@mriekki/project-forge 4.10.1 → 4.10.3

package/assets/components.json

@@ -1,7 +1,7 @@
 {
   "schemaVersion": 2,
   "package": "@mriekki/project-forge",
-  "version": "4.10.1",
+  "version": "4.10.3",
   "defaultProfile": "greenfield-project",
   "profiles": {
     "greenfield-project": {
@@ -21,7 +21,7 @@
       "canonicalDescriptor": "distributions/greenfield-workspace.json"
     },
     "deployment": {
-      "revision": "6b13a6e66218c067771311db1336c73229d23899",
+      "revision": "75c272db383f1803383e8cd4ad4511537c175abe",
       "distribution": "greenfield-project",
       "descriptor": "assets/deployment/distribution.json",
       "sourceRoot": "assets/generated/deployment",

package/assets/generated/ASSEMBLY.json

@@ -1,7 +1,7 @@
 {
   "schemaVersion": 2,
   "package": "@mriekki/project-forge",
-  "version": "4.10.1",
+  "version": "4.10.3",
   "components": {
     "core": {
       "revision": "8796fd8dc22df8b64078e5b460e1008a8c7a5f7d",
@@ -326,7 +326,7 @@
       ]
     },
     "deployment": {
-      "revision": "6b13a6e66218c067771311db1336c73229d23899",
+      "revision": "75c272db383f1803383e8cd4ad4511537c175abe",
       "distribution": "greenfield-project",
       "files": [
         {
@@ -402,7 +402,7 @@
         {
           "source": "src/project_forge_deployment/cloudflare_ingress.py",
           "destination": "tools/project-forge-deployment/project_forge_deployment/cloudflare_ingress.py",
-          "sha256": "98c77950df1d0bba36da1244001bdd157251238778e7068be0c6c20d2683d2d4"
+          "sha256": "ca2c80e0b64792f550a08fc51994bdfdac42644c35f23cdf7ae5c50b468109f8"
         },
         {
           "source": "src/project_forge_deployment/cloudflare_ingress_remote.py",
@@ -412,7 +412,7 @@
         {
           "source": "src/project_forge_deployment/cloudflare_route_apply.py",
           "destination": "tools/project-forge-deployment/project_forge_deployment/cloudflare_route_apply.py",
-          "sha256": "eea7a5b4322e0601db36d28cb0529522d6acc37c55dfc9a7b41d91518fe14cd4"
+          "sha256": "d3fe77a2f61ae281308ad1046ee1e6e5ea460f3605c5cd275cc16cff3e9bb568"
         },
         {
           "source": "src/project_forge_deployment/cli.py",

package/assets/generated/deployment/src/project_forge_deployment/cloudflare_ingress.py

@@ -37,6 +37,11 @@ PUBLIC_INGRESS_ROUTE_WRITE_PHRASE = "[PUBLIC INGRESS ROUTE WRITE]"
 PUBLIC_INGRESS_ROUTE_REMOVE_PHRASE = "[PUBLIC INGRESS ROUTE REMOVE]"
 CLOUDFLARE_API_TOKEN_ENV = "PROJECT_FORGE_CLOUDFLARE_API_TOKEN"
 
+
+class CloudflarePostWriteVerificationError(DeploymentKitError):
+    """Final public-route verification failed after mutations completed."""
+
+
 _SLUG_RE = re.compile(r"^[a-z0-9](?:[a-z0-9-]{0,61}[a-z0-9])?$")
 _REPO_RE = re.compile(r"^[A-Za-z0-9_.-]+/[A-Za-z0-9_.-]+$")
 _LABEL_RE = re.compile(r"^[a-z0-9](?:[a-z0-9-]{0,61}[a-z0-9])?$")
@@ -698,27 +703,32 @@ def apply_public_route(plan: dict[str, Any], *, api_token: str) -> dict[str, Any
                 pass
         raise
 
-    final_inventory = cloudflare_route_inventory(name, scope)
-    if _find_route(final_inventory, spec["routeId"]) != spec:
-        raise DeploymentKitError("Public route registration returned without exact host ownership metadata.")
-    final_config = cloudflare_api.get_tunnel_configuration(api_token, host["accountId"], host["tunnelId"])
-    if final_config != plan["desiredTunnelConfig"]:
-        raise DeploymentKitError("Cloudflare tunnel configuration does not match the reviewed route plan after apply.")
-    final_dns = _exact_dns_record(
-        cloudflare_api.list_dns_records(api_token, host["zoneId"], name=spec["publicHostname"]),
-        spec=spec,
-        tunnel_id=host["tunnelId"],
-    )
-    if final_dns is None:
-        raise DeploymentKitError("Cloudflare DNS record is missing after public-route apply.")
-    return {
-        "targetName": name,
-        "scope": scope,
-        "route": spec,
-        "dnsRecordId": str(final_dns["id"]),
-        "publicUrl": f"https://{spec['publicHostname']}",
-        "mutated": True,
-    }
+    try:
+        final_inventory = cloudflare_route_inventory(name, scope)
+        if _find_route(final_inventory, spec["routeId"]) != spec:
+            raise DeploymentKitError("Public route registration returned without exact host ownership metadata.")
+        final_config = cloudflare_api.get_tunnel_configuration(api_token, host["accountId"], host["tunnelId"])
+        if final_config != plan["desiredTunnelConfig"]:
+            raise DeploymentKitError("Cloudflare tunnel configuration does not match the reviewed route plan after apply.")
+        final_dns = _exact_dns_record(
+            cloudflare_api.list_dns_records(api_token, host["zoneId"], name=spec["publicHostname"]),
+            spec=spec,
+            tunnel_id=host["tunnelId"],
+        )
+        if final_dns is None:
+            raise DeploymentKitError("Cloudflare DNS record is missing after public-route apply.")
+        return {
+            "targetName": name,
+            "scope": scope,
+            "route": spec,
+            "dnsRecordId": str(final_dns["id"]),
+            "publicUrl": f"https://{spec['publicHostname']}",
+            "mutated": True,
+        }
+    except Exception as error:
+        raise CloudflarePostWriteVerificationError(
+            f"Cloudflare public-route post-write verification failed: {error}"
+        ) from error
 
 
 def plan_public_route_removal(

package/assets/generated/deployment/src/project_forge_deployment/cloudflare_route_apply.py

@@ -17,12 +17,6 @@ from .errors import DeploymentKitError
 from .profiles import load_profile
 from .ssh import verify_access
 
-_FINAL_VERIFICATION_ERRORS = {
-    "Public route registration returned without exact host ownership metadata.",
-    "Cloudflare tunnel configuration does not match the reviewed route plan after apply.",
-    "Cloudflare DNS record is missing after public-route apply.",
-}
-
 
 def _reviewed_config_matches(actual: Any, reviewed: Any) -> bool:
     """Match reviewed config after removing only the observed safe provider default."""
@@ -113,23 +107,32 @@ def _rollback_final_state(
     return errors
 
 
+def _uncertain_recovery_error(
+    original_error: Exception,
+    recovery_error: Exception,
+) -> DeploymentKitError:
+    return DeploymentKitError(
+        "Cloudflare public-route final verification failed, and recovery could not read "
+        "the current host/provider state. External state is uncertain and rollback was "
+        "not attempted because current ownership could not be verified safely. "
+        f"Original verification error: {original_error} "
+        f"Recovery read failed: {recovery_error} "
+        "Inspect the managed host route, tunnel configuration, and DNS record before retrying."
+    )
+
+
 def apply_public_route(plan: dict[str, Any], *, api_token: str) -> dict[str, Any]:
     """Apply a reviewed public route with bounded post-write recovery.
 
     The underlying apply retains all pre-write stale-state checks and its write
-    rollback.  Recovery is entered only for errors that are emitted exclusively
-    by the final verification phase, so preflight failures can never be turned
+    rollback. Recovery is entered only for the typed error emitted by the
+    post-write verification phase, so preflight failures can never be turned
     into success by observing later provider state.
     """
     try:
         return ingress.apply_public_route(plan, api_token=api_token)
-    except Exception as original_error:
-        if (
-            not isinstance(original_error, DeploymentKitError)
-            or str(original_error) not in _FINAL_VERIFICATION_ERRORS
-            or not isinstance(plan, dict)
-            or plan.get("action") != "register"
-        ):
+    except ingress.CloudflarePostWriteVerificationError as original_error:
+        if not isinstance(plan, dict) or plan.get("action") != "register":
             raise
         required = {
             "targetName", "scope", "route", "previousRoute", "tunnelConfig",
@@ -140,8 +143,8 @@ def apply_public_route(plan: dict[str, Any], *, api_token: str) -> dict[str, Any
 
         try:
             state = _read_final_state(plan, api_token=api_token)
-        except Exception:
-            raise original_error
+        except Exception as recovery_error:
+            raise _uncertain_recovery_error(original_error, recovery_error) from recovery_error
 
         route_ok = state["route"] == plan["route"]
         config_ok = _reviewed_config_matches(state["config"], plan["desiredTunnelConfig"])
@@ -159,7 +162,9 @@ def apply_public_route(plan: dict[str, Any], *, api_token: str) -> dict[str, Any
         rollback_errors = _rollback_final_state(plan, state, api_token=api_token)
         if rollback_errors:
             raise DeploymentKitError(
-                "Cloudflare public-route final verification failed and rollback was incomplete: "
+                "Cloudflare public-route final verification failed and rollback was incomplete; "
+                "external state may remain changed. "
                 + "; ".join(rollback_errors)
+                + " Inspect the managed host route, tunnel configuration, and DNS record before retrying."
             ) from original_error
         raise original_error

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@mriekki/project-forge",
-  "version": "4.10.1",
+  "version": "4.10.3",
   "description": "Public consumer distribution and updater for Project Forge engineering assets.",
   "type": "module",
   "bin": {