@wtfalch/foundry 0.11.0 → 0.13.0

package/dist/plan/plan-apply.d.ts

@@ -1,10 +1,9 @@
-import type { AdoptionRestored, PlanApply } from '../apply.js';
+import type { PlanApply } from '../apply.js';
 import type { DeclaredOrg, OrgId } from '../org.js';
-import type { Plan, PlanStep, UnmanagedItem } from '../plan.js';
+import type { Plan, PlanStep } from '../plan.js';
 import type { DeclaredPlatform } from '../platform.js';
 import type { AppliedState } from '../state.js';
-import type { Adoption, AdoptionStore, DeclaredOrgStore, PlatformStore } from '../store.js';
-import type { AdoptionVault } from './adoption-vault.js';
+import type { DeclaredOrgStore, PlatformStore } from '../store.js';
 import { type AgoraHostPort } from './agora.js';
 import { type StepAction } from './diff.js';
 import { type LiveReaders, type LiveResource, type PlatformLiveReaders } from './live.js';
@@ -148,26 +147,6 @@ export interface StepExecutor {
     execute(action: StepAction, context: StepExecutionContext): Promise<{
         resourceId?: string;
     } | undefined>;
-    /**
-     * #311: what each `coolify:adopt` step will change, keyed by the step's key,
-     * and the adoption items that are blocked. Read from the live app on every
-     * plan. Optional: an executor without it plans the step with no details.
-     */
-    adoptionReport?(org: DeclaredOrg, recordedIds: Readonly<Record<string, string>>): Promise<{
-        details: Record<string, string[]>;
-        blocked: UnmanagedItem[];
-        /** Resource keys whose live resource could not be read: their steps are not planned. */
-        withheld: string[];
-    }>;
-    /**
-     * #311: puts the adopted apps back as their snapshots recorded them and
-     * returns the env names it deleted. Refuses before any write when a
-     * snapshot's vault entry is missing. Optional like `adoptionReport`.
-     */
-    restoreAdoption?(org: DeclaredOrg, recordedIds: Readonly<Record<string, string>>, rows: readonly Adoption[]): Promise<{
-        envDeleted: string[];
-        tokenLeft?: string[];
-    }>;
 }
 /**
  * #167: {@link StepExecutionContext}'s platform-scoped counterpart -- what
@@ -271,10 +250,6 @@ export declare class StalePlanError extends Error {
 export declare class ConfirmationRequiredError extends Error {
     constructor(orgId: OrgId);
 }
-/** #311: the first successful apply after the adopting one confirmed the snapshot, so it is no longer offered. */
-export declare class AdoptionConfirmedError extends Error {
-    constructor(orgId: OrgId, resourceKeys: readonly string[]);
-}
 export declare class NotAuthorizedError extends Error {
     constructor(actor: AuditActor, orgId: OrgId);
 }
@@ -336,13 +311,6 @@ export interface FoundryPlanApplyOptions {
      */
     filesOrganisation?: boolean;
     aiOrganisation?: boolean;
-    /**
-     * #311: where an adoption keeps the env values of the app it takes over, and
-     * the rows that hold the rest of the snapshot. Both are needed: with either
-     * absent, each adopted resource is reported blocked and planned for nothing.
-     */
-    adoptionVault?: AdoptionVault;
-    adoptionStore?: AdoptionStore;
     /** Overridable for tests; defaults to `() => new Date()`. */
     now?: () => Date;
     /**
@@ -393,21 +361,11 @@ export declare class FoundryPlanApply implements PlanApply {
     private readonly broker;
     private readonly hostFiles;
     private readonly hostAi;
-    private readonly adoptionVault;
-    private readonly adoptionStore;
     private readonly now;
     private readonly platformDeps;
     constructor(options: FoundryPlanApplyOptions);
     plan(id: OrgId): Promise<Plan>;
     apply(plan: Plan, confirmedOrgName: string): Promise<AppliedState>;
-    /**
-     * #311: puts the org's adopted apps back as their snapshots recorded them.
-     * Refused unless `confirmedOrgName` matches the org's `displayName`, and
-     * when every snapshot is `confirmed`; a `confirmed` row beside an `adopted`
-     * one is left as it is. Returns resource keys and env names, never a value
-     * (rule 6).
-     */
-    restore(id: OrgId, confirmedOrgName: string): Promise<AdoptionRestored>;
     /**
      * #167: {@link plan}, for the shared platform (#166) rather than an org --
      * there is no id to pass, since `DeclaredPlatform` is one singleton record.
@@ -440,8 +398,6 @@ export declare class FoundryPlanApply implements PlanApply {
     private refuseDestroy;
     private runSteps;
     private computeFreshPlan;
-    /** #311: the `details` of each `coolify:adopt` step and the adoption items that are blocked. */
-    private addAdoptionReport;
     /**
      * An entry may not take a name foundry owns (`locked-hostnames.ts`). The
      * store checks the names it knows; this adds the platform's own hostnames,

package/dist/plan/plan-apply.js

@@ -2,7 +2,6 @@ import { createHash } from 'node:crypto';
 import { VERSIONS, floatingTagBlocked } from '../bootstrap/versions.js';
 import { validateHosting } from '../org.js';
 import { PLATFORM_SERVICE_KEYS } from '../platform.js';
-import { adoptedConnectorKey, adoptedTunnelKey, declaredAdoptUuids } from './adopt.js';
 import { NO_AGORA_HOST_VALUES, readAgoraHost, } from './agora.js';
 import { AI_KEY_UNDELIVERED_SCOPE_KEY, JOBS_REGISTRATION_UNDELIVERED_SCOPE_KEY, computePlanDetail, toPlan, } from './diff.js';
 import { readLivePlatformResources, readLiveResources, } from './live.js';
@@ -29,13 +28,6 @@ export class ConfirmationRequiredError extends Error {
         this.name = 'ConfirmationRequiredError';
     }
 }
-/** #311: the first successful apply after the adopting one confirmed the snapshot, so it is no longer offered. */
-export class AdoptionConfirmedError extends Error {
-    constructor(orgId, resourceKeys) {
-        super(`the snapshot of org ${orgId} is confirmed (${resourceKeys.join(', ')}); it can no longer be restored`);
-        this.name = 'AdoptionConfirmedError';
-    }
-}
 export class NotAuthorizedError extends Error {
     constructor(actor, orgId) {
         super(`${actor.display} does not hold the permission to apply org ${orgId} (#9, #19)`);
@@ -76,7 +68,6 @@ export class PlatformConfirmationRequiredError extends Error {
 }
 /** The steps that read an entry's hostnames: `computeFreshPlan` drops them for an org whose hosting is invalid. */
 const HOSTNAME_STEPS = new Set([
-    'coolify:adopt',
     'coolify:app',
     'coolify:broker-entry',
     'coolify:database',
@@ -104,8 +95,6 @@ export class FoundryPlanApply {
     broker;
     hostFiles;
     hostAi;
-    adoptionVault;
-    adoptionStore;
     now;
     platformDeps;
     constructor(options) {
@@ -122,8 +111,6 @@ export class FoundryPlanApply {
         this.broker = options.broker ?? false;
         this.hostFiles = options.filesOrganisation ?? false;
         this.hostAi = options.aiOrganisation ?? false;
-        this.adoptionVault = options.adoptionVault;
-        this.adoptionStore = options.adoptionStore;
         this.now = options.now ?? (() => new Date());
         this.platformDeps = options.platform;
     }
@@ -150,42 +137,6 @@ export class FoundryPlanApply {
         }
         return this.runSteps(org, plan, detail);
     }
-    /**
-     * #311: puts the org's adopted apps back as their snapshots recorded them.
-     * Refused unless `confirmedOrgName` matches the org's `displayName`, and
-     * when every snapshot is `confirmed`; a `confirmed` row beside an `adopted`
-     * one is left as it is. Returns resource keys and env names, never a value
-     * (rule 6).
-     */
-    async restore(id, confirmedOrgName) {
-        const authorized = await this.authz.canApply(this.actor, id);
-        if (!authorized)
-            throw new NotAuthorizedError(this.actor, id);
-        const org = await this.store.get(id);
-        if (!org)
-            throw new DeclaredOrgNotFoundError(id);
-        if (confirmedOrgName.trim() !== org.displayName.trim())
-            throw new ConfirmationRequiredError(id);
-        const { adoptionStore, executor } = this;
-        if (!this.adoptionVault || !adoptionStore || !executor.restoreAdoption) {
-            throw new Error(`restore for org ${id}: no adoption vault is wired`);
-        }
-        const rows = await adoptionStore.list(id);
-        const adopted = rows.filter((row) => row.state === 'adopted');
-        const confirmed = rows.filter((row) => row.state === 'confirmed');
-        if (adopted.length === 0 && confirmed.length > 0) {
-            throw new AdoptionConfirmedError(id, confirmed.map((row) => row.resourceKey));
-        }
-        const state = await this.store.getAppliedState(id);
-        const { envDeleted, tokenLeft } = await executor.restoreAdoption(org, state?.serviceIds ?? {}, adopted);
-        for (const row of adopted)
-            await adoptionStore.setState(id, row.resourceKey, 'restored');
-        return {
-            restored: adopted.map((row) => row.resourceKey),
-            envDeleted,
-            ...(tokenLeft?.length ? { tokenLeft } : {}),
-        };
-    }
     /**
      * #167: {@link plan}, for the shared platform (#166) rather than an org --
      * there is no id to pass, since `DeclaredPlatform` is one singleton record.
@@ -266,25 +217,8 @@ export class FoundryPlanApply {
         }
         const state = await this.store.getAppliedState(id);
         const serviceIds = { ...(state?.serviceIds ?? {}) };
-        // #311: an adopted resource is released, never deleted. Its rows go to
-        // `released` and its ids leave `serviceIds` before the first delete, so a
-        // retried destroy skips them the same way.
-        const adoptedKeys = new Set((await this.adoptionStore?.list(id))?.map((r) => r.resourceKey));
-        const targets = destroyTargets(serviceIds, adoptedKeys, declaredAdoptUuids(org));
+        const targets = destroyTargets(serviceIds);
         try {
-            for (const resourceKey of adoptedKeys) {
-                delete serviceIds[resourceKey];
-                await this.adoptionStore?.setState(id, resourceKey, 'released');
-            }
-            if (adoptedKeys.size > 0) {
-                await this.store.putAppliedState({
-                    orgId: id,
-                    serviceIds,
-                    checkpoints: state?.checkpoints ?? [],
-                    failedFields: state?.failedFields ?? [],
-                    lastApplied: state?.lastApplied ?? null,
-                });
-            }
             for (const target of targets) {
                 // A provider 404 counts as deleted -- `StepDestroyer.destroy`'s own
                 // doc comment -- so nothing here needs to special-case "already
@@ -352,7 +286,6 @@ export class FoundryPlanApply {
         const orgId = plan.orgId;
         const previous = await this.store.getAppliedState(orgId);
         const serviceIds = { ...(previous?.serviceIds ?? {}) };
-        const adoptedBefore = (await this.adoptionStore?.list(orgId))?.filter((row) => row.state === 'adopted');
         const checkpoints = [];
         // Backed by the very `serviceIds` map this method persists once, at the
         // end — see `StepExecutionContext`'s doc comment for why.
@@ -416,20 +349,6 @@ export class FoundryPlanApply {
             lastApplied: { at: this.now().toISOString(), declaredOrgVersion: hashOrg(org) },
         };
         await this.store.putAppliedState(applied);
-        // #311: the first successful apply after the adopting one confirms the
-        // snapshot. A row taken after the last successful apply was taken by this
-        // one, or by one that failed, and is not confirmed yet.
-        // Only that same snapshot: one this apply took again is not confirmed by it.
-        for (const row of adoptedBefore ?? []) {
-            if (previous?.lastApplied && row.takenAt <= previous.lastApplied.at) {
-                const now = await this.adoptionStore?.get(orgId, row.resourceKey);
-                if (now?.state === 'adopted' &&
-                    now.takenAt === row.takenAt &&
-                    now.settings.uuid === row.settings.uuid) {
-                    await this.adoptionStore?.setState(orgId, row.resourceKey, 'confirmed');
-                }
-            }
-        }
         await this.audit.recordApply({
             actor: this.actor,
             orgId,
@@ -443,22 +362,13 @@ export class FoundryPlanApply {
         const org = await this.store.get(id);
         if (!org)
             throw new DeclaredOrgNotFoundError(id);
-        const [live, applied, platformReadiness, agoraHost, adopted] = await Promise.all([
+        const [live, applied, platformReadiness, agoraHost] = await Promise.all([
             readLiveResources(id, this.readers),
             this.store.getAppliedState(id),
             this.orgPlatformReadiness(),
             this.orgAgoraHost(id),
-            this.adoptionStore?.list(id) ?? [],
         ]);
-        const detail = computePlanDetail(org, live, applied?.serviceIds ?? {}, agoraHost, this.jobsScheduler, platformReadiness, {
-            loginHostBindings: this.loginHostBindings,
-            broker: this.broker,
-            adoption: {
-                wired: Boolean(this.adoptionVault && this.adoptionStore),
-                adopted,
-            },
-        });
-        await this.addAdoptionReport(org, detail, applied?.serviceIds ?? {});
+        const detail = computePlanDetail(org, live, applied?.serviceIds ?? {}, agoraHost, this.jobsScheduler, platformReadiness, { loginHostBindings: this.loginHostBindings, broker: this.broker });
         const invalid = await this.invalidHosting(org);
         if (invalid) {
             // Rule 2: reported in `unmanaged`, not thrown. Steps that read the
@@ -471,31 +381,6 @@ export class FoundryPlanApply {
         }
         return { org, plan: toPlan(detail), detail };
     }
-    /** #311: the `details` of each `coolify:adopt` step and the adoption items that are blocked. */
-    async addAdoptionReport(org, detail, recordedIds) {
-        if (!this.adoptionVault || !this.adoptionStore || !this.executor.adoptionReport)
-            return;
-        const report = await this.executor.adoptionReport(org, recordedIds);
-        // A resource that cannot be read gets neither its adopt step nor its own (rule 2).
-        const withheld = new Set(report.withheld);
-        // The tunnel step waits for the adoption of the tunnel and of its connector (#312).
-        const tunnelHeld = withheld.has(adoptedTunnelKey(org)) || withheld.has(adoptedConnectorKey(org));
-        detail.plannedSteps = detail.plannedSteps.filter(({ action }) => !(action.system === 'coolify' && action.kind === 'adopt' && withheld.has(action.key)) &&
-            !(action.system === 'coolify' &&
-                (action.kind === 'app' || action.kind === 'database') &&
-                withheld.has(`coolify:${action.kind}:${action.key}`)) &&
-            !(action.system === 'cloudflare' && action.kind === 'tunnel' && tunnelHeld));
-        for (const { action, step } of detail.plannedSteps) {
-            const key = action.system === 'coolify' && action.kind === 'adopt'
-                ? action.key
-                : action.system === 'cloudflare' && action.kind === 'tunnel'
-                    ? adoptedTunnelKey(org)
-                    : undefined;
-            if (key !== undefined && report.details[key])
-                step.details = report.details[key];
-        }
-        detail.unmanaged.push(...report.blocked);
-    }
     /**
      * An entry may not take a name foundry owns (`locked-hostnames.ts`). The
      * store checks the names it knows; this adds the platform's own hostnames,
@@ -703,7 +588,7 @@ const ZITADEL_ORG_SCOPE_KEY = 'zitadel_org';
  * belongs to is already left in place -- deleting only the rule and not the
  * zone is a decision left for whoever wires teardown in, not made here.
  */
-function destroyTargets(serviceIds, adoptedKeys, adoptedUuids) {
+function destroyTargets(serviceIds) {
     // Reverse-teardown order: everything under one of these prefixes is
     // collected in this order, then every ZITADEL app (there can be several,
     // #71), then the two scope ids last.
@@ -720,9 +605,6 @@ function destroyTargets(serviceIds, adoptedKeys, adoptedUuids) {
         for (const [resourceKey, id] of Object.entries(serviceIds)) {
             if (!resourceKey.startsWith(prefix))
                 continue;
-            // Never delete what was adopted: a row in any state, or a declared uuid (#311).
-            if (adoptedKeys.has(resourceKey) || adoptedUuids.has(id))
-                continue;
             const [system, kind] = prefix.split(':');
             targets.push({ system, kind, key: resourceKey.slice(prefix.length), id });
         }
@@ -867,9 +749,11 @@ function canonical(plan) {
 }
 /**
  * A structural version of the declared org, recorded on {@link AppliedState}
- * so a later reader can tell whether it changed since this apply —
- * `DeclaredOrg` (org.ts) carries no version field of its own.
+ * so a later reader can tell whether its content changed since this apply.
+ * The store's write counter `version` (#351) is left out, so the hash reads
+ * the same before and after that column existed.
  */
 function hashOrg(org) {
-    return createHash('sha256').update(JSON.stringify(org)).digest('hex');
+    const { version: _version, ...content } = org;
+    return createHash('sha256').update(JSON.stringify(content)).digest('hex');
 }

package/dist/plan/platform-diff.d.ts

@@ -357,12 +357,6 @@ export declare function appSettingsOf(entry: HostingEntry): AppSettings;
 /** What an app that predates the marker has: Coolify's own defaults, so it plans no change. */
 export declare const DEFAULT_APP_SETTINGS: AppSettings;
 export declare function appSettingsAppliedScopeKey(entryKey: string): string;
-/**
- * Set before an adopted app's settings are patched, cleared once its deploy
- * succeeded (an empty value is not pending): a failed deploy replans whatever
- * the markers say (#311).
- */
-export declare function appDeployPendingScopeKey(entryKey: string): string;
 /** The settings the app has: the marker, or the defaults when there is none. */
 export declare function appliedAppSettings(recorded: Readonly<Record<string, string>>, entryKey: string): AppSettings;
 /**

package/dist/plan/platform-diff.js

@@ -391,14 +391,6 @@ export const DEFAULT_APP_SETTINGS = { folder: null, port: null, autoDeploy: true
 export function appSettingsAppliedScopeKey(entryKey) {
     return `app_settings_applied.${entryKey}`;
 }
-/**
- * Set before an adopted app's settings are patched, cleared once its deploy
- * succeeded (an empty value is not pending): a failed deploy replans whatever
- * the markers say (#311).
- */
-export function appDeployPendingScopeKey(entryKey) {
-    return `app_deploy_pending.${entryKey}`;
-}
 /** The settings the app has: the marker, or the defaults when there is none. */
 export function appliedAppSettings(recorded, entryKey) {
     const marker = recorded[appSettingsAppliedScopeKey(entryKey)];

package/dist/plan/providers-readers.d.ts

@@ -3,7 +3,6 @@ import type { CoolifyClient } from '@wtfalch/providers/coolify';
 import type { ZitadelClient } from '@wtfalch/providers/zitadel';
 import type { OrgId } from '../org.js';
 import type { DeclaredOrgStore } from '../store.js';
-import type { AdoptedResource } from './adopt.js';
 import type { CloudflareReader, CmsReader, CoolifyReader, LiveResource, ZitadelReader } from './live.js';
 /**
  * Real `CoolifyReader`, `CloudflareReader` and `ZitadelReader` implementations
@@ -93,13 +92,7 @@ export declare class ProvidersCoolifyReader implements CoolifyReader {
     private readonly client;
     private readonly resolveScope;
     private readonly resolveRecordedIds;
-    private readonly options;
-    constructor(client: CoolifyClient, resolveScope: ScopeResolver, resolveRecordedIds: RecordedIds, options?: {
-        /** #311: what the org adopts by uuid; each is read directly, not found by project. */
-        adopted?: (orgId: OrgId) => Promise<AdoptedResource[]>;
-    });
-    /** #311: each adopted uuid, read by uuid, under the key the planner matches. An unreadable one is absent. */
-    private readAdopted;
+    constructor(client: CoolifyClient, resolveScope: ScopeResolver, resolveRecordedIds: RecordedIds);
     listResources(orgId: OrgId): Promise<LiveResource[]>;
 }
 /**

package/dist/plan/providers-readers.js

@@ -204,73 +204,19 @@ export class ProvidersCoolifyReader {
     client;
     resolveScope;
     resolveRecordedIds;
-    options;
-    constructor(client, resolveScope, resolveRecordedIds, options = {}) {
+    constructor(client, resolveScope, resolveRecordedIds) {
         this.client = client;
         this.resolveScope = resolveScope;
         this.resolveRecordedIds = resolveRecordedIds;
-        this.options = options;
-    }
-    /** #311: each adopted uuid, read by uuid, under the key the planner matches. An unreadable one is absent. */
-    async readAdopted(adopted) {
-        const read = await Promise.all(adopted.map(async (a) => {
-            try {
-                if (a.kind === 'database') {
-                    const { name, status } = await this.client.getDatabase(a.uuid);
-                    return {
-                        resource: {
-                            kind: 'database',
-                            key: a.uuid,
-                            config: { name, status },
-                        },
-                        recorded: `database:${a.resourceKey.slice('coolify:database:'.length)}`,
-                    };
-                }
-                const app = await this.client.getApplication(a.uuid);
-                return {
-                    resource: {
-                        kind: 'application',
-                        key: a.uuid,
-                        config: {
-                            name: app.name,
-                            fqdn: app.fqdn,
-                            status: app.status,
-                            git_repository: app.git_repository,
-                            git_branch: app.git_branch,
-                            is_auto_deploy_enabled: app.is_auto_deploy_enabled,
-                            environment_id: app.environment_id,
-                        },
-                    },
-                    recorded: `app:${a.resourceKey.slice('coolify:app:'.length)}`,
-                };
-            }
-            catch {
-                return null;
-            }
-        }));
-        return read.filter((r) => r !== null);
     }
     async listResources(orgId) {
         const projectUuid = await this.resolveScope(orgId);
-        // The tunnel and its connector are read by `ProvidersCloudflareReader` and the executor (#312).
-        const adopted = ((await this.options.adopted?.(orgId)) ?? []).filter((a) => a.kind === 'app' || a.kind === 'database');
-        if (!projectUuid && adopted.length === 0)
+        if (!projectUuid)
             return [];
-        const [listed, recordedById, adoptedLive] = await Promise.all([
-            projectUuid ? this.client.listResources(projectUuid) : [],
+        const [resources, recorded] = await Promise.all([
+            this.client.listResources(projectUuid),
             this.resolveRecordedIds(orgId),
-            this.readAdopted(adopted),
         ]);
-        // The declared uuid wins over a recorded id and over the project listing.
-        const uuids = new Set(adoptedLive.map((a) => a.resource.key));
-        const resources = [
-            ...listed.filter((r) => !uuids.has(r.key)),
-            ...adoptedLive.map((a) => a.resource),
-        ];
-        const recorded = {
-            ...recordedById,
-            ...Object.fromEntries(adoptedLive.map((a) => [a.resource.key, a.recorded])),
-        };
         const withLogConfig = await Promise.all(toFoundryResources('coolify', resources).map((r) => withLogVolumeConfig(this.client, r, recorded)));
         const withEnvNames = await Promise.all(withLogConfig.map((r) => withEnvNamesConfig(this.client, r, recorded)));
         const withDbUrl = await Promise.all(withEnvNames.map((r) => withDatabaseUrlConfig(this.client, r, recorded)));

package/dist/plan.d.ts

@@ -9,12 +9,6 @@ import type { OrgId } from './org.js';
  */
 export interface PlanStep {
     description: string;
-    /**
-     * Lines that say what the step will change, shown beside the description.
-     * `coolify:adopt` (#311) gives one per setting, old value beside new, and
-     * env vars by name only. Never a secret.
-     */
-    details?: string[];
     /**
      * True when this step deletes or replaces data the org cannot get back
      * without foundry's own backup: a chat re-key, an issuer move, a mail

package/dist/store/postgres.d.ts

@@ -1,5 +1,5 @@
 import type { PgDatabase, PgQueryResultHKT } from 'drizzle-orm/pg-core';
-import type { AdoptionStore, DeclaredOrgStore, PlatformStore, RequestedChangeStore } from '../store.js';
+import type { DeclaredOrgStore, PlatformStore, RequestedChangeStore } from '../store.js';
 /**
  * The host's own drizzle handle or a transaction open on it, same shape
  * `@wtfalch/keys`'s `HeldKeysDb` uses: postgres-js in a real host, PGlite in
@@ -90,8 +90,3 @@ export declare function createPostgresPlatformStore(db: FoundryStoreDb): Platfor
  * argument makes -- and stores the result as the request's initial `state`.
  */
 export declare function createPostgresRequestedChangeStore(db: FoundryStoreDb): RequestedChangeStore;
-/**
- * `AdoptionStore` (`../store.ts`) on Postgres, for #311: the snapshot row of
- * each live resource foundry takes over, beside the stores above.
- */
-export declare function createPostgresAdoptionStore(db: FoundryStoreDb): AdoptionStore;

package/dist/store/postgres.js

@@ -4,7 +4,7 @@ import { lockedHostnames } from '../plan/locked-hostnames.js';
 import { validatePlatform } from '../platform.js';
 import { RequestedChangeError, classifyChange } from '../requested-changes.js';
 import { validateSlug } from '../slug.js';
-import { declaredOrgs, foundryAdoptions, foundryAppliedState, foundryDeclaredPlatform, foundryRequestedChanges, } from './schema.js';
+import { declaredOrgs, foundryAppliedState, foundryDeclaredPlatform, foundryRequestedChanges, } from './schema.js';
 const UNIQUE_VIOLATION = '23505';
 /** `migrations/0004_slug_unique.sql` / `migrations/0015_domain_unique.sql`'s index names, read back off a caught unique-violation to tell which one fired. */
 const SLUG_UNIQUE_INDEX = 'foundry_declared_orgs_slug_idx';
@@ -62,6 +62,7 @@ export class DeclaredOrgError extends Error {
 function rowToOrg(row) {
     return {
         id: row.id,
+        version: row.version,
         slug: row.slug,
         displayName: row.displayName,
         domain: row.domain,
@@ -82,7 +83,6 @@ function rowToOrg(row) {
             usesDomain: row.hostingUsesDomain,
             tunnel: row.hostingTunnel,
             issuerApps: row.hostingIssuerApps,
-            ...(row.hostingAdopt ? { adopt: row.hostingAdopt } : {}),
             // Migration 0030's default for an entry stored before `hostnames`.
             entries: row.hostingEntries.map((entry) => ({
                 ...entry,
@@ -127,7 +127,6 @@ function orgToRow(org) {
         hostingTunnel: org.hosting.tunnel,
         hostingIssuerApps: org.hosting.issuerApps,
         hostingEntries: org.hosting.entries,
-        hostingAdopt: org.hosting.adopt ?? null,
         ssoEnabled: org.sso.enabled,
         guestsEnabled: org.guests.enabled,
         soloEnabled: org.solo.enabled,
@@ -287,6 +286,7 @@ export function createPostgresDeclaredOrgStore(db) {
         if (reason)
             throw new DeclaredOrgError(`mail invalid: ${reason} (#162)`);
     }
+    // `as`: `update` is overloaded in the interface (#351), which one object-literal method cannot express.
     return {
         async create(org) {
             requireValidSlug(org.slug);
@@ -352,8 +352,11 @@ export function createPostgresDeclaredOrgStore(db) {
             }
             return null;
         },
-        async update(id, patch) {
+        async update(id, patch, opts) {
             const current = rowToOrg(await requireRow(id));
+            // #351: already behind, so refuse without validating a write that will not happen.
+            if (opts && current.version !== opts.expectedVersion)
+                return { stale: true, current };
             // The slug freeze (#7 corrections 3): once mail exists, the mail
             // subdomain already reads the slug, so the slug this update would
             // leave in place — not the one it started from — is what decides.
@@ -369,7 +372,7 @@ export function createPostgresDeclaredOrgStore(db) {
             // just be re-litigating a write this update isn't making.
             if (patch.slug !== undefined && patch.slug !== current.slug)
                 requireValidSlug(patch.slug);
-            const next = { ...current, ...patch, id: current.id };
+            const next = { ...current, ...patch, id: current.id, version: current.version };
             requireValidDomain(next.domain);
             requireValidLimits(next);
             requireValidBuyer(next);
@@ -378,10 +381,24 @@ export function createPostgresDeclaredOrgStore(db) {
             requireValidOwner(next);
             requireValidMail(next);
             try {
-                await db
+                // #351: with `expectedVersion` the version check is part of this one
+                // statement, so an edit that lands after the read above makes it match
+                // no row instead of being overwritten.
+                const written = await db
                     .update(declaredOrgs)
-                    .set({ ...orgToRow(next), updatedAt: sql `now()` })
-                    .where(eq(declaredOrgs.id, id));
+                    .set({
+                    ...orgToRow(next),
+                    version: sql `${declaredOrgs.version} + 1`,
+                    updatedAt: sql `now()`,
+                })
+                    .where(opts
+                    ? and(eq(declaredOrgs.id, id), eq(declaredOrgs.version, opts.expectedVersion))
+                    : eq(declaredOrgs.id, id))
+                    .returning({ version: declaredOrgs.version });
+                if (opts && written.length === 0) {
+                    return { stale: true, current: rowToOrg(await requireRow(id)) };
+                }
+                return { ...next, version: written[0]?.version ?? (current.version ?? 1) + 1 };
             }
             catch (error) {
                 // Same race as `create`: another org's concurrent write took this
@@ -396,7 +413,6 @@ export function createPostgresDeclaredOrgStore(db) {
                 }
                 throw error;
             }
-            return next;
         },
         async getAppliedState(id) {
             const [row] = await db
@@ -614,68 +630,3 @@ export function createPostgresRequestedChangeStore(db) {
         },
     };
 }
-function rowToAdoption(row) {
-    return {
-        orgId: row.orgId,
-        resourceKey: row.resourceKey,
-        kind: row.kind,
-        takenAt: row.takenAt.toISOString(),
-        settings: row.settings,
-        vaultRef: row.vaultRef,
-        state: row.state,
-    };
-}
-/**
- * `AdoptionStore` (`../store.ts`) on Postgres, for #311: the snapshot row of
- * each live resource foundry takes over, beside the stores above.
- */
-export function createPostgresAdoptionStore(db) {
-    return {
-        async put(adoption) {
-            const values = {
-                orgId: adoption.orgId,
-                resourceKey: adoption.resourceKey,
-                kind: adoption.kind,
-                takenAt: new Date(adoption.takenAt),
-                settings: adoption.settings,
-                vaultRef: adoption.vaultRef,
-                state: 'adopted',
-            };
-            await db
-                .insert(foundryAdoptions)
-                .values(values)
-                .onConflictDoUpdate({
-                target: [foundryAdoptions.orgId, foundryAdoptions.resourceKey],
-                set: values,
-            });
-        },
-        async get(orgId, resourceKey) {
-            const [row] = await db
-                .select()
-                .from(foundryAdoptions)
-                .where(and(eq(foundryAdoptions.orgId, orgId), eq(foundryAdoptions.resourceKey, resourceKey)))
-                .limit(1);
-            return row ? rowToAdoption(row) : null;
-        },
-        async list(orgId) {
-            const rows = await db
-                .select()
-                .from(foundryAdoptions)
-                .where(eq(foundryAdoptions.orgId, orgId))
-                .orderBy(asc(foundryAdoptions.resourceKey));
-            return rows.map(rowToAdoption);
-        },
-        async setState(orgId, resourceKey, state) {
-            await db
-                .update(foundryAdoptions)
-                .set({ state })
-                .where(and(eq(foundryAdoptions.orgId, orgId), eq(foundryAdoptions.resourceKey, resourceKey)));
-        },
-        async setSettings(orgId, resourceKey, settings) {
-            await db
-                .update(foundryAdoptions)
-                .set({ settings })
-                .where(and(eq(foundryAdoptions.orgId, orgId), eq(foundryAdoptions.resourceKey, resourceKey)));
-        },
-    };
-}