@wtfalch/foundry 0.22.2 → 0.22.4

package/dist/index.d.ts

@@ -20,7 +20,7 @@ export type { FoundryStoreDb } from './store/postgres.js';
 export { declaredOrgs, foundryAppliedState, foundryAppliedVersions, foundryAuditEvents, foundryDeclaredPlatform, foundryRequestedChanges, type AuditEventRow, type DeclaredOrgRow, type NewDeclaredOrgRow, type AppliedStateRow, type NewAppliedStateRow, type AppliedVersionRow, type NewAppliedVersionRow, type DeclaredPlatformRow, type NewDeclaredPlatformRow, type RequestedChangeRow, type NewRequestedChangeRow, } from './store/schema.js';
 export type { LiveResource, ZitadelReader, CoolifyReader, CloudflareReader, FilesReader, AiReader, CmsReader, LiveReaders, PlatformCloudflareReader, PlatformCoolifyReader, PlatformLiveReaders, StepAction, PlannedStep, StepSystem, PlanDetail, PlatformPlanDetail, AdoptCandidate, AdoptInput, AdoptPlan, AdoptSnapshot, AuditActor, AuditLog, AuthzGate, StepExecutor, StepDestroyer, DestroyTarget, StepExecutionContext, PlatformStepExecutor, PlatformStepExecutionContext, FoundryPlanApplyOptions, } from './plan/index.js';
 export { AdoptRefusedError } from './plan/index.js';
-export { createEdgeAccess, createEdgeDns, createEdgeRateLimits, createEdgeTunnels, createEdgeWorkers, createEdgeZones, } from './plan/index.js';
+export { createEdgeAccess, createEdgeDns, edgeDnsRecordOwners, createEdgeRateLimits, createEdgeTunnels, createEdgeWorkers, createEdgeZones, } from './plan/index.js';
 export type { AccessAppSummary, AccessDecision, AccessPolicyRule, AccessPort, DnsPort, EdgePlatformAccess, EdgePlatformDns, EdgePlatformRateLimits, EdgePlatformWorkers, EdgePlatformZones, EdgeZonesOptions, ZonePort, EdgeRateLimitsOptions, RateLimitPort, RateLimitRuleInput, EdgeWorkersOptions, EdgePlatformTunnels, TunnelPort, } from './plan/index.js';
 export { readLiveResources, readLivePlatformResources, computePlanDetail, toPlan, planPlatform, toPlatformPlan, JOBS_INTERNAL_URL_SCOPE_KEY, JOBS_SCHEDULER_KEY, PLATFORM_AI_KEY, PLATFORM_AI_INTERNAL_URL_SCOPE_KEY, PLATFORM_AI_MANAGEMENT_KEY_SCOPE_KEY, PLATFORM_AI_ORGANISATION_SCOPE_KEY, PLATFORM_FILES_KEY, PLATFORM_FILES_INTERNAL_URL_SCOPE_KEY, PLATFORM_FILES_ZITADEL_PROJECT_SCOPE_KEY, PLATFORM_MAIL_INTERNAL_URL_SCOPE_KEY, PLATFORM_MAIL_ZITADEL_PROJECT_SCOPE_KEY, PLATFORM_EDGE_KEY, PLATFORM_EDGE_INTERNAL_URL_SCOPE_KEY, PLATFORM_EDGE_KEY_REF, PLATFORM_EDGE_CLOUDFLARE_TOKEN_REF, FoundryPlanApply, DeclaredOrgNotFoundError, StalePlanError, ConfirmationRequiredError, NotAuthorizedError, NotATestOrgError, DeclaredPlatformNotFoundError, PlatformStalePlanError, PlatformConfirmationRequiredError, planNeedsConfirmation, } from './plan/index.js';
 export type { HeldKeyResolver, OrgPlatformReadiness } from './plan/index.js';
@@ -32,7 +32,7 @@ export { FoundryStepExecutor, NotBuiltError, healthUrls, loginHostnameFor } from
 export { HttpJobsSchedulerClient } from './plan/index.js';
 export type { HealthTarget, HealthTargetDepth, HealthTargetExpect } from './plan/index.js';
 export { healthTargets, platformHealthTargets } from './plan/index.js';
-export type { ScopeResolver, RecordedIds } from './plan/index.js';
+export type { ScopeResolver, RecordedIds, DnsRecordOwners } from './plan/index.js';
 export { ProvidersAiReader, ProvidersCloudflareReader, ProvidersCmsReader, ProvidersCoolifyReader, ProvidersZitadelReader, storeScopeResolver, storeRecordedIds, } from './plan/index.js';
 export type { ZitadelListAppsRawApp } from './plan/index.js';
 export { adaptZitadelListApps } from './plan/index.js';

package/dist/index.js

@@ -12,7 +12,7 @@ export { createPostgresAppliedVersionsStore, createPostgresDeclaredOrgStore, cre
 export { createPostgresAuditLog } from './store/audit.js';
 export { declaredOrgs, foundryAppliedState, foundryAppliedVersions, foundryAuditEvents, foundryDeclaredPlatform, foundryRequestedChanges, } from './store/schema.js';
 export { AdoptRefusedError } from './plan/index.js';
-export { createEdgeAccess, createEdgeDns, createEdgeRateLimits, createEdgeTunnels, createEdgeWorkers, createEdgeZones, } from './plan/index.js';
+export { createEdgeAccess, createEdgeDns, edgeDnsRecordOwners, createEdgeRateLimits, createEdgeTunnels, createEdgeWorkers, createEdgeZones, } from './plan/index.js';
 export { readLiveResources, readLivePlatformResources, computePlanDetail, toPlan, planPlatform, toPlatformPlan, JOBS_INTERNAL_URL_SCOPE_KEY, JOBS_SCHEDULER_KEY, PLATFORM_AI_KEY, PLATFORM_AI_INTERNAL_URL_SCOPE_KEY, PLATFORM_AI_MANAGEMENT_KEY_SCOPE_KEY, PLATFORM_AI_ORGANISATION_SCOPE_KEY, PLATFORM_FILES_KEY, PLATFORM_FILES_INTERNAL_URL_SCOPE_KEY, PLATFORM_FILES_ZITADEL_PROJECT_SCOPE_KEY, PLATFORM_MAIL_INTERNAL_URL_SCOPE_KEY, PLATFORM_MAIL_ZITADEL_PROJECT_SCOPE_KEY, PLATFORM_EDGE_KEY, PLATFORM_EDGE_INTERNAL_URL_SCOPE_KEY, PLATFORM_EDGE_KEY_REF, PLATFORM_EDGE_CLOUDFLARE_TOKEN_REF, FoundryPlanApply, DeclaredOrgNotFoundError, StalePlanError, ConfirmationRequiredError, NotAuthorizedError, NotATestOrgError, DeclaredPlatformNotFoundError, PlatformStalePlanError, PlatformConfirmationRequiredError, planNeedsConfirmation, } from './plan/index.js';
 export { DEFAULT_ORG_PLATFORM_READINESS, ORG_PLATFORM_KEY_REFS, agoraHostValuesFromPlatform, heldPlatformKeyRefs, orgPlatformReadinessFrom, } from './plan/index.js';
 export { PlatformOrgBlockedError, PlatformOrgPorts } from './plan/index.js';

package/dist/plan/diff.js

@@ -3,13 +3,14 @@ import { APP_ENTRY_KEY, ownerMailboxRecorded, ownerMailboxes } from '../org.js';
 import { AGORA_ACTIVATED_ENV_SCOPE_KEY, AGORA_APP_PORTS_EXPOSES, CALLS_INTROSPECTION_SCOPE_KEY, CALLS_INTROSPECTION_UNDELIVERED_SCOPE_KEY, CHAT_INTROSPECTION_SCOPE_KEY, NO_AGORA_HOST_VALUES, ZITADEL_ORG_SCOPE_KEY, agoraEnvDrift, agoraEnvRevision, agoraHostMissing, agoraHostnameFor, callsServiceHasName, callsServiceHasTokenEnv, callsTokenEnvMovedMessage, callsTokenHostFrom, desiredAgoraEnv, withRecordedMessagingProject, } from './agora.js';
 import { BOULE_BROKER_ENTRY_KEY, bouleEnvDrift, desiredBouleEnv, wantedBouleBrokerEntry, } from './boule.js';
 import { brokerEntryAppliedScopeKey, brokerEntryWarningsScopeKey, entryAuthEnv, entryAuthEnvAppliedScopeKey, wantedBrokerEntry, } from './broker-entries.js';
+import { chatInternalNames } from './chat-matrix.js';
 import { planEntryAiKeys } from './entry-ai-key.js';
 import { planEdgeReservedLabels, planEntryEdgeKeys } from './entry-edge-key.js';
 import { planFilesKeys } from './entry-files-key.js';
 import { appHostname, entryHostnames, tunnelDnsHostnames, tunnelDomainList } from './hostnames.js';
 import { LOGIN_BINDING_SCOPE_KEY, companyLoginTunnelHost, loginBindingState, loginHostClientIds, loginHostnameFor, pendingRemovalHosts, } from './login-host.js';
 import { MAIL_COPY_COMPLETED_SCOPE_KEY, MAIL_COPY_DONE_SCOPE_KEY, parseMailCopyCompleted, } from './mail-copy.js';
-import { CALLS_MAS_APPLIED_IMAGE_TAG_SCOPE_KEY, CALLS_SYNAPSE_APPLIED_IMAGE_TAG_SCOPE_KEY, ORG_MAIL_APPLIED_APEX_SCOPE_KEY, ORG_MAIL_APPLIED_HOST_SCOPE_KEY, ORG_MAIL_APPLIED_MODE_SCOPE_KEY, ORG_MAIL_APPLIED_USES_DOMAIN_SCOPE_KEY, appEnvAppliedScopeKey, appSettingsOf, appStepKey, appliedAppDomains, appliedAppSettings, dbEnvAppliedScopeKey, resolveAppEnv, serviceDbEnvAppliedScopeKey, versionNotAppliedLine, } from './platform-diff.js';
+import { CALLS_MAS_APPLIED_IMAGE_TAG_SCOPE_KEY, CALLS_SYNAPSE_APPLIED_IMAGE_TAG_SCOPE_KEY, ORG_MAIL_APPLIED_APEX_SCOPE_KEY, ORG_MAIL_APPLIED_HOST_SCOPE_KEY, ORG_MAIL_APPLIED_MODE_SCOPE_KEY, ORG_MAIL_APPLIED_USES_DOMAIN_SCOPE_KEY, appEnvAppliedScopeKey, appFolderDiffers, appSettingsOf, appStepKey, appliedAppDomains, appliedAppSettings, dbEnvAppliedScopeKey, resolveAppEnv, serviceDbEnvAppliedScopeKey, versionNotAppliedLine, } from './platform-diff.js';
 import { DEFAULT_ORG_PLATFORM_READINESS, } from './platform-org.js';
 import { PLATFORM_AUTH_BROKER_MAIL_KEY_REF } from './platform-providers.js';
 import { appLabelsAppliedScopeKey, entryLabelHash, entryLabelSpec } from './proxy-labels.js';
@@ -27,6 +28,74 @@ export function toPlan(detail) {
 function resourceKey(system, kind, key) {
     return `${system}:${kind}:${key}`;
 }
+/**
+ * Whether an unclaimed live resource is one foundry made for the org, so the
+ * plan does not list it as a stranger. Nothing here claims a resource: no step
+ * is planned from it and none is removed.
+ *
+ * - An id foundry recorded, under any key. One step often makes several
+ *   resources and records the others under a flat key (`coolify_chat_synapse`,
+ *   `zitadel_project`), which the readers do not map to a name. Only a
+ *   resource still under its provider's own kind and id is matched: a mapped
+ *   one carries foundry's key (the org id, a name), which other recorded
+ *   values equal, and a planner that leaves it unclaimed wants it listed.
+ * - The environment of the org's own Coolify project.
+ * - The chat login app. Its id is recorded under `coolify:chat:<org>` until
+ *   the introspection step records the chat service there instead.
+ * - A DNS record edge holds a row for (`config.owner`): foundry or the company
+ *   wrote it through edge.
+ * - A DNS record written before edge held rows: a tunnel hostname foundry
+ *   published that points at a tunnel, or the mail records of the recorded
+ *   mail domain.
+ */
+function madeByFoundry(org, r, recordedIds, recordedValues) {
+    if (PROVIDER_KINDS[r.system]?.includes(r.kind) && recordedValues.has(r.key))
+        return true;
+    if (r.system === 'coolify') {
+        if (r.kind === 'environment')
+            return true;
+        return r.kind === 'application' && r.config.name === chatInternalNames(org.slug).mas;
+    }
+    if (r.system !== 'cloudflare' || r.kind !== 'dns_record')
+        return false;
+    if (typeof r.config.owner === 'string')
+        return true;
+    const name = typeof r.config.name === 'string' ? r.config.name.toLowerCase() : '';
+    if (name === '')
+        return false;
+    const type = r.config.type;
+    const content = typeof r.config.content === 'string' ? r.config.content.toLowerCase() : '';
+    const tunnelHostnames = (recordedIds[CLOUDFLARE_TUNNEL_DNS_HOSTNAMES_SCOPE_KEY] ?? '')
+        .toLowerCase()
+        .split(',');
+    if (type === 'CNAME' && content.endsWith('.cfargotunnel.com') && tunnelHostnames.includes(name)) {
+        return true;
+    }
+    const mailDomain = recordedIds[MAIL_DOMAIN_SCOPE_KEY]?.toLowerCase();
+    if (!mailDomain)
+        return false;
+    if (name === mailDomain) {
+        return type === 'MX' || (type === 'TXT' && /^"?v=spf1\b/.test(content));
+    }
+    return name === `_dmarc.${mailDomain}` || name.endsWith(`._domainkey.${mailDomain}`);
+}
+/** The kinds a provider lists a resource under before a recorded `system:kind:key` maps it to foundry's own. */
+const PROVIDER_KINDS = {
+    coolify: ['application', 'database'],
+    zitadel: ['project', 'app'],
+};
+/**
+ * What a listed resource is called: the provider's own name for it, then its
+ * id, which tells two resources of one name apart. The id alone when it has
+ * no name.
+ */
+function liveResourceName(r) {
+    const name = typeof r.config.name === 'string' && r.config.name !== '' ? r.config.name : null;
+    if (name === null || name === r.key)
+        return r.key;
+    const type = r.kind === 'dns_record' && typeof r.config.type === 'string' ? `${r.config.type} ` : '';
+    return `${type}${name}, ${r.key}`;
+}
 /**
  * The diff engine: #19's "a plan reads live state from Zitadel, Coolify and
  * Cloudflare and diffs it against the declared org", built on #10's rule
@@ -356,10 +425,17 @@ export function computePlanDetail(org, live, recordedIds = {}, agoraHost = NO_AG
     }
     // #10 (resolved): "foundry manages only what the declared org names";
     // anything left unclaimed is listed, never proposed for deletion.
+    // A resource foundry made for the org is not a finding: only a resource
+    // nobody recorded is listed, under the name its provider shows.
+    // The org's own id and names are recorded as values too, and are no provider id.
+    const recordedValues = new Set(Object.values(recordedIds));
+    for (const own of ['', org.id, org.slug, org.domain ?? ''])
+        recordedValues.delete(own);
     const unmanaged = live
         .filter((r) => !claimed.has(resourceKey(r.system, r.kind, r.key)))
+        .filter((r) => !madeByFoundry(org, r, recordedIds, recordedValues))
         .map((r) => ({
-        description: `${r.system} ${r.kind} "${r.key}" is live but not named by the declared org`,
+        description: `${r.system} ${r.kind} "${liveResourceName(r)}" is live but not named by the declared org`,
     }));
     // A blocked Agora is reported here, not planned: a step the executor must
     // refuse would halt every step after it. This is the plan's one non-step
@@ -2229,7 +2305,7 @@ function planApp(org, entryKey, byKey, claimed, recordedIds, plannedSteps, authI
             key: blockedKey('port'),
         });
     }
-    if (want.folder !== have.folder ||
+    if (appFolderDiffers(want, have) ||
         want.autoDeploy !== have.autoDeploy ||
         (want.port !== null && want.port !== have.port)) {
         return {

package/dist/plan/edge-dns.d.ts

@@ -47,6 +47,11 @@ export interface DnsPort {
     }>;
     deleteDnsRecord(zone: string, recordId: string): Promise<void>;
 }
+/**
+ * The owner edge reports for each record of a zone that has an edge row, by
+ * record id. For `ProvidersCloudflareReader`'s `resolveDnsOwners`.
+ */
+export declare function edgeDnsRecordOwners(client: Pick<EdgePlatformDns, 'list'>, zone: string): Promise<Record<string, string>>;
 /** Edge answers its platform writes from one shared slot of 4 (company-less writes). */
 export declare const EDGE_DNS_WRITE_CONCURRENCY = 4;
 /**

package/dist/plan/edge-dns.js

@@ -1,4 +1,16 @@
 import { EdgeApiError } from '@wtfalch/edge';
+/**
+ * The owner edge reports for each record of a zone that has an edge row, by
+ * record id. For `ProvidersCloudflareReader`'s `resolveDnsOwners`.
+ */
+export async function edgeDnsRecordOwners(client, zone) {
+    const owners = {};
+    for (const record of (await client.list({ zone })).records) {
+        if (record.owner !== null)
+            owners[record.id] = record.owner;
+    }
+    return owners;
+}
 /** Edge answers its platform writes from one shared slot of 4 (company-less writes). */
 export const EDGE_DNS_WRITE_CONCURRENCY = 4;
 /**

package/dist/plan/executor.d.ts

@@ -117,8 +117,6 @@ export interface CoolifyPort {
         ports_exposes?: string;
         /** `false` for an internal entry: Coolify makes no domain for it. */
         autogenerate_domain?: boolean;
-        /** The folder a `static` entry serves (`HostingEntry.folder`). */
-        publish_directory?: string;
         /** Whether a push to `git_branch` deploys (`HostingEntry.autoDeploy`). */
         is_auto_deploy_enabled?: boolean;
         /**

package/dist/plan/executor.js

@@ -23,7 +23,7 @@ import { healthCheckSettings } from './health-check-settings.js';
 import { appHostname, coolifyTunnelDomains, entryHostnames, tunnelDnsHostnames, tunnelDomainList, tunnelIngressHostnames, } from './hostnames.js';
 import { LOGIN_BINDING_SCOPE_KEY, LOGIN_HOST_PENDING_REMOVAL_SCOPE_KEY, LOGIN_HOST_SHARED_SCOPE_KEY, customersEntryKeys, loginBindingState, loginHostClientIds, pendingRemovalHosts, pendingRemovalState, } from './login-host.js';
 import { MAIL_COPY_COMPLETED_SCOPE_KEY, MAIL_COPY_DONE_SCOPE_KEY, parseMailCopyCompleted, runMailCopyStep, } from './mail-copy.js';
-import { CALLS_MAS_APPLIED_IMAGE_TAG_SCOPE_KEY, CALLS_SYNAPSE_APPLIED_IMAGE_TAG_SCOPE_KEY, ORG_MAIL_APPLIED_APEX_SCOPE_KEY, ORG_MAIL_APPLIED_HOST_SCOPE_KEY, ORG_MAIL_APPLIED_MODE_SCOPE_KEY, ORG_MAIL_APPLIED_USES_DOMAIN_SCOPE_KEY, appDomainsAppliedScopeKey, appEnvAppliedScopeKey, appNameFor, appSettingsAppliedScopeKey, appSettingsOf, appStepKey, appliedAppDomains, appliedAppSettings, dbEnvAppliedScopeKey, resolveAppEnv, serviceDbEnvAppliedScopeKey, } from './platform-diff.js';
+import { CALLS_MAS_APPLIED_IMAGE_TAG_SCOPE_KEY, CALLS_SYNAPSE_APPLIED_IMAGE_TAG_SCOPE_KEY, ORG_MAIL_APPLIED_APEX_SCOPE_KEY, ORG_MAIL_APPLIED_HOST_SCOPE_KEY, ORG_MAIL_APPLIED_MODE_SCOPE_KEY, ORG_MAIL_APPLIED_USES_DOMAIN_SCOPE_KEY, appDomainsAppliedScopeKey, appEnvAppliedScopeKey, appFolderDiffers, appNameFor, appSettingsAppliedScopeKey, appSettingsOf, appStepKey, appliedAppDomains, appliedAppSettings, dbEnvAppliedScopeKey, resolveAppEnv, serviceDbEnvAppliedScopeKey, } from './platform-diff.js';
 import { AUTH_LOGIN_PORT, PLATFORM_AUTH_BROKER_MAIL_KEY_REF, PLATFORM_AUTH_LOGIN_INTERNAL_NAME, } from './platform-providers.js';
 import { appLabelsAppliedScopeKey, entryLabelHash, entryLabelSpec, entryProxyLabels, sameLabelSets, } from './proxy-labels.js';
 import { entryWorkerAppliedScopeKey, entryWorkerExclusionsScopeKey, entryWorkerRetiredScopeKey, entryWorkerRouteIdScopeKey, entryWorkerRoutePatternScopeKey, entryWorkerRoutePendingScopeKey, entryWorkerRouteZoneScopeKey, entryWorkerUploadedScopeKey, } from './worker.js';
@@ -1789,7 +1789,6 @@ export class FoundryStepExecutor {
         const names = entryHostnames(org, entry);
         const wantDomains = tunnelDomainList(names);
         const isStatic = entry.buildPack === 'static';
-        const folderField = isStatic ? 'publish_directory' : 'base_directory';
         const settingsKey = appSettingsAppliedScopeKey(entry.key);
         const domainsKey = appDomainsAppliedScopeKey(entry.key);
         let haveDomains;
@@ -1833,7 +1832,10 @@ export class FoundryStepExecutor {
                 // A static site is served by Coolify's own web server on port 80.
                 ports_exposes: isStatic ? '80' : entry.port === null ? undefined : String(entry.port),
                 is_auto_deploy_enabled: entry.autoDeploy,
-                [folderField]: entry.folder === null ? undefined : `/${entry.folder}`,
+                // Also the folder a static entry serves: Coolify's static build
+                // copies `base_directory`, and reads `publish_directory` only for a
+                // built app.
+                base_directory: entry.folder === null ? undefined : `/${entry.folder}`,
                 // Only the shared standard app builds from this repo; a bespoke
                 // app's Dockerfile is at its own repo's root.
                 dockerfile_location: entry.repo ? undefined : DEFAULT_APP_DOCKERFILE,
@@ -1848,8 +1850,8 @@ export class FoundryStepExecutor {
         // difference again.
         const want = appSettingsOf(entry);
         const patch = {};
-        if (want.folder !== have.folder)
-            patch[folderField] = want.folder ? `/${want.folder}` : '/';
+        if (appFolderDiffers(want, have))
+            patch.base_directory = want.folder ? `/${want.folder}` : '/';
         if (want.port !== have.port && want.port !== null && !isStatic) {
             patch.ports_exposes = String(want.port);
         }
@@ -1904,7 +1906,6 @@ export class FoundryStepExecutor {
             await this.ports.coolify.updateApplication(appId, patch);
         // The container builds and listens from these only at its next deploy.
         const settingsNeedDeploy = Boolean(patch.base_directory ||
-            patch.publish_directory ||
             patch.ports_exposes ||
             patch.domains !== undefined ||
             patch.custom_internal_name ||

package/dist/plan/index.d.ts

@@ -26,7 +26,7 @@ export type { CallsSfuConnection, CallsSfuConnectionPort, CallsSfuKeysPort, Call
 export { MissingCallsSfuConnectionError, applyCallsSfuPlatformStep } from './platform-sfu.js';
 export type { MailCopyJob, MailCopyPort, MailCopyStepResult } from './mail-copy.js';
 export { MAIL_COPY_COMPLETED_SCOPE_KEY, MAIL_COPY_DONE_SCOPE_KEY, MissingMailCopyAccountsError, MissingMailCopySourceTokenError, MissingMailCopyStalwartTokenError, parseMailCopyCompleted, runMailCopyStep, } from './mail-copy.js';
-export type { ScopeResolver, RecordedIds } from './providers-readers.js';
+export type { ScopeResolver, RecordedIds, DnsRecordOwners } from './providers-readers.js';
 export { ProvidersAiReader, ProvidersCloudflareReader, ProvidersCmsReader, ProvidersCoolifyReader, ProvidersZitadelReader, storeScopeResolver, storeRecordedIds, } from './providers-readers.js';
 export type { AgoraHostPort, AgoraHostValues } from './agora.js';
 export type { BrokerPort } from './broker-entries.js';
@@ -41,7 +41,7 @@ export type { CoolifyPort, CloudflarePort, ZitadelPort, CallsSfuPort, JobsSchedu
 export { FoundryStepExecutor, NotBuiltError, healthUrls } from './executor.js';
 export type { HealthTarget, HealthTargetDepth, HealthTargetExpect } from './health-targets.js';
 export { healthTargets, platformHealthTargets } from './health-targets.js';
-export { createEdgeDns, EDGE_DNS_WRITE_CONCURRENCY } from './edge-dns.js';
+export { createEdgeDns, edgeDnsRecordOwners, EDGE_DNS_WRITE_CONCURRENCY } from './edge-dns.js';
 export type { DnsPort, DnsRecordInput, DnsRecordSummary, EdgePlatformDns } from './edge-dns.js';
 export { createEdgeAccess } from './edge-access.js';
 export type { AccessAppSummary, AccessDecision, AccessPolicyRule, AccessPort, EdgePlatformAccess, } from './edge-access.js';

package/dist/plan/index.js

@@ -21,7 +21,7 @@ export { checkMailIdentityAudience } from './mail-identity.js';
 export { checkMailAppsAllowlist } from './mail-identity-allowlist.js';
 export { FoundryStepExecutor, NotBuiltError, healthUrls } from './executor.js';
 export { healthTargets, platformHealthTargets } from './health-targets.js';
-export { createEdgeDns, EDGE_DNS_WRITE_CONCURRENCY } from './edge-dns.js';
+export { createEdgeDns, edgeDnsRecordOwners, EDGE_DNS_WRITE_CONCURRENCY } from './edge-dns.js';
 export { createEdgeAccess } from './edge-access.js';
 export { createEdgeWorkers } from './edge-workers.js';
 export { createEdgeRateLimits } from './edge-ratelimits.js';

package/dist/plan/platform-diff.d.ts

@@ -482,8 +482,17 @@ export interface AppSettings {
     folder: string | null;
     port: number | null;
     autoDeploy: boolean;
+    /**
+     * Set for a `static` entry whose folder is written as `base_directory`,
+     * the field Coolify's static build serves from. A static marker without it
+     * was written as `publish_directory`, which that build ignores (it served
+     * the repo root), so the app is patched and redeployed once.
+     */
+    staticFolderIn?: 'base_directory';
 }
 export declare function appSettingsOf(entry: HostingEntry): AppSettings;
+/** Whether the app's folder is not yet where Coolify reads it: a changed folder, or a static one written to the old field. */
+export declare function appFolderDiffers(want: AppSettings, have: AppSettings): boolean;
 /** What an app that predates the marker has: Coolify's own defaults, so it plans no change. */
 export declare const DEFAULT_APP_SETTINGS: AppSettings;
 export declare function appSettingsAppliedScopeKey(entryKey: string): string;

package/dist/plan/platform-diff.js

@@ -520,7 +520,17 @@ export function serviceDbEnvAppliedScopeKey(service) {
     return `service_db_env_applied.${service}`;
 }
 export function appSettingsOf(entry) {
-    return { folder: entry.folder, port: entry.port, autoDeploy: entry.autoDeploy };
+    return {
+        folder: entry.folder,
+        port: entry.port,
+        autoDeploy: entry.autoDeploy,
+        ...(entry.buildPack === 'static' ? { staticFolderIn: 'base_directory' } : {}),
+    };
+}
+/** Whether the app's folder is not yet where Coolify reads it: a changed folder, or a static one written to the old field. */
+export function appFolderDiffers(want, have) {
+    return (want.folder !== have.folder ||
+        (want.folder !== null && want.staticFolderIn !== have.staticFolderIn));
 }
 /** What an app that predates the marker has: Coolify's own defaults, so it plans no change. */
 export const DEFAULT_APP_SETTINGS = { folder: null, port: null, autoDeploy: true };

package/dist/plan/providers-readers.d.ts

@@ -99,16 +99,29 @@ export declare class ProvidersCoolifyReader implements CoolifyReader {
     /** The project's resources as Coolify reports them, unmapped: what adopt checks against a declaration. */
     listProject(projectUuid: string): Promise<LiveResource[]>;
 }
-/**
- * Backed by `@wtfalch/providers/cloudflare`'s `CloudflareClient.listResources`:
- * a zone's DNS records plus its email-routing status (v1 scope — see that
- * method's own doc comment for what it leaves out).
- */
+/** Record id to the owner edge reports for it (`platform` or `organisation`); a record with no edge row is absent. */
+export type DnsRecordOwners = (orgId: OrgId) => Promise<Readonly<Record<string, string>>>;
 export declare class ProvidersCloudflareReader implements CloudflareReader {
     private readonly client;
     private readonly resolveScope;
     private readonly resolveRecordedIds;
-    constructor(client: CloudflareClient, resolveScope: ScopeResolver, resolveRecordedIds: RecordedIds);
+    /**
+     * Who edge holds each DNS record of the org's zone for. A `dns_record`
+     * with a row gets `config.owner`, and the plan does not list it as a
+     * stranger. Left out, every record reads as having no row. A failing
+     * lookup fails the read: a plan that listed those records as strangers
+     * would not match the next one.
+     */
+    private readonly resolveDnsOwners?;
+    constructor(client: CloudflareClient, resolveScope: ScopeResolver, resolveRecordedIds: RecordedIds, 
+    /**
+     * Who edge holds each DNS record of the org's zone for. A `dns_record`
+     * with a row gets `config.owner`, and the plan does not list it as a
+     * stranger. Left out, every record reads as having no row. A failing
+     * lookup fails the read: a plan that listed those records as strangers
+     * would not match the next one.
+     */
+    resolveDnsOwners?: DnsRecordOwners | undefined);
     listResources(orgId: OrgId): Promise<LiveResource[]>;
 }
 /**

package/dist/plan/providers-readers.js

@@ -303,23 +303,39 @@ export class ProvidersCoolifyReader {
  * a zone's DNS records plus its email-routing status (v1 scope — see that
  * method's own doc comment for what it leaves out).
  */
+const NO_DNS_OWNERS = {};
 export class ProvidersCloudflareReader {
     client;
     resolveScope;
     resolveRecordedIds;
-    constructor(client, resolveScope, resolveRecordedIds) {
+    resolveDnsOwners;
+    constructor(client, resolveScope, resolveRecordedIds, 
+    /**
+     * Who edge holds each DNS record of the org's zone for. A `dns_record`
+     * with a row gets `config.owner`, and the plan does not list it as a
+     * stranger. Left out, every record reads as having no row. A failing
+     * lookup fails the read: a plan that listed those records as strangers
+     * would not match the next one.
+     */
+    resolveDnsOwners) {
         this.client = client;
         this.resolveScope = resolveScope;
         this.resolveRecordedIds = resolveRecordedIds;
+        this.resolveDnsOwners = resolveDnsOwners;
     }
     async listResources(orgId) {
         const zoneId = await this.resolveScope(orgId);
         if (!zoneId)
             return [];
-        const [resources, recorded] = await Promise.all([
+        const [listed, recorded, owners] = await Promise.all([
             this.client.listResources(zoneId),
             this.resolveRecordedIds(orgId),
+            this.resolveDnsOwners?.(orgId) ?? NO_DNS_OWNERS,
         ]);
+        const resources = listed.map((resource) => {
+            const owner = resource.kind === 'dns_record' ? owners[resource.key] : undefined;
+            return owner ? { ...resource, config: { ...resource.config, owner } } : resource;
+        });
         // A zone needs no mapping: its key is already the zone name, which is
         // foundry's own zone key (`diff.ts`'s `planZone`), so it never matches a
         // recorded provider id and always passes through unchanged.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@wtfalch/foundry",
-  "version": "0.22.2",
+  "version": "0.22.4",
   "description": "Foundry's SDK: the declared org's types, the plan and apply contracts, and the state store's interface.",
   "repository": {
     "type": "git",