@mriekki/project-forge 4.10.0 → 4.10.2

package/assets/components.json

@@ -1,7 +1,7 @@
 {
   "schemaVersion": 2,
   "package": "@mriekki/project-forge",
-  "version": "4.10.0",
+  "version": "4.10.2",
   "defaultProfile": "greenfield-project",
   "profiles": {
     "greenfield-project": {
@@ -21,7 +21,7 @@
       "canonicalDescriptor": "distributions/greenfield-workspace.json"
     },
     "deployment": {
-      "revision": "23799aec3e7c9a99873aaf912b040d43658fa4fb",
+      "revision": "5131dd0db9bbccda1647eee352f6bdcad7f5c112",
       "distribution": "greenfield-project",
       "descriptor": "assets/deployment/distribution.json",
       "sourceRoot": "assets/generated/deployment",

package/assets/deployment/distribution.json

@@ -19,6 +19,7 @@
     {"source": "src/project_forge_deployment/cloudflare_api.py", "destination": "tools/project-forge-deployment/project_forge_deployment/cloudflare_api.py"},
     {"source": "src/project_forge_deployment/cloudflare_ingress.py", "destination": "tools/project-forge-deployment/project_forge_deployment/cloudflare_ingress.py"},
     {"source": "src/project_forge_deployment/cloudflare_ingress_remote.py", "destination": "tools/project-forge-deployment/project_forge_deployment/cloudflare_ingress_remote.py"},
+    {"source": "src/project_forge_deployment/cloudflare_route_apply.py", "destination": "tools/project-forge-deployment/project_forge_deployment/cloudflare_route_apply.py"},
     {"source": "src/project_forge_deployment/cli.py", "destination": "tools/project-forge-deployment/project_forge_deployment/cli.py"},
     {"source": "src/project_forge_deployment/doctor.py", "destination": "tools/project-forge-deployment/project_forge_deployment/doctor.py"},
     {"source": "src/project_forge_deployment/entrypoint.py", "destination": "tools/project-forge-deployment/project_forge_deployment/entrypoint.py"},

package/assets/generated/ASSEMBLY.json

@@ -1,7 +1,7 @@
 {
   "schemaVersion": 2,
   "package": "@mriekki/project-forge",
-  "version": "4.10.0",
+  "version": "4.10.2",
   "components": {
     "core": {
       "revision": "8796fd8dc22df8b64078e5b460e1008a8c7a5f7d",
@@ -326,7 +326,7 @@
       ]
     },
     "deployment": {
-      "revision": "23799aec3e7c9a99873aaf912b040d43658fa4fb",
+      "revision": "5131dd0db9bbccda1647eee352f6bdcad7f5c112",
       "distribution": "greenfield-project",
       "files": [
         {
@@ -409,6 +409,11 @@
           "destination": "tools/project-forge-deployment/project_forge_deployment/cloudflare_ingress_remote.py",
           "sha256": "35ac39b4f4538d4ff23f68982cc4b176782378cf03539fa51a228becbdfcf4d0"
         },
+        {
+          "source": "src/project_forge_deployment/cloudflare_route_apply.py",
+          "destination": "tools/project-forge-deployment/project_forge_deployment/cloudflare_route_apply.py",
+          "sha256": "9c41b4b35d15bc46e7828f0366dc53c58be47f4414e7d90dfd176ea922bf294a"
+        },
         {
           "source": "src/project_forge_deployment/cli.py",
           "destination": "tools/project-forge-deployment/project_forge_deployment/cli.py",
@@ -422,7 +427,7 @@
         {
           "source": "src/project_forge_deployment/entrypoint.py",
           "destination": "tools/project-forge-deployment/project_forge_deployment/entrypoint.py",
-          "sha256": "021434f8f601ebbff0aae354e6c6b25b36d598a521a7948d02d5f1cc797c22fd"
+          "sha256": "c9dd332a68e923ef15a9f228e0666306c9692dd3ffe724b73160ce313f627ab6"
         },
         {
           "source": "src/project_forge_deployment/environment_cli.py",

package/assets/generated/deployment/src/project_forge_deployment/cloudflare_route_apply.py

@@ -0,0 +1,181 @@
+"""Safe public-route apply wrapper for Cloudflare provider normalization.
+
+Cloudflare currently adds ``warp-routing: {enabled: false}`` when returning a
+remotely managed tunnel configuration even when that provider default was not
+submitted.  Project Forge tolerates only that observed no-op normalization;
+all reviewed ingress rules and every other configuration value remain exact.
+"""
+
+from __future__ import annotations
+
+from copy import deepcopy
+from typing import Any
+
+from . import cloudflare_api
+from . import cloudflare_ingress as ingress
+from .errors import DeploymentKitError
+from .profiles import load_profile
+from .ssh import verify_access
+
+_FINAL_VERIFICATION_ERRORS = {
+    "Public route registration returned without exact host ownership metadata.",
+    "Cloudflare tunnel configuration does not match the reviewed route plan after apply.",
+    "Cloudflare DNS record is missing after public-route apply.",
+}
+
+
+def _reviewed_config_matches(actual: Any, reviewed: Any) -> bool:
+    """Match reviewed config after removing only the observed safe provider default."""
+    if not isinstance(actual, dict) or not isinstance(reviewed, dict):
+        return False
+    normalized = deepcopy(actual)
+    if "warp-routing" not in reviewed and normalized.get("warp-routing") == {"enabled": False}:
+        normalized.pop("warp-routing")
+    return normalized == reviewed
+
+
+def _read_final_state(plan: dict[str, Any], *, api_token: str) -> dict[str, Any]:
+    name = plan["targetName"]
+    scope = plan["scope"]
+    spec = plan["route"]
+    host = ingress.cloudflare_ingress_status(name, scope)
+    inventory = ingress.cloudflare_route_inventory(name, scope)
+    route = ingress._find_route(inventory, spec["routeId"])
+    config = cloudflare_api.get_tunnel_configuration(api_token, host["accountId"], host["tunnelId"])
+    records = cloudflare_api.list_dns_records(api_token, host["zoneId"], name=spec["publicHostname"])
+    dns_error: str | None = None
+    try:
+        dns = ingress._exact_dns_record(records, spec=spec, tunnel_id=host["tunnelId"])
+    except DeploymentKitError as error:
+        dns = None
+        dns_error = str(error)
+    return {
+        "host": host,
+        "route": route,
+        "config": config,
+        "dns": dns,
+        "dnsError": dns_error,
+    }
+
+
+def _rollback_final_state(
+    plan: dict[str, Any],
+    state: dict[str, Any],
+    *,
+    api_token: str,
+) -> list[str]:
+    """Best-effort reverse only mutations that can still be attributed safely."""
+    errors: list[str] = []
+    host = state["host"]
+    spec = plan["route"]
+
+    if plan["dnsRecord"] is None:
+        dns = state["dns"]
+        if dns is not None:
+            try:
+                cloudflare_api.delete_dns_record(api_token, host["zoneId"], str(dns["id"]))
+            except Exception as error:  # pragma: no cover - provider failure detail only
+                errors.append(f"DNS rollback failed: {error}")
+        elif state["dnsError"] is not None:
+            errors.append("DNS rollback skipped because current DNS ownership is ambiguous.")
+
+    if plan["desiredTunnelConfig"] != plan["tunnelConfig"]:
+        current = state["config"]
+        if _reviewed_config_matches(current, plan["desiredTunnelConfig"]):
+            try:
+                cloudflare_api.update_tunnel_configuration(
+                    api_token,
+                    host["accountId"],
+                    host["tunnelId"],
+                    plan["tunnelConfig"],
+                )
+            except Exception as error:  # pragma: no cover - provider failure detail only
+                errors.append(f"tunnel configuration rollback failed: {error}")
+        elif not _reviewed_config_matches(current, plan["tunnelConfig"]):
+            errors.append(
+                "Tunnel configuration rollback skipped because current provider state cannot be safely attributed to this apply."
+            )
+
+    if plan["previousRoute"] is None and state["route"] == spec:
+        try:
+            profile = load_profile(plan["targetName"])
+            access = verify_access(profile)
+            ingress._run_remote(
+                profile,
+                access["address"],
+                "route-remove",
+                scope=plan["scope"],
+                spec=spec,
+            )
+        except Exception as error:  # pragma: no cover - remote failure detail only
+            errors.append(f"host route rollback failed: {error}")
+
+    return errors
+
+
+def _uncertain_recovery_error(
+    original_error: Exception,
+    recovery_error: Exception,
+) -> DeploymentKitError:
+    return DeploymentKitError(
+        "Cloudflare public-route final verification failed, and recovery could not read "
+        "the current host/provider state. External state is uncertain and rollback was "
+        "not attempted because current ownership could not be verified safely. "
+        f"Original verification error: {original_error} "
+        f"Recovery read failed: {recovery_error} "
+        "Inspect the managed host route, tunnel configuration, and DNS record before retrying."
+    )
+
+
+def apply_public_route(plan: dict[str, Any], *, api_token: str) -> dict[str, Any]:
+    """Apply a reviewed public route with bounded post-write recovery.
+
+    The underlying apply retains all pre-write stale-state checks and its write
+    rollback.  Recovery is entered only for errors that are emitted exclusively
+    by the final verification phase, so preflight failures can never be turned
+    into success by observing later provider state.
+    """
+    try:
+        return ingress.apply_public_route(plan, api_token=api_token)
+    except Exception as original_error:
+        if (
+            not isinstance(original_error, DeploymentKitError)
+            or str(original_error) not in _FINAL_VERIFICATION_ERRORS
+            or not isinstance(plan, dict)
+            or plan.get("action") != "register"
+        ):
+            raise
+        required = {
+            "targetName", "scope", "route", "previousRoute", "tunnelConfig",
+            "desiredTunnelConfig", "dnsRecord", "dnsMarker",
+        }
+        if not required.issubset(plan):
+            raise
+
+        try:
+            state = _read_final_state(plan, api_token=api_token)
+        except Exception as recovery_error:
+            raise _uncertain_recovery_error(original_error, recovery_error) from recovery_error
+
+        route_ok = state["route"] == plan["route"]
+        config_ok = _reviewed_config_matches(state["config"], plan["desiredTunnelConfig"])
+        dns_ok = state["dns"] is not None
+        if route_ok and config_ok and dns_ok:
+            return {
+                "targetName": plan["targetName"],
+                "scope": plan["scope"],
+                "route": plan["route"],
+                "dnsRecordId": str(state["dns"]["id"]),
+                "publicUrl": f"https://{plan['route']['publicHostname']}",
+                "mutated": True,
+            }
+
+        rollback_errors = _rollback_final_state(plan, state, api_token=api_token)
+        if rollback_errors:
+            raise DeploymentKitError(
+                "Cloudflare public-route final verification failed and rollback was incomplete; "
+                "external state may remain changed. "
+                + "; ".join(rollback_errors)
+                + " Inspect the managed host route, tunnel configuration, and DNS record before retrying."
+            ) from original_error
+        raise original_error

package/assets/generated/deployment/src/project_forge_deployment/entrypoint.py

@@ -1,20 +1,78 @@
-"""Top-level console entrypoint for Deployment Kit command groups."""
+"""Top-level console entrypoint for Deployment Kit command groups.
+
+Command groups are loaded lazily so an optional capability defect cannot prevent
+unrelated Deployment Kit commands from starting.
+"""
 
 from __future__ import annotations
 
 import sys
 
-from .access_cli import main as access_main
-from .app_cli import main as app_main
-from .cli import main as core_main
-from .environment_cli import main as environment_main
-from .ingress_cli import main as ingress_main
-from .local_cli import main as local_main
-from .registry_cli import main as registry_main
-from .sqlite_cli import main as sqlite_main
-from .teardown_cli import inventory_main as target_inventory_main
-from .teardown_cli import main as teardown_main
-from .topology_cli import main as topology_main
+
+def access_main(argv: list[str]) -> int:
+    from .access_cli import main
+
+    return main(argv)
+
+
+def app_main(argv: list[str]) -> int:
+    from .app_cli import main
+
+    return main(argv)
+
+
+def core_main(argv: list[str]) -> int:
+    from .cli import main
+
+    return main(argv)
+
+
+def environment_main(argv: list[str]) -> int:
+    from .environment_cli import main
+
+    return main(argv)
+
+
+def ingress_main(argv: list[str]) -> int:
+    from .ingress_cli import main
+
+    return main(argv)
+
+
+def local_main(argv: list[str]) -> int:
+    from .local_cli import main
+
+    return main(argv)
+
+
+def registry_main(argv: list[str]) -> int:
+    from .registry_cli import main
+
+    return main(argv)
+
+
+def sqlite_main(argv: list[str]) -> int:
+    from .sqlite_cli import main
+
+    return main(argv)
+
+
+def target_inventory_main(argv: list[str]) -> int:
+    from .teardown_cli import inventory_main
+
+    return inventory_main(argv)
+
+
+def teardown_main(argv: list[str]) -> int:
+    from .teardown_cli import main
+
+    return main(argv)
+
+
+def topology_main(argv: list[str]) -> int:
+    from .topology_cli import main
+
+    return main(argv)
 
 
 def main(argv: list[str] | None = None) -> int:

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@mriekki/project-forge",
-  "version": "4.10.0",
+  "version": "4.10.2",
   "description": "Public consumer distribution and updater for Project Forge engineering assets.",
   "type": "module",
   "bin": {