@wtfalch/foundry 0.19.1 → 0.21.0

package/dist/plan/providers-readers.d.ts

@@ -3,7 +3,7 @@ import type { CoolifyClient } from '@wtfalch/providers/coolify';
 import { type ZitadelClient } from '@wtfalch/providers/zitadel';
 import type { OrgId } from '../org.js';
 import type { DeclaredOrgStore } from '../store.js';
-import type { CloudflareReader, CmsReader, CoolifyReader, LiveResource, ZitadelReader } from './live.js';
+import type { AiReader, CloudflareReader, CmsReader, CoolifyReader, LiveResource, ZitadelReader } from './live.js';
 /**
  * Real `CoolifyReader`, `CloudflareReader` and `ZitadelReader` implementations
  * (`live.ts:31-45`), backed by `@wtfalch/providers`' HTTP clients instead of
@@ -144,6 +144,28 @@ export declare class ProvidersZitadelReader implements ZitadelReader {
      */
     private liveIssuer;
 }
+/**
+ * Reads the org's applied AI budget limit back, so `diff.ts`'s `planAiBudget`
+ * stops re-proposing "set the AI budget" once it has already landed (#515).
+ * AI's own API offers no read for this (`live.ts`'s `AiReader` doc comment:
+ * wiring a real budget read is #20, a non-goal of #27 -- unlike
+ * {@link ProvidersZitadelReader}/{@link ProvidersCloudflareReader}, which both
+ * call a real provider client), so `executor.ts`'s `aiBudget` recording the
+ * limit it just applied under the flat `ai_budget_limit_micros` scope key is
+ * the only evidence there is -- the same "nothing live yet" shape
+ * {@link storeScopeResolver}'s own doc comment describes for `cloudflare_zone`
+ * before #510 fixed it.
+ *
+ * Nothing recorded yet reads as `[]`, never a default: a never-applied org
+ * must still plan its first `ai:budget` step, and inventing the declared (or
+ * default) limit here would make a budget that actually drifted out of band
+ * read as converged.
+ */
+export declare class ProvidersAiReader implements AiReader {
+    private readonly resolveLimit;
+    constructor(resolveLimit: ScopeResolver);
+    listResources(orgId: OrgId): Promise<LiveResource[]>;
+}
 /**
  * Backed by the same `@wtfalch/providers/coolify`'s `CoolifyClient.listResources`
  * call {@link ProvidersCoolifyReader} makes, not a real cms admin API --

package/dist/plan/providers-readers.js

@@ -134,6 +134,36 @@ async function withLogVolumeConfig(client, resource, recorded) {
         return resource;
     }
 }
+/**
+ * #543: whether a recorded app's own Coolify health check is on, as
+ * `config.healthCheckEnabled`, so `diff.ts`'s `planApp` can notice a human
+ * turning it back off in the Coolify UI and plan the repair -- the same
+ * drift `platform-providers.ts`'s own `archonRollingUpdateDrifted` catches
+ * for Archon, now for a company's own hosting-entry app. Gated and failing
+ * exactly like {@link withLogVolumeConfig}: a failed read, or one that has
+ * not run at all (nothing recorded yet), leaves `healthCheckEnabled` absent,
+ * which `planApp` reads as compliant rather than drift.
+ */
+async function withHealthCheckConfig(client, resource, recorded) {
+    if (resource.kind !== 'application' || !recorded[resource.key]?.startsWith('app:')) {
+        return resource;
+    }
+    try {
+        const app = await client.getApplication(resource.key);
+        // `@wtfalch/providers`' `CoolifyApplication` type does not declare
+        // `health_check_enabled` (as of 0.7.3), the same gap `withAgoraEnvConfig`
+        // above notes for `ports_exposes` -- `getApplication` returns the raw
+        // Coolify API response regardless.
+        const healthCheckEnabled = app.health_check_enabled;
+        return {
+            ...resource,
+            config: { ...resource.config, healthCheckEnabled },
+        };
+    }
+    catch {
+        return resource;
+    }
+}
 /**
  * #239: whether a recorded database has an internal connection URL, as
  * `config.hasInternalUrl` (a boolean, never the URL), so `planApp` can report
@@ -256,7 +286,8 @@ export class ProvidersCoolifyReader {
             this.resolveRecordedIds(orgId),
         ]);
         const withLogConfig = await Promise.all(toFoundryResources('coolify', resources).map((r) => withLogVolumeConfig(this.client, r, recorded)));
-        const withEnvNames = await Promise.all(withLogConfig.map((r) => withEnvNamesConfig(this.client, r, recorded)));
+        const withHealthCheck = await Promise.all(withLogConfig.map((r) => withHealthCheckConfig(this.client, r, recorded)));
+        const withEnvNames = await Promise.all(withHealthCheck.map((r) => withEnvNamesConfig(this.client, r, recorded)));
         const withDbUrl = await Promise.all(withEnvNames.map((r) => withDatabaseUrlConfig(this.client, r, recorded)));
         const withAgoraConfig = await Promise.all(withDbUrl.map((r) => withAgoraEnvConfig(this.client, r, recorded)));
         const withBouleConfig = await Promise.all(withAgoraConfig.map((r) => withBouleEnvConfig(this.client, r, recorded)));
@@ -358,6 +389,35 @@ export class ProvidersZitadelReader {
         return { system: 'zitadel', kind: 'issuer', key: orgId, config: {} };
     }
 }
+/**
+ * Reads the org's applied AI budget limit back, so `diff.ts`'s `planAiBudget`
+ * stops re-proposing "set the AI budget" once it has already landed (#515).
+ * AI's own API offers no read for this (`live.ts`'s `AiReader` doc comment:
+ * wiring a real budget read is #20, a non-goal of #27 -- unlike
+ * {@link ProvidersZitadelReader}/{@link ProvidersCloudflareReader}, which both
+ * call a real provider client), so `executor.ts`'s `aiBudget` recording the
+ * limit it just applied under the flat `ai_budget_limit_micros` scope key is
+ * the only evidence there is -- the same "nothing live yet" shape
+ * {@link storeScopeResolver}'s own doc comment describes for `cloudflare_zone`
+ * before #510 fixed it.
+ *
+ * Nothing recorded yet reads as `[]`, never a default: a never-applied org
+ * must still plan its first `ai:budget` step, and inventing the declared (or
+ * default) limit here would make a budget that actually drifted out of band
+ * read as converged.
+ */
+export class ProvidersAiReader {
+    resolveLimit;
+    constructor(resolveLimit) {
+        this.resolveLimit = resolveLimit;
+    }
+    async listResources(orgId) {
+        const limitMicros = await this.resolveLimit(orgId);
+        if (!limitMicros)
+            return [];
+        return [{ system: 'ai', kind: 'budget', key: orgId, config: { limitMicros } }];
+    }
+}
 /**
  * Whether an application counts as up, or on its way there, from its own
  * Coolify `status` (`` `running:healthy`, `running:unknown`,

package/dist/plan/rollout.d.ts

@@ -10,14 +10,15 @@ import type { OrgId } from '../org.js';
  * file knows nothing about that shape, only whether it threw.
  *
  * "Stop at the first failed health check" (the issue's own words) is, today,
- * "stop at the first `apply` that throws" -- the shared health helper
- * (`deploy-health.ts`'s `waitForNewDeployment`) is not yet wired into the
- * org-level calls stack deploy (`executor.ts`'s `coolifyCalls`/
- * `coolifyCallsService` only ever fire-and-forget deploy, and never patch a
- * running app's image tag at all -- see `org.ts`'s `CallsConfig.versionPin`
- * doc comment). Once that step itself throws on a failed health check, a
- * caller's `apply` naturally does too, and this orchestration needs no
- * change.
+ * "stop at the first `apply` that throws" -- which is now also true of a
+ * failed health check specifically: #543 wired the shared health helper
+ * (`deploy-health.ts`'s `waitForNewDeployment`) into the org-level calls
+ * stack deploy too (`executor.ts`'s `coolifyCalls`/`coolifyCallsService`),
+ * alongside every other company-app step. Neither still patches a running
+ * app's image tag (see `org.ts`'s `CallsConfig.versionPin` doc comment,
+ * unrelated to #543). That step throwing on a failed health check is enough
+ * on its own: a caller's `apply` naturally does too, and this orchestration
+ * needs no change.
  */
 /** One org's outcome from {@link applyOrgsInOrder}. */
 export interface RolloutOrgResult {

package/dist/platform.d.ts

@@ -30,7 +30,7 @@ export interface PlatformMailService extends PlatformService {
  * holds the Cloudflare token `<username>.<org domain>` claims use, so no
  * hosting entry ever holds that credential itself.
  */
-export type PlatformServiceKey = 'auth' | 'mail' | 'sfu' | 'files' | 'ai' | 'jobs' | 'integrations' | 'archon' | 'edge';
+export type PlatformServiceKey = 'auth' | 'mail' | 'sfu' | 'files' | 'ai' | 'jobs' | 'integrations' | 'archon' | 'edge' | 'hc';
 export declare const PLATFORM_SERVICE_KEYS: readonly PlatformServiceKey[];
 /**
  * The one shared platform every org's services run on -- decided in #165 as
@@ -68,6 +68,19 @@ export interface DeclaredPlatform {
     archon: PlatformService;
     /** #317 (F7). No deploy step reads this service's own `gitRef` yet -- `N1` is deployed by hand until it exists. */
     edge: PlatformService;
+    /**
+     * #540: a self-hosted heartbeat server (Healthchecks) for the platform,
+     * for now -- whether it stays the platform's heartbeat server long-term,
+     * instead of or alongside the hand-set-up `hc.wtfalch.dev` instance, and
+     * what happens to that instance's own data, are both still open "Decide"
+     * items on issue #540's own thread, not settled by this field. `gitRef`
+     * is the Docker image tag it runs (the same overload `mail.gitRef`
+     * already carries for Stalwart's tag), not a git ref. Every piece of
+     * scheduled work foundry sets up (the uptime Worker, each platform
+     * database backup) gets one check here, named after it; see
+     * `plan/platform-diff.ts`'s `planHeartbeats`.
+     */
+    hc: PlatformService;
 }
 /** `<service>.<apex>` -- the default `hostname` for a platform service, before an operator overrides it. */
 export declare function defaultPlatformHostname(service: PlatformServiceKey, apex: string): string;

package/dist/platform.js

@@ -10,6 +10,7 @@ export const PLATFORM_SERVICE_KEYS = [
     'integrations',
     'archon',
     'edge',
+    'hc',
 ];
 /** `<service>.<apex>` -- the default `hostname` for a platform service, before an operator overrides it. */
 export function defaultPlatformHostname(service, apex) {

package/dist/store/postgres.js

@@ -603,6 +603,11 @@ function rowToPlatform(row) {
             hostname: row.edgeHostname,
             gitRef: row.edgeGitRef,
         },
+        hc: {
+            enabled: row.hcEnabled,
+            hostname: row.hcHostname,
+            gitRef: row.hcGitRef,
+        },
     };
 }
 function platformToRow(platform) {
@@ -639,6 +644,9 @@ function platformToRow(platform) {
         edgeEnabled: platform.edge.enabled,
         edgeHostname: platform.edge.hostname,
         edgeGitRef: platform.edge.gitRef,
+        hcEnabled: platform.hc.enabled,
+        hcHostname: platform.hc.hostname,
+        hcGitRef: platform.hc.gitRef,
     };
 }
 /**

package/dist/store/schema.d.ts

@@ -1932,6 +1932,57 @@ export declare const foundryDeclaredPlatform: import("drizzle-orm/pg-core").PgTa
             identity: undefined;
             generated: undefined;
         }, {}, {}>;
+        hcEnabled: import("drizzle-orm/pg-core").PgColumn<{
+            name: "hc_enabled";
+            tableName: "foundry_declared_platform";
+            dataType: "boolean";
+            columnType: "PgBoolean";
+            data: boolean;
+            driverParam: boolean;
+            notNull: true;
+            hasDefault: true;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: undefined;
+            baseColumn: never;
+            identity: undefined;
+            generated: undefined;
+        }, {}, {}>;
+        hcHostname: import("drizzle-orm/pg-core").PgColumn<{
+            name: "hc_hostname";
+            tableName: "foundry_declared_platform";
+            dataType: "string";
+            columnType: "PgText";
+            data: string;
+            driverParam: string;
+            notNull: true;
+            hasDefault: false;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: [string, ...string[]];
+            baseColumn: never;
+            identity: undefined;
+            generated: undefined;
+        }, {}, {}>;
+        hcGitRef: import("drizzle-orm/pg-core").PgColumn<{
+            name: "hc_git_ref";
+            tableName: "foundry_declared_platform";
+            dataType: "string";
+            columnType: "PgText";
+            data: string;
+            driverParam: string;
+            notNull: true;
+            hasDefault: true;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: [string, ...string[]];
+            baseColumn: never;
+            identity: undefined;
+            generated: undefined;
+        }, {}, {}>;
         serviceIds: import("drizzle-orm/pg-core").PgColumn<{
             name: "service_ids";
             tableName: "foundry_declared_platform";

package/dist/store/schema.js

@@ -182,6 +182,10 @@ export const foundryDeclaredPlatform = pgTable('foundry_declared_platform', {
     edgeEnabled: boolean('edge_enabled').notNull().default(false),
     edgeHostname: text('edge_hostname').notNull(),
     edgeGitRef: text('edge_git_ref').notNull().default(''),
+    /** #540, `migrations/0046_platform_hc.sql`: the platform's own heartbeat server (self-hosted Healthchecks). */
+    hcEnabled: boolean('hc_enabled').notNull().default(false),
+    hcHostname: text('hc_hostname').notNull(),
+    hcGitRef: text('hc_git_ref').notNull().default(''),
     /** `migrations/0018_platform_apply.sql`: the platform's applied state, `system:kind:key` to provider id. */
     serviceIds: jsonb('service_ids').$type().notNull().default({}),
     createdAt: timestamp('created_at', { withTimezone: true }).notNull().defaultNow(),

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@wtfalch/foundry",
-  "version": "0.19.1",
+  "version": "0.21.0",
   "description": "Foundry's SDK: the declared org's types, the plan and apply contracts, and the state store's interface.",
   "repository": {
     "type": "git",
@@ -42,6 +42,7 @@
   "dependencies": {
     "@wtfalch/audit": "0.6.0",
     "@wtfalch/auth": "0.16.0",
+    "@wtfalch/edge": "0.9.0",
     "@wtfalch/email": "^0.17.0",
     "@wtfalch/providers": "0.7.3",
     "ssh2": "1.17.0",

package/versions.json

@@ -4,5 +4,6 @@
   "mas": "1.24.0",
   "livekit": "v1.13.7",
   "cloudflared": "2026.9.3",
-  "stalwart": "v0.16.24"
+  "stalwart": "v0.16.24",
+  "hc": "v4.4"
 }