@wtfalch/foundry 0.1.0 → 0.2.0

package/dist/plan/executor.js

@@ -0,0 +1,507 @@
+// ---------------------------------------------------------------------------
+// Errors
+// ---------------------------------------------------------------------------
+/**
+ * Thrown by name for a step this executor deliberately does not implement:
+ * mail and chat (no admin API exists yet in either service) and the cms
+ * site (same), plus moving the issuer onto or off the org's domain (built,
+ * but not in v1 — domain verification and passkey invalidation need their
+ * own design). Never carries a token, secret or key (task brief: "errors
+ * carry the step and the provider's status only").
+ */
+export class NotBuiltError extends Error {
+    constructor(step, detail) {
+        super(`${step} is not built yet -- ${detail}`);
+        this.name = 'NotBuiltError';
+    }
+}
+/** `coolify:app` needs source code to build from; `DeclaredOrg.bespokeAppRepo` is the only source this executor knows (#71, #20). */
+export class MissingBespokeAppRepoError extends Error {
+    constructor(slug) {
+        super(`${slug} has no declared bespokeAppRepo; coolify:app cannot provision a hosted app without one`);
+        this.name = 'MissingBespokeAppRepoError';
+    }
+}
+// ---------------------------------------------------------------------------
+// Hostnames
+// ---------------------------------------------------------------------------
+/**
+ * `<slug>.oikos.host` (`../slug.ts`), or `DeclaredOrg.domain` once
+ * `hosting.usesDomain` is true — the same rule `diff.ts`'s `planApp` and
+ * `planSite` document, reused here for the org's own hosted app, its
+ * Cloudflare tunnel ingress and its ZITADEL issuer apps' redirect URIs
+ * (task brief: "Hostnames: `<slug>.oikos.host` ... or `DeclaredOrg.domain`
+ * when `hosting.usesDomain`").
+ */
+function hostnameFor(org) {
+    return org.hosting.usesDomain && org.domain ? org.domain : `${org.slug}.oikos.host`;
+}
+/**
+ * Every app on the Coolify box shares one Traefik reverse proxy, and Coolify
+ * itself points that proxy's routing at whatever `domains` an application
+ * declares (`coolifyApp`'s `hostnameFor(org)`) -- so a tunnel's ingress only
+ * has to reach the proxy, never a specific app container.
+ * `wtfalch/app-template`'s bootstrap (`bootstrap/steps/cf-tunnel.ts`, prior
+ * art for the exact org this file's `cloudflareTunnel` implements, cited by
+ * https://github.com/wtfalch/foundry/issues/71) names this same constant and
+ * value.
+ */
+const COOLIFY_PROXY_ORIGIN = 'http://coolify-proxy:80';
+// ---------------------------------------------------------------------------
+// Executor
+// ---------------------------------------------------------------------------
+export class FoundryStepExecutor {
+    ports;
+    constructor(ports) {
+        this.ports = ports;
+    }
+    async execute(action, context) {
+        const { org } = context;
+        switch (`${action.system}:${action.kind}`) {
+            case 'zitadel:issuer':
+                return this.zitadelIssuer(action, org, context);
+            case 'zitadel:owner':
+                return this.zitadelOwner(action, org, context);
+            case 'zitadel:app':
+                return this.zitadelApp(action, org, context);
+            case 'zitadel:customers':
+                return this.zitadelCustomers(org, context);
+            case 'coolify:app':
+                return this.coolifyApp(action, org, context);
+            case 'coolify:database':
+                return this.coolifyDatabase(action, org, context);
+            case 'cloudflare:tunnel':
+                return this.cloudflareTunnel(action, org, context);
+            case 'cloudflare:zone':
+                return this.cloudflareZone(action);
+            case 'files:organisation':
+                return this.filesOrganisation(action, org);
+            case 'files:storage':
+                return this.filesStorage(action, org);
+            case 'ai:organisation':
+                return this.aiOrganisation(action, org);
+            case 'ai:budget':
+                return this.aiBudget(action, org);
+            case 'coolify:mail':
+                throw new NotBuiltError(`coolify:mail for ${org.slug}`, 'mail has no Stalwart admin API yet; tracked at https://github.com/wtfalch/email/issues/96');
+            case 'coolify:chat':
+                throw new NotBuiltError(`coolify:chat for ${org.slug}`, "chat's per-org Synapse+MAS has no admin API yet; tracked at https://github.com/wtfalch/chat/issues/40");
+            case 'cms:site':
+                throw new NotBuiltError(`cms:site for ${org.slug}`, 'the cms site has no admin API yet; tracked at https://github.com/wtfalch/cms/issues/20');
+            default:
+                throw new Error(`FoundryStepExecutor has no dispatch for ${action.system}:${action.kind}`);
+        }
+    }
+    // ---- zitadel --------------------------------------------------------
+    async zitadelIssuer(action, org, context) {
+        if (action.desired.provision !== true) {
+            // Moving an already-provisioned issuer onto or off the org's domain
+            // (decisions file: "domain verification and passkey invalidation need
+            // their own design" -- not built in v1).
+            throw new NotBuiltError(`zitadel:issuer move for ${org.slug}`, 'moving the issuer onto or off the org\'s own domain is not built in v1; see foundry\'s .claude/decisions-2026-09-24-executor.md, "Executor decisions"');
+        }
+        const { org: zOrg } = await this.ports.zitadel.findOrCreateOrg(org.slug);
+        context.recordScopeId('zitadel_org', zOrg.id);
+        return { resourceId: zOrg.id };
+    }
+    /**
+     * `plan/diff.ts`'s `planOwner`: invites the org's owner into its ZITADEL
+     * org by email. Never logs, returns or throws the email itself -- only the
+     * invited user id, handed back as `resourceId` so `runSteps` records it
+     * under `zitadel:owner:<orgId>`, which is exactly what makes the next
+     * `plan()` call idempotent (`planOwner` plans nothing once that key is
+     * recorded).
+     */
+    async zitadelOwner(action, org, context) {
+        const zitadelOrgId = context.recordedIds().zitadel_org;
+        if (!zitadelOrgId) {
+            throw new Error(`zitadel:owner for ${org.slug}: no ZITADEL org recorded yet -- the issuer must be provisioned first`);
+        }
+        const { userId } = await this.ports.zitadel.inviteOrgOwner(zitadelOrgId, {
+            givenName: action.desired.givenName,
+            familyName: action.desired.familyName,
+            email: action.desired.email,
+        });
+        return { resourceId: userId };
+    }
+    /**
+     * `plan/diff.ts`'s `planCustomers` (plan gap A9): the org's customers sign
+     * in through a second ZITADEL org, `<slug> customers`, with
+     * self-registration on and a grant to the org's app project. Staff stay in
+     * the org's own invite-only ZITADEL org. The space keeps the name apart from
+     * every issuer org, which is named by a slug and a slug has no spaces. Every call here is idempotent, so
+     * a re-run after a crash finishes the job.
+     */
+    async zitadelCustomers(org, context) {
+        const zitadelOrgId = context.recordedIds().zitadel_org;
+        if (!zitadelOrgId) {
+            throw new Error(`zitadel:customers for ${org.slug}: no ZITADEL org recorded yet -- the issuer must be provisioned first`);
+        }
+        const projectId = await this.ensureZitadelProject(org, zitadelOrgId, context);
+        const { org: customers } = await this.ports.zitadel.findOrCreateOrg(`${org.slug} customers`);
+        await this.ports.zitadel.allowSelfRegistration(customers.id);
+        await this.ports.zitadel.findOrCreateProjectGrant(zitadelOrgId, projectId, customers.id);
+        return { resourceId: customers.id };
+    }
+    async zitadelApp(action, org, context) {
+        const appType = action.desired.appType;
+        const recorded = context.recordedIds();
+        const zitadelOrgId = recorded.zitadel_org;
+        if (!zitadelOrgId) {
+            throw new Error(`zitadel:app '${action.key}' for ${org.slug}: no ZITADEL org recorded yet -- the issuer must be provisioned first`);
+        }
+        const projectId = await this.ensureZitadelProject(org, zitadelOrgId, context);
+        // A kind change deletes the recorded app then recreates it (task
+        // brief); the first-ever create for this key has nothing recorded, so
+        // this is a no-op then.
+        const priorAppId = recorded[`zitadel:app:${action.key}`];
+        if (priorAppId) {
+            await this.ports.zitadel.deleteApp(zitadelOrgId, projectId, priorAppId);
+        }
+        if (appType === 'api') {
+            const created = await this.ports.zitadel.createApiApp(zitadelOrgId, projectId, {
+                name: action.key,
+            });
+            // Handed off once, right here, before returning -- never in the
+            // return value, `serviceIds`, the store, a log or a thrown error (see
+            // `FoundryStepExecutorPorts.deliverSecret`'s doc comment).
+            await this.ports.deliverSecret(`zitadel:app:${org.slug}:${action.key}`, created.clientSecret);
+            return { resourceId: created.appId };
+        }
+        const hostname = hostnameFor(org);
+        // Native apps sign in via device code, with no redirect of their own
+        // (auth/scripts/provision.mjs:475-497, prior art cited in the decisions
+        // file) -- empty arrays rather than a web app's callback/logout URLs.
+        const created = await this.ports.zitadel.createOidcApp(zitadelOrgId, projectId, {
+            name: action.key,
+            appType,
+            redirectUris: appType === 'native' ? [] : [`https://${hostname}/auth/callback`],
+            postLogoutRedirectUris: appType === 'native' ? [] : [`https://${hostname}/`],
+        });
+        return { resourceId: created.appId };
+    }
+    async ensureZitadelProject(org, zitadelOrgId, context) {
+        const recorded = context.recordedIds();
+        const existing = recorded.zitadel_project;
+        if (existing)
+            return existing;
+        const { project } = await this.ports.zitadel.findOrCreateProject(zitadelOrgId, org.slug);
+        context.recordScopeId('zitadel_project', project.id);
+        return project.id;
+    }
+    // ---- coolify ---------------------------------------------------------
+    async ensureCoolifyProject(org, context) {
+        const recorded = context.recordedIds();
+        const existing = recorded.coolify_project;
+        if (existing)
+            return existing;
+        const found = await this.ports.coolify.findProjectByName(org.slug);
+        const projectUuid = found
+            ? found.uuid
+            : (await this.ports.coolify.createProject(org.slug)).uuid;
+        context.recordScopeId('coolify_project', projectUuid);
+        return projectUuid;
+    }
+    async resolveServer() {
+        const servers = await this.ports.coolify.listServers();
+        const server = servers.find((s) => s.is_usable && s.is_reachable) ?? servers[0];
+        if (!server)
+            throw new Error('no usable Coolify server is registered on this instance');
+        return server;
+    }
+    async coolifyApp(action, org, context) {
+        if (action.desired.enabled === false) {
+            const appId = context.recordedIds()[`coolify:app:${action.key}`];
+            if (!appId) {
+                throw new Error(`coolify:app for ${org.slug}: no live app recorded, nothing to park`);
+            }
+            await this.ports.coolify.raw('POST', `/applications/${appId}/stop`);
+            return { resourceId: appId };
+        }
+        if (!org.bespokeAppRepo)
+            throw new MissingBespokeAppRepoError(org.slug);
+        const projectUuid = await this.ensureCoolifyProject(org, context);
+        const { environment } = await this.ports.coolify.findOrCreateEnvironment(projectUuid, 'production');
+        const existing = await this.ports.coolify.findApplicationByName(org.slug, {
+            environmentIds: [environment.id],
+        });
+        let appId;
+        if (existing) {
+            appId = existing.uuid;
+        }
+        else {
+            const server = await this.resolveServer();
+            const githubApp = await this.ports.coolify.requireGithubApp();
+            const created = await this.ports.coolify.createGithubAppApplication({
+                project_uuid: projectUuid,
+                server_uuid: server.uuid,
+                environment_name: environment.name,
+                environment_uuid: environment.uuid,
+                github_app_uuid: githubApp.uuid,
+                git_repository: org.bespokeAppRepo,
+                git_branch: org.hosting.gitBranch,
+                build_pack: org.hosting.buildPack,
+                name: org.slug,
+                domains: hostnameFor(org),
+            });
+            appId = created.uuid;
+        }
+        // The database plans before the app (`diff.ts`'s `computePlanDetail`,
+        // hosting-wiring campaign) so that, on the same apply, the database's
+        // resource id is already recorded by the time this runs -- but this also
+        // covers the database being turned on after the app already exists (the
+        // app step still ran this apply, found the app by name, and lands here).
+        if (org.hosting.database) {
+            const dbId = context.recordedIds()[`coolify:database:${action.key}`];
+            if (dbId)
+                await this.pushDatabaseUrl(appId, dbId);
+        }
+        return { resourceId: appId };
+    }
+    async coolifyDatabase(action, org, context) {
+        if (action.desired.enabled === false) {
+            const dbId = context.recordedIds()[`coolify:database:${action.key}`];
+            if (!dbId) {
+                throw new Error(`coolify:database for ${org.slug}: no live database recorded, nothing to park`);
+            }
+            await this.ports.coolify.raw('POST', `/databases/${dbId}/stop`);
+            return { resourceId: dbId };
+        }
+        const existing = context.recordedIds()[`coolify:database:${action.key}`];
+        let dbId;
+        if (existing) {
+            dbId = existing;
+        }
+        else {
+            const projectUuid = await this.ensureCoolifyProject(org, context);
+            const { environment } = await this.ports.coolify.findOrCreateEnvironment(projectUuid, 'production');
+            const name = `${org.slug}-db`;
+            const found = (await this.ports.coolify.listDatabases()).find((db) => db.name === name && db.environment_id === environment.id);
+            if (found) {
+                dbId = found.uuid;
+            }
+            else {
+                const server = await this.resolveServer();
+                const dbName = org.slug.replace(/-/g, '_');
+                const created = await this.ports.coolify.createPostgresDatabase({
+                    project_uuid: projectUuid,
+                    server_uuid: server.uuid,
+                    environment_name: environment.name,
+                    environment_uuid: environment.uuid,
+                    name,
+                    postgres_db: dbName,
+                    postgres_user: dbName,
+                });
+                dbId = created.uuid;
+            }
+        }
+        // Handles the database being provisioned after the app already exists
+        // (`coolifyApp`'s own push handles the more common order, database
+        // before app on the same apply -- `diff.ts`'s `computePlanDetail`).
+        const appId = context.recordedIds()[`coolify:app:${action.key}`];
+        if (appId)
+            await this.pushDatabaseUrl(appId, dbId);
+        return { resourceId: dbId };
+    }
+    /**
+     * Pushes the database's connection string into the app's environment as
+     * `DATABASE_URL` -- never also as `DATABASE_URL_OWNER` (Decision, this
+     * campaign's report). Archon's own boot script
+     * (`archon/scripts/migrate-and-start.sh`) treats a bare `DATABASE_URL` with
+     * no `DATABASE_URL_OWNER` as "before the split": it migrates and serves as
+     * the one role it has, which is exactly what a database Coolify just
+     * created (one superuser role, no separate runtime role yet) is. Setting
+     * both to the *same* superuser URL would instead take the split branch --
+     * `db-role-guard.sh` then refuses to boot, since `DATABASE_URL_OWNER` being
+     * set means it expects `DATABASE_URL` to connect as a distinct,
+     * non-superuser runtime role (`<database>_rt`), which nothing here creates.
+     * Minting that role's own password and URL is a provisioning step of its
+     * own, not built here (Finding, this campaign's report).
+     *
+     * The connection string is a live credential
+     * (`postgres://user:password@host/db`): it is read from
+     * `CoolifyPort.getDatabase` and handed straight to `bulkUpsertEnvs` and
+     * nowhere else in this class -- never returned, never recorded in
+     * `serviceIds` (hence never in the store or an audit record), never logged,
+     * never interpolated into a thrown error.
+     */
+    async pushDatabaseUrl(appId, dbId) {
+        const db = await this.ports.coolify.getDatabase(dbId);
+        if (!db.internal_db_url)
+            return;
+        await this.ports.coolify.bulkUpsertEnvs(appId, [
+            { key: 'DATABASE_URL', value: db.internal_db_url },
+        ]);
+    }
+    // ---- cloudflare --------------------------------------------------------
+    async cloudflareTunnel(action, org, context) {
+        if (action.desired.enabled === false) {
+            const tunnelId = context.recordedIds()[`cloudflare:tunnel:${action.key}`];
+            if (!tunnelId) {
+                throw new Error(`cloudflare:tunnel for ${org.slug}: no live tunnel recorded, nothing to park`);
+            }
+            // Cleared, not deleted (#7 corrections 1): an ingress with only the
+            // mandatory catch-all routes nothing.
+            await this.ports.cloudflare.putTunnelConfig(tunnelId, {
+                ingress: [{ service: 'http_status:404' }],
+            });
+            return { resourceId: tunnelId };
+        }
+        const tunnelName = `${org.slug}-tunnel`;
+        const existing = await this.ports.cloudflare.findTunnelByName(tunnelName);
+        const tunnel = existing ?? (await this.ports.cloudflare.createTunnel(tunnelName));
+        const hostname = hostnameFor(org);
+        // Routes the app's own hostname to Coolify's own Traefik reverse proxy,
+        // not a per-app container address -- `COOLIFY_PROXY_ORIGIN`, the same
+        // constant name and value `wtfalch/app-template`'s prior art used
+        // (`bootstrap/steps/cf-tunnel.ts`, offline.tf's bootstrap, cited by
+        // https://github.com/wtfalch/foundry/issues/71): every app on the
+        // Coolify box already gets a Traefik route from the `domains` its
+        // `coolify:app` step declared (`hostnameFor(org)`, this file's
+        // `coolifyApp`), so a cloudflared connector joined to the same Docker
+        // network only has to reach Traefik and let it route by Host header --
+        // the connector never needs to know the app's own container name or
+        // uuid. Verified evidence, not a guess (see this campaign's report);
+        // `http://<slug>:3000`, the placeholder this replaces, named a container
+        // and port no `coolify:app` step here ever configures.
+        await this.ports.cloudflare.putTunnelConfig(tunnel.id, {
+            ingress: [{ hostname, service: COOLIFY_PROXY_ORIGIN }, { service: 'http_status:404' }],
+        });
+        return { resourceId: tunnel.id };
+    }
+    async cloudflareZone(action) {
+        const domain = action.key;
+        const existing = await this.ports.cloudflare.findZoneByApex(domain);
+        if (existing)
+            return { resourceId: existing.id };
+        const created = await this.ports.cloudflare.createZone(domain);
+        return { resourceId: created.id };
+    }
+    // ---- files / ai --------------------------------------------------------
+    /**
+     * #80: provisions the org's own organisation on Files, before
+     * {@link filesStorage} can set its spend limit. `provisionOrganisation` is
+     * safely repeatable on its own (`FilesOrganisationPort`'s doc comment), so
+     * this is called every time regardless of whether it already ran --
+     * idempotent by find-or-create, not by checking `recordedIds` first.
+     */
+    async filesOrganisation(action, org) {
+        const provisioned = await this.ports.filesOrganisation.provisionOrganisation({
+            organisationId: org.id,
+            ceilingBytes: action.desired.ceilingBytes ?? null,
+            ceilingMicros: action.desired.ceilingMicros ?? null,
+        });
+        return { resourceId: provisioned.organisationId };
+    }
+    async filesStorage(action, org) {
+        const limits = this.ports.filesLimitsFor(org.id);
+        await limits.setQuota(action.desired.limitBytes ?? null);
+        await limits.setBudget(action.desired.limitMicros ?? null);
+        return { resourceId: org.id };
+    }
+    /**
+     * #80: provisions the org's own organisation on AI and switches its AI use
+     * on, before {@link aiBudget} can set its own spend limit. Both
+     * `provisionOrganisation` and `setOrganisationOffers` are safely repeatable
+     * on their own (`AiOrganisationPort`'s doc comment), so both are called
+     * every time regardless of whether they already ran.
+     */
+    async aiOrganisation(action, org) {
+        const provisioned = await this.ports.aiOrganisation.provisionOrganisation({
+            organisationId: org.id,
+            limitMicros: action.desired.limitMicros ?? null,
+        });
+        await this.ports.aiOrganisation.setOrganisationOffers(org.id, action.desired.offers ?? []);
+        return { resourceId: provisioned.organisationId };
+    }
+    async aiBudget(action, org) {
+        const limitMicros = action.desired.limitMicros ?? null;
+        if (limitMicros === null) {
+            // ai/packages/sdk/src/types.ts:134-137's UpdateBudget.limitMicros is a
+            // required string -- there is no "uncapped" this API can express yet
+            // (Finding, this campaign's report).
+            throw new Error(`ai:budget for ${org.slug}: AI's updateBudget has no uncapped representation (UpdateBudget.limitMicros is a required string); declare a numeric limit until AI's API adds one`);
+        }
+        const limits = this.ports.aiLimitsFor(org.id);
+        await limits.updateBudget({ keyId: null, limitMicros });
+        return { resourceId: org.id };
+    }
+    // ---- destroy -------------------------------------------------------------
+    /**
+     * {@link StepDestroyer.destroy}: deletes the one resource
+     * `FoundryPlanApply.destroy` names. A provider 404 (already gone) counts as
+     * deleted -- `isNotFoundError` below -- since a destroy retried after a
+     * partial failure must find an already-deleted resource a no-op, not a new
+     * error.
+     */
+    async destroy(target, context) {
+        const { org, recordedIds } = context;
+        try {
+            switch (`${target.system}:${target.kind}`) {
+                case 'cloudflare:tunnel':
+                    await this.ports.cloudflare.deleteTunnel(target.id);
+                    return;
+                case 'coolify:app':
+                    await this.ports.coolify.deleteApplication(target.id);
+                    return;
+                case 'coolify:database':
+                    await this.ports.coolify.deleteDatabase(target.id);
+                    return;
+                case 'zitadel:app': {
+                    const zitadelOrgId = recordedIds.zitadel_org;
+                    const projectId = recordedIds.zitadel_project;
+                    if (!zitadelOrgId || !projectId) {
+                        throw new Error(`zitadel:app '${target.key}' for ${org.slug}: no ZITADEL org/project recorded, cannot delete`);
+                    }
+                    await this.ports.zitadel.deleteApp(zitadelOrgId, projectId, target.id);
+                    return;
+                }
+                case 'zitadel:project': {
+                    const zitadelOrgId = recordedIds.zitadel_org;
+                    if (!zitadelOrgId) {
+                        throw new Error(`zitadel:project for ${org.slug}: no ZITADEL org recorded, cannot delete project`);
+                    }
+                    await this.ports.zitadel.deleteProject(zitadelOrgId, target.id);
+                    return;
+                }
+                case 'zitadel:customers':
+                case 'zitadel:org':
+                    await this.ports.zitadel.deleteOrg(target.id);
+                    return;
+                default:
+                    throw new Error(`FoundryStepExecutor has no destroy dispatch for ${target.system}:${target.kind}`);
+            }
+        }
+        catch (error) {
+            if (isNotFoundError(error))
+                return;
+            throw error;
+        }
+    }
+}
+/**
+ * True for a provider's own "already gone" response, however it surfaces --
+ * `@wtfalch/providers`' `ZitadelError` carries a structured `status: number`
+ * (`zitadel.ts`), while its Coolify and Cloudflare clients throw a plain
+ * `Error` whose message embeds the HTTP status (`` `Coolify ${method} ${path}
+ * → ${status}: ${text}` ``, `` `CF ${method} ${path} → ${status}: ${msg}` ``).
+ * Ports are structural here (this file's own top comment: never import a
+ * concrete provider class), so this cannot `instanceof`-check a real error
+ * type -- it duck-types a `status` field first.
+ *
+ * A prior version fell back to scanning the *whole* message for a standalone
+ * `404` when no `status` field was present. That is unsafe: the Coolify and
+ * Cloudflare clients put the resource path -- which can contain a hex UUID
+ * -- ahead of the status in the message, so a UUID that happens to contain
+ * the digits `404` (`9a404b12-...`) made a genuine 500 read as a 404. The
+ * fallback below instead anchors to the exact position both clients put the
+ * status in: the first `→ `, after the client, method and path, and before
+ * `:`. It never scans the path or the response body.
+ */
+function isNotFoundError(error) {
+    const status = error?.status;
+    if (typeof status === 'number')
+        return status === 404;
+    const message = error instanceof Error ? error.message : String(error);
+    return /^\S+ \S+ \S+ → 404:/.test(message);
+}

package/dist/plan/index.d.ts

@@ -2,7 +2,9 @@ export type { LiveResource, ZitadelReader, CoolifyReader, CloudflareReader, File
 export { readLiveResources } from './live.js';
 export type { StepAction, PlannedStep, PlanDetail } from './diff.js';
 export { computePlanDetail, toPlan } from './diff.js';
-export type { AuditActor, AuditLog, AuthzGate, StepExecutor, FoundryPlanApplyOptions, } from './plan-apply.js';
-export { FoundryPlanApply, DeclaredOrgNotFoundError, StalePlanError, ConfirmationRequiredError, NotAuthorizedError, } from './plan-apply.js';
-export type { ScopeResolver } from './providers-readers.js';
-export { ProvidersCloudflareReader, ProvidersCoolifyReader, ProvidersZitadelReader, storeScopeResolver, } from './providers-readers.js';
+export type { AuditActor, AuditLog, AuthzGate, StepExecutor, StepDestroyer, DestroyTarget, StepExecutionContext, FoundryPlanApplyOptions, } from './plan-apply.js';
+export { FoundryPlanApply, DeclaredOrgNotFoundError, StalePlanError, ConfirmationRequiredError, NotAuthorizedError, NotATestOrgError, } from './plan-apply.js';
+export type { ScopeResolver, RecordedIds } from './providers-readers.js';
+export { ProvidersCloudflareReader, ProvidersCoolifyReader, ProvidersZitadelReader, storeScopeResolver, storeRecordedIds, } from './providers-readers.js';
+export type { CoolifyPort, CloudflarePort, ZitadelPort, FilesOrgLimits, AiOrgLimits, FilesOrganisationPort, AiOrganisationPort, FoundryStepExecutorPorts, } from './executor.js';
+export { FoundryStepExecutor, NotBuiltError, MissingBespokeAppRepoError } from './executor.js';

package/dist/plan/index.js

@@ -1,4 +1,5 @@
 export { readLiveResources } from './live.js';
 export { computePlanDetail, toPlan } from './diff.js';
-export { FoundryPlanApply, DeclaredOrgNotFoundError, StalePlanError, ConfirmationRequiredError, NotAuthorizedError, } from './plan-apply.js';
-export { ProvidersCloudflareReader, ProvidersCoolifyReader, ProvidersZitadelReader, storeScopeResolver, } from './providers-readers.js';
+export { FoundryPlanApply, DeclaredOrgNotFoundError, StalePlanError, ConfirmationRequiredError, NotAuthorizedError, NotATestOrgError, } from './plan-apply.js';
+export { ProvidersCloudflareReader, ProvidersCoolifyReader, ProvidersZitadelReader, storeScopeResolver, storeRecordedIds, } from './providers-readers.js';
+export { FoundryStepExecutor, NotBuiltError, MissingBespokeAppRepoError } from './executor.js';

package/dist/plan/live.d.ts

@@ -3,10 +3,14 @@ import type { OrgId } from '../org.js';
  * One resource as seen live in one of foundry's six systems.
  *
  * `key` is unique within `(system, kind)`. Per-org singleton resources
- * (issuer, mail, chat, storage's spend limit, AI's budget, the cms site —
- * see `diff.ts`) are keyed by the {@link OrgId} itself; anything else foundry can see in
- * that system's account/org is keyed however that system names it, so it can
- * still be matched, or left
+ * (issuer, mail, chat, storage's spend limit, AI's budget, the cms site, the
+ * org's own app, its database, its Cloudflare tunnel — see `diff.ts`) are
+ * keyed by the {@link OrgId} itself. Two resources key by something else
+ * instead (#71): the Cloudflare zone is keyed by the domain name, since a
+ * zone belongs to a domain rather than an org, and each declared ZITADEL
+ * issuer app is keyed by its own declared name, since an org can declare
+ * more than one. Anything else foundry can see in that system's account/org
+ * is keyed however that system names it, so it can still be matched, or left
  * {@link https://github.com/wtfalch/foundry/issues/10 unmanaged}, by
  * `computePlanDetail`.
  */