@wtfalch/foundry 0.25.0 → 0.26.0

package/dist/org.js

@@ -179,7 +179,7 @@ export function validateHosting(hosting, names) {
 const ACCESS_RULE_HOSTNAME = /^[a-z0-9]([a-z0-9-]{0,61}[a-z0-9])?(\.[a-z0-9]([a-z0-9-]{0,61}[a-z0-9])?)+$/;
 /**
  * The rules for one {@link AccessRule}; `null` when it is valid. The hostname
- * must be a name the org serves under its own domain and never a locked one;
+ * must be the org's domain or a name under it, and never a locked one;
  * without `names` only the checks that need no domain run.
  */
 function validateAccessRule(rule, hosting, names) {
@@ -201,11 +201,11 @@ function validateAccessRule(rule, hosting, names) {
             return `${at} is a name foundry owns`;
         }
         const { domain } = names;
+        // Any name under the domain: `share.<domain>` and `storage.<domain>` are
+        // served for the org by the files service, not by one of its entries.
         const served = hosting.usesDomain &&
             domain !== null &&
-            hosting.entries.some((entry) => entry.hostnames.some((name) => name === '*'
-                ? rule.hostname.endsWith(`.${domain}`)
-                : rule.hostname === (name === '@' ? domain : `${name}.${domain}`)));
+            (rule.hostname === domain || rule.hostname.endsWith(`.${domain}`));
         if (!served) {
             return `${at} is not a name the org serves under its own domain`;
         }

package/dist/plan/plan-apply.d.ts

@@ -197,6 +197,21 @@ export interface PlatformStepExecutionContext {
      */
     persist?(): Promise<void>;
 }
+/**
+ * The flags {@link PlatformStepExecutor.driftedSteps} returns. Each one is
+ * described on `PlanPlatformOptions.drifted` (`platform-diff.ts`).
+ */
+export interface PlatformDriftedSteps {
+    archon?: boolean;
+    auth?: boolean;
+    /** The host sets it. */
+    edge?: boolean;
+    /** #380 */
+    files?: boolean;
+    backupStorage?: boolean;
+    /** #257 fix round 4 */
+    backupStorageBlocked?: string;
+}
 /** {@link StepExecutor}, for the platform (#167) rather than an org. */
 export interface PlatformStepExecutor {
     /**
@@ -235,17 +250,12 @@ export interface PlatformStepExecutor {
     }>;
     /**
      * Steps whose live state differs from the declared one in a way the recorded
-     * ids cannot show, read from the live system on each plan.
-     */
-    driftedSteps?(platform: DeclaredPlatform, recordedIds: Readonly<Record<string, string>>): Promise<{
-        archon?: boolean;
-        auth?: boolean;
-        /** #380: see `PlanPlatformOptions.drifted.files` (`platform-diff.ts`). */
-        files?: boolean;
-        backupStorage?: boolean;
-        /** #257 fix round 4: see `PlanPlatformOptions.drifted.backupStorageBlocked` (`platform-diff.ts`). */
-        backupStorageBlocked?: string;
-    }>;
+     * ids cannot show, read from the live system on each plan. The host sets
+     * `edge` (foundry's own executor never does). Foundry stores nothing about
+     * the token and the edge step does not clear the flag, so the host must stop
+     * reporting it once edge holds the new token and the old one is gone.
+     */
+    driftedSteps?(platform: DeclaredPlatform, recordedIds: Readonly<Record<string, string>>): Promise<PlatformDriftedSteps>;
     /**
      * Gives the platform files runner a changed share-domain set and touches
      * nothing else. Returns the scope ids to record (only the share-domains

package/dist/plan/platform-diff.d.ts

@@ -1008,11 +1008,17 @@ export interface PlanPlatformOptions {
      * retried forever. `files` (#380): the runner's live env is missing a
      * setting `ensureStarted()` requires -- see `filesRunnerEnvDrifted`
      * (`platform-providers.ts`) -- which the recorded hostname/gitRef alone
-     * could never show.
+     * could never show. `edge`: the Cloudflare token edge runs on is not the one
+     * the host now wants (an older scope), so the recorded ids say edge is
+     * applied while it still holds the old token. The host sets it; foundry's
+     * own executor never does. Foundry stores nothing about the token and the
+     * edge step does not clear the flag, so the host must stop reporting it once
+     * edge holds the new token and the old one is gone.
      */
     drifted?: {
         archon?: boolean;
         auth?: boolean;
+        edge?: boolean;
         files?: boolean;
         backupStorage?: boolean;
         backupStorageBlocked?: string;

package/dist/plan/platform-diff.js

@@ -1061,7 +1061,7 @@ export function planPlatform(platform, live, options = {}) {
     // through it; it needs none of them (a Coolify database and app, its own
     // tunnel and DNS record, a held Cloudflare token) and records the address
     // they reach it at.
-    const edge = planEdge(platform, recordedIds, blocked.edge);
+    const edge = planEdge(platform, recordedIds, blocked.edge, drifted.edge);
     if (edge.step)
         plannedSteps.push(edge.step);
     // Auth, mail and archon would build their tunnels and then fail at the DNS
@@ -2108,13 +2108,17 @@ function planFiles(platform, recordedIds, executorBlocked, authReady, drifted) {
  * Coolify app. A changed hostname or `gitRef` plans the step again (a
  * redeploy, no new secret).
  *
+ * `drifted` (the host's own `driftedSteps`: edge holds an older Cloudflare
+ * token) plans the same step on an applied edge. The step writes the held
+ * token into edge's env and redeploys it.
+ *
  * Blocked, not planned: a platform key minted but never delivered (lost,
  * `ServiceError`-free the way {@link planFiles}'s own management-key check
  * is), or `executorBlocked` -- the host built no edge dependencies, or
  * (CLAUDE.md's "Human steps") no Cloudflare API token is held yet under
  * {@link PLATFORM_EDGE_CLOUDFLARE_TOKEN_REF}.
  */
-function planEdge(platform, recordedIds, executorBlocked) {
+function planEdge(platform, recordedIds, executorBlocked, drifted) {
     if (!platform.edge.enabled)
         return { step: null, blocked: null };
     const undelivered = recordedIds[PLATFORM_EDGE_PLATFORM_KEY_UNDELIVERED_SCOPE_KEY];
@@ -2129,7 +2133,7 @@ function planEdge(platform, recordedIds, executorBlocked) {
         recordedIds[PLATFORM_EDGE_APPLIED_GIT_REF_SCOPE_KEY] === platform.edge.gitRef &&
         // F4.dns: an edge applied before its address was recorded runs once more to record it.
         Boolean(recordedIds[PLATFORM_EDGE_INTERNAL_URL_SCOPE_KEY]);
-    if (applied)
+    if (applied && !drifted)
         return { step: null, blocked: null };
     if (executorBlocked)
         return { step: null, blocked: executorBlocked };
@@ -2142,7 +2146,9 @@ function planEdge(platform, recordedIds, executorBlocked) {
                 desired: { hostname: platform.edge.hostname, gitRef: platform.edge.gitRef },
             },
             step: {
-                description: `provision the edge host at ${platform.edge.hostname}, with its own database and foundry's platform key`,
+                description: applied
+                    ? `replace the Cloudflare token edge runs on at ${platform.edge.hostname} and redeploy edge`
+                    : `provision the edge host at ${platform.edge.hostname}, with its own database and foundry's platform key`,
                 destroys: false,
                 migrates: false,
             },

package/dist/plan/platform-providers.d.ts

@@ -9,7 +9,7 @@ import type { DnsPort } from './edge-dns.js';
 import type { TunnelPort } from './edge-tunnels.js';
 import type { CloudflarePort, CoolifyPort, FoundryStepExecutorPorts, ZitadelPort } from './executor.js';
 import type { LiveResource, PlatformCloudflareReader, PlatformCoolifyReader } from './live.js';
-import type { PlatformStepExecutionContext, PlatformStepExecutor } from './plan-apply.js';
+import type { PlatformDriftedSteps, PlatformStepExecutionContext, PlatformStepExecutor } from './plan-apply.js';
 import { type BrokerDeployRecord } from './platform-diff.js';
 import { type CallsSfuPlatformDeps } from './platform-sfu.js';
 import { type PlatformUptimeDeps } from './uptime-worker.js';
@@ -335,13 +335,7 @@ export declare class FoundryPlatformStepExecutor implements PlatformStepExecutor
      * login-client token is no longer the sole live PAT on its ZITADEL machine
      * user.
      */
-    driftedSteps(platform: DeclaredPlatform, recordedIds?: Readonly<Record<string, string>>): Promise<{
-        archon?: boolean;
-        auth?: boolean;
-        files?: boolean;
-        backupStorage?: boolean;
-        backupStorageBlocked?: string;
-    }>;
+    driftedSteps(platform: DeclaredPlatform, recordedIds?: Readonly<Record<string, string>>): Promise<PlatformDriftedSteps>;
     /**
      * Gives the files runner a changed share-domain set and nothing else: its
      * Coolify `domains`, `FILES_PUBLIC_HOSTS` and one redeploy of the runner.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@wtfalch/foundry",
-  "version": "0.25.0",
+  "version": "0.26.0",
   "description": "Foundry's SDK: the declared org's types, the plan and apply contracts, and the state store's interface.",
   "repository": {
     "type": "git",