Payload
{
"ref": "refs/heads/feat/gateway-only-access",
"before": "0000000000000000000000000000000000000000",
"after": "86ed8fd2a67316ec13dd4ba506dafaf164657aac",
"repository": {
"id": 1218503331,
"node_id": "R_kgDOSKDiow",
"name": "platform",
"full_name": "darkmatter/platform",
"private": true,
"owner": {
"name": "darkmatter",
"email": "hello@dm.sh",
"login": "darkmatter",
"id": 17834193,
"node_id": "MDEyOk9yZ2FuaXphdGlvbjE3ODM0MTkz",
"avatar_url": "https://avatars.githubusercontent.com/u/17834193?v=4",
"gravatar_id": "",
"url": "https://api.github.com/users/darkmatter",
"html_url": "https://github.com/darkmatter",
"followers_url": "https://api.github.com/users/darkmatter/followers",
"following_url": "https://api.github.com/users/darkmatter/following{/other_user}",
"gists_url": "https://api.github.com/users/darkmatter/gists{/gist_id}",
"starred_url": "https://api.github.com/users/darkmatter/starred{/owner}{/repo}",
"subscriptions_url": "https://api.github.com/users/darkmatter/subscriptions",
"organizations_url": "https://api.github.com/users/darkmatter/orgs",
"repos_url": "https://api.github.com/users/darkmatter/repos",
"events_url": "https://api.github.com/users/darkmatter/events{/privacy}",
"received_events_url": "https://api.github.com/users/darkmatter/received_events",
"type": "Organization",
"user_view_type": "public",
"site_admin": false
},
"html_url": "https://github.com/darkmatter/platform",
"description": null,
"fork": false,
"url": "https://api.github.com/repos/darkmatter/platform",
"forks_url": "https://api.github.com/repos/darkmatter/platform/forks",
"keys_url": "https://api.github.com/repos/darkmatter/platform/keys{/key_id}",
"collaborators_url": "https://api.github.com/repos/darkmatter/platform/collaborators{/collaborator}",
"teams_url": "https://api.github.com/repos/darkmatter/platform/teams",
"hooks_url": "https://api.github.com/repos/darkmatter/platform/hooks",
"issue_events_url": "https://api.github.com/repos/darkmatter/platform/issues/events{/number}",
"events_url": "https://api.github.com/repos/darkmatter/platform/events",
"assignees_url": "https://api.github.com/repos/darkmatter/platform/assignees{/user}",
"branches_url": "https://api.github.com/repos/darkmatter/platform/branches{/branch}",
"tags_url": "https://api.github.com/repos/darkmatter/platform/tags",
"blobs_url": "https://api.github.com/repos/darkmatter/platform/git/blobs{/sha}",
"git_tags_url": "https://api.github.com/repos/darkmatter/platform/git/tags{/sha}",
"git_refs_url": "https://api.github.com/repos/darkmatter/platform/git/refs{/sha}",
"trees_url": "https://api.github.com/repos/darkmatter/platform/git/trees{/sha}",
"statuses_url": "https://api.github.com/repos/darkmatter/platform/statuses/{sha}",
"languages_url": "https://api.github.com/repos/darkmatter/platform/languages",
"stargazers_url": "https://api.github.com/repos/darkmatter/platform/stargazers",
"contributors_url": "https://api.github.com/repos/darkmatter/platform/contributors",
"subscribers_url": "https://api.github.com/repos/darkmatter/platform/subscribers",
"subscription_url": "https://api.github.com/repos/darkmatter/platform/subscription",
"commits_url": "https://api.github.com/repos/darkmatter/platform/commits{/sha}",
"git_commits_url": "https://api.github.com/repos/darkmatter/platform/git/commits{/sha}",
"comments_url": "https://api.github.com/repos/darkmatter/platform/comments{/number}",
"issue_comment_url": "https://api.github.com/repos/darkmatter/platform/issues/comments{/number}",
"contents_url": "https://api.github.com/repos/darkmatter/platform/contents/{+path}",
"compare_url": "https://api.github.com/repos/darkmatter/platform/compare/{base}...{head}",
"merges_url": "https://api.github.com/repos/darkmatter/platform/merges",
"archive_url": "https://api.github.com/repos/darkmatter/platform/{archive_format}{/ref}",
"downloads_url": "https://api.github.com/repos/darkmatter/platform/downloads",
"issues_url": "https://api.github.com/repos/darkmatter/platform/issues{/number}",
"pulls_url": "https://api.github.com/repos/darkmatter/platform/pulls{/number}",
"milestones_url": "https://api.github.com/repos/darkmatter/platform/milestones{/number}",
"notifications_url": "https://api.github.com/repos/darkmatter/platform/notifications{?since,all,participating}",
"labels_url": "https://api.github.com/repos/darkmatter/platform/labels{/name}",
"releases_url": "https://api.github.com/repos/darkmatter/platform/releases{/id}",
"deployments_url": "https://api.github.com/repos/darkmatter/platform/deployments",
"created_at": 1776903158,
"updated_at": "2026-05-26T09:48:19Z",
"pushed_at": 1779789736,
"git_url": "git://github.com/darkmatter/platform.git",
"ssh_url": "git@github.com:darkmatter/platform.git",
"clone_url": "https://github.com/darkmatter/platform.git",
"svn_url": "https://github.com/darkmatter/platform",
"homepage": null,
"size": 390,
"stargazers_count": 0,
"watchers_count": 0,
"language": "TypeScript",
"has_issues": true,
"has_projects": true,
"has_downloads": true,
"has_wiki": true,
"has_pages": false,
"has_discussions": false,
"forks_count": 0,
"mirror_url": null,
"archived": false,
"disabled": false,
"open_issues_count": 0,
"license": {
"key": "apache-2.0",
"name": "Apache License 2.0",
"spdx_id": "Apache-2.0",
"url": "https://api.github.com/licenses/apache-2.0",
"node_id": "MDc6TGljZW5zZTI="
},
"allow_forking": false,
"is_template": false,
"web_commit_signoff_required": false,
"has_pull_requests": true,
"pull_request_creation_policy": "all",
"topics": [],
"visibility": "internal",
"forks": 0,
"open_issues": 0,
"watchers": 0,
"default_branch": "main",
"stargazers": 0,
"master_branch": "main",
"organization": "darkmatter",
"custom_properties": {}
},
"pusher": {
"name": "czxtm",
"email": "1325802+czxtm@users.noreply.github.com"
},
"forced": false,
"organization": {
"login": "darkmatter",
"id": 17834193,
"node_id": "MDEyOk9yZ2FuaXphdGlvbjE3ODM0MTkz",
"url": "https://api.github.com/orgs/darkmatter",
"repos_url": "https://api.github.com/orgs/darkmatter/repos",
"events_url": "https://api.github.com/orgs/darkmatter/events",
"hooks_url": "https://api.github.com/orgs/darkmatter/hooks",
"issues_url": "https://api.github.com/orgs/darkmatter/issues",
"members_url": "https://api.github.com/orgs/darkmatter/members{/member}",
"public_members_url": "https://api.github.com/orgs/darkmatter/public_members{/member}",
"avatar_url": "https://avatars.githubusercontent.com/u/17834193?v=4",
"description": ""
},
"enterprise": {
"id": 469843,
"slug": "darkmatter",
"name": "darkmatter",
"node_id": "E_kgDOAAcrUw",
"avatar_url": "https://avatars.githubusercontent.com/b/469843?v=4",
"description": "",
"website_url": "darkmatter.io",
"html_url": "https://github.com/enterprises/darkmatter",
"created_at": "2025-09-07T16:01:00Z",
"updated_at": "2026-05-09T15:34:55Z"
},
"sender": {
"login": "czxtm",
"id": 1325802,
"node_id": "MDQ6VXNlcjEzMjU4MDI=",
"avatar_url": "https://avatars.githubusercontent.com/u/1325802?v=4",
"gravatar_id": "",
"url": "https://api.github.com/users/czxtm",
"html_url": "https://github.com/czxtm",
"followers_url": "https://api.github.com/users/czxtm/followers",
"following_url": "https://api.github.com/users/czxtm/following{/other_user}",
"gists_url": "https://api.github.com/users/czxtm/gists{/gist_id}",
"starred_url": "https://api.github.com/users/czxtm/starred{/owner}{/repo}",
"subscriptions_url": "https://api.github.com/users/czxtm/subscriptions",
"organizations_url": "https://api.github.com/users/czxtm/orgs",
"repos_url": "https://api.github.com/users/czxtm/repos",
"events_url": "https://api.github.com/users/czxtm/events{/privacy}",
"received_events_url": "https://api.github.com/users/czxtm/received_events",
"type": "User",
"user_view_type": "public",
"site_admin": false
},
"installation": {
"id": 131074261,
"node_id": "MDIzOkludGVncmF0aW9uSW5zdGFsbGF0aW9uMTMxMDc0MjYx"
},
"created": true,
"deleted": false,
"base_ref": null,
"compare": "https://github.com/darkmatter/platform/commit/86ed8fd2a673",
"commits": [
{
"id": "86ed8fd2a67316ec13dd4ba506dafaf164657aac",
"tree_id": "515bd18517f7e65e84023659c71cde04c58d7509",
"distinct": true,
"message": "feat: consolidate Access onto gateway, split public/internal zones\n\nArchitecture change:\n\n *.darkmatter.io -> PUBLIC (no Cloudflare Access)\n *.dm.foo -> INTERNAL (single Access app on gateway)\n\nSingle Access app on the gateway covers `dm.foo` + `*.dm.foo` via the\nself_hosted destinations array (previously the resource only supported\none customDomain). The gateway owns all internal hostnames and routes\nincoming traffic by subdomain via service bindings:\n\n dm.foo -> SITE (apex / app launcher)\n api.dm.foo -> API\n cli.dm.foo -> CLI\n trader.dm.foo -> TRADER\n vault.dm.foo -> VAULT_ANALYTICS (binding renamed VAULT)\n platform.dm.foo -> SITE\n dashboard.dm.foo -> GITHUB_BOT (path-rewritten to /dashboard/*)\n\nInternal workers (api, cli, site, trader, vault-analytics) lose their:\n- per-app AccessApplication\n- per-app customDomain\n- workers.dev subdomain in prod (still on in preview)\n\nThey keep `requireAccess` with ACCESS_GUARD_DISABLED=true so direct\nhits return ok via the access-guard kill-switch; legitimate traffic\narrives via the gateway, which adds X-Darkmatter-Gateway-Token.\n\ngithub-bot moves to the public surface at `github-bot.darkmatter.io`\n(no Access on the webhook). Its dashboard remains gated: direct\n`/dashboard` hits to the public hostname are blocked by the in-worker\nrequireAccess (no shared-secret token), and legitimate dashboard\naccess comes via `dashboard.dm.foo` proxied by the gateway with the\ngateway token. The dropped `github-bot-dashboard-access` AccessApp\nbecomes redundant — the gateway's single Access app covers it.\n\nGateway worker now does subdomain routing via the Host header in prod\nand keeps the path-prefix routing as a fallback for the workers.dev\npreview URL.\n\nAccessApplication resource extended with extraDomains: readonly\nstring[] which become additional `destinations` entries on the\nself_hosted Access app. Pre-existing customDomain behavior unchanged.\n\nToken narrowing follow-up: only the gateway needs Zone:Read +\nDNS:Edit on dm.foo. github-bot needs the same on darkmatter.io. The\nother 5 internal workers can drop all Zone-scoped scopes.",
"timestamp": "2026-05-26T03:02:13-07:00",
"url": "https://github.com/darkmatter/platform/commit/86ed8fd2a67316ec13dd4ba506dafaf164657aac",
"author": {
"name": "Cooper Maruyama",
"email": "me@cooperm.com",
"date": "2026-05-26T03:02:13-07:00",
"username": "czxtm"
},
"committer": {
"name": "Cooper Maruyama",
"email": "me@cooperm.com",
"date": "2026-05-26T03:02:13-07:00",
"username": "czxtm"
},
"added": [],
"removed": [],
"modified": [
"apps/access-guard/src/alchemy.ts",
"apps/api/alchemy.run.ts",
"apps/cli/alchemy.run.ts",
"apps/gateway/alchemy.run.ts",
"apps/gateway/src/worker.ts",
"apps/gateway/worker-configuration.d.ts",
"apps/github-bot/alchemy.run.ts",
"apps/site/alchemy.run.ts",
"apps/trader/alchemy.run.ts",
"apps/vault-analytics/alchemy.run.ts"
]
}
],
"head_commit": {
"id": "86ed8fd2a67316ec13dd4ba506dafaf164657aac",
"tree_id": "515bd18517f7e65e84023659c71cde04c58d7509",
"distinct": true,
"message": "feat: consolidate Access onto gateway, split public/internal zones\n\nArchitecture change:\n\n *.darkmatter.io -> PUBLIC (no Cloudflare Access)\n *.dm.foo -> INTERNAL (single Access app on gateway)\n\nSingle Access app on the gateway covers `dm.foo` + `*.dm.foo` via the\nself_hosted destinations array (previously the resource only supported\none customDomain). The gateway owns all internal hostnames and routes\nincoming traffic by subdomain via service bindings:\n\n dm.foo -> SITE (apex / app launcher)\n api.dm.foo -> API\n cli.dm.foo -> CLI\n trader.dm.foo -> TRADER\n vault.dm.foo -> VAULT_ANALYTICS (binding renamed VAULT)\n platform.dm.foo -> SITE\n dashboard.dm.foo -> GITHUB_BOT (path-rewritten to /dashboard/*)\n\nInternal workers (api, cli, site, trader, vault-analytics) lose their:\n- per-app AccessApplication\n- per-app customDomain\n- workers.dev subdomain in prod (still on in preview)\n\nThey keep `requireAccess` with ACCESS_GUARD_DISABLED=true so direct\nhits return ok via the access-guard kill-switch; legitimate traffic\narrives via the gateway, which adds X-Darkmatter-Gateway-Token.\n\ngithub-bot moves to the public surface at `github-bot.darkmatter.io`\n(no Access on the webhook). Its dashboard remains gated: direct\n`/dashboard` hits to the public hostname are blocked by the in-worker\nrequireAccess (no shared-secret token), and legitimate dashboard\naccess comes via `dashboard.dm.foo` proxied by the gateway with the\ngateway token. The dropped `github-bot-dashboard-access` AccessApp\nbecomes redundant — the gateway's single Access app covers it.\n\nGateway worker now does subdomain routing via the Host header in prod\nand keeps the path-prefix routing as a fallback for the workers.dev\npreview URL.\n\nAccessApplication resource extended with extraDomains: readonly\nstring[] which become additional `destinations` entries on the\nself_hosted Access app. Pre-existing customDomain behavior unchanged.\n\nToken narrowing follow-up: only the gateway needs Zone:Read +\nDNS:Edit on dm.foo. github-bot needs the same on darkmatter.io. The\nother 5 internal workers can drop all Zone-scoped scopes.",
"timestamp": "2026-05-26T03:02:13-07:00",
"url": "https://github.com/darkmatter/platform/commit/86ed8fd2a67316ec13dd4ba506dafaf164657aac",
"author": {
"name": "Cooper Maruyama",
"email": "me@cooperm.com",
"date": "2026-05-26T03:02:13-07:00",
"username": "czxtm"
},
"committer": {
"name": "Cooper Maruyama",
"email": "me@cooperm.com",
"date": "2026-05-26T03:02:13-07:00",
"username": "czxtm"
},
"added": [],
"removed": [],
"modified": [
"apps/access-guard/src/alchemy.ts",
"apps/api/alchemy.run.ts",
"apps/cli/alchemy.run.ts",
"apps/gateway/alchemy.run.ts",
"apps/gateway/src/worker.ts",
"apps/gateway/worker-configuration.d.ts",
"apps/github-bot/alchemy.run.ts",
"apps/site/alchemy.run.ts",
"apps/trader/alchemy.run.ts",
"apps/vault-analytics/alchemy.run.ts"
]
}
}