@wtfalch/foundry 0.25.1 → 0.26.1

package/dist/plan/diff.d.ts

@@ -117,6 +117,15 @@ export declare function toPlan(detail: PlanDetail): Plan;
  * against this seam.
  */
 export declare function computePlanDetail(org: DeclaredOrg, live: LiveResource[], recordedIds?: Readonly<Record<string, string>>, agoraHost?: AgoraHostReading, jobsAvailable?: boolean, platformReadiness?: OrgPlatformReadiness, options?: PlanOrgOptions): PlanDetail;
+/**
+ * #488: the bare hostname out of an issuer URL (`https://<hostname>`, the
+ * only shape {@link agoraHostValuesFromPlatform} or a host-supplied
+ * `AgoraHostPort` ever hands back), or `null` when there is no issuer to
+ * read one from. What {@link loginHostnameFor} compares the org's own
+ * computed `auth.<domain>` against, so the platform's own org never plans
+ * its login host equal to the shared ZITADEL instance's own.
+ */
+export declare function isPlatformOwnOrg(org: DeclaredOrg, platformApex: string | null): boolean;
 /** Restated from `executor.ts`, the same rule: the id of an ai key minted but not delivered. */
 export declare const AI_KEY_UNDELIVERED_SCOPE_KEY = "ai_key_undelivered";
 /** Restated from `executor.ts`, the same rule: the id of a jobs project registered but not delivered. */

package/dist/plan/diff.js

@@ -734,7 +734,7 @@ function planOwners(org, recordedIds, authReady, authIssuer) {
  * computed `auth.<domain>` against, so the platform's own org never plans
  * its login host equal to the shared ZITADEL instance's own.
  */
-function isPlatformOwnOrg(org, platformApex) {
+export function isPlatformOwnOrg(org, platformApex) {
     return Boolean(org.domain && platformApex && org.domain.toLowerCase() === platformApex.toLowerCase());
 }
 function platformAuthHostnameFrom(issuer) {

package/dist/plan/health-targets.d.ts

@@ -71,7 +71,9 @@ export interface HealthTarget {
  * the broker whenever the org has them; then whichever of hosting or site
  * the org runs, if either.
  */
-export declare function healthTargets(org: DeclaredOrg): HealthTarget[];
+export declare function healthTargets(org: DeclaredOrg, options?: {
+    platform?: DeclaredPlatform | null;
+}): HealthTarget[];
 /**
  * The seven platform services #541 names (`platform:auth`, `platform:archon`,
  * `platform:mail`, `platform:ai`, `platform:files`, `platform:integrations`,

package/dist/plan/health-targets.js

@@ -1,6 +1,7 @@
 import { appEntry } from '../org.js';
 import { agoraHostnameFor } from './agora.js';
 import { bouleHostnameFor } from './boule.js';
+import { isPlatformOwnOrg } from './diff.js';
 import { callsHostnameFor, cmsHostnameFor } from './executor.js';
 import { isBehindGate } from './gates.js';
 import { entryHostnames } from './hostnames.js';
@@ -12,8 +13,6 @@ const DEFAULT_API_HEALTH_PATH = '/api/health';
 const STATIC_PAGE_PATH = '/';
 /** zitadel-login's own readiness route (#541's "Real paths today"). `depth: 'shallow'`, not `'deep'`: login holds no database of its own (`login-host.ts`), whatever its name suggests. */
 const LOGIN_READY_PATH = '/ready';
-/** The broker answers on `platform.auth.hostname` under `AUTH_BROKER_PATH_PATTERN` (`platform-providers.ts`, `'^/api(/|$)'`), so its own health path carries that prefix. */
-const BROKER_HEALTH_PATH = '/api/healthy';
 /** `platform-providers.ts`'s own `waitForInstance` call target (`` `https://${hostname}/debug/healthz}` ``), also the one path `AUTH_ZITADEL_PATH_PATTERN` names by name. */
 const ZITADEL_HEALTH_PATH = '/debug/healthz';
 /**
@@ -26,7 +25,12 @@ const STALWART_READY_PATH = '/healthz/ready';
 const CHAT_SERVICE_HEALTH_PATH = '/_chat/health';
 const CALLS_HEALTH_PATH = '/healthz';
 /** Boule, Agora and the company's own login host: every org gets these, with no flag to check (the "Why" this issue opens with). */
-function alwaysOnTargets(org) {
+function alwaysOnTargets(org, platform) {
+    // The platform's own org signs in on the shared instance host, not its own
+    // `loginHostnameFor` (#488; `login-host.ts`, `diff.ts`'s `planLoginHost`).
+    const loginHost = platform && isPlatformOwnOrg(org, platform.apex)
+        ? platform.auth.hostname
+        : loginHostnameFor(org);
     return [
         {
             service: 'boule',
@@ -49,7 +53,7 @@ function alwaysOnTargets(org) {
         },
         {
             service: 'login',
-            url: `https://${loginHostnameFor(org)}${LOGIN_READY_PATH}`,
+            url: `https://${loginHost}${LOGIN_READY_PATH}`,
             expect: okExpect(),
             depth: 'shallow',
             restartSafe: false,
@@ -224,8 +228,8 @@ function appTargets(org) {
  * the broker whenever the org has them; then whichever of hosting or site
  * the org runs, if either.
  */
-export function healthTargets(org) {
-    const targets = alwaysOnTargets(org);
+export function healthTargets(org, options = {}) {
+    const targets = alwaysOnTargets(org, options.platform ?? null);
     const broker = brokerTarget(org);
     if (broker)
         targets.push(broker);
@@ -265,12 +269,18 @@ function authTargets(platform) {
             behindAccess: false,
         },
         {
+            // The broker's only unauthenticated route is `/healthy` at its own root
+            // (auth's `broker/src/server.ts`), but the tunnel hands it only
+            // `AUTH_BROKER_PATH_PATTERN` ('^/api(/|$)') unchanged: `/api/healthy`
+            // reaches the broker and answers 401, and bare `/healthy` reaches
+            // zitadel-login instead, which would read as the broker being up.
             service: 'auth-broker',
-            url: `https://${hostname}${BROKER_HEALTH_PATH}`,
+            url: null,
             expect: okExpect(),
             depth: 'shallow',
             restartSafe: false,
             behindAccess: false,
+            reason: "the broker's health route (/healthy) is not reachable from outside: the tunnel sends it only /api/*, which answers 401 without a session, and /healthy on this host is zitadel-login's",
         },
     ];
 }
@@ -302,11 +312,15 @@ export function platformHealthTargets(platform) {
         ...authTargets(platform),
         {
             service: 'archon',
+            // `provisionPlatformArchon` always puts a Cloudflare Access app in front
+            // of this hostname (it throws with no Access emails), so a prober with no
+            // service token reads a redirect: it proves Access and the tunnel are up,
+            // not that Archon answers.
             url: `https://${platform.archon.hostname}${DEFAULT_API_HEALTH_PATH}`,
             expect: okExpect(),
-            depth: 'deep',
+            depth: 'shallow',
             restartSafe: false,
-            behindAccess: false,
+            behindAccess: true,
         },
         {
             service: 'mail',

package/dist/plan/plan-apply.d.ts

@@ -197,6 +197,21 @@ export interface PlatformStepExecutionContext {
      */
     persist?(): Promise<void>;
 }
+/**
+ * The flags {@link PlatformStepExecutor.driftedSteps} returns. Each one is
+ * described on `PlanPlatformOptions.drifted` (`platform-diff.ts`).
+ */
+export interface PlatformDriftedSteps {
+    archon?: boolean;
+    auth?: boolean;
+    /** The host sets it. */
+    edge?: boolean;
+    /** #380 */
+    files?: boolean;
+    backupStorage?: boolean;
+    /** #257 fix round 4 */
+    backupStorageBlocked?: string;
+}
 /** {@link StepExecutor}, for the platform (#167) rather than an org. */
 export interface PlatformStepExecutor {
     /**
@@ -235,17 +250,12 @@ export interface PlatformStepExecutor {
     }>;
     /**
      * Steps whose live state differs from the declared one in a way the recorded
-     * ids cannot show, read from the live system on each plan.
-     */
-    driftedSteps?(platform: DeclaredPlatform, recordedIds: Readonly<Record<string, string>>): Promise<{
-        archon?: boolean;
-        auth?: boolean;
-        /** #380: see `PlanPlatformOptions.drifted.files` (`platform-diff.ts`). */
-        files?: boolean;
-        backupStorage?: boolean;
-        /** #257 fix round 4: see `PlanPlatformOptions.drifted.backupStorageBlocked` (`platform-diff.ts`). */
-        backupStorageBlocked?: string;
-    }>;
+     * ids cannot show, read from the live system on each plan. The host sets
+     * `edge` (foundry's own executor never does). Foundry stores nothing about
+     * the token and the edge step does not clear the flag, so the host must stop
+     * reporting it once edge holds the new token and the old one is gone.
+     */
+    driftedSteps?(platform: DeclaredPlatform, recordedIds: Readonly<Record<string, string>>): Promise<PlatformDriftedSteps>;
     /**
      * Gives the platform files runner a changed share-domain set and touches
      * nothing else. Returns the scope ids to record (only the share-domains

package/dist/plan/platform-diff.d.ts

@@ -1008,11 +1008,17 @@ export interface PlanPlatformOptions {
      * retried forever. `files` (#380): the runner's live env is missing a
      * setting `ensureStarted()` requires -- see `filesRunnerEnvDrifted`
      * (`platform-providers.ts`) -- which the recorded hostname/gitRef alone
-     * could never show.
+     * could never show. `edge`: the Cloudflare token edge runs on is not the one
+     * the host now wants (an older scope), so the recorded ids say edge is
+     * applied while it still holds the old token. The host sets it; foundry's
+     * own executor never does. Foundry stores nothing about the token and the
+     * edge step does not clear the flag, so the host must stop reporting it once
+     * edge holds the new token and the old one is gone.
      */
     drifted?: {
         archon?: boolean;
         auth?: boolean;
+        edge?: boolean;
         files?: boolean;
         backupStorage?: boolean;
         backupStorageBlocked?: string;

package/dist/plan/platform-diff.js

@@ -1061,7 +1061,7 @@ export function planPlatform(platform, live, options = {}) {
     // through it; it needs none of them (a Coolify database and app, its own
     // tunnel and DNS record, a held Cloudflare token) and records the address
     // they reach it at.
-    const edge = planEdge(platform, recordedIds, blocked.edge);
+    const edge = planEdge(platform, recordedIds, blocked.edge, drifted.edge);
     if (edge.step)
         plannedSteps.push(edge.step);
     // Auth, mail and archon would build their tunnels and then fail at the DNS
@@ -2108,13 +2108,17 @@ function planFiles(platform, recordedIds, executorBlocked, authReady, drifted) {
  * Coolify app. A changed hostname or `gitRef` plans the step again (a
  * redeploy, no new secret).
  *
+ * `drifted` (the host's own `driftedSteps`: edge holds an older Cloudflare
+ * token) plans the same step on an applied edge. The step writes the held
+ * token into edge's env and redeploys it.
+ *
  * Blocked, not planned: a platform key minted but never delivered (lost,
  * `ServiceError`-free the way {@link planFiles}'s own management-key check
  * is), or `executorBlocked` -- the host built no edge dependencies, or
  * (CLAUDE.md's "Human steps") no Cloudflare API token is held yet under
  * {@link PLATFORM_EDGE_CLOUDFLARE_TOKEN_REF}.
  */
-function planEdge(platform, recordedIds, executorBlocked) {
+function planEdge(platform, recordedIds, executorBlocked, drifted) {
     if (!platform.edge.enabled)
         return { step: null, blocked: null };
     const undelivered = recordedIds[PLATFORM_EDGE_PLATFORM_KEY_UNDELIVERED_SCOPE_KEY];
@@ -2129,7 +2133,7 @@ function planEdge(platform, recordedIds, executorBlocked) {
         recordedIds[PLATFORM_EDGE_APPLIED_GIT_REF_SCOPE_KEY] === platform.edge.gitRef &&
         // F4.dns: an edge applied before its address was recorded runs once more to record it.
         Boolean(recordedIds[PLATFORM_EDGE_INTERNAL_URL_SCOPE_KEY]);
-    if (applied)
+    if (applied && !drifted)
         return { step: null, blocked: null };
     if (executorBlocked)
         return { step: null, blocked: executorBlocked };
@@ -2142,7 +2146,9 @@ function planEdge(platform, recordedIds, executorBlocked) {
                 desired: { hostname: platform.edge.hostname, gitRef: platform.edge.gitRef },
             },
             step: {
-                description: `provision the edge host at ${platform.edge.hostname}, with its own database and foundry's platform key`,
+                description: applied
+                    ? `replace the Cloudflare token edge runs on at ${platform.edge.hostname} and redeploy edge`
+                    : `provision the edge host at ${platform.edge.hostname}, with its own database and foundry's platform key`,
                 destroys: false,
                 migrates: false,
             },

package/dist/plan/platform-providers.d.ts

@@ -9,7 +9,7 @@ import type { DnsPort } from './edge-dns.js';
 import type { TunnelPort } from './edge-tunnels.js';
 import type { CloudflarePort, CoolifyPort, FoundryStepExecutorPorts, ZitadelPort } from './executor.js';
 import type { LiveResource, PlatformCloudflareReader, PlatformCoolifyReader } from './live.js';
-import type { PlatformStepExecutionContext, PlatformStepExecutor } from './plan-apply.js';
+import type { PlatformDriftedSteps, PlatformStepExecutionContext, PlatformStepExecutor } from './plan-apply.js';
 import { type BrokerDeployRecord } from './platform-diff.js';
 import { type CallsSfuPlatformDeps } from './platform-sfu.js';
 import { type PlatformUptimeDeps } from './uptime-worker.js';
@@ -335,13 +335,7 @@ export declare class FoundryPlatformStepExecutor implements PlatformStepExecutor
      * login-client token is no longer the sole live PAT on its ZITADEL machine
      * user.
      */
-    driftedSteps(platform: DeclaredPlatform, recordedIds?: Readonly<Record<string, string>>): Promise<{
-        archon?: boolean;
-        auth?: boolean;
-        files?: boolean;
-        backupStorage?: boolean;
-        backupStorageBlocked?: string;
-    }>;
+    driftedSteps(platform: DeclaredPlatform, recordedIds?: Readonly<Record<string, string>>): Promise<PlatformDriftedSteps>;
     /**
      * Gives the files runner a changed share-domain set and nothing else: its
      * Coolify `domains`, `FILES_PUBLIC_HOSTS` and one redeploy of the runner.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@wtfalch/foundry",
-  "version": "0.25.1",
+  "version": "0.26.1",
   "description": "Foundry's SDK: the declared org's types, the plan and apply contracts, and the state store's interface.",
   "repository": {
     "type": "git",