@wtfalch/foundry 0.16.6 → 0.16.7

package/dist/index.d.ts

@@ -23,6 +23,8 @@ export { PlatformOrgBlockedError, PlatformOrgPorts } from './plan/index.js';
 export type { CoolifyPort, CloudflarePort, ZitadelPort, CallsSfuPort, JobsSchedulerPort, FilesOrganisationPort, AiOrganisationPort, FoundryStepExecutorPorts, PlatformOrgPortSource, AgoraHostPort, AgoraHostValues, LoginHostBinding, LoginHostBindingsPort, } from './plan/index.js';
 export { FoundryStepExecutor, NotBuiltError, healthUrls, loginHostnameFor } from './plan/index.js';
 export { HttpJobsSchedulerClient } from './plan/index.js';
+export type { ZitadelListAppsRawApp } from './plan/index.js';
+export { adaptZitadelListApps } from './plan/index.js';
 export type { MailIdentityApp, MailIdentityAudienceCheck } from './plan/index.js';
 export { checkMailIdentityAudience } from './plan/index.js';
 export type { MailAllowlistApp } from './plan/index.js';

package/dist/index.js

@@ -10,6 +10,7 @@ export { DEFAULT_ORG_PLATFORM_READINESS, ORG_PLATFORM_KEY_REFS, agoraHostValuesF
 export { PlatformOrgBlockedError, PlatformOrgPorts } from './plan/index.js';
 export { FoundryStepExecutor, NotBuiltError, healthUrls, loginHostnameFor } from './plan/index.js';
 export { HttpJobsSchedulerClient } from './plan/index.js';
+export { adaptZitadelListApps } from './plan/index.js';
 export { checkMailIdentityAudience } from './plan/index.js';
 export { checkMailAppsAllowlist } from './plan/index.js';
 export { FoundryPlatformStepExecutor, ProvidersPlatformCloudflareReader, ProvidersPlatformCoolifyReader, createZitadelAdminMinter, createZitadelProjectRoles, PLATFORM_AUTH_KEY, PLATFORM_MAIL_KEY, PLATFORM_MAIL_ADMIN_KEY_DESCRIPTION, } from './plan/index.js';

package/dist/plan/index.d.ts

@@ -35,4 +35,6 @@ export type { MailAllowlistApp } from './mail-identity-allowlist.js';
 export { checkMailAppsAllowlist } from './mail-identity-allowlist.js';
 export type { CoolifyPort, CloudflarePort, ZitadelPort, CallsSfuPort, JobsSchedulerPort, FilesOrganisationPort, AiOrganisationPort, FoundryStepExecutorPorts, PlatformOrgPortSource, } from './executor.js';
 export { FoundryStepExecutor, NotBuiltError, healthUrls } from './executor.js';
+export type { ZitadelListAppsRawApp } from './executor.js';
+export { adaptZitadelListApps } from './executor.js';
 export { HttpJobsSchedulerClient } from './jobs-scheduler-http.js';

package/dist/plan/index.js

@@ -18,4 +18,5 @@ export { loginHostnameFor } from './login-host.js';
 export { checkMailIdentityAudience } from './mail-identity.js';
 export { checkMailAppsAllowlist } from './mail-identity-allowlist.js';
 export { FoundryStepExecutor, NotBuiltError, healthUrls } from './executor.js';
+export { adaptZitadelListApps } from './executor.js';
 export { HttpJobsSchedulerClient } from './jobs-scheduler-http.js';

package/dist/plan/platform-diff.js

@@ -1049,6 +1049,10 @@ function planSfu(platform) {
  * the broker's own token as part of running this step, and a step that is
  * never planned never runs. So this still plans the step -- surfacing
  * `executorBlocked` in `blocked` for visibility, not to stop planning.
+ * Exception (the auth-broker loop): once everything else is applied and
+ * `otherInputsMissing` is non-empty, nothing this step can do changes the
+ * missing inputs, so it is reported blocked and not planned -- else every
+ * `driveApply` round replans it until `maxRounds`.
  *
  * #211 round 6: round 3's `!brokerApplied` guard assumed "no executor" and
  * "broker not yet created" always coincide. They don't: a broker recorded on
@@ -1159,10 +1163,25 @@ function planAuth(platform, recordedIds, executorBlocked, executorMissing, authD
     // #211 round 3: a blocked reason with no broker yet created also means the
     // executor is unusable (no auth dependencies) -- nothing to plan.
     // A blocked reason with the broker already created means only its deploy
-    // is held back; plan the step anyway so it can keep retrying and, once
-    // #209/#210 land, deploy on the very next apply.
+    // is held back; plan the step anyway, so it can mint what it can (#209) and,
+    // once #210 lands, deploy on the very next apply.
     if (executorBlocked && !brokerApplied)
         return { step: null, blocked: executorBlocked };
+    // Loop fix: everything but the broker deploy is applied and that deploy
+    // waits on an input (`otherInputsMissing`, never the token this step mints)
+    // that another run supplies -- re-applying changes nothing, so the step
+    // planned and applied every `driveApply` round, with dozens of Coolify
+    // calls each, until `maxRounds`. Report it blocked and plan nothing; the
+    // next plan re-reads the live inputs, so it plans the step once they exist.
+    // The login client is not required here: `provisionPlatformAuth` mints it
+    // only once those same inputs exist, so it is never recorded before then.
+    if (executorBlocked &&
+        otherInputsMissing.length > 0 &&
+        recordedIds[key] &&
+        connectorApplied &&
+        recordedIds[PLATFORM_AUTH_ZITADEL_RUN_OPTIONS_SCOPE_KEY] === AUTH_ZITADEL_RUN_OPTIONS) {
+        return { step: null, blocked: executorBlocked };
+    }
     return {
         step: {
             action: {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@wtfalch/foundry",
-  "version": "0.16.6",
+  "version": "0.16.7",
   "description": "Foundry's SDK: the declared org's types, the plan and apply contracts, and the state store's interface.",
   "repository": {
     "type": "git",