@wtfalch/foundry 0.22.3 → 0.22.4

package/dist/index.d.ts

@@ -20,7 +20,7 @@ export type { FoundryStoreDb } from './store/postgres.js';
 export { declaredOrgs, foundryAppliedState, foundryAppliedVersions, foundryAuditEvents, foundryDeclaredPlatform, foundryRequestedChanges, type AuditEventRow, type DeclaredOrgRow, type NewDeclaredOrgRow, type AppliedStateRow, type NewAppliedStateRow, type AppliedVersionRow, type NewAppliedVersionRow, type DeclaredPlatformRow, type NewDeclaredPlatformRow, type RequestedChangeRow, type NewRequestedChangeRow, } from './store/schema.js';
 export type { LiveResource, ZitadelReader, CoolifyReader, CloudflareReader, FilesReader, AiReader, CmsReader, LiveReaders, PlatformCloudflareReader, PlatformCoolifyReader, PlatformLiveReaders, StepAction, PlannedStep, StepSystem, PlanDetail, PlatformPlanDetail, AdoptCandidate, AdoptInput, AdoptPlan, AdoptSnapshot, AuditActor, AuditLog, AuthzGate, StepExecutor, StepDestroyer, DestroyTarget, StepExecutionContext, PlatformStepExecutor, PlatformStepExecutionContext, FoundryPlanApplyOptions, } from './plan/index.js';
 export { AdoptRefusedError } from './plan/index.js';
-export { createEdgeAccess, createEdgeDns, createEdgeRateLimits, createEdgeTunnels, createEdgeWorkers, createEdgeZones, } from './plan/index.js';
+export { createEdgeAccess, createEdgeDns, edgeDnsRecordOwners, createEdgeRateLimits, createEdgeTunnels, createEdgeWorkers, createEdgeZones, } from './plan/index.js';
 export type { AccessAppSummary, AccessDecision, AccessPolicyRule, AccessPort, DnsPort, EdgePlatformAccess, EdgePlatformDns, EdgePlatformRateLimits, EdgePlatformWorkers, EdgePlatformZones, EdgeZonesOptions, ZonePort, EdgeRateLimitsOptions, RateLimitPort, RateLimitRuleInput, EdgeWorkersOptions, EdgePlatformTunnels, TunnelPort, } from './plan/index.js';
 export { readLiveResources, readLivePlatformResources, computePlanDetail, toPlan, planPlatform, toPlatformPlan, JOBS_INTERNAL_URL_SCOPE_KEY, JOBS_SCHEDULER_KEY, PLATFORM_AI_KEY, PLATFORM_AI_INTERNAL_URL_SCOPE_KEY, PLATFORM_AI_MANAGEMENT_KEY_SCOPE_KEY, PLATFORM_AI_ORGANISATION_SCOPE_KEY, PLATFORM_FILES_KEY, PLATFORM_FILES_INTERNAL_URL_SCOPE_KEY, PLATFORM_FILES_ZITADEL_PROJECT_SCOPE_KEY, PLATFORM_MAIL_INTERNAL_URL_SCOPE_KEY, PLATFORM_MAIL_ZITADEL_PROJECT_SCOPE_KEY, PLATFORM_EDGE_KEY, PLATFORM_EDGE_INTERNAL_URL_SCOPE_KEY, PLATFORM_EDGE_KEY_REF, PLATFORM_EDGE_CLOUDFLARE_TOKEN_REF, FoundryPlanApply, DeclaredOrgNotFoundError, StalePlanError, ConfirmationRequiredError, NotAuthorizedError, NotATestOrgError, DeclaredPlatformNotFoundError, PlatformStalePlanError, PlatformConfirmationRequiredError, planNeedsConfirmation, } from './plan/index.js';
 export type { HeldKeyResolver, OrgPlatformReadiness } from './plan/index.js';
@@ -32,7 +32,7 @@ export { FoundryStepExecutor, NotBuiltError, healthUrls, loginHostnameFor } from
 export { HttpJobsSchedulerClient } from './plan/index.js';
 export type { HealthTarget, HealthTargetDepth, HealthTargetExpect } from './plan/index.js';
 export { healthTargets, platformHealthTargets } from './plan/index.js';
-export type { ScopeResolver, RecordedIds } from './plan/index.js';
+export type { ScopeResolver, RecordedIds, DnsRecordOwners } from './plan/index.js';
 export { ProvidersAiReader, ProvidersCloudflareReader, ProvidersCmsReader, ProvidersCoolifyReader, ProvidersZitadelReader, storeScopeResolver, storeRecordedIds, } from './plan/index.js';
 export type { ZitadelListAppsRawApp } from './plan/index.js';
 export { adaptZitadelListApps } from './plan/index.js';

package/dist/index.js

@@ -12,7 +12,7 @@ export { createPostgresAppliedVersionsStore, createPostgresDeclaredOrgStore, cre
 export { createPostgresAuditLog } from './store/audit.js';
 export { declaredOrgs, foundryAppliedState, foundryAppliedVersions, foundryAuditEvents, foundryDeclaredPlatform, foundryRequestedChanges, } from './store/schema.js';
 export { AdoptRefusedError } from './plan/index.js';
-export { createEdgeAccess, createEdgeDns, createEdgeRateLimits, createEdgeTunnels, createEdgeWorkers, createEdgeZones, } from './plan/index.js';
+export { createEdgeAccess, createEdgeDns, edgeDnsRecordOwners, createEdgeRateLimits, createEdgeTunnels, createEdgeWorkers, createEdgeZones, } from './plan/index.js';
 export { readLiveResources, readLivePlatformResources, computePlanDetail, toPlan, planPlatform, toPlatformPlan, JOBS_INTERNAL_URL_SCOPE_KEY, JOBS_SCHEDULER_KEY, PLATFORM_AI_KEY, PLATFORM_AI_INTERNAL_URL_SCOPE_KEY, PLATFORM_AI_MANAGEMENT_KEY_SCOPE_KEY, PLATFORM_AI_ORGANISATION_SCOPE_KEY, PLATFORM_FILES_KEY, PLATFORM_FILES_INTERNAL_URL_SCOPE_KEY, PLATFORM_FILES_ZITADEL_PROJECT_SCOPE_KEY, PLATFORM_MAIL_INTERNAL_URL_SCOPE_KEY, PLATFORM_MAIL_ZITADEL_PROJECT_SCOPE_KEY, PLATFORM_EDGE_KEY, PLATFORM_EDGE_INTERNAL_URL_SCOPE_KEY, PLATFORM_EDGE_KEY_REF, PLATFORM_EDGE_CLOUDFLARE_TOKEN_REF, FoundryPlanApply, DeclaredOrgNotFoundError, StalePlanError, ConfirmationRequiredError, NotAuthorizedError, NotATestOrgError, DeclaredPlatformNotFoundError, PlatformStalePlanError, PlatformConfirmationRequiredError, planNeedsConfirmation, } from './plan/index.js';
 export { DEFAULT_ORG_PLATFORM_READINESS, ORG_PLATFORM_KEY_REFS, agoraHostValuesFromPlatform, heldPlatformKeyRefs, orgPlatformReadinessFrom, } from './plan/index.js';
 export { PlatformOrgBlockedError, PlatformOrgPorts } from './plan/index.js';

package/dist/plan/diff.js

@@ -3,6 +3,7 @@ import { APP_ENTRY_KEY, ownerMailboxRecorded, ownerMailboxes } from '../org.js';
 import { AGORA_ACTIVATED_ENV_SCOPE_KEY, AGORA_APP_PORTS_EXPOSES, CALLS_INTROSPECTION_SCOPE_KEY, CALLS_INTROSPECTION_UNDELIVERED_SCOPE_KEY, CHAT_INTROSPECTION_SCOPE_KEY, NO_AGORA_HOST_VALUES, ZITADEL_ORG_SCOPE_KEY, agoraEnvDrift, agoraEnvRevision, agoraHostMissing, agoraHostnameFor, callsServiceHasName, callsServiceHasTokenEnv, callsTokenEnvMovedMessage, callsTokenHostFrom, desiredAgoraEnv, withRecordedMessagingProject, } from './agora.js';
 import { BOULE_BROKER_ENTRY_KEY, bouleEnvDrift, desiredBouleEnv, wantedBouleBrokerEntry, } from './boule.js';
 import { brokerEntryAppliedScopeKey, brokerEntryWarningsScopeKey, entryAuthEnv, entryAuthEnvAppliedScopeKey, wantedBrokerEntry, } from './broker-entries.js';
+import { chatInternalNames } from './chat-matrix.js';
 import { planEntryAiKeys } from './entry-ai-key.js';
 import { planEdgeReservedLabels, planEntryEdgeKeys } from './entry-edge-key.js';
 import { planFilesKeys } from './entry-files-key.js';
@@ -27,6 +28,74 @@ export function toPlan(detail) {
 function resourceKey(system, kind, key) {
     return `${system}:${kind}:${key}`;
 }
+/**
+ * Whether an unclaimed live resource is one foundry made for the org, so the
+ * plan does not list it as a stranger. Nothing here claims a resource: no step
+ * is planned from it and none is removed.
+ *
+ * - An id foundry recorded, under any key. One step often makes several
+ *   resources and records the others under a flat key (`coolify_chat_synapse`,
+ *   `zitadel_project`), which the readers do not map to a name. Only a
+ *   resource still under its provider's own kind and id is matched: a mapped
+ *   one carries foundry's key (the org id, a name), which other recorded
+ *   values equal, and a planner that leaves it unclaimed wants it listed.
+ * - The environment of the org's own Coolify project.
+ * - The chat login app. Its id is recorded under `coolify:chat:<org>` until
+ *   the introspection step records the chat service there instead.
+ * - A DNS record edge holds a row for (`config.owner`): foundry or the company
+ *   wrote it through edge.
+ * - A DNS record written before edge held rows: a tunnel hostname foundry
+ *   published that points at a tunnel, or the mail records of the recorded
+ *   mail domain.
+ */
+function madeByFoundry(org, r, recordedIds, recordedValues) {
+    if (PROVIDER_KINDS[r.system]?.includes(r.kind) && recordedValues.has(r.key))
+        return true;
+    if (r.system === 'coolify') {
+        if (r.kind === 'environment')
+            return true;
+        return r.kind === 'application' && r.config.name === chatInternalNames(org.slug).mas;
+    }
+    if (r.system !== 'cloudflare' || r.kind !== 'dns_record')
+        return false;
+    if (typeof r.config.owner === 'string')
+        return true;
+    const name = typeof r.config.name === 'string' ? r.config.name.toLowerCase() : '';
+    if (name === '')
+        return false;
+    const type = r.config.type;
+    const content = typeof r.config.content === 'string' ? r.config.content.toLowerCase() : '';
+    const tunnelHostnames = (recordedIds[CLOUDFLARE_TUNNEL_DNS_HOSTNAMES_SCOPE_KEY] ?? '')
+        .toLowerCase()
+        .split(',');
+    if (type === 'CNAME' && content.endsWith('.cfargotunnel.com') && tunnelHostnames.includes(name)) {
+        return true;
+    }
+    const mailDomain = recordedIds[MAIL_DOMAIN_SCOPE_KEY]?.toLowerCase();
+    if (!mailDomain)
+        return false;
+    if (name === mailDomain) {
+        return type === 'MX' || (type === 'TXT' && /^"?v=spf1\b/.test(content));
+    }
+    return name === `_dmarc.${mailDomain}` || name.endsWith(`._domainkey.${mailDomain}`);
+}
+/** The kinds a provider lists a resource under before a recorded `system:kind:key` maps it to foundry's own. */
+const PROVIDER_KINDS = {
+    coolify: ['application', 'database'],
+    zitadel: ['project', 'app'],
+};
+/**
+ * What a listed resource is called: the provider's own name for it, then its
+ * id, which tells two resources of one name apart. The id alone when it has
+ * no name.
+ */
+function liveResourceName(r) {
+    const name = typeof r.config.name === 'string' && r.config.name !== '' ? r.config.name : null;
+    if (name === null || name === r.key)
+        return r.key;
+    const type = r.kind === 'dns_record' && typeof r.config.type === 'string' ? `${r.config.type} ` : '';
+    return `${type}${name}, ${r.key}`;
+}
 /**
  * The diff engine: #19's "a plan reads live state from Zitadel, Coolify and
  * Cloudflare and diffs it against the declared org", built on #10's rule
@@ -356,10 +425,17 @@ export function computePlanDetail(org, live, recordedIds = {}, agoraHost = NO_AG
     }
     // #10 (resolved): "foundry manages only what the declared org names";
     // anything left unclaimed is listed, never proposed for deletion.
+    // A resource foundry made for the org is not a finding: only a resource
+    // nobody recorded is listed, under the name its provider shows.
+    // The org's own id and names are recorded as values too, and are no provider id.
+    const recordedValues = new Set(Object.values(recordedIds));
+    for (const own of ['', org.id, org.slug, org.domain ?? ''])
+        recordedValues.delete(own);
     const unmanaged = live
         .filter((r) => !claimed.has(resourceKey(r.system, r.kind, r.key)))
+        .filter((r) => !madeByFoundry(org, r, recordedIds, recordedValues))
         .map((r) => ({
-        description: `${r.system} ${r.kind} "${r.key}" is live but not named by the declared org`,
+        description: `${r.system} ${r.kind} "${liveResourceName(r)}" is live but not named by the declared org`,
     }));
     // A blocked Agora is reported here, not planned: a step the executor must
     // refuse would halt every step after it. This is the plan's one non-step

package/dist/plan/edge-dns.d.ts

@@ -47,6 +47,11 @@ export interface DnsPort {
     }>;
     deleteDnsRecord(zone: string, recordId: string): Promise<void>;
 }
+/**
+ * The owner edge reports for each record of a zone that has an edge row, by
+ * record id. For `ProvidersCloudflareReader`'s `resolveDnsOwners`.
+ */
+export declare function edgeDnsRecordOwners(client: Pick<EdgePlatformDns, 'list'>, zone: string): Promise<Record<string, string>>;
 /** Edge answers its platform writes from one shared slot of 4 (company-less writes). */
 export declare const EDGE_DNS_WRITE_CONCURRENCY = 4;
 /**

package/dist/plan/edge-dns.js

@@ -1,4 +1,16 @@
 import { EdgeApiError } from '@wtfalch/edge';
+/**
+ * The owner edge reports for each record of a zone that has an edge row, by
+ * record id. For `ProvidersCloudflareReader`'s `resolveDnsOwners`.
+ */
+export async function edgeDnsRecordOwners(client, zone) {
+    const owners = {};
+    for (const record of (await client.list({ zone })).records) {
+        if (record.owner !== null)
+            owners[record.id] = record.owner;
+    }
+    return owners;
+}
 /** Edge answers its platform writes from one shared slot of 4 (company-less writes). */
 export const EDGE_DNS_WRITE_CONCURRENCY = 4;
 /**

package/dist/plan/index.d.ts

@@ -26,7 +26,7 @@ export type { CallsSfuConnection, CallsSfuConnectionPort, CallsSfuKeysPort, Call
 export { MissingCallsSfuConnectionError, applyCallsSfuPlatformStep } from './platform-sfu.js';
 export type { MailCopyJob, MailCopyPort, MailCopyStepResult } from './mail-copy.js';
 export { MAIL_COPY_COMPLETED_SCOPE_KEY, MAIL_COPY_DONE_SCOPE_KEY, MissingMailCopyAccountsError, MissingMailCopySourceTokenError, MissingMailCopyStalwartTokenError, parseMailCopyCompleted, runMailCopyStep, } from './mail-copy.js';
-export type { ScopeResolver, RecordedIds } from './providers-readers.js';
+export type { ScopeResolver, RecordedIds, DnsRecordOwners } from './providers-readers.js';
 export { ProvidersAiReader, ProvidersCloudflareReader, ProvidersCmsReader, ProvidersCoolifyReader, ProvidersZitadelReader, storeScopeResolver, storeRecordedIds, } from './providers-readers.js';
 export type { AgoraHostPort, AgoraHostValues } from './agora.js';
 export type { BrokerPort } from './broker-entries.js';
@@ -41,7 +41,7 @@ export type { CoolifyPort, CloudflarePort, ZitadelPort, CallsSfuPort, JobsSchedu
 export { FoundryStepExecutor, NotBuiltError, healthUrls } from './executor.js';
 export type { HealthTarget, HealthTargetDepth, HealthTargetExpect } from './health-targets.js';
 export { healthTargets, platformHealthTargets } from './health-targets.js';
-export { createEdgeDns, EDGE_DNS_WRITE_CONCURRENCY } from './edge-dns.js';
+export { createEdgeDns, edgeDnsRecordOwners, EDGE_DNS_WRITE_CONCURRENCY } from './edge-dns.js';
 export type { DnsPort, DnsRecordInput, DnsRecordSummary, EdgePlatformDns } from './edge-dns.js';
 export { createEdgeAccess } from './edge-access.js';
 export type { AccessAppSummary, AccessDecision, AccessPolicyRule, AccessPort, EdgePlatformAccess, } from './edge-access.js';

package/dist/plan/index.js

@@ -21,7 +21,7 @@ export { checkMailIdentityAudience } from './mail-identity.js';
 export { checkMailAppsAllowlist } from './mail-identity-allowlist.js';
 export { FoundryStepExecutor, NotBuiltError, healthUrls } from './executor.js';
 export { healthTargets, platformHealthTargets } from './health-targets.js';
-export { createEdgeDns, EDGE_DNS_WRITE_CONCURRENCY } from './edge-dns.js';
+export { createEdgeDns, edgeDnsRecordOwners, EDGE_DNS_WRITE_CONCURRENCY } from './edge-dns.js';
 export { createEdgeAccess } from './edge-access.js';
 export { createEdgeWorkers } from './edge-workers.js';
 export { createEdgeRateLimits } from './edge-ratelimits.js';

package/dist/plan/providers-readers.d.ts

@@ -99,16 +99,29 @@ export declare class ProvidersCoolifyReader implements CoolifyReader {
     /** The project's resources as Coolify reports them, unmapped: what adopt checks against a declaration. */
     listProject(projectUuid: string): Promise<LiveResource[]>;
 }
-/**
- * Backed by `@wtfalch/providers/cloudflare`'s `CloudflareClient.listResources`:
- * a zone's DNS records plus its email-routing status (v1 scope — see that
- * method's own doc comment for what it leaves out).
- */
+/** Record id to the owner edge reports for it (`platform` or `organisation`); a record with no edge row is absent. */
+export type DnsRecordOwners = (orgId: OrgId) => Promise<Readonly<Record<string, string>>>;
 export declare class ProvidersCloudflareReader implements CloudflareReader {
     private readonly client;
     private readonly resolveScope;
     private readonly resolveRecordedIds;
-    constructor(client: CloudflareClient, resolveScope: ScopeResolver, resolveRecordedIds: RecordedIds);
+    /**
+     * Who edge holds each DNS record of the org's zone for. A `dns_record`
+     * with a row gets `config.owner`, and the plan does not list it as a
+     * stranger. Left out, every record reads as having no row. A failing
+     * lookup fails the read: a plan that listed those records as strangers
+     * would not match the next one.
+     */
+    private readonly resolveDnsOwners?;
+    constructor(client: CloudflareClient, resolveScope: ScopeResolver, resolveRecordedIds: RecordedIds, 
+    /**
+     * Who edge holds each DNS record of the org's zone for. A `dns_record`
+     * with a row gets `config.owner`, and the plan does not list it as a
+     * stranger. Left out, every record reads as having no row. A failing
+     * lookup fails the read: a plan that listed those records as strangers
+     * would not match the next one.
+     */
+    resolveDnsOwners?: DnsRecordOwners | undefined);
     listResources(orgId: OrgId): Promise<LiveResource[]>;
 }
 /**

package/dist/plan/providers-readers.js

@@ -303,23 +303,39 @@ export class ProvidersCoolifyReader {
  * a zone's DNS records plus its email-routing status (v1 scope — see that
  * method's own doc comment for what it leaves out).
  */
+const NO_DNS_OWNERS = {};
 export class ProvidersCloudflareReader {
     client;
     resolveScope;
     resolveRecordedIds;
-    constructor(client, resolveScope, resolveRecordedIds) {
+    resolveDnsOwners;
+    constructor(client, resolveScope, resolveRecordedIds, 
+    /**
+     * Who edge holds each DNS record of the org's zone for. A `dns_record`
+     * with a row gets `config.owner`, and the plan does not list it as a
+     * stranger. Left out, every record reads as having no row. A failing
+     * lookup fails the read: a plan that listed those records as strangers
+     * would not match the next one.
+     */
+    resolveDnsOwners) {
         this.client = client;
         this.resolveScope = resolveScope;
         this.resolveRecordedIds = resolveRecordedIds;
+        this.resolveDnsOwners = resolveDnsOwners;
     }
     async listResources(orgId) {
         const zoneId = await this.resolveScope(orgId);
         if (!zoneId)
             return [];
-        const [resources, recorded] = await Promise.all([
+        const [listed, recorded, owners] = await Promise.all([
             this.client.listResources(zoneId),
             this.resolveRecordedIds(orgId),
+            this.resolveDnsOwners?.(orgId) ?? NO_DNS_OWNERS,
         ]);
+        const resources = listed.map((resource) => {
+            const owner = resource.kind === 'dns_record' ? owners[resource.key] : undefined;
+            return owner ? { ...resource, config: { ...resource.config, owner } } : resource;
+        });
         // A zone needs no mapping: its key is already the zone name, which is
         // foundry's own zone key (`diff.ts`'s `planZone`), so it never matches a
         // recorded provider id and always passes through unchanged.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@wtfalch/foundry",
-  "version": "0.22.3",
+  "version": "0.22.4",
   "description": "Foundry's SDK: the declared org's types, the plan and apply contracts, and the state store's interface.",
   "repository": {
     "type": "git",