@intentius/chant-lexicon-fly 0.45.0 → 0.49.0

package/dist/describe-resources.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"describe-resources.d.ts","sourceRoot":"","sources":["../src/describe-resources.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2BG;AAEH,OAAO,KAAK,EAAE,iBAAiB,EAAE,gBAAgB,EAAoB,MAAM,0BAA0B,CAAC;AAEtG,OAAO,EAGL,KAAK,SAAS,EACf,MAAM,uCAAuC,CAAC;AAC/C,OAAO,EAqBL,KAAK,OAAO,EAIb,MAAM,2BAA2B,CAAC;AAcnC,MAAM,WAAW,wBAAwB;IACvC,WAAW,EAAE,MAAM,CAAC;IACpB,WAAW,EAAE,MAAM,CAAC;IACpB,WAAW,EAAE,MAAM,EAAE,CAAC;IACtB,QAAQ,EAAE,GAAG,CAAC,MAAM,EAAE;QAAE,UAAU,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;KAAE,CAAC,CAAC;IAC9E,gDAAgD;IAChD,KAAK,CAAC,EAAE,OAAO,CAAC;IAChB,2FAA2F;IAC3F,QAAQ,CAAC,EAAE,MAAM,CAAC;CACnB;AAeD;;;;;;;;GAQG;AACH,wBAAsB,iBAAiB,CACrC,OAAO,EAAE,wBAAwB,EACjC,IAAI,GAAE,OAA0B,EAChC,MAAM,CAAC,EAAE,WAAW,GACnB,OAAO,CAAC,iBAAiB,CAAC,CA4R5B;AAED;;;;;;;;;;;GAWG;AACH,wBAAsB,OAAO,CAC3B,OAAO,EAAE,wBAAwB,GAAG;IAClC,4EAA4E;IAC5E,YAAY,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,gBAAgB,CAAC,CAAC;CACjD,EACD,IAAI,GAAE,OAA0B,EAChC,MAAM,CAAC,EAAE,WAAW,GACnB,OAAO,CAAC;IAAE,SAAS,EAAE,SAAS,CAAC;IAAC,QAAQ,EAAE,MAAM,CAAA;CAAE,CAAC,CAkCrD"}
+{"version":3,"file":"describe-resources.d.ts","sourceRoot":"","sources":["../src/describe-resources.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2BG;AAEH,OAAO,KAAK,EAAE,iBAAiB,EAAE,gBAAgB,EAAoB,MAAM,0BAA0B,CAAC;AAItG,OAAO,EAGL,KAAK,SAAS,EACf,MAAM,uCAAuC,CAAC;AAC/C,OAAO,EAqBL,KAAK,OAAO,EAIb,MAAM,2BAA2B,CAAC;AAcnC,MAAM,WAAW,wBAAwB;IACvC,WAAW,EAAE,MAAM,CAAC;IACpB,WAAW,EAAE,MAAM,CAAC;IACpB,WAAW,EAAE,MAAM,EAAE,CAAC;IACtB,QAAQ,EAAE,GAAG,CAAC,MAAM,EAAE;QAAE,UAAU,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;KAAE,CAAC,CAAC;IAC9E,gDAAgD;IAChD,KAAK,CAAC,EAAE,OAAO,CAAC;IAChB,2FAA2F;IAC3F,QAAQ,CAAC,EAAE,MAAM,CAAC;CACnB;AAeD;;;;;;;;GAQG;AACH,wBAAsB,iBAAiB,CACrC,OAAO,EAAE,wBAAwB,EACjC,IAAI,GAAE,OAA0B,EAChC,MAAM,CAAC,EAAE,WAAW,GACnB,OAAO,CAAC,iBAAiB,CAAC,CAiS5B;AAED;;;;;;;;;;;GAWG;AACH,wBAAsB,OAAO,CAC3B,OAAO,EAAE,wBAAwB,GAAG;IAClC,4EAA4E;IAC5E,YAAY,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,gBAAgB,CAAC,CAAC;CACjD,EACD,IAAI,GAAE,OAA0B,EAChC,MAAM,CAAC,EAAE,WAAW,GACnB,OAAO,CAAC;IAAE,SAAS,EAAE,SAAS,CAAC;IAAC,QAAQ,EAAE,MAAM,CAAA;CAAE,CAAC,CAkCrD"}

package/dist/integrity.json

@@ -1,7 +1,7 @@
 {
   "algorithm": "sha256",
   "artifacts": {
-    "manifest.json": "aed323ed6c59f96ab9470a796a81e75ddac9d72d7b1a5f7522cc7a544d88df42",
+    "manifest.json": "6dcc2b17471f8b97f59b038dc09152ed5ce8c1ed3668889577f9ec066dc7783a",
     "meta.json": "e46e65ba7544fafc6dbb3fd48b841904b5ae6f7cb4d517a940ed68b01626c097",
     "types/index.d.ts": "a76090adb6eda33a2c07a074183299a59e953b48dd3f2020d7ef11278d59341e",
     "rules/guest-sizing.ts": "bc749d218df8f3cc3d8fbe388205ae96e6b204ae0d6d77e8bf82cb936cc53ff6",
@@ -15,5 +15,5 @@
     "skills/chant-fly-ops.md": "b8eef6504e203133e6a35c83aabb08404eec95060705395515a0046d42269cf1",
     "skills/chant-fly-sprites.md": "89ba52db63a71a17eab483d99233a4ae67f5d34920445010e750f81c95200b4e"
   },
-  "composite": "2831247df3815a0f1f18a99d8a7dc4baeb905952268fec353746037d2d8a86c2"
+  "composite": "85f11e33db1d17e0fb429183c61ffc405fa34f66d88b71bda49476a7446fe289"
 }

package/dist/manifest.json

@@ -1,6 +1,6 @@
 {
   "name": "fly",
-  "version": "0.45.0",
+  "version": "0.49.0",
   "chantVersion": ">=0.1.0",
   "namespace": "Fly"
 }

package/dist/plugin.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"plugin.d.ts","sourceRoot":"","sources":["../src/plugin.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,aAAa,EAAkD,MAAM,0BAA0B,CAAC;AAuB9G;;;;GAIG;AACH,eAAO,MAAM,SAAS,EAAE,aA+RvB,CAAC"}
+{"version":3,"file":"plugin.d.ts","sourceRoot":"","sources":["../src/plugin.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,aAAa,EAAkD,MAAM,0BAA0B,CAAC;AAuB9G;;;;GAIG;AACH,eAAO,MAAM,SAAS,EAAE,aA6SvB,CAAC"}

package/dist/teardown.d.ts

@@ -0,0 +1,54 @@
+/**
+ * Env teardown for the fly lexicon (chant #1222) — both halves of the
+ * `teardownOwned` / `executeTeardown` capability pair, over the applier's own
+ * flaps primitives (op/activities/fly-apply.ts).
+ *
+ * Selection follows the two-tier ownership convention (#743, D2):
+ *
+ *   - Machines carry the primary marker in `config.metadata`
+ *     (`managed-by: chant` + `chant-stack` + `chant-env`), so a machine is a
+ *     candidate exactly when its own metadata reads back the requested
+ *     stack + env identity.
+ *   - The app is the boundary for everything metadata-less (volumes, IPs,
+ *     certificates, secrets). An app becomes a candidate only when it has at
+ *     least one machine and EVERY machine in it carries the requested
+ *     identity — an app also hosting a foreign or other-env machine is never
+ *     deleted whole; only its matching machines are.
+ *
+ * Enumeration lists apps via `GET /v1/apps` (mudflaps serves it as-is; real
+ * flaps wants `?org_slug=`, appended from FLY_ORG / FLY_ORG_SLUG when set)
+ * and each app's machines. An unlistable app is a hole (#1089) — unknown,
+ * never absent.
+ *
+ * Execution deletes machines first (lease → destroy → wait, the applier's
+ * `destroyMachine`) and apps last (`deleteApp`, which takes the app-scoped
+ * volumes/IPs/certs with it). Before every delete the live side is re-read
+ * and the identity re-verified; already-gone is `deleted` (teardown is
+ * idempotent), an identity mismatch is `not-prunable`, never a delete.
+ */
+import type { TeardownCandidate, TeardownEnumeration, TeardownExecution } from "@intentius/chant/lexicon";
+import { type OwnershipMarker } from "@intentius/chant/ownership";
+import { type FlyHttp, type WaitOpts } from "./op/activities/fly-apply.js";
+export interface FlyTeardownOptions {
+    environment: string;
+    marker: OwnershipMarker;
+}
+/** Injection seam for tests: scripted http, explicit endpoint, shrunk waits. */
+export interface FlyTeardownDeps {
+    http?: FlyHttp;
+    endpoint?: string;
+    wait?: WaitOpts;
+}
+/**
+ * Enumerate the env's marker-matching machines and whole-app boundaries — the
+ * fly half of `chant lifecycle teardown <env>` planning.
+ */
+export declare function teardownOwned(options: FlyTeardownOptions, deps?: FlyTeardownDeps): Promise<TeardownEnumeration>;
+/**
+ * Delete the handed-over candidates: machines first, apps last. One outcome
+ * per candidate, always.
+ */
+export declare function executeTeardown(options: FlyTeardownOptions & {
+    candidates: TeardownCandidate[];
+}, deps?: FlyTeardownDeps): Promise<TeardownExecution>;
+//# sourceMappingURL=teardown.d.ts.map

package/dist/teardown.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"teardown.d.ts","sourceRoot":"","sources":["../src/teardown.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2BG;AAEH,OAAO,KAAK,EACV,iBAAiB,EACjB,mBAAmB,EACnB,iBAAiB,EAGlB,MAAM,0BAA0B,CAAC;AAClC,OAAO,EAAiB,KAAK,eAAe,EAAE,MAAM,4BAA4B,CAAC;AAEjF,OAAO,EAQL,KAAK,OAAO,EACZ,KAAK,QAAQ,EACd,MAAM,2BAA2B,CAAC;AAQnC,MAAM,WAAW,kBAAkB;IACjC,WAAW,EAAE,MAAM,CAAC;IACpB,MAAM,EAAE,eAAe,CAAC;CACzB;AAED,gFAAgF;AAChF,MAAM,WAAW,eAAe;IAC9B,IAAI,CAAC,EAAE,OAAO,CAAC;IACf,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,IAAI,CAAC,EAAE,QAAQ,CAAC;CACjB;AA2BD;;;GAGG;AACH,wBAAsB,aAAa,CACjC,OAAO,EAAE,kBAAkB,EAC3B,IAAI,GAAE,eAAoB,GACzB,OAAO,CAAC,mBAAmB,CAAC,CA8C9B;AAED;;;GAGG;AACH,wBAAsB,eAAe,CACnC,OAAO,EAAE,kBAAkB,GAAG;IAAE,UAAU,EAAE,iBAAiB,EAAE,CAAA;CAAE,EACjE,IAAI,GAAE,eAAoB,GACzB,OAAO,CAAC,iBAAiB,CAAC,CAuB5B"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@intentius/chant-lexicon-fly",
-  "version": "0.45.0",
+  "version": "0.49.0",
   "type": "module",
   "files": [
     "src/",
@@ -57,7 +57,7 @@
     "typescript": "^5.9.3"
   },
   "peerDependencies": {
-    "@intentius/chant": "^0.45.0",
+    "@intentius/chant": "^0.49.0",
     "typescript": "^5.9.3"
   },
   "description": "Fly.io Machines lexicon for chant — declarative IaC in TypeScript",

package/src/describe-resources.test.ts

@@ -259,5 +259,31 @@ describeObservationConformance({
           fakeHttp([liveMachine("web", "nginx:1")]),
         ),
     },
+    {
+      // Marker identity (#1222): machines carry the metadata channel and
+      // surface stack/env verbatim; the app's `owned` verdict is inferred at
+      // the boundary and carries no marker of its own — absent, not guessed.
+      name: "a stack/env-stamped machine surfaces its marker; the app surfaces none",
+      declared: ["app", "web"],
+      expectPresent: ["app", "web"],
+      expectMarker: { web: { stack: "shop", env: "prod" } },
+      expectNoMarker: ["app"],
+      run: () =>
+        describeResources(
+          { environment: "prod", buildOutput: PLAN, entityNames: ["app", "web"], entities: ENTS, endpoint: ENDPOINT },
+          fakeHttp([
+            {
+              id: "m-web",
+              name: "web",
+              state: "started",
+              instance_id: "INST0",
+              config: {
+                image: "nginx:1",
+                metadata: { ...OWNED_META, "chant-stack": "shop", "chant-env": "prod" },
+              },
+            },
+          ]),
+        ),
+    },
   ],
 });

package/src/describe-resources.ts

@@ -29,6 +29,8 @@
 
 import type { ObservationResult, ResourceMetadata, UnobservedEntity } from "@intentius/chant/lexicon";
 import { normalizeObservation, observation, unobservedAll } from "@intentius/chant/observation";
+import { readOwnership } from "@intentius/chant/ownership";
+import { FLY_METADATA_OWNERSHIP_KEYS } from "./ownership";
 import {
   buildChangeSet,
   renderChangeSet,
@@ -311,6 +313,11 @@ export async function describeResources(
         physicalId: m.id,
         status: m.state,
         ownership: isOwned ? "owned" : "foreign",
+        // Marker identity (#1222): machines are the one fly type carrying the
+        // metadata channel, so only they surface stack/env. Apps and the
+        // boundary types (volumes/ips/certs) get their verdict inferred at the
+        // app boundary and carry no marker of their own — absent, not guessed.
+        marker: readOwnership(m.config?.metadata, FLY_METADATA_OWNERSHIP_KEYS),
         attributes: pruneUndefined({
           app,
           machineName: m.name,

package/src/plugin.ts

@@ -299,6 +299,20 @@ export { app, web };
     return describeResources(options);
   },
 
+  // Env teardown (#1222): enumeration + execution over the machine marker
+  // (`managed-by` + `chant-stack` + `chant-env`) and the app boundary (#743).
+  // Machines are destroyed first, whole apps last — an app hosting any machine
+  // outside the requested identity is never deleted whole. See ./teardown.ts.
+  async teardownOwned(options) {
+    const { teardownOwned } = await import("./teardown");
+    return teardownOwned(options);
+  },
+
+  async executeTeardown(options) {
+    const { executeTeardown } = await import("./teardown");
+    return executeTeardown(options);
+  },
+
   // Live export (cloud → code): read live flaps state and regenerate App/Machine
   // TypeScript. Strips server-written fields to the authored shape; honors the
   // `owned` filter (machine marker; app-boundary inference for the marker-less

package/src/teardown.test.ts

@@ -0,0 +1,253 @@
+/**
+ * Env teardown over a scripted flaps (chant #1222) — the fly halves of the
+ * teardownOwned / executeTeardown capability pair, mirroring the injected-HTTP
+ * style of fly-apply.test.ts and describe-resources.test.ts: a stateful fake
+ * answers app/machine reads and records mutations, so the lease → destroy →
+ * wait path and the app-boundary rules run for real.
+ */
+
+import { describe, test, expect, beforeEach, afterEach } from "vitest";
+import { teardownOwned, executeTeardown } from "./teardown";
+import type { FlyHttp } from "./op/activities/fly-apply";
+
+const ENDPOINT = "http://localhost:4280";
+const MARKER = { stack: "shop", env: "dev" };
+const NO_WAIT = { intervalMs: 0, deadlineMs: 5_000 };
+
+const savedOrg = { FLY_ORG: process.env.FLY_ORG, FLY_ORG_SLUG: process.env.FLY_ORG_SLUG };
+beforeEach(() => {
+  delete process.env.FLY_ORG;
+  delete process.env.FLY_ORG_SLUG;
+});
+afterEach(() => {
+  if (savedOrg.FLY_ORG === undefined) delete process.env.FLY_ORG; else process.env.FLY_ORG = savedOrg.FLY_ORG;
+  if (savedOrg.FLY_ORG_SLUG === undefined) delete process.env.FLY_ORG_SLUG; else process.env.FLY_ORG_SLUG = savedOrg.FLY_ORG_SLUG;
+});
+
+type FakeMachine = { id: string; name: string; state: string; instance_id: string; config?: { metadata?: Record<string, string> } };
+
+function machine(
+  name: string,
+  metadata: Record<string, string> | undefined,
+  extra: Partial<FakeMachine> = {},
+): FakeMachine {
+  return {
+    id: extra.id ?? `m-${name}`,
+    name,
+    state: extra.state ?? "started",
+    instance_id: "INST0",
+    config: { ...(metadata !== undefined ? { metadata } : {}) },
+  };
+}
+
+const MINE = { "managed-by": "chant", "chant-stack": "shop", "chant-env": "dev" };
+const OTHER_ENV = { "managed-by": "chant", "chant-stack": "shop", "chant-env": "prod" };
+const OTHER_STACK = { "managed-by": "chant", "chant-stack": "blog", "chant-env": "dev" };
+
+/**
+ * A stateful scripted flaps: `apps` maps app name to its machines; deletes
+ * mutate the state, so the app-boundary re-check after a destroy sees what a
+ * real flaps would. An app mapped to the string "boom" fails its machine list.
+ */
+function scriptedFlaps(apps: Record<string, FakeMachine[] | "boom">): { http: FlyHttp; log: string[] } {
+  const log: string[] = [];
+  const http: FlyHttp = async (method, url) => {
+    log.push(`${method} ${url}`);
+    if (method === "GET" && /\/v1\/apps(\?[^/]*)?$/.test(url)) {
+      return { status: 200, text: JSON.stringify({ apps: Object.keys(apps).map((name) => ({ name })) }) };
+    }
+    if (/\/machines\/[^/]+\/lease$/.test(url)) {
+      return { status: 200, text: JSON.stringify({ status: "success", data: { nonce: "N" } }) };
+    }
+    if (method === "GET" && /\/machines\/[^/]+\/wait\?/.test(url)) {
+      return { status: 200, text: JSON.stringify({ ok: true }) };
+    }
+    let m = url.match(/\/v1\/apps\/([^/?]+)\/machines\/([^/?]+)$/);
+    if (m && method === "DELETE") {
+      const held = apps[m[1]];
+      if (Array.isArray(held)) apps[m[1]] = held.filter((mm) => mm.id !== m![2]);
+      return { status: 200, text: "{}" };
+    }
+    m = url.match(/\/v1\/apps\/([^/?]+)\/machines$/);
+    if (m && method === "GET") {
+      const held = apps[m[1]];
+      if (held === "boom") return { status: 500, text: "machine list exploded" };
+      if (held === undefined) return { status: 404, text: "no such app" };
+      return { status: 200, text: JSON.stringify(held) };
+    }
+    m = url.match(/\/v1\/apps\/([^/?]+)$/);
+    if (m && method === "DELETE") {
+      if (apps[m[1]] === undefined) return { status: 404, text: "gone" };
+      delete apps[m[1]];
+      return { status: 200, text: "{}" };
+    }
+    return { status: 500, text: `unscripted: ${method} ${url}` };
+  };
+  return { http, log };
+}
+
+describe("teardownOwned — marker machines + the app boundary (#743)", () => {
+  test("machines carrying this stack+env are candidates; an all-matching app is one too", async () => {
+    const { http } = scriptedFlaps({
+      mine: [machine("web", MINE), machine("worker", MINE)],
+      mixed: [machine("ok", MINE), machine("foreign", { role: "db" })],
+    });
+    const enumeration = await teardownOwned({ environment: "dev", marker: MARKER }, { http, endpoint: ENDPOINT });
+
+    expect(enumeration.candidates.map((c) => `${c.type === "Fly::Machines::App" ? "app" : "machine"}:${c.name}`).sort()).toEqual([
+      "app:mine",
+      "machine:mine/web",
+      "machine:mine/worker",
+      "machine:mixed/ok",
+    ]);
+    for (const candidate of enumeration.candidates) {
+      expect(candidate.marker).toEqual(MARKER);
+    }
+    const web = enumeration.candidates.find((c) => c.name === "mine/web")!;
+    expect(web.physicalId).toBe("m-web");
+    expect(enumeration.holes ?? []).toEqual([]);
+  });
+
+  test("another env's and another stack's machines are never candidates", async () => {
+    const { http } = scriptedFlaps({
+      mine: [machine("web", MINE), machine("prod-twin", OTHER_ENV), machine("their", OTHER_STACK)],
+    });
+    const enumeration = await teardownOwned({ environment: "dev", marker: MARKER }, { http, endpoint: ENDPOINT });
+    // Only the matching machine — and no whole-app candidate, because the app
+    // hosts machines outside the requested identity.
+    expect(enumeration.candidates.map((c) => c.name)).toEqual(["mine/web"]);
+  });
+
+  test("terminal machines are ignored, and do not block the app boundary", async () => {
+    const { http } = scriptedFlaps({
+      mine: [machine("web", MINE), machine("old", { role: "db" }, { state: "destroyed" })],
+    });
+    const enumeration = await teardownOwned({ environment: "dev", marker: MARKER }, { http, endpoint: ENDPOINT });
+    expect(enumeration.candidates.map((c) => c.name).sort()).toEqual(["mine", "mine/web"]);
+  });
+
+  test("an app whose machine list fails is a hole, and the others still enumerate (#1089)", async () => {
+    const { http } = scriptedFlaps({
+      broken: "boom",
+      mine: [machine("web", MINE)],
+    });
+    const enumeration = await teardownOwned({ environment: "dev", marker: MARKER }, { http, endpoint: ENDPOINT });
+    expect(enumeration.candidates.map((c) => c.name).sort()).toEqual(["mine", "mine/web"]);
+    expect(enumeration.holes).toHaveLength(1);
+    expect(enumeration.holes![0].name).toBe("broken");
+    expect(enumeration.holes![0].reason).toBe("read-failed");
+  });
+
+  test("FLY_ORG is passed as org_slug on the app list (real flaps requires it)", async () => {
+    process.env.FLY_ORG = "acme";
+    const { http, log } = scriptedFlaps({});
+    await teardownOwned({ environment: "dev", marker: MARKER }, { http, endpoint: ENDPOINT });
+    expect(log[0]).toBe(`GET ${ENDPOINT}/v1/apps?org_slug=acme`);
+  });
+});
+
+describe("executeTeardown — machines first, apps last", () => {
+  test("destroys the machines (lease → destroy → wait), then deletes the app", async () => {
+    const state: Record<string, FakeMachine[] | "boom"> = {
+      mine: [machine("web", MINE), machine("worker", MINE)],
+    };
+    const { http, log } = scriptedFlaps(state);
+    const execution = await executeTeardown(
+      {
+        environment: "dev",
+        marker: MARKER,
+        candidates: [
+          { name: "mine", type: "Fly::Machines::App", marker: MARKER },
+          { name: "mine/web", type: "Fly::Machines::Machine", physicalId: "m-web", marker: MARKER },
+          { name: "mine/worker", type: "Fly::Machines::Machine", physicalId: "m-worker", marker: MARKER },
+        ],
+      },
+      { http, endpoint: ENDPOINT, wait: NO_WAIT },
+    );
+
+    expect(execution.outcomes.map((o) => ({ name: o.name, outcome: o.outcome }))).toEqual([
+      { name: "mine/web", outcome: "deleted" },
+      { name: "mine/worker", outcome: "deleted" },
+      { name: "mine", outcome: "deleted" },
+    ]);
+    const deletes = log.filter((l) => l.startsWith("DELETE") && !l.endsWith("/lease"));
+    expect(deletes).toEqual([
+      `DELETE ${ENDPOINT}/v1/apps/mine/machines/m-web`,
+      `DELETE ${ENDPOINT}/v1/apps/mine/machines/m-worker`,
+      `DELETE ${ENDPOINT}/v1/apps/mine`,
+    ]);
+    expect(state.mine).toBeUndefined();
+  });
+
+  test("an app hosting a machine outside the requested identity is never deleted whole", async () => {
+    const { http, log } = scriptedFlaps({
+      mine: [machine("foreign", { role: "db" })],
+    });
+    const execution = await executeTeardown(
+      {
+        environment: "dev",
+        marker: MARKER,
+        candidates: [{ name: "mine", type: "Fly::Machines::App", marker: MARKER }],
+      },
+      { http, endpoint: ENDPOINT, wait: NO_WAIT },
+    );
+    expect(execution.outcomes[0].outcome).toBe("not-prunable");
+    expect(execution.outcomes[0].detail).toContain("outside the requested identity");
+    expect(log.filter((l) => l.startsWith("DELETE"))).toEqual([]);
+  });
+
+  test("an already-absent machine and an already-absent app are deleted (idempotent)", async () => {
+    const { http } = scriptedFlaps({ mine: [] });
+    const execution = await executeTeardown(
+      {
+        environment: "dev",
+        marker: MARKER,
+        candidates: [
+          { name: "mine/web", type: "Fly::Machines::Machine", physicalId: "m-web", marker: MARKER },
+          { name: "gone-app", type: "Fly::Machines::App", marker: MARKER },
+        ],
+      },
+      { http, endpoint: ENDPOINT, wait: NO_WAIT },
+    );
+    expect(execution.outcomes.map((o) => ({ name: o.name, outcome: o.outcome, detail: o.detail }))).toEqual([
+      { name: "mine/web", outcome: "deleted", detail: "already absent" },
+      { name: "gone-app", outcome: "deleted", detail: "already absent" },
+    ]);
+  });
+
+  test("a machine re-stamped since planning is not-prunable, never destroyed", async () => {
+    const { http, log } = scriptedFlaps({
+      mine: [machine("web", OTHER_STACK)],
+    });
+    const execution = await executeTeardown(
+      {
+        environment: "dev",
+        marker: MARKER,
+        candidates: [{ name: "mine/web", type: "Fly::Machines::Machine", physicalId: "m-web", marker: MARKER }],
+      },
+      { http, endpoint: ENDPOINT, wait: NO_WAIT },
+    );
+    expect(execution.outcomes[0].outcome).toBe("not-prunable");
+    expect(log.filter((l) => l.startsWith("DELETE"))).toEqual([]);
+  });
+
+  test("a refused delete is a failed outcome carrying the server's message", async () => {
+    const inner = scriptedFlaps({ mine: [machine("web", MINE)] });
+    const http: FlyHttp = async (method, url, body, headers, signal) => {
+      if (method === "DELETE" && /\/machines\/m-web$/.test(url)) {
+        return { status: 500, text: "flaps had a bad day" };
+      }
+      return inner.http(method, url, body, headers, signal);
+    };
+    const execution = await executeTeardown(
+      {
+        environment: "dev",
+        marker: MARKER,
+        candidates: [{ name: "mine/web", type: "Fly::Machines::Machine", physicalId: "m-web", marker: MARKER }],
+      },
+      { http, endpoint: ENDPOINT, wait: NO_WAIT },
+    );
+    expect(execution.outcomes[0].outcome).toBe("failed");
+    expect(execution.outcomes[0].detail).toContain("flaps had a bad day");
+  });
+});

package/src/teardown.ts

@@ -0,0 +1,263 @@
+/**
+ * Env teardown for the fly lexicon (chant #1222) — both halves of the
+ * `teardownOwned` / `executeTeardown` capability pair, over the applier's own
+ * flaps primitives (op/activities/fly-apply.ts).
+ *
+ * Selection follows the two-tier ownership convention (#743, D2):
+ *
+ *   - Machines carry the primary marker in `config.metadata`
+ *     (`managed-by: chant` + `chant-stack` + `chant-env`), so a machine is a
+ *     candidate exactly when its own metadata reads back the requested
+ *     stack + env identity.
+ *   - The app is the boundary for everything metadata-less (volumes, IPs,
+ *     certificates, secrets). An app becomes a candidate only when it has at
+ *     least one machine and EVERY machine in it carries the requested
+ *     identity — an app also hosting a foreign or other-env machine is never
+ *     deleted whole; only its matching machines are.
+ *
+ * Enumeration lists apps via `GET /v1/apps` (mudflaps serves it as-is; real
+ * flaps wants `?org_slug=`, appended from FLY_ORG / FLY_ORG_SLUG when set)
+ * and each app's machines. An unlistable app is a hole (#1089) — unknown,
+ * never absent.
+ *
+ * Execution deletes machines first (lease → destroy → wait, the applier's
+ * `destroyMachine`) and apps last (`deleteApp`, which takes the app-scoped
+ * volumes/IPs/certs with it). Before every delete the live side is re-read
+ * and the identity re-verified; already-gone is `deleted` (teardown is
+ * idempotent), an identity mismatch is `not-prunable`, never a delete.
+ */
+
+import type {
+  TeardownCandidate,
+  TeardownEnumeration,
+  TeardownExecution,
+  TeardownHole,
+  TeardownOutcome,
+} from "@intentius/chant/lexicon";
+import { readOwnership, type OwnershipMarker } from "@intentius/chant/ownership";
+import { FLY_METADATA_OWNERSHIP_KEYS } from "./ownership";
+import {
+  resolveEndpoint,
+  defaultFlyHttp,
+  listMachines,
+  destroyMachine,
+  deleteApp,
+  type ApplyCtx,
+  type FlapsMachine,
+  type FlyHttp,
+  type WaitOpts,
+} from "./op/activities/fly-apply";
+
+const APP_TYPE = "Fly::Machines::App";
+const MACHINE_TYPE = "Fly::Machines::Machine";
+
+/** Live machine states that mean the machine is gone or on its way out. */
+const TERMINAL_STATES = new Set(["destroyed", "destroying"]);
+
+export interface FlyTeardownOptions {
+  environment: string;
+  marker: OwnershipMarker;
+}
+
+/** Injection seam for tests: scripted http, explicit endpoint, shrunk waits. */
+export interface FlyTeardownDeps {
+  http?: FlyHttp;
+  endpoint?: string;
+  wait?: WaitOpts;
+}
+
+/** True when a machine's own metadata reads back exactly the requested identity. */
+function matchesMarker(machine: FlapsMachine, marker: OwnershipMarker): boolean {
+  const read = readOwnership(machine.config?.metadata, FLY_METADATA_OWNERSHIP_KEYS);
+  return read !== undefined && read.stack === marker.stack && read.env === marker.env;
+}
+
+/** Machines that are actually live — terminal ones are already gone. */
+function liveMachines(machines: FlapsMachine[]): FlapsMachine[] {
+  return machines.filter((m) => !TERMINAL_STATES.has(m.state));
+}
+
+/** `GET /v1/apps`, with `?org_slug=` appended when the env names an org. */
+async function listApps(
+  ctx: ApplyCtx,
+  http: FlyHttp,
+  signal?: AbortSignal,
+): Promise<string[]> {
+  const org = process.env.FLY_ORG || process.env.FLY_ORG_SLUG;
+  const url = `${ctx.base}/v1/apps${org ? `?org_slug=${encodeURIComponent(org)}` : ""}`;
+  const res = await http("GET", url, undefined, undefined, signal);
+  if (res.status >= 300) throw new Error(`app list failed (${res.status}): ${res.text}`);
+  const body = JSON.parse(res.text) as { apps?: Array<{ name?: string }> };
+  return (body.apps ?? []).map((a) => a.name).filter((n): n is string => typeof n === "string" && n.length > 0);
+}
+
+/**
+ * Enumerate the env's marker-matching machines and whole-app boundaries — the
+ * fly half of `chant lifecycle teardown <env>` planning.
+ */
+export async function teardownOwned(
+  options: FlyTeardownOptions,
+  deps: FlyTeardownDeps = {},
+): Promise<TeardownEnumeration> {
+  const http = deps.http ?? defaultFlyHttp();
+  const ctx: ApplyCtx = { base: resolveEndpoint({ ...(deps.endpoint ? { endpoint: deps.endpoint } : {}) }) };
+
+  const candidates: TeardownCandidate[] = [];
+  const holes: TeardownHole[] = [];
+
+  const apps = await listApps(ctx, http); // a failed app list throws — core turns it into a whole-lexicon hole
+
+  for (const app of apps) {
+    let machines: FlapsMachine[];
+    try {
+      machines = liveMachines(await listMachines(ctx, app, http));
+    } catch (err) {
+      holes.push({
+        name: app,
+        type: APP_TYPE,
+        reason: "read-failed",
+        detail: err instanceof Error ? err.message : String(err),
+      });
+      continue;
+    }
+
+    const matching = machines.filter((m) => matchesMarker(m, options.marker));
+    for (const m of matching) {
+      candidates.push({
+        name: `${app}/${m.name}`,
+        type: MACHINE_TYPE,
+        physicalId: m.id,
+        marker: readOwnership(m.config?.metadata, FLY_METADATA_OWNERSHIP_KEYS)!,
+      });
+    }
+
+    // The app boundary: whole-app delete only when every live machine carries
+    // the requested identity. Its marker is read back off its machines — the
+    // only channel an app has (#743).
+    if (machines.length > 0 && matching.length === machines.length) {
+      candidates.push({
+        name: app,
+        type: APP_TYPE,
+        marker: readOwnership(matching[0].config?.metadata, FLY_METADATA_OWNERSHIP_KEYS)!,
+      });
+    }
+  }
+
+  return { candidates, ...(holes.length > 0 ? { holes } : {}) };
+}
+
+/**
+ * Delete the handed-over candidates: machines first, apps last. One outcome
+ * per candidate, always.
+ */
+export async function executeTeardown(
+  options: FlyTeardownOptions & { candidates: TeardownCandidate[] },
+  deps: FlyTeardownDeps = {},
+): Promise<TeardownExecution> {
+  const http = deps.http ?? defaultFlyHttp();
+  const ctx: ApplyCtx = { base: resolveEndpoint({ ...(deps.endpoint ? { endpoint: deps.endpoint } : {}) }) };
+
+  const outcomes: TeardownOutcome[] = [];
+
+  for (const candidate of options.candidates.filter((c) => c.type === MACHINE_TYPE)) {
+    outcomes.push(await destroyMachineCandidate(ctx, candidate, options.marker, http, deps.wait));
+  }
+  for (const candidate of options.candidates.filter((c) => c.type === APP_TYPE)) {
+    outcomes.push(await deleteAppCandidate(ctx, candidate, options.marker, http));
+  }
+  for (const candidate of options.candidates) {
+    if (candidate.type === MACHINE_TYPE || candidate.type === APP_TYPE) continue;
+    outcomes.push({
+      name: candidate.name,
+      type: candidate.type,
+      outcome: "not-prunable",
+      detail: `fly teardown deletes machines and apps; ${candidate.type} is app-scoped and goes with its app`,
+    });
+  }
+
+  return { outcomes };
+}
+
+async function destroyMachineCandidate(
+  ctx: ApplyCtx,
+  candidate: TeardownCandidate,
+  marker: OwnershipMarker,
+  http: FlyHttp,
+  wait?: WaitOpts,
+): Promise<TeardownOutcome> {
+  const base = {
+    name: candidate.name,
+    type: candidate.type,
+    ...(candidate.physicalId ? { physicalId: candidate.physicalId } : {}),
+  };
+  const slash = candidate.name.indexOf("/");
+  if (slash <= 0) {
+    return { ...base, outcome: "not-prunable", detail: "machine candidate name is not app/machine-shaped" };
+  }
+  const app = candidate.name.slice(0, slash);
+  const machineName = candidate.name.slice(slash + 1);
+
+  let machines: FlapsMachine[];
+  try {
+    machines = await listMachines(ctx, app, http);
+  } catch (err) {
+    return { ...base, outcome: "failed", detail: err instanceof Error ? err.message : String(err) };
+  }
+
+  const live = liveMachines(machines).find((m) =>
+    candidate.physicalId ? m.id === candidate.physicalId : m.name === machineName,
+  );
+  if (!live) {
+    return { ...base, outcome: "deleted", detail: "already absent" };
+  }
+  // Re-verify right before destroying — a delete is not undoable.
+  if (!matchesMarker(live, marker)) {
+    return {
+      ...base,
+      outcome: "not-prunable",
+      detail: "the live machine no longer carries the requested marker identity",
+    };
+  }
+
+  try {
+    await destroyMachine(ctx, app, live.id, http, undefined, wait ?? {});
+  } catch (err) {
+    return { ...base, outcome: "failed", detail: err instanceof Error ? err.message : String(err) };
+  }
+  return { ...base, outcome: "deleted" };
+}
+
+async function deleteAppCandidate(
+  ctx: ApplyCtx,
+  candidate: TeardownCandidate,
+  marker: OwnershipMarker,
+  http: FlyHttp,
+): Promise<TeardownOutcome> {
+  const base = { name: candidate.name, type: candidate.type };
+  const app = candidate.name;
+
+  // The boundary re-check: an app that (still, or again) hosts any machine
+  // outside the requested identity is not deleted whole. Machines this same
+  // execution just destroyed are gone by now — destroyMachine waits.
+  let machines: FlapsMachine[];
+  try {
+    machines = liveMachines(await listMachines(ctx, app, http));
+  } catch (err) {
+    return { ...base, outcome: "failed", detail: err instanceof Error ? err.message : String(err) };
+  }
+  const foreign = machines.filter((m) => !matchesMarker(m, marker));
+  if (foreign.length > 0) {
+    return {
+      ...base,
+      outcome: "not-prunable",
+      detail: `the app hosts ${foreign.length} machine(s) outside the requested identity`,
+    };
+  }
+
+  try {
+    const result = await deleteApp(ctx, app, http);
+    return result.deleted ? { ...base, outcome: "deleted" } : { ...base, outcome: "deleted", detail: "already absent" };
+  } catch (err) {
+    return { ...base, outcome: "failed", detail: err instanceof Error ? err.message : String(err) };
+  }
+}