@wtfalch/foundry 0.16.5 → 0.16.7

package/dist/index.d.ts

@@ -23,6 +23,8 @@ export { PlatformOrgBlockedError, PlatformOrgPorts } from './plan/index.js';
 export type { CoolifyPort, CloudflarePort, ZitadelPort, CallsSfuPort, JobsSchedulerPort, FilesOrganisationPort, AiOrganisationPort, FoundryStepExecutorPorts, PlatformOrgPortSource, AgoraHostPort, AgoraHostValues, LoginHostBinding, LoginHostBindingsPort, } from './plan/index.js';
 export { FoundryStepExecutor, NotBuiltError, healthUrls, loginHostnameFor } from './plan/index.js';
 export { HttpJobsSchedulerClient } from './plan/index.js';
+export type { ZitadelListAppsRawApp } from './plan/index.js';
+export { adaptZitadelListApps } from './plan/index.js';
 export type { MailIdentityApp, MailIdentityAudienceCheck } from './plan/index.js';
 export { checkMailIdentityAudience } from './plan/index.js';
 export type { MailAllowlistApp } from './plan/index.js';

package/dist/index.js

@@ -10,6 +10,7 @@ export { DEFAULT_ORG_PLATFORM_READINESS, ORG_PLATFORM_KEY_REFS, agoraHostValuesF
 export { PlatformOrgBlockedError, PlatformOrgPorts } from './plan/index.js';
 export { FoundryStepExecutor, NotBuiltError, healthUrls, loginHostnameFor } from './plan/index.js';
 export { HttpJobsSchedulerClient } from './plan/index.js';
+export { adaptZitadelListApps } from './plan/index.js';
 export { checkMailIdentityAudience } from './plan/index.js';
 export { checkMailAppsAllowlist } from './plan/index.js';
 export { FoundryPlatformStepExecutor, ProvidersPlatformCloudflareReader, ProvidersPlatformCoolifyReader, createZitadelAdminMinter, createZitadelProjectRoles, PLATFORM_AUTH_KEY, PLATFORM_MAIL_KEY, PLATFORM_MAIL_ADMIN_KEY_DESCRIPTION, } from './plan/index.js';

package/dist/plan/index.d.ts

@@ -35,4 +35,6 @@ export type { MailAllowlistApp } from './mail-identity-allowlist.js';
 export { checkMailAppsAllowlist } from './mail-identity-allowlist.js';
 export type { CoolifyPort, CloudflarePort, ZitadelPort, CallsSfuPort, JobsSchedulerPort, FilesOrganisationPort, AiOrganisationPort, FoundryStepExecutorPorts, PlatformOrgPortSource, } from './executor.js';
 export { FoundryStepExecutor, NotBuiltError, healthUrls } from './executor.js';
+export type { ZitadelListAppsRawApp } from './executor.js';
+export { adaptZitadelListApps } from './executor.js';
 export { HttpJobsSchedulerClient } from './jobs-scheduler-http.js';

package/dist/plan/index.js

@@ -18,4 +18,5 @@ export { loginHostnameFor } from './login-host.js';
 export { checkMailIdentityAudience } from './mail-identity.js';
 export { checkMailAppsAllowlist } from './mail-identity-allowlist.js';
 export { FoundryStepExecutor, NotBuiltError, healthUrls } from './executor.js';
+export { adaptZitadelListApps } from './executor.js';
 export { HttpJobsSchedulerClient } from './jobs-scheduler-http.js';

package/dist/plan/platform-diff.d.ts

@@ -466,6 +466,13 @@ export declare const PLATFORM_AI_MIGRATE_BLOCKED_SCOPE_KEY = "ai_platform_migrat
  * that throws) is repaired by the next one.
  */
 export declare const PLATFORM_AI_DEPLOY_PENDING_SCOPE_KEY = "ai_platform_deploy_pending";
+/**
+ * The Coolify deployment queued for the host (its `deployment_uuid`, or
+ * `untracked` when the deploy answered none), set when that deploy is queued
+ * and cleared once it finished. The mint waits for it, so a retry after a
+ * failed wait still waits instead of minting against the old container.
+ */
+export declare const PLATFORM_AI_RUNNER_DEPLOYMENT_SCOPE_KEY = "ai_platform_runner_deployment";
 /**
  * #171: the resource key `planFiles` plans under and `FoundryPlatformStepExecutor`
  * dispatches on, the {@link PLATFORM_AUTH_KEY} shape for the files host.

package/dist/plan/platform-diff.js

@@ -523,6 +523,13 @@ export const PLATFORM_AI_MIGRATE_BLOCKED_SCOPE_KEY = 'ai_platform_migrate_blocke
  * that throws) is repaired by the next one.
  */
 export const PLATFORM_AI_DEPLOY_PENDING_SCOPE_KEY = 'ai_platform_deploy_pending';
+/**
+ * The Coolify deployment queued for the host (its `deployment_uuid`, or
+ * `untracked` when the deploy answered none), set when that deploy is queued
+ * and cleared once it finished. The mint waits for it, so a retry after a
+ * failed wait still waits instead of minting against the old container.
+ */
+export const PLATFORM_AI_RUNNER_DEPLOYMENT_SCOPE_KEY = 'ai_platform_runner_deployment';
 /**
  * #171: the resource key `planFiles` plans under and `FoundryPlatformStepExecutor`
  * dispatches on, the {@link PLATFORM_AUTH_KEY} shape for the files host.
@@ -1042,6 +1049,10 @@ function planSfu(platform) {
  * the broker's own token as part of running this step, and a step that is
  * never planned never runs. So this still plans the step -- surfacing
  * `executorBlocked` in `blocked` for visibility, not to stop planning.
+ * Exception (the auth-broker loop): once everything else is applied and
+ * `otherInputsMissing` is non-empty, nothing this step can do changes the
+ * missing inputs, so it is reported blocked and not planned -- else every
+ * `driveApply` round replans it until `maxRounds`.
  *
  * #211 round 6: round 3's `!brokerApplied` guard assumed "no executor" and
  * "broker not yet created" always coincide. They don't: a broker recorded on
@@ -1152,10 +1163,25 @@ function planAuth(platform, recordedIds, executorBlocked, executorMissing, authD
     // #211 round 3: a blocked reason with no broker yet created also means the
     // executor is unusable (no auth dependencies) -- nothing to plan.
     // A blocked reason with the broker already created means only its deploy
-    // is held back; plan the step anyway so it can keep retrying and, once
-    // #209/#210 land, deploy on the very next apply.
+    // is held back; plan the step anyway, so it can mint what it can (#209) and,
+    // once #210 lands, deploy on the very next apply.
     if (executorBlocked && !brokerApplied)
         return { step: null, blocked: executorBlocked };
+    // Loop fix: everything but the broker deploy is applied and that deploy
+    // waits on an input (`otherInputsMissing`, never the token this step mints)
+    // that another run supplies -- re-applying changes nothing, so the step
+    // planned and applied every `driveApply` round, with dozens of Coolify
+    // calls each, until `maxRounds`. Report it blocked and plan nothing; the
+    // next plan re-reads the live inputs, so it plans the step once they exist.
+    // The login client is not required here: `provisionPlatformAuth` mints it
+    // only once those same inputs exist, so it is never recorded before then.
+    if (executorBlocked &&
+        otherInputsMissing.length > 0 &&
+        recordedIds[key] &&
+        connectorApplied &&
+        recordedIds[PLATFORM_AUTH_ZITADEL_RUN_OPTIONS_SCOPE_KEY] === AUTH_ZITADEL_RUN_OPTIONS) {
+        return { step: null, blocked: executorBlocked };
+    }
     return {
         step: {
             action: {

package/dist/plan/platform-providers.js

@@ -6,7 +6,7 @@ import { redactSecrets } from '../calls-sfu-deploy-support.js';
 import { ensureCloudflaredConnector } from './cloudflared-connector.js';
 import { ACCESS_POLICY_NAME, getDatabaseStarted, isNotFoundError, isRunningOrStarting, } from './executor.js';
 import { coolifyDomains } from './hostnames.js';
-import { AUTH_ZITADEL_RUN_OPTIONS, JOBS_SCHEDULER_KEY, PLATFORM_AI_APPLIED_GITREF_SCOPE_KEY, PLATFORM_AI_APPLIED_HOSTNAME_SCOPE_KEY, PLATFORM_AI_DEPLOY_PENDING_SCOPE_KEY, PLATFORM_AI_INTERNAL_URL_SCOPE_KEY, PLATFORM_AI_KEY, PLATFORM_AI_MANAGEMENT_KEY_CONFLICT_SCOPE_KEY, PLATFORM_AI_MANAGEMENT_KEY_SCOPE_KEY, PLATFORM_AI_MANAGEMENT_KEY_UNDELIVERED_SCOPE_KEY, PLATFORM_AI_MIGRATE_BLOCKED_SCOPE_KEY, PLATFORM_AI_ORGANISATION_SCOPE_KEY, PLATFORM_AI_SIGNING_KEY_SET_SCOPE_KEY, PLATFORM_AI_SIGNING_KEY_UNDELIVERED_SCOPE_KEY, PLATFORM_ARCHON_APPLIED_BROKER_SCOPE_KEY, PLATFORM_ARCHON_APPLIED_GIT_REF_SCOPE_KEY, PLATFORM_ARCHON_APPLIED_HOSTNAME_SCOPE_KEY, PLATFORM_ARCHON_CONNECTOR_APP_SCOPE_KEY, PLATFORM_ARCHON_GATE_CLOSED_SCOPE_KEY, PLATFORM_ARCHON_KEY, PLATFORM_ARCHON_MASTER_CLOUDFLARE_TOKEN_REF, PLATFORM_ARCHON_MASTER_COOLIFY_TOKEN_REF, PLATFORM_ARCHON_MASTER_COOLIFY_URL_REF, PLATFORM_AUTH_ADMIN_UNDELIVERED_SCOPE_KEY, PLATFORM_AUTH_ADMIN_USER_SCOPE_KEY, PLATFORM_AUTH_BROKER_DEPLOYED_SCOPE_KEY, PLATFORM_AUTH_BROKER_SCOPE_KEY, PLATFORM_AUTH_CONNECTOR_APP_SCOPE_KEY, PLATFORM_AUTH_INSTANCE_SCOPE_KEY, PLATFORM_AUTH_INSTANCE_UNDELIVERED_SCOPE_KEY, PLATFORM_AUTH_KEY, PLATFORM_AUTH_LOGIN_CLIENT_UNDELIVERED_SCOPE_KEY, PLATFORM_AUTH_LOGIN_CLIENT_USER_SCOPE_KEY, PLATFORM_AUTH_ZITADEL_APPLIED_IMAGE_TAG_SCOPE_KEY, PLATFORM_AUTH_ZITADEL_RUN_OPTIONS_SCOPE_KEY, PLATFORM_BACKUP_DATABASE_SCOPE_KEYS, PLATFORM_BACKUP_SERVICE_KEYS, PLATFORM_FILES_APPLIED_GIT_REF_SCOPE_KEY, PLATFORM_FILES_APPLIED_HOSTNAME_SCOPE_KEY, PLATFORM_FILES_INTERNAL_URL_SCOPE_KEY, PLATFORM_FILES_INTROSPECTION_SCOPE_KEY, PLATFORM_FILES_INTROSPECTION_UNDELIVERED_SCOPE_KEY, PLATFORM_FILES_KEY, PLATFORM_FILES_MANAGEMENT_KEY_SCOPE_KEY, PLATFORM_FILES_MANAGEMENT_UNDELIVERED_SCOPE_KEY, PLATFORM_FILES_ZITADEL_PROJECT_SCOPE_KEY, PLATFORM_INTEGRATIONS_APPLIED_GITREF_SCOPE_KEY, PLATFORM_INTEGRATIONS_APPLIED_HOSTNAME_SCOPE_KEY, PLATFORM_INTEGRATIONS_KEY, PLATFORM_INTEGRATIONS_KEY_SET_SCOPE_KEY, PLATFORM_INTEGRATIONS_KEY_UNDELIVERED_SCOPE_KEY, PLATFORM_MAIL_ADMIN_KEY_SCOPE_KEY, PLATFORM_MAIL_ADMIN_UNDELIVERED_SCOPE_KEY, PLATFORM_MAIL_APPLIED_GIT_REF_SCOPE_KEY, PLATFORM_MAIL_APPLIED_HOSTNAME_SCOPE_KEY, PLATFORM_MAIL_CONNECTOR_APP_SCOPE_KEY, PLATFORM_MAIL_INTERNAL_URL_SCOPE_KEY, PLATFORM_MAIL_KEY, PLATFORM_MAIL_ZITADEL_PROJECT_SCOPE_KEY, parseBrokerDeployRecord, parseLoginClientRecord, platformMailMxHost, } from './platform-diff.js';
+import { AUTH_ZITADEL_RUN_OPTIONS, JOBS_SCHEDULER_KEY, PLATFORM_AI_APPLIED_GITREF_SCOPE_KEY, PLATFORM_AI_APPLIED_HOSTNAME_SCOPE_KEY, PLATFORM_AI_DEPLOY_PENDING_SCOPE_KEY, PLATFORM_AI_INTERNAL_URL_SCOPE_KEY, PLATFORM_AI_KEY, PLATFORM_AI_MANAGEMENT_KEY_CONFLICT_SCOPE_KEY, PLATFORM_AI_MANAGEMENT_KEY_SCOPE_KEY, PLATFORM_AI_MANAGEMENT_KEY_UNDELIVERED_SCOPE_KEY, PLATFORM_AI_MIGRATE_BLOCKED_SCOPE_KEY, PLATFORM_AI_ORGANISATION_SCOPE_KEY, PLATFORM_AI_RUNNER_DEPLOYMENT_SCOPE_KEY, PLATFORM_AI_SIGNING_KEY_SET_SCOPE_KEY, PLATFORM_AI_SIGNING_KEY_UNDELIVERED_SCOPE_KEY, PLATFORM_ARCHON_APPLIED_BROKER_SCOPE_KEY, PLATFORM_ARCHON_APPLIED_GIT_REF_SCOPE_KEY, PLATFORM_ARCHON_APPLIED_HOSTNAME_SCOPE_KEY, PLATFORM_ARCHON_CONNECTOR_APP_SCOPE_KEY, PLATFORM_ARCHON_GATE_CLOSED_SCOPE_KEY, PLATFORM_ARCHON_KEY, PLATFORM_ARCHON_MASTER_CLOUDFLARE_TOKEN_REF, PLATFORM_ARCHON_MASTER_COOLIFY_TOKEN_REF, PLATFORM_ARCHON_MASTER_COOLIFY_URL_REF, PLATFORM_AUTH_ADMIN_UNDELIVERED_SCOPE_KEY, PLATFORM_AUTH_ADMIN_USER_SCOPE_KEY, PLATFORM_AUTH_BROKER_DEPLOYED_SCOPE_KEY, PLATFORM_AUTH_BROKER_SCOPE_KEY, PLATFORM_AUTH_CONNECTOR_APP_SCOPE_KEY, PLATFORM_AUTH_INSTANCE_SCOPE_KEY, PLATFORM_AUTH_INSTANCE_UNDELIVERED_SCOPE_KEY, PLATFORM_AUTH_KEY, PLATFORM_AUTH_LOGIN_CLIENT_UNDELIVERED_SCOPE_KEY, PLATFORM_AUTH_LOGIN_CLIENT_USER_SCOPE_KEY, PLATFORM_AUTH_ZITADEL_APPLIED_IMAGE_TAG_SCOPE_KEY, PLATFORM_AUTH_ZITADEL_RUN_OPTIONS_SCOPE_KEY, PLATFORM_BACKUP_DATABASE_SCOPE_KEYS, PLATFORM_BACKUP_SERVICE_KEYS, PLATFORM_FILES_APPLIED_GIT_REF_SCOPE_KEY, PLATFORM_FILES_APPLIED_HOSTNAME_SCOPE_KEY, PLATFORM_FILES_INTERNAL_URL_SCOPE_KEY, PLATFORM_FILES_INTROSPECTION_SCOPE_KEY, PLATFORM_FILES_INTROSPECTION_UNDELIVERED_SCOPE_KEY, PLATFORM_FILES_KEY, PLATFORM_FILES_MANAGEMENT_KEY_SCOPE_KEY, PLATFORM_FILES_MANAGEMENT_UNDELIVERED_SCOPE_KEY, PLATFORM_FILES_ZITADEL_PROJECT_SCOPE_KEY, PLATFORM_INTEGRATIONS_APPLIED_GITREF_SCOPE_KEY, PLATFORM_INTEGRATIONS_APPLIED_HOSTNAME_SCOPE_KEY, PLATFORM_INTEGRATIONS_KEY, PLATFORM_INTEGRATIONS_KEY_SET_SCOPE_KEY, PLATFORM_INTEGRATIONS_KEY_UNDELIVERED_SCOPE_KEY, PLATFORM_MAIL_ADMIN_KEY_SCOPE_KEY, PLATFORM_MAIL_ADMIN_UNDELIVERED_SCOPE_KEY, PLATFORM_MAIL_APPLIED_GIT_REF_SCOPE_KEY, PLATFORM_MAIL_APPLIED_HOSTNAME_SCOPE_KEY, PLATFORM_MAIL_CONNECTOR_APP_SCOPE_KEY, PLATFORM_MAIL_INTERNAL_URL_SCOPE_KEY, PLATFORM_MAIL_KEY, PLATFORM_MAIL_ZITADEL_PROJECT_SCOPE_KEY, parseBrokerDeployRecord, parseLoginClientRecord, platformMailMxHost, } from './platform-diff.js';
 import { applyCallsSfuPlatformStep } from './platform-sfu.js';
 import { CreateInstanceError, createZitadelInstance, generateSystemApiKeypair, instanceWithoutBearerMessage, systemApiUsersEnv, } from './zitadel-system-api.js';
 /** The key `runPlatformSteps` records the apex zone's id under (`system:kind:key`). */
@@ -3147,16 +3147,18 @@ const PLATFORM_AI_WORKER_SCOPE_KEY = 'coolify_platform_ai_worker_app';
  * Written only when absent, never overwritten: an operator's own model list
  * or worker bounds survive every apply. Values are `.env.example`'s, and
  * `AI_MODELS=[]` is the README's "honest configuration for a host with no
- * approved text model".
+ * approved text model". The runner needs `AI_WORKER_TIMEOUT_MS` too: ai's
+ * `runtimeHost()` (`apps/host/src/lib/authz/ai-host.ts`) requires it, and
+ * every route that checks readiness fails without it.
  */
 const PLATFORM_AI_RUNNER_DEFAULTS = [
     { key: 'AI_MODELS', value: '[]' },
     { key: 'AI_FORGE_BINDINGS', value: '[]' },
+    { key: 'AI_WORKER_TIMEOUT_MS', value: '60000' },
 ];
 const PLATFORM_AI_WORKER_DEFAULTS = [
     ...PLATFORM_AI_RUNNER_DEFAULTS,
     { key: 'AI_WORKER_BATCH', value: '10' },
-    { key: 'AI_WORKER_TIMEOUT_MS', value: '60000' },
 ];
 /**
  * #172: makes `coolify:app` keyed {@link PLATFORM_AI_KEY} true -- the ai host
@@ -3402,8 +3404,12 @@ async function provisionPlatformAi(context, deps) {
         }
         await coolify.raw('POST', `/applications/${migrate.appId}/stop`);
     }
-    if (deployRunner)
-        await coolify.deploy(runner.appId);
+    // `deploy` only queues a build that takes minutes, so the id of the host's
+    // deployment is kept for the mint below to wait on.
+    const runnerDeployment = deployRunner ? await coolify.deploy(runner.appId) : undefined;
+    if (deployRunner) {
+        await record(PLATFORM_AI_RUNNER_DEPLOYMENT_SCOPE_KEY, queuedDeploymentUuid(runnerDeployment) ?? 'untracked');
+    }
     if (deployWorker)
         await coolify.deploy(worker.appId);
     await record(PLATFORM_AI_DEPLOY_PENDING_SCOPE_KEY, '');
@@ -3422,6 +3428,25 @@ async function provisionPlatformAi(context, deps) {
         if (lost) {
             throw new Error(`platform:ai: AI management key ${lost} was minted but never delivered; revoke it and remove the recorded key ${PLATFORM_AI_MANAGEMENT_KEY_UNDELIVERED_SCOPE_KEY} to mint a new one`);
         }
+        // The host answers 503 (or nothing) until the deployment that carries its
+        // management settings has finished.
+        const queued = context.recordedIds()[PLATFORM_AI_RUNNER_DEPLOYMENT_SCOPE_KEY];
+        if (queued) {
+            try {
+                await waitForAiDeployment(coolify, runner.appId, queued, runtime, sleep);
+            }
+            catch (error) {
+                // Only a build still running is worth waiting on again. A deployment
+                // that failed, was cancelled or cannot be read is not: mark the host
+                // pending so the next apply queues a new one instead of polling it.
+                if (!(error instanceof AiDeploymentTimeoutError)) {
+                    await record(PLATFORM_AI_DEPLOY_PENDING_SCOPE_KEY, '1');
+                    await record(PLATFORM_AI_RUNNER_DEPLOYMENT_SCOPE_KEY, '');
+                }
+                throw error;
+            }
+            await record(PLATFORM_AI_RUNNER_DEPLOYMENT_SCOPE_KEY, '');
+        }
         // #201: a test injects its own minter; without one, build the real one
         // over ai's own POST /v1/platform/keys, signed with the key pinned above.
         const minter = deps.managementKeyMinter ??
@@ -3459,8 +3484,9 @@ async function provisionPlatformAi(context, deps) {
             if (error instanceof AiManagementKeyUntrustedError) {
                 throw new Error(`platform:ai: ${error.message}`);
             }
-            // The cause is dropped in case it echoes a credential.
-            throw new Error('platform:ai: the AI management key could not be minted (the minter failed; its error is not shown). Nothing was recorded; apply again');
+            // The cause is dropped in case it echoes a credential; only the HTTP
+            // status, or a network error's name and code, say why.
+            throw new Error(`platform:ai: the AI management key could not be minted (${describeMintFailure(error)}). Nothing was recorded; apply again`);
         }
         const { credentialId, organisationId, secret } = minted;
         await record(PLATFORM_AI_MANAGEMENT_KEY_UNDELIVERED_SCOPE_KEY, credentialId);
@@ -3549,6 +3575,70 @@ class MigrationNotHealthyError extends Error {
         this.lastStatus = lastStatus;
     }
 }
+/** The `deployment_uuid` in the `{deployments:[...]}` / array answer of Coolify's deploy call, if any. */
+function queuedDeploymentUuid(result) {
+    const rows = Array.isArray(result)
+        ? result
+        : result?.deployments;
+    const uuid = Array.isArray(rows)
+        ? rows[0]?.deployment_uuid
+        : undefined;
+    return typeof uuid === 'string' && uuid ? uuid : undefined;
+}
+/**
+ * Waits until the host's queued deployment has `finished`; throws on
+ * `failed`/`cancelled-by-user` or once `migrateTimeoutMs` has passed. With no
+ * deployment id (`untracked`) the only signal left is the app's own status,
+ * which an old container can already satisfy, so that is best effort.
+ */
+/** The host's deployment was still running when the wait gave up. */
+class AiDeploymentTimeoutError extends Error {
+}
+async function waitForAiDeployment(coolify, appId, deploymentUuid, runtime, sleep) {
+    const now = runtime.now ?? Date.now;
+    const timeout = runtime.migrateTimeoutMs ?? 600_000;
+    const interval = runtime.migrateIntervalMs ?? 5_000;
+    const deadline = now() + timeout;
+    let status;
+    for (;;) {
+        await sleep(interval);
+        if (deploymentUuid === 'untracked') {
+            status = (await coolify.getApplication(appId)).status;
+            if (status?.startsWith('running:healthy'))
+                return;
+        }
+        else {
+            const found = (await coolify.raw('GET', `/deployments/${deploymentUuid}`));
+            status = typeof found?.status === 'string' ? found.status : undefined;
+            if (status === 'finished')
+                return;
+            if (status === 'failed' || status === 'cancelled-by-user') {
+                throw new Error(`platform:ai: the host's deployment for ${appId} ended ${status}; the AI management key was not minted. Check its build log in Coolify, then apply again`);
+            }
+        }
+        if (now() >= deadline) {
+            throw new AiDeploymentTimeoutError(`platform:ai: the host's deployment for ${appId} did not finish within ${Math.round(timeout / 1000)}s (last status ${status ?? 'unknown'}); the AI management key was not minted. Apply again`);
+        }
+    }
+}
+/**
+ * Why a mint failed, safe to show: the status ai answered (the minter's own
+ * fixed message), or a network error's `name` and `cause.code`. Never a
+ * `.message` or body, which could echo a credential.
+ */
+function describeMintFailure(error) {
+    const status = /^ai's platform\/keys route answered (\d{3})$/.exec(error instanceof Error ? error.message : '')?.[1];
+    if (status)
+        return `ai answered HTTP ${status}`;
+    if (error instanceof Error) {
+        const code = error.cause?.code;
+        // A plain `Error` is the minter's own (a malformed body), not the network.
+        if (typeof code === 'string' || error.name !== 'Error') {
+            return `network error ${error.name}${typeof code === 'string' ? ` ${code}` : ''}`;
+        }
+    }
+    return 'the minter failed; its error is not shown';
+}
 /**
  * Polls the app until Coolify reports it stopped (`exited`/`stopped`), so a
  * healthy status read afterwards belongs to a deployment queued after this.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@wtfalch/foundry",
-  "version": "0.16.5",
+  "version": "0.16.7",
   "description": "Foundry's SDK: the declared org's types, the plan and apply contracts, and the state store's interface.",
   "repository": {
     "type": "git",