ApplyReport
in package
What {@see ManifestApi::apply()} actually did — including, when it stopped early, what it had already done.
§27.7 is explicit that apply STOPS AT THE FIRST FAILURE and DOES NOT ROLL BACK. That is not a limitation to apologise for: a partial apply against a live IAM tenant is a state an operator must be able to inspect and resume from, and an automatic rollback would issue a second wave of writes at exactly the moment the server is already telling you something is wrong.
So this report is the recovery tool. $applied is what landed, in order; $failure is
why it stopped; $remaining is what was never attempted.
Table of Contents
Properties
- $applied : array<string|int, mixed>
- $createdServiceAccounts : array<string|int, mixed>
- $failed : PlannedChange|null
- $failure : Throwable|null
- $remaining : array<string|int, mixed>
Methods
- __construct() : mixed
- createdServiceAccounts() : array<int, ServiceAccountCreatedResponse>
- Every service account this apply created, with the one-time secret the server returned for it. See {@see self::$createdServiceAccounts}.
- describe() : array<int, string>
- A human-readable account of the run, suitable for a log line or a CI summary.
- failureReasonCode() : string|null
- The `reason_code` of the `409` that stopped this apply, when that is what did (CONTRACT.md §27.6.2 item 5, §36.4): `stale_version`, `strands_profile`, `duplicate_vlan`, ... as the server wrote it, an unknown value included.
- isComplete() : bool
- True when every planned change landed.
Properties
$applied read-only
public
array<string|int, mixed>
$applied
$createdServiceAccounts read-only
public
array<string|int, mixed>
$createdServiceAccounts
= []
$failed read-only
public
PlannedChange|null
$failed
= null
$failure read-only
public
Throwable|null
$failure
= null
$remaining read-only
public
array<string|int, mixed>
$remaining
= []
Methods
__construct()
public
__construct(array<int, PlannedChange> $applied[, PlannedChange|null $failed = null ][, Throwable|null $failure = null ][, array<int, PlannedChange> $remaining = [] ][, array<int, ServiceAccountCreatedResponse> $createdServiceAccounts = [] ]) : mixed
Parameters
- $applied : array<int, PlannedChange>
-
Changes that succeeded, in the order they ran.
- $failed : PlannedChange|null = null
-
The change that failed, or
nullif none did. - $failure : Throwable|null = null
-
Why it failed, or
null. - $remaining : array<int, PlannedChange> = []
-
Changes never attempted because of the failure.
- $createdServiceAccounts : array<int, ServiceAccountCreatedResponse> = []
-
Every service account this apply created,
client_secretincluded — the ONE time it is ever returned (§27.5 rule 5, CONTRACT.md §27.6.1 addition 3). Kept here even when a LATER step of the same apply fails: the account and its secret exist on the server regardless, and losing the report would lose the only chance to read the secret at all.apply()never rotates one to reconcile drift.
createdServiceAccounts()
Every service account this apply created, with the one-time secret the server returned for it. See {@see self::$createdServiceAccounts}.
public
createdServiceAccounts() : array<int, ServiceAccountCreatedResponse>
Return values
array<int, ServiceAccountCreatedResponse>describe()
A human-readable account of the run, suitable for a log line or a CI summary.
public
describe() : array<int, string>
Return values
array<int, string>failureReasonCode()
The `reason_code` of the `409` that stopped this apply, when that is what did (CONTRACT.md §27.6.2 item 5, §36.4): `stale_version`, `strands_profile`, `duplicate_vlan`, ... as the server wrote it, an unknown value included.
public
failureReasonCode() : string|null
A 409 is that action's failure — apply stopped there, nothing was retried, and the
recovery is to run apply again, which re-reads. Branch on this code, never on the
message.
Return values
string|null —null when the apply completed, failed for another reason, or the
409 carried no code (a server before 1.1.0).
isComplete()
True when every planned change landed.
public
isComplete() : bool