Alchemy Cloudflare Access Gateway
An Effect-driven Alchemy deployment that puts one Cloudflare Worker behind Zero Trust Access for both people and authenticated agents. It validates the owner email and gateway hostname before provisioning, creates a one-year agent service token, attaches separate human and non-identity policies to a self-hosted Access application, disables workers.dev and preview ingress, routes the protected hostname to the Worker, serves SPA assets while keeping /api on the Worker, and exposes the Access audience as a binding for origin-side verification.
npx shadcn@latest add https://ui.aryank.space/r/alchemy-cloudflare-access-gateway.jsonInstalls from ui.aryank.space. To add it by hand, copy the files in Files below, or register the @compronents namespace via the docs.
The named owner completes identity login, the email policy matches, and Cloudflare Access admits the request to the only public Worker route.