@wtfalch/foundry 0.18.0 → 0.19.1

package/dist/plan/providers-readers.d.ts

@@ -1,6 +1,6 @@
 import type { CloudflareClient } from '@wtfalch/providers/cloudflare';
 import type { CoolifyClient } from '@wtfalch/providers/coolify';
-import type { ZitadelClient } from '@wtfalch/providers/zitadel';
+import { type ZitadelClient } from '@wtfalch/providers/zitadel';
 import type { OrgId } from '../org.js';
 import type { DeclaredOrgStore } from '../store.js';
 import type { CloudflareReader, CmsReader, CoolifyReader, LiveResource, ZitadelReader } from './live.js';
@@ -53,15 +53,17 @@ export type ScopeResolver = (orgId: OrgId) => Promise<string | null>;
  * resource it creates, keyed `system:kind:key` ({@link storeRecordedIds}
  * below reads those back), and #20's `FoundryStepExecutor` (`executor.ts`)
  * now also calls `StepExecutionContext.recordScopeId` for `coolify_project`,
- * `zitadel_org` and `zitadel_project`, so a resolver built with one of those
- * three `serviceKey`s returns the real id once that step has run. A
- * Cloudflare zone is the one scope id nothing writes yet: `executor.ts`'s
- * `cloudflareZone` records its result only under `cloudflare:zone:<domain>`
- * (a resource id, read back by {@link storeRecordedIds}), not under a plain
- * `cloudflare_zone` scope key — a resolver built with that `serviceKey`
- * still returns `null` for every org. That is the correct "nothing live yet"
- * answer: a reader passed `null` returns `[]`, which `computePlanDetail`
- * (`diff.ts`) already reads as "no live resource".
+ * `zitadel_org`, `zitadel_project` and (#510) `cloudflare_zone`, so a
+ * resolver built with one of those `serviceKey`s returns the real id once
+ * that step has run. Before #510, `cloudflareZone` recorded its result only
+ * under `cloudflare:zone:<domain>` (a resource id, read back by
+ * {@link storeRecordedIds}), never under the plain `cloudflare_zone` scope
+ * key — so a resolver built with that `serviceKey` always returned `null`,
+ * `ProvidersCloudflareReader.listResources` always returned `[]`, and
+ * `diff.ts`'s `planZone` re-proposed provisioning the zone on every apply
+ * even once it was live. A scope key that genuinely has nothing recorded yet
+ * still correctly resolves to `null`: a reader passed `null` returns `[]`,
+ * which `computePlanDetail` (`diff.ts`) already reads as "no live resource".
  */
 export declare function storeScopeResolver(store: DeclaredOrgStore, serviceKey: string): ScopeResolver;
 /**
@@ -112,7 +114,8 @@ export declare class ProvidersCloudflareReader implements CloudflareReader {
 /**
  * Backed by `@wtfalch/providers/zitadel`'s `ZitadelClient.listResources`: one
  * resource per project and per project grant in a ZITADEL org (v1 scope —
- * see that method's own doc comment).
+ * see that method's own doc comment), plus (#510) a synthesized `issuer`
+ * resource once the org's own ZITADEL org is confirmed live.
  */
 export declare class ProvidersZitadelReader implements ZitadelReader {
     private readonly client;
@@ -120,6 +123,26 @@ export declare class ProvidersZitadelReader implements ZitadelReader {
     private readonly resolveRecordedIds;
     constructor(client: ZitadelClient, resolveScope: ScopeResolver, resolveRecordedIds: RecordedIds);
     listResources(orgId: OrgId): Promise<LiveResource[]>;
+    /**
+     * #510: `client.listResources` reports only what is *inside* a ZITADEL org
+     * (its projects and grants), never the org record itself, so nothing ever
+     * matched `diff.ts`'s `planIssuer`'s own `zitadel:issuer:<orgId>` lookup —
+     * every plan re-proposed "provision the org's own ZITADEL org" after a
+     * clean apply, even once `zitadel_org` was recorded and live. `orgId` here
+     * is foundry's own id ({@link resourceKey}'s `key` for an issuer, `diff.ts`'s
+     * `planIssuer`), not `zitadelOrgId` — the resource foundry tracks is "this
+     * org's issuer", and ZITADEL's own org id is an implementation detail of
+     * where it lives, the same distinction {@link applyRecordedIds} draws for
+     * every other recorded resource.
+     *
+     * `resolveScope` only reads what was last recorded; it never confirms the
+     * org still exists in ZITADEL. A 404 here means the recorded id no longer
+     * resolves (the org was removed out of band) and reads as "not live" — the
+     * same `[]` answer a never-recorded scope already gives. Any other failure
+     * propagates, same as every other call in this reader. An org ZITADEL still
+     * returns but marks `ORG_STATE_REMOVED` is not live either.
+     */
+    private liveIssuer;
 }
 /**
  * Backed by the same `@wtfalch/providers/coolify`'s `CoolifyClient.listResources`

package/dist/plan/providers-readers.js

@@ -1,3 +1,4 @@
+import { ZitadelError } from '@wtfalch/providers/zitadel';
 import { BOULE_MANAGED_ENV_KEYS } from './boule.js';
 /**
  * A {@link ScopeResolver} backed by `AppliedState.serviceIds` (`../state.ts`)
@@ -8,15 +9,17 @@ import { BOULE_MANAGED_ENV_KEYS } from './boule.js';
  * resource it creates, keyed `system:kind:key` ({@link storeRecordedIds}
  * below reads those back), and #20's `FoundryStepExecutor` (`executor.ts`)
  * now also calls `StepExecutionContext.recordScopeId` for `coolify_project`,
- * `zitadel_org` and `zitadel_project`, so a resolver built with one of those
- * three `serviceKey`s returns the real id once that step has run. A
- * Cloudflare zone is the one scope id nothing writes yet: `executor.ts`'s
- * `cloudflareZone` records its result only under `cloudflare:zone:<domain>`
- * (a resource id, read back by {@link storeRecordedIds}), not under a plain
- * `cloudflare_zone` scope key — a resolver built with that `serviceKey`
- * still returns `null` for every org. That is the correct "nothing live yet"
- * answer: a reader passed `null` returns `[]`, which `computePlanDetail`
- * (`diff.ts`) already reads as "no live resource".
+ * `zitadel_org`, `zitadel_project` and (#510) `cloudflare_zone`, so a
+ * resolver built with one of those `serviceKey`s returns the real id once
+ * that step has run. Before #510, `cloudflareZone` recorded its result only
+ * under `cloudflare:zone:<domain>` (a resource id, read back by
+ * {@link storeRecordedIds}), never under the plain `cloudflare_zone` scope
+ * key — so a resolver built with that `serviceKey` always returned `null`,
+ * `ProvidersCloudflareReader.listResources` always returned `[]`, and
+ * `diff.ts`'s `planZone` re-proposed provisioning the zone on every apply
+ * even once it was live. A scope key that genuinely has nothing recorded yet
+ * still correctly resolves to `null`: a reader passed `null` returns `[]`,
+ * which `computePlanDetail` (`diff.ts`) already reads as "no live resource".
  */
 export function storeScopeResolver(store, serviceKey) {
     return async (orgId) => {
@@ -179,18 +182,34 @@ async function withEnvNamesConfig(client, resource, recorded) {
  * the `agora` kind, like {@link withLogVolumeConfig}. Unlike that read, a
  * failure here is not swallowed: a plan that cannot see the live config must
  * fail, not report it as missing.
+ *
+ * #506: also the live app's own `ports_exposes`, as `config.ports_exposes`,
+ * so `planAgora` can plan the fix for an app Coolify never got that setting
+ * on even when its env already matches -- the exact shape of the Company
+ * Included incident this issue names, where re-planning without this read
+ * would see no drift at all and never run `coolifyAgora` again.
  */
 async function withAgoraEnvConfig(client, resource, recorded) {
     if (resource.kind !== 'application' || !recorded[resource.key]?.startsWith('agora:')) {
         return resource;
     }
-    const envs = await client.listEnvs(resource.key);
+    const [envs, app] = await Promise.all([
+        client.listEnvs(resource.key),
+        client.getApplication(resource.key),
+    ]);
     const env = {};
     for (const e of envs) {
         if (!e.is_preview && e.key.startsWith('AGORA_'))
             env[e.key] = e.value;
     }
-    return { ...resource, config: { ...resource.config, env } };
+    // `@wtfalch/providers`' `CoolifyApplication` type does not declare
+    // `ports_exposes` (as of 0.7.3), but `getApplication` returns the raw
+    // Coolify API response (`coolify.ts`'s own `getApplication`, a plain
+    // `request` passthrough), which does carry it -- the same gap that
+    // repo's own CLAUDE.md names for other fields ("verified against a live
+    // instance, not the bundled openapi.yaml").
+    const portsExposes = app.ports_exposes;
+    return { ...resource, config: { ...resource.config, env, ports_exposes: portsExposes } };
 }
 /**
  * #161: the org's own recorded Boule app's live sign-in env vars, as
@@ -273,13 +292,17 @@ export class ProvidersCloudflareReader {
         // A zone needs no mapping: its key is already the zone name, which is
         // foundry's own zone key (`diff.ts`'s `planZone`), so it never matches a
         // recorded provider id and always passes through unchanged.
-        return applyRecordedIds(toFoundryResources('cloudflare', resources), recorded, CLOUDFLARE_DROP_UNRECORDED);
+        return applyRecordedIds(toFoundryResources('cloudflare', resources)
+            // Keyed by the zone id, so a recorded zone id would map it onto the
+            // zone's own key and replace the zone's status; nothing plans from it.
+            .filter((resource) => resource.kind !== 'email_routing'), recorded, CLOUDFLARE_DROP_UNRECORDED);
     }
 }
 /**
  * Backed by `@wtfalch/providers/zitadel`'s `ZitadelClient.listResources`: one
  * resource per project and per project grant in a ZITADEL org (v1 scope —
- * see that method's own doc comment).
+ * see that method's own doc comment), plus (#510) a synthesized `issuer`
+ * resource once the org's own ZITADEL org is confirmed live.
  */
 export class ProvidersZitadelReader {
     client;
@@ -294,11 +317,45 @@ export class ProvidersZitadelReader {
         const zitadelOrgId = await this.resolveScope(orgId);
         if (!zitadelOrgId)
             return [];
-        const [resources, recorded] = await Promise.all([
+        const [resources, recorded, issuer] = await Promise.all([
             this.client.listResources(zitadelOrgId),
             this.resolveRecordedIds(orgId),
+            this.liveIssuer(orgId, zitadelOrgId),
         ]);
-        return applyRecordedIds(toFoundryResources('zitadel', resources), recorded);
+        const mapped = applyRecordedIds(toFoundryResources('zitadel', resources), recorded);
+        return issuer ? [...mapped, issuer] : mapped;
+    }
+    /**
+     * #510: `client.listResources` reports only what is *inside* a ZITADEL org
+     * (its projects and grants), never the org record itself, so nothing ever
+     * matched `diff.ts`'s `planIssuer`'s own `zitadel:issuer:<orgId>` lookup —
+     * every plan re-proposed "provision the org's own ZITADEL org" after a
+     * clean apply, even once `zitadel_org` was recorded and live. `orgId` here
+     * is foundry's own id ({@link resourceKey}'s `key` for an issuer, `diff.ts`'s
+     * `planIssuer`), not `zitadelOrgId` — the resource foundry tracks is "this
+     * org's issuer", and ZITADEL's own org id is an implementation detail of
+     * where it lives, the same distinction {@link applyRecordedIds} draws for
+     * every other recorded resource.
+     *
+     * `resolveScope` only reads what was last recorded; it never confirms the
+     * org still exists in ZITADEL. A 404 here means the recorded id no longer
+     * resolves (the org was removed out of band) and reads as "not live" — the
+     * same `[]` answer a never-recorded scope already gives. Any other failure
+     * propagates, same as every other call in this reader. An org ZITADEL still
+     * returns but marks `ORG_STATE_REMOVED` is not live either.
+     */
+    async liveIssuer(orgId, zitadelOrgId) {
+        try {
+            const found = await this.client.getOrg(zitadelOrgId);
+            if (found.state === 'ORG_STATE_REMOVED')
+                return null;
+        }
+        catch (err) {
+            if (err instanceof ZitadelError && err.status === 404)
+                return null;
+            throw err;
+        }
+        return { system: 'zitadel', kind: 'issuer', key: orgId, config: {} };
     }
 }
 /**

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@wtfalch/foundry",
-  "version": "0.18.0",
+  "version": "0.19.1",
   "description": "Foundry's SDK: the declared org's types, the plan and apply contracts, and the state store's interface.",
   "repository": {
     "type": "git",