/starred{/owner}{/repo}",
"subscriptions_url": "https://api.github.com/users/github/subscriptions",
"organizations_url": "https://api.github.com/users/github/orgs",
"repos_url": "https://api.github.com/users/github/repos",
"events_url": "https://api.github.com/users/github/events{/privacy}",
"received_events_url": "https://api.github.com/users/github/received_events",
"type": "Organization",
"user_view_type": "public",
"site_admin": false
},
"name": "GitHub Actions",
"description": "Automate your workflow from idea to production",
"external_url": "https://help.github.com/en/actions",
"html_url": "https://github.com/apps/github-actions",
"created_at": "2018-07-30T09:30:17Z",
"updated_at": "2026-05-05T14:51:38Z",
"permissions": {
"actions": "write",
"administration": "read",
"artifact_metadata": "write",
"attestations": "write",
"checks": "write",
"code_quality": "write",
"contents": "write",
"copilot_requests": "write",
"deployments": "write",
"discussions": "write",
"issues": "write",
"merge_queues": "write",
"metadata": "read",
"models": "read",
"packages": "write",
"pages": "write",
"pull_requests": "write",
"repository_hooks": "write",
"repository_projects": "write",
"security_events": "write",
"statuses": "write",
"vulnerability_alerts": "read"
},
"events": [
"branch_protection_rule",
"check_run",
"check_suite",
"create",
"delete",
"deployment",
"deployment_status",
"discussion",
"discussion_comment",
"fork",
"gollum",
"issues",
"issue_comment",
"label",
"merge_group",
"milestone",
"page_build",
"public",
"pull_request",
"pull_request_review",
"pull_request_review_comment",
"push",
"registry_package",
"release",
"repository",
"repository_dispatch",
"status",
"watch",
"workflow_dispatch",
"workflow_run"
]
}
},
"repository": {
"id": 1218503331,
"node_id": "R_kgDOSKDiow",
"name": "platform",
"full_name": "darkmatter/platform",
"private": true,
"owner": {
"login": "darkmatter",
"id": 17834193,
"node_id": "MDEyOk9yZ2FuaXphdGlvbjE3ODM0MTkz",
"avatar_url": "https://avatars.githubusercontent.com/u/17834193?v=4",
"gravatar_id": "",
"url": "https://api.github.com/users/darkmatter",
"html_url": "https://github.com/darkmatter",
"followers_url": "https://api.github.com/users/darkmatter/followers",
"following_url": "https://api.github.com/users/darkmatter/following{/other_user}",
"gists_url": "https://api.github.com/users/darkmatter/gists{/gist_id}",
"starred_url": "https://api.github.com/users/darkmatter/starred{/owner}{/repo}",
"subscriptions_url": "https://api.github.com/users/darkmatter/subscriptions",
"organizations_url": "https://api.github.com/users/darkmatter/orgs",
"repos_url": "https://api.github.com/users/darkmatter/repos",
"events_url": "https://api.github.com/users/darkmatter/events{/privacy}",
"received_events_url": "https://api.github.com/users/darkmatter/received_events",
"type": "Organization",
"user_view_type": "public",
"site_admin": false
},
"html_url": "https://github.com/darkmatter/platform",
"description": null,
"fork": false,
"url": "https://api.github.com/repos/darkmatter/platform",
"forks_url": "https://api.github.com/repos/darkmatter/platform/forks",
"keys_url": "https://api.github.com/repos/darkmatter/platform/keys{/key_id}",
"collaborators_url": "https://api.github.com/repos/darkmatter/platform/collaborators{/collaborator}",
"teams_url": "https://api.github.com/repos/darkmatter/platform/teams",
"hooks_url": "https://api.github.com/repos/darkmatter/platform/hooks",
"issue_events_url": "https://api.github.com/repos/darkmatter/platform/issues/events{/number}",
"events_url": "https://api.github.com/repos/darkmatter/platform/events",
"assignees_url": "https://api.github.com/repos/darkmatter/platform/assignees{/user}",
"branches_url": "https://api.github.com/repos/darkmatter/platform/branches{/branch}",
"tags_url": "https://api.github.com/repos/darkmatter/platform/tags",
"blobs_url": "https://api.github.com/repos/darkmatter/platform/git/blobs{/sha}",
"git_tags_url": "https://api.github.com/repos/darkmatter/platform/git/tags{/sha}",
"git_refs_url": "https://api.github.com/repos/darkmatter/platform/git/refs{/sha}",
"trees_url": "https://api.github.com/repos/darkmatter/platform/git/trees{/sha}",
"statuses_url": "https://api.github.com/repos/darkmatter/platform/statuses/{sha}",
"languages_url": "https://api.github.com/repos/darkmatter/platform/languages",
"stargazers_url": "https://api.github.com/repos/darkmatter/platform/stargazers",
"contributors_url": "https://api.github.com/repos/darkmatter/platform/contributors",
"subscribers_url": "https://api.github.com/repos/darkmatter/platform/subscribers",
"subscription_url": "https://api.github.com/repos/darkmatter/platform/subscription",
"commits_url": "https://api.github.com/repos/darkmatter/platform/commits{/sha}",
"git_commits_url": "https://api.github.com/repos/darkmatter/platform/git/commits{/sha}",
"comments_url": "https://api.github.com/repos/darkmatter/platform/comments{/number}",
"issue_comment_url": "https://api.github.com/repos/darkmatter/platform/issues/comments{/number}",
"contents_url": "https://api.github.com/repos/darkmatter/platform/contents/{+path}",
"compare_url": "https://api.github.com/repos/darkmatter/platform/compare/{base}...{head}",
"merges_url": "https://api.github.com/repos/darkmatter/platform/merges",
"archive_url": "https://api.github.com/repos/darkmatter/platform/{archive_format}{/ref}",
"downloads_url": "https://api.github.com/repos/darkmatter/platform/downloads",
"issues_url": "https://api.github.com/repos/darkmatter/platform/issues{/number}",
"pulls_url": "https://api.github.com/repos/darkmatter/platform/pulls{/number}",
"milestones_url": "https://api.github.com/repos/darkmatter/platform/milestones{/number}",
"notifications_url": "https://api.github.com/repos/darkmatter/platform/notifications{?since,all,participating}",
"labels_url": "https://api.github.com/repos/darkmatter/platform/labels{/name}",
"releases_url": "https://api.github.com/repos/darkmatter/platform/releases{/id}",
"deployments_url": "https://api.github.com/repos/darkmatter/platform/deployments",
"created_at": "2026-04-23T00:12:38Z",
"updated_at": "2026-05-26T09:48:19Z",
"pushed_at": "2026-05-26T10:02:16Z",
"git_url": "git://github.com/darkmatter/platform.git",
"ssh_url": "git@github.com:darkmatter/platform.git",
"clone_url": "https://github.com/darkmatter/platform.git",
"svn_url": "https://github.com/darkmatter/platform",
"homepage": null,
"size": 390,
"stargazers_count": 0,
"watchers_count": 0,
"language": "TypeScript",
"has_issues": true,
"has_projects": true,
"has_downloads": true,
"has_wiki": true,
"has_pages": false,
"has_discussions": false,
"forks_count": 0,
"mirror_url": null,
"archived": false,
"disabled": false,
"open_issues_count": 1,
"license": {
"key": "apache-2.0",
"name": "Apache License 2.0",
"spdx_id": "Apache-2.0",
"url": "https://api.github.com/licenses/apache-2.0",
"node_id": "MDc6TGljZW5zZTI="
},
"allow_forking": false,
"is_template": false,
"web_commit_signoff_required": false,
"has_pull_requests": true,
"pull_request_creation_policy": "all",
"topics": [],
"visibility": "internal",
"forks": 0,
"open_issues": 1,
"watchers": 0,
"default_branch": "main",
"custom_properties": {}
},
"organization": {
"login": "darkmatter",
"id": 17834193,
"node_id": "MDEyOk9yZ2FuaXphdGlvbjE3ODM0MTkz",
"url": "https://api.github.com/orgs/darkmatter",
"repos_url": "https://api.github.com/orgs/darkmatter/repos",
"events_url": "https://api.github.com/orgs/darkmatter/events",
"hooks_url": "https://api.github.com/orgs/darkmatter/hooks",
"issues_url": "https://api.github.com/orgs/darkmatter/issues",
"members_url": "https://api.github.com/orgs/darkmatter/members{/member}",
"public_members_url": "https://api.github.com/orgs/darkmatter/public_members{/member}",
"avatar_url": "https://avatars.githubusercontent.com/u/17834193?v=4",
"description": ""
},
"enterprise": {
"id": 469843,
"slug": "darkmatter",
"name": "darkmatter",
"node_id": "E_kgDOAAcrUw",
"avatar_url": "https://avatars.githubusercontent.com/b/469843?v=4",
"description": "",
"website_url": "darkmatter.io",
"html_url": "https://github.com/enterprises/darkmatter",
"created_at": "2025-09-07T16:01:00Z",
"updated_at": "2026-05-09T15:34:55Z"
},
"sender": {
"login": "github-actions[bot]",
"id": 41898282,
"node_id": "MDM6Qm90NDE4OTgyODI=",
"avatar_url": "https://avatars.githubusercontent.com/in/15368?v=4",
"gravatar_id": "",
"url": "https://api.github.com/users/github-actions%5Bbot%5D",
"html_url": "https://github.com/apps/github-actions",
"followers_url": "https://api.github.com/users/github-actions%5Bbot%5D/followers",
"following_url": "https://api.github.com/users/github-actions%5Bbot%5D/following{/other_user}",
"gists_url": "https://api.github.com/users/github-actions%5Bbot%5D/gists{/gist_id}",
"starred_url": "https://api.github.com/users/github-actions%5Bbot%5D/starred{/owner}{/repo}",
"subscriptions_url": "https://api.github.com/users/github-actions%5Bbot%5D/subscriptions",
"organizations_url": "https://api.github.com/users/github-actions%5Bbot%5D/orgs",
"repos_url": "https://api.github.com/users/github-actions%5Bbot%5D/repos",
"events_url": "https://api.github.com/users/github-actions%5Bbot%5D/events{/privacy}",
"received_events_url": "https://api.github.com/users/github-actions%5Bbot%5D/received_events",
"type": "Bot",
"user_view_type": "public",
"site_admin": false
},
"installation": {
"id": 131074261,
"node_id": "MDIzOkludGVncmF0aW9uSW5zdGFsbGF0aW9uMTMxMDc0MjYx"
}
}