@wtfalch/foundry 0.10.0 → 0.11.0

package/dist/plan/plan-apply.d.ts

@@ -1,9 +1,10 @@
-import type { PlanApply } from '../apply.js';
+import type { AdoptionRestored, PlanApply } from '../apply.js';
 import type { DeclaredOrg, OrgId } from '../org.js';
-import type { Plan, PlanStep } from '../plan.js';
+import type { Plan, PlanStep, UnmanagedItem } from '../plan.js';
 import type { DeclaredPlatform } from '../platform.js';
 import type { AppliedState } from '../state.js';
-import type { DeclaredOrgStore, PlatformStore } from '../store.js';
+import type { Adoption, AdoptionStore, DeclaredOrgStore, PlatformStore } from '../store.js';
+import type { AdoptionVault } from './adoption-vault.js';
 import { type AgoraHostPort } from './agora.js';
 import { type StepAction } from './diff.js';
 import { type LiveReaders, type LiveResource, type PlatformLiveReaders } from './live.js';
@@ -147,6 +148,26 @@ export interface StepExecutor {
     execute(action: StepAction, context: StepExecutionContext): Promise<{
         resourceId?: string;
     } | undefined>;
+    /**
+     * #311: what each `coolify:adopt` step will change, keyed by the step's key,
+     * and the adoption items that are blocked. Read from the live app on every
+     * plan. Optional: an executor without it plans the step with no details.
+     */
+    adoptionReport?(org: DeclaredOrg, recordedIds: Readonly<Record<string, string>>): Promise<{
+        details: Record<string, string[]>;
+        blocked: UnmanagedItem[];
+        /** Resource keys whose live resource could not be read: their steps are not planned. */
+        withheld: string[];
+    }>;
+    /**
+     * #311: puts the adopted apps back as their snapshots recorded them and
+     * returns the env names it deleted. Refuses before any write when a
+     * snapshot's vault entry is missing. Optional like `adoptionReport`.
+     */
+    restoreAdoption?(org: DeclaredOrg, recordedIds: Readonly<Record<string, string>>, rows: readonly Adoption[]): Promise<{
+        envDeleted: string[];
+        tokenLeft?: string[];
+    }>;
 }
 /**
  * #167: {@link StepExecutionContext}'s platform-scoped counterpart -- what
@@ -250,6 +271,10 @@ export declare class StalePlanError extends Error {
 export declare class ConfirmationRequiredError extends Error {
     constructor(orgId: OrgId);
 }
+/** #311: the first successful apply after the adopting one confirmed the snapshot, so it is no longer offered. */
+export declare class AdoptionConfirmedError extends Error {
+    constructor(orgId: OrgId, resourceKeys: readonly string[]);
+}
 export declare class NotAuthorizedError extends Error {
     constructor(actor: AuditActor, orgId: OrgId);
 }
@@ -311,6 +336,13 @@ export interface FoundryPlanApplyOptions {
      */
     filesOrganisation?: boolean;
     aiOrganisation?: boolean;
+    /**
+     * #311: where an adoption keeps the env values of the app it takes over, and
+     * the rows that hold the rest of the snapshot. Both are needed: with either
+     * absent, each adopted resource is reported blocked and planned for nothing.
+     */
+    adoptionVault?: AdoptionVault;
+    adoptionStore?: AdoptionStore;
     /** Overridable for tests; defaults to `() => new Date()`. */
     now?: () => Date;
     /**
@@ -361,11 +393,21 @@ export declare class FoundryPlanApply implements PlanApply {
     private readonly broker;
     private readonly hostFiles;
     private readonly hostAi;
+    private readonly adoptionVault;
+    private readonly adoptionStore;
     private readonly now;
     private readonly platformDeps;
     constructor(options: FoundryPlanApplyOptions);
     plan(id: OrgId): Promise<Plan>;
     apply(plan: Plan, confirmedOrgName: string): Promise<AppliedState>;
+    /**
+     * #311: puts the org's adopted apps back as their snapshots recorded them.
+     * Refused unless `confirmedOrgName` matches the org's `displayName`, and
+     * when every snapshot is `confirmed`; a `confirmed` row beside an `adopted`
+     * one is left as it is. Returns resource keys and env names, never a value
+     * (rule 6).
+     */
+    restore(id: OrgId, confirmedOrgName: string): Promise<AdoptionRestored>;
     /**
      * #167: {@link plan}, for the shared platform (#166) rather than an org --
      * there is no id to pass, since `DeclaredPlatform` is one singleton record.
@@ -398,6 +440,8 @@ export declare class FoundryPlanApply implements PlanApply {
     private refuseDestroy;
     private runSteps;
     private computeFreshPlan;
+    /** #311: the `details` of each `coolify:adopt` step and the adoption items that are blocked. */
+    private addAdoptionReport;
     /**
      * An entry may not take a name foundry owns (`locked-hostnames.ts`). The
      * store checks the names it knows; this adds the platform's own hostnames,

package/dist/plan/plan-apply.js

@@ -2,6 +2,7 @@ import { createHash } from 'node:crypto';
 import { VERSIONS, floatingTagBlocked } from '../bootstrap/versions.js';
 import { validateHosting } from '../org.js';
 import { PLATFORM_SERVICE_KEYS } from '../platform.js';
+import { adoptedConnectorKey, adoptedTunnelKey, declaredAdoptUuids } from './adopt.js';
 import { NO_AGORA_HOST_VALUES, readAgoraHost, } from './agora.js';
 import { AI_KEY_UNDELIVERED_SCOPE_KEY, JOBS_REGISTRATION_UNDELIVERED_SCOPE_KEY, computePlanDetail, toPlan, } from './diff.js';
 import { readLivePlatformResources, readLiveResources, } from './live.js';
@@ -28,6 +29,13 @@ export class ConfirmationRequiredError extends Error {
         this.name = 'ConfirmationRequiredError';
     }
 }
+/** #311: the first successful apply after the adopting one confirmed the snapshot, so it is no longer offered. */
+export class AdoptionConfirmedError extends Error {
+    constructor(orgId, resourceKeys) {
+        super(`the snapshot of org ${orgId} is confirmed (${resourceKeys.join(', ')}); it can no longer be restored`);
+        this.name = 'AdoptionConfirmedError';
+    }
+}
 export class NotAuthorizedError extends Error {
     constructor(actor, orgId) {
         super(`${actor.display} does not hold the permission to apply org ${orgId} (#9, #19)`);
@@ -68,6 +76,7 @@ export class PlatformConfirmationRequiredError extends Error {
 }
 /** The steps that read an entry's hostnames: `computeFreshPlan` drops them for an org whose hosting is invalid. */
 const HOSTNAME_STEPS = new Set([
+    'coolify:adopt',
     'coolify:app',
     'coolify:broker-entry',
     'coolify:database',
@@ -95,6 +104,8 @@ export class FoundryPlanApply {
     broker;
     hostFiles;
     hostAi;
+    adoptionVault;
+    adoptionStore;
     now;
     platformDeps;
     constructor(options) {
@@ -111,6 +122,8 @@ export class FoundryPlanApply {
         this.broker = options.broker ?? false;
         this.hostFiles = options.filesOrganisation ?? false;
         this.hostAi = options.aiOrganisation ?? false;
+        this.adoptionVault = options.adoptionVault;
+        this.adoptionStore = options.adoptionStore;
         this.now = options.now ?? (() => new Date());
         this.platformDeps = options.platform;
     }
@@ -137,6 +150,42 @@ export class FoundryPlanApply {
         }
         return this.runSteps(org, plan, detail);
     }
+    /**
+     * #311: puts the org's adopted apps back as their snapshots recorded them.
+     * Refused unless `confirmedOrgName` matches the org's `displayName`, and
+     * when every snapshot is `confirmed`; a `confirmed` row beside an `adopted`
+     * one is left as it is. Returns resource keys and env names, never a value
+     * (rule 6).
+     */
+    async restore(id, confirmedOrgName) {
+        const authorized = await this.authz.canApply(this.actor, id);
+        if (!authorized)
+            throw new NotAuthorizedError(this.actor, id);
+        const org = await this.store.get(id);
+        if (!org)
+            throw new DeclaredOrgNotFoundError(id);
+        if (confirmedOrgName.trim() !== org.displayName.trim())
+            throw new ConfirmationRequiredError(id);
+        const { adoptionStore, executor } = this;
+        if (!this.adoptionVault || !adoptionStore || !executor.restoreAdoption) {
+            throw new Error(`restore for org ${id}: no adoption vault is wired`);
+        }
+        const rows = await adoptionStore.list(id);
+        const adopted = rows.filter((row) => row.state === 'adopted');
+        const confirmed = rows.filter((row) => row.state === 'confirmed');
+        if (adopted.length === 0 && confirmed.length > 0) {
+            throw new AdoptionConfirmedError(id, confirmed.map((row) => row.resourceKey));
+        }
+        const state = await this.store.getAppliedState(id);
+        const { envDeleted, tokenLeft } = await executor.restoreAdoption(org, state?.serviceIds ?? {}, adopted);
+        for (const row of adopted)
+            await adoptionStore.setState(id, row.resourceKey, 'restored');
+        return {
+            restored: adopted.map((row) => row.resourceKey),
+            envDeleted,
+            ...(tokenLeft?.length ? { tokenLeft } : {}),
+        };
+    }
     /**
      * #167: {@link plan}, for the shared platform (#166) rather than an org --
      * there is no id to pass, since `DeclaredPlatform` is one singleton record.
@@ -217,8 +266,25 @@ export class FoundryPlanApply {
         }
         const state = await this.store.getAppliedState(id);
         const serviceIds = { ...(state?.serviceIds ?? {}) };
-        const targets = destroyTargets(serviceIds);
+        // #311: an adopted resource is released, never deleted. Its rows go to
+        // `released` and its ids leave `serviceIds` before the first delete, so a
+        // retried destroy skips them the same way.
+        const adoptedKeys = new Set((await this.adoptionStore?.list(id))?.map((r) => r.resourceKey));
+        const targets = destroyTargets(serviceIds, adoptedKeys, declaredAdoptUuids(org));
         try {
+            for (const resourceKey of adoptedKeys) {
+                delete serviceIds[resourceKey];
+                await this.adoptionStore?.setState(id, resourceKey, 'released');
+            }
+            if (adoptedKeys.size > 0) {
+                await this.store.putAppliedState({
+                    orgId: id,
+                    serviceIds,
+                    checkpoints: state?.checkpoints ?? [],
+                    failedFields: state?.failedFields ?? [],
+                    lastApplied: state?.lastApplied ?? null,
+                });
+            }
             for (const target of targets) {
                 // A provider 404 counts as deleted -- `StepDestroyer.destroy`'s own
                 // doc comment -- so nothing here needs to special-case "already
@@ -286,6 +352,7 @@ export class FoundryPlanApply {
         const orgId = plan.orgId;
         const previous = await this.store.getAppliedState(orgId);
         const serviceIds = { ...(previous?.serviceIds ?? {}) };
+        const adoptedBefore = (await this.adoptionStore?.list(orgId))?.filter((row) => row.state === 'adopted');
         const checkpoints = [];
         // Backed by the very `serviceIds` map this method persists once, at the
         // end — see `StepExecutionContext`'s doc comment for why.
@@ -349,6 +416,20 @@ export class FoundryPlanApply {
             lastApplied: { at: this.now().toISOString(), declaredOrgVersion: hashOrg(org) },
         };
         await this.store.putAppliedState(applied);
+        // #311: the first successful apply after the adopting one confirms the
+        // snapshot. A row taken after the last successful apply was taken by this
+        // one, or by one that failed, and is not confirmed yet.
+        // Only that same snapshot: one this apply took again is not confirmed by it.
+        for (const row of adoptedBefore ?? []) {
+            if (previous?.lastApplied && row.takenAt <= previous.lastApplied.at) {
+                const now = await this.adoptionStore?.get(orgId, row.resourceKey);
+                if (now?.state === 'adopted' &&
+                    now.takenAt === row.takenAt &&
+                    now.settings.uuid === row.settings.uuid) {
+                    await this.adoptionStore?.setState(orgId, row.resourceKey, 'confirmed');
+                }
+            }
+        }
         await this.audit.recordApply({
             actor: this.actor,
             orgId,
@@ -362,13 +443,22 @@ export class FoundryPlanApply {
         const org = await this.store.get(id);
         if (!org)
             throw new DeclaredOrgNotFoundError(id);
-        const [live, applied, platformReadiness, agoraHost] = await Promise.all([
+        const [live, applied, platformReadiness, agoraHost, adopted] = await Promise.all([
             readLiveResources(id, this.readers),
             this.store.getAppliedState(id),
             this.orgPlatformReadiness(),
             this.orgAgoraHost(id),
+            this.adoptionStore?.list(id) ?? [],
         ]);
-        const detail = computePlanDetail(org, live, applied?.serviceIds ?? {}, agoraHost, this.jobsScheduler, platformReadiness, { loginHostBindings: this.loginHostBindings, broker: this.broker });
+        const detail = computePlanDetail(org, live, applied?.serviceIds ?? {}, agoraHost, this.jobsScheduler, platformReadiness, {
+            loginHostBindings: this.loginHostBindings,
+            broker: this.broker,
+            adoption: {
+                wired: Boolean(this.adoptionVault && this.adoptionStore),
+                adopted,
+            },
+        });
+        await this.addAdoptionReport(org, detail, applied?.serviceIds ?? {});
         const invalid = await this.invalidHosting(org);
         if (invalid) {
             // Rule 2: reported in `unmanaged`, not thrown. Steps that read the
@@ -381,6 +471,31 @@ export class FoundryPlanApply {
         }
         return { org, plan: toPlan(detail), detail };
     }
+    /** #311: the `details` of each `coolify:adopt` step and the adoption items that are blocked. */
+    async addAdoptionReport(org, detail, recordedIds) {
+        if (!this.adoptionVault || !this.adoptionStore || !this.executor.adoptionReport)
+            return;
+        const report = await this.executor.adoptionReport(org, recordedIds);
+        // A resource that cannot be read gets neither its adopt step nor its own (rule 2).
+        const withheld = new Set(report.withheld);
+        // The tunnel step waits for the adoption of the tunnel and of its connector (#312).
+        const tunnelHeld = withheld.has(adoptedTunnelKey(org)) || withheld.has(adoptedConnectorKey(org));
+        detail.plannedSteps = detail.plannedSteps.filter(({ action }) => !(action.system === 'coolify' && action.kind === 'adopt' && withheld.has(action.key)) &&
+            !(action.system === 'coolify' &&
+                (action.kind === 'app' || action.kind === 'database') &&
+                withheld.has(`coolify:${action.kind}:${action.key}`)) &&
+            !(action.system === 'cloudflare' && action.kind === 'tunnel' && tunnelHeld));
+        for (const { action, step } of detail.plannedSteps) {
+            const key = action.system === 'coolify' && action.kind === 'adopt'
+                ? action.key
+                : action.system === 'cloudflare' && action.kind === 'tunnel'
+                    ? adoptedTunnelKey(org)
+                    : undefined;
+            if (key !== undefined && report.details[key])
+                step.details = report.details[key];
+        }
+        detail.unmanaged.push(...report.blocked);
+    }
     /**
      * An entry may not take a name foundry owns (`locked-hostnames.ts`). The
      * store checks the names it knows; this adds the platform's own hostnames,
@@ -588,7 +703,7 @@ const ZITADEL_ORG_SCOPE_KEY = 'zitadel_org';
  * belongs to is already left in place -- deleting only the rule and not the
  * zone is a decision left for whoever wires teardown in, not made here.
  */
-function destroyTargets(serviceIds) {
+function destroyTargets(serviceIds, adoptedKeys, adoptedUuids) {
     // Reverse-teardown order: everything under one of these prefixes is
     // collected in this order, then every ZITADEL app (there can be several,
     // #71), then the two scope ids last.
@@ -605,6 +720,9 @@ function destroyTargets(serviceIds) {
         for (const [resourceKey, id] of Object.entries(serviceIds)) {
             if (!resourceKey.startsWith(prefix))
                 continue;
+            // Never delete what was adopted: a row in any state, or a declared uuid (#311).
+            if (adoptedKeys.has(resourceKey) || adoptedUuids.has(id))
+                continue;
             const [system, kind] = prefix.split(':');
             targets.push({ system, kind, key: resourceKey.slice(prefix.length), id });
         }

package/dist/plan/platform-diff.d.ts

@@ -357,6 +357,12 @@ export declare function appSettingsOf(entry: HostingEntry): AppSettings;
 /** What an app that predates the marker has: Coolify's own defaults, so it plans no change. */
 export declare const DEFAULT_APP_SETTINGS: AppSettings;
 export declare function appSettingsAppliedScopeKey(entryKey: string): string;
+/**
+ * Set before an adopted app's settings are patched, cleared once its deploy
+ * succeeded (an empty value is not pending): a failed deploy replans whatever
+ * the markers say (#311).
+ */
+export declare function appDeployPendingScopeKey(entryKey: string): string;
 /** The settings the app has: the marker, or the defaults when there is none. */
 export declare function appliedAppSettings(recorded: Readonly<Record<string, string>>, entryKey: string): AppSettings;
 /**

package/dist/plan/platform-diff.js

@@ -391,6 +391,14 @@ export const DEFAULT_APP_SETTINGS = { folder: null, port: null, autoDeploy: true
 export function appSettingsAppliedScopeKey(entryKey) {
     return `app_settings_applied.${entryKey}`;
 }
+/**
+ * Set before an adopted app's settings are patched, cleared once its deploy
+ * succeeded (an empty value is not pending): a failed deploy replans whatever
+ * the markers say (#311).
+ */
+export function appDeployPendingScopeKey(entryKey) {
+    return `app_deploy_pending.${entryKey}`;
+}
 /** The settings the app has: the marker, or the defaults when there is none. */
 export function appliedAppSettings(recorded, entryKey) {
     const marker = recorded[appSettingsAppliedScopeKey(entryKey)];

package/dist/plan/providers-readers.d.ts

@@ -3,6 +3,7 @@ import type { CoolifyClient } from '@wtfalch/providers/coolify';
 import type { ZitadelClient } from '@wtfalch/providers/zitadel';
 import type { OrgId } from '../org.js';
 import type { DeclaredOrgStore } from '../store.js';
+import type { AdoptedResource } from './adopt.js';
 import type { CloudflareReader, CmsReader, CoolifyReader, LiveResource, ZitadelReader } from './live.js';
 /**
  * Real `CoolifyReader`, `CloudflareReader` and `ZitadelReader` implementations
@@ -92,7 +93,13 @@ export declare class ProvidersCoolifyReader implements CoolifyReader {
     private readonly client;
     private readonly resolveScope;
     private readonly resolveRecordedIds;
-    constructor(client: CoolifyClient, resolveScope: ScopeResolver, resolveRecordedIds: RecordedIds);
+    private readonly options;
+    constructor(client: CoolifyClient, resolveScope: ScopeResolver, resolveRecordedIds: RecordedIds, options?: {
+        /** #311: what the org adopts by uuid; each is read directly, not found by project. */
+        adopted?: (orgId: OrgId) => Promise<AdoptedResource[]>;
+    });
+    /** #311: each adopted uuid, read by uuid, under the key the planner matches. An unreadable one is absent. */
+    private readAdopted;
     listResources(orgId: OrgId): Promise<LiveResource[]>;
 }
 /**

package/dist/plan/providers-readers.js

@@ -204,19 +204,73 @@ export class ProvidersCoolifyReader {
     client;
     resolveScope;
     resolveRecordedIds;
-    constructor(client, resolveScope, resolveRecordedIds) {
+    options;
+    constructor(client, resolveScope, resolveRecordedIds, options = {}) {
         this.client = client;
         this.resolveScope = resolveScope;
         this.resolveRecordedIds = resolveRecordedIds;
+        this.options = options;
+    }
+    /** #311: each adopted uuid, read by uuid, under the key the planner matches. An unreadable one is absent. */
+    async readAdopted(adopted) {
+        const read = await Promise.all(adopted.map(async (a) => {
+            try {
+                if (a.kind === 'database') {
+                    const { name, status } = await this.client.getDatabase(a.uuid);
+                    return {
+                        resource: {
+                            kind: 'database',
+                            key: a.uuid,
+                            config: { name, status },
+                        },
+                        recorded: `database:${a.resourceKey.slice('coolify:database:'.length)}`,
+                    };
+                }
+                const app = await this.client.getApplication(a.uuid);
+                return {
+                    resource: {
+                        kind: 'application',
+                        key: a.uuid,
+                        config: {
+                            name: app.name,
+                            fqdn: app.fqdn,
+                            status: app.status,
+                            git_repository: app.git_repository,
+                            git_branch: app.git_branch,
+                            is_auto_deploy_enabled: app.is_auto_deploy_enabled,
+                            environment_id: app.environment_id,
+                        },
+                    },
+                    recorded: `app:${a.resourceKey.slice('coolify:app:'.length)}`,
+                };
+            }
+            catch {
+                return null;
+            }
+        }));
+        return read.filter((r) => r !== null);
     }
     async listResources(orgId) {
         const projectUuid = await this.resolveScope(orgId);
-        if (!projectUuid)
+        // The tunnel and its connector are read by `ProvidersCloudflareReader` and the executor (#312).
+        const adopted = ((await this.options.adopted?.(orgId)) ?? []).filter((a) => a.kind === 'app' || a.kind === 'database');
+        if (!projectUuid && adopted.length === 0)
             return [];
-        const [resources, recorded] = await Promise.all([
-            this.client.listResources(projectUuid),
+        const [listed, recordedById, adoptedLive] = await Promise.all([
+            projectUuid ? this.client.listResources(projectUuid) : [],
             this.resolveRecordedIds(orgId),
+            this.readAdopted(adopted),
         ]);
+        // The declared uuid wins over a recorded id and over the project listing.
+        const uuids = new Set(adoptedLive.map((a) => a.resource.key));
+        const resources = [
+            ...listed.filter((r) => !uuids.has(r.key)),
+            ...adoptedLive.map((a) => a.resource),
+        ];
+        const recorded = {
+            ...recordedById,
+            ...Object.fromEntries(adoptedLive.map((a) => [a.resource.key, a.recorded])),
+        };
         const withLogConfig = await Promise.all(toFoundryResources('coolify', resources).map((r) => withLogVolumeConfig(this.client, r, recorded)));
         const withEnvNames = await Promise.all(withLogConfig.map((r) => withEnvNamesConfig(this.client, r, recorded)));
         const withDbUrl = await Promise.all(withEnvNames.map((r) => withDatabaseUrlConfig(this.client, r, recorded)));

package/dist/plan.d.ts

@@ -9,6 +9,12 @@ import type { OrgId } from './org.js';
  */
 export interface PlanStep {
     description: string;
+    /**
+     * Lines that say what the step will change, shown beside the description.
+     * `coolify:adopt` (#311) gives one per setting, old value beside new, and
+     * env vars by name only. Never a secret.
+     */
+    details?: string[];
     /**
      * True when this step deletes or replaces data the org cannot get back
      * without foundry's own backup: a chat re-key, an issuer move, a mail

package/dist/store/postgres.d.ts

@@ -1,5 +1,5 @@
 import type { PgDatabase, PgQueryResultHKT } from 'drizzle-orm/pg-core';
-import type { DeclaredOrgStore, PlatformStore, RequestedChangeStore } from '../store.js';
+import type { AdoptionStore, DeclaredOrgStore, PlatformStore, RequestedChangeStore } from '../store.js';
 /**
  * The host's own drizzle handle or a transaction open on it, same shape
  * `@wtfalch/keys`'s `HeldKeysDb` uses: postgres-js in a real host, PGlite in
@@ -90,3 +90,8 @@ export declare function createPostgresPlatformStore(db: FoundryStoreDb): Platfor
  * argument makes -- and stores the result as the request's initial `state`.
  */
 export declare function createPostgresRequestedChangeStore(db: FoundryStoreDb): RequestedChangeStore;
+/**
+ * `AdoptionStore` (`../store.ts`) on Postgres, for #311: the snapshot row of
+ * each live resource foundry takes over, beside the stores above.
+ */
+export declare function createPostgresAdoptionStore(db: FoundryStoreDb): AdoptionStore;

package/dist/store/postgres.js

@@ -1,10 +1,10 @@
-import { asc, eq, sql } from 'drizzle-orm';
+import { and, asc, eq, sql } from 'drizzle-orm';
 import { APP_ENTRY_KEY, DEFAULT_MAIL_APPS, DEFAULT_NO_REPLY_LOCAL_PART, validateBuyerIdentity, validateDomain, validateHosting, validateMail, validateOwner, validateSite, } from '../org.js';
 import { lockedHostnames } from '../plan/locked-hostnames.js';
 import { validatePlatform } from '../platform.js';
 import { RequestedChangeError, classifyChange } from '../requested-changes.js';
 import { validateSlug } from '../slug.js';
-import { declaredOrgs, foundryAppliedState, foundryDeclaredPlatform, foundryRequestedChanges, } from './schema.js';
+import { declaredOrgs, foundryAdoptions, foundryAppliedState, foundryDeclaredPlatform, foundryRequestedChanges, } from './schema.js';
 const UNIQUE_VIOLATION = '23505';
 /** `migrations/0004_slug_unique.sql` / `migrations/0015_domain_unique.sql`'s index names, read back off a caught unique-violation to tell which one fired. */
 const SLUG_UNIQUE_INDEX = 'foundry_declared_orgs_slug_idx';
@@ -82,6 +82,7 @@ function rowToOrg(row) {
             usesDomain: row.hostingUsesDomain,
             tunnel: row.hostingTunnel,
             issuerApps: row.hostingIssuerApps,
+            ...(row.hostingAdopt ? { adopt: row.hostingAdopt } : {}),
             // Migration 0030's default for an entry stored before `hostnames`.
             entries: row.hostingEntries.map((entry) => ({
                 ...entry,
@@ -126,6 +127,7 @@ function orgToRow(org) {
         hostingTunnel: org.hosting.tunnel,
         hostingIssuerApps: org.hosting.issuerApps,
         hostingEntries: org.hosting.entries,
+        hostingAdopt: org.hosting.adopt ?? null,
         ssoEnabled: org.sso.enabled,
         guestsEnabled: org.guests.enabled,
         soloEnabled: org.solo.enabled,
@@ -612,3 +614,68 @@ export function createPostgresRequestedChangeStore(db) {
         },
     };
 }
+function rowToAdoption(row) {
+    return {
+        orgId: row.orgId,
+        resourceKey: row.resourceKey,
+        kind: row.kind,
+        takenAt: row.takenAt.toISOString(),
+        settings: row.settings,
+        vaultRef: row.vaultRef,
+        state: row.state,
+    };
+}
+/**
+ * `AdoptionStore` (`../store.ts`) on Postgres, for #311: the snapshot row of
+ * each live resource foundry takes over, beside the stores above.
+ */
+export function createPostgresAdoptionStore(db) {
+    return {
+        async put(adoption) {
+            const values = {
+                orgId: adoption.orgId,
+                resourceKey: adoption.resourceKey,
+                kind: adoption.kind,
+                takenAt: new Date(adoption.takenAt),
+                settings: adoption.settings,
+                vaultRef: adoption.vaultRef,
+                state: 'adopted',
+            };
+            await db
+                .insert(foundryAdoptions)
+                .values(values)
+                .onConflictDoUpdate({
+                target: [foundryAdoptions.orgId, foundryAdoptions.resourceKey],
+                set: values,
+            });
+        },
+        async get(orgId, resourceKey) {
+            const [row] = await db
+                .select()
+                .from(foundryAdoptions)
+                .where(and(eq(foundryAdoptions.orgId, orgId), eq(foundryAdoptions.resourceKey, resourceKey)))
+                .limit(1);
+            return row ? rowToAdoption(row) : null;
+        },
+        async list(orgId) {
+            const rows = await db
+                .select()
+                .from(foundryAdoptions)
+                .where(eq(foundryAdoptions.orgId, orgId))
+                .orderBy(asc(foundryAdoptions.resourceKey));
+            return rows.map(rowToAdoption);
+        },
+        async setState(orgId, resourceKey, state) {
+            await db
+                .update(foundryAdoptions)
+                .set({ state })
+                .where(and(eq(foundryAdoptions.orgId, orgId), eq(foundryAdoptions.resourceKey, resourceKey)));
+        },
+        async setSettings(orgId, resourceKey, settings) {
+            await db
+                .update(foundryAdoptions)
+                .set({ settings })
+                .where(and(eq(foundryAdoptions.orgId, orgId), eq(foundryAdoptions.resourceKey, resourceKey)));
+        },
+    };
+}