@wtfalch/foundry 0.16.15 → 0.17.0

package/dist/plan/providers-readers.d.ts

@@ -94,6 +94,8 @@ export declare class ProvidersCoolifyReader implements CoolifyReader {
     private readonly resolveRecordedIds;
     constructor(client: CoolifyClient, resolveScope: ScopeResolver, resolveRecordedIds: RecordedIds);
     listResources(orgId: OrgId): Promise<LiveResource[]>;
+    /** The project's resources as Coolify reports them, unmapped: what adopt checks against a declaration. */
+    listProject(projectUuid: string): Promise<LiveResource[]>;
 }
 /**
  * Backed by `@wtfalch/providers/cloudflare`'s `CloudflareClient.listResources`:

package/dist/plan/providers-readers.js

@@ -243,6 +243,10 @@ export class ProvidersCoolifyReader {
         const withBouleConfig = await Promise.all(withAgoraConfig.map((r) => withBouleEnvConfig(this.client, r, recorded)));
         return applyRecordedIds(withBouleConfig, recorded);
     }
+    /** The project's resources as Coolify reports them, unmapped: what adopt checks against a declaration. */
+    async listProject(projectUuid) {
+        return toFoundryResources('coolify', await this.client.listResources(projectUuid));
+    }
 }
 /**
  * Backed by `@wtfalch/providers/cloudflare`'s `CloudflareClient.listResources`:

package/dist/plan/rollout.d.ts

@@ -0,0 +1,52 @@
+import type { OrgId } from '../org.js';
+/**
+ * #259: ordered, stop-on-failure rollout across several orgs' own applies.
+ *
+ * Where the order itself comes from is still open (#259 "Decide": the
+ * platform declaration, one place, vs. spread across each org) -- this
+ * takes the order as a plain, caller-supplied list, so it works unchanged
+ * whichever way that is answered. `apply` is the caller's own one-org apply
+ * (typically `plan` then `PlanApply.apply`, confirmation and all) -- this
+ * file knows nothing about that shape, only whether it threw.
+ *
+ * "Stop at the first failed health check" (the issue's own words) is, today,
+ * "stop at the first `apply` that throws" -- the shared health helper
+ * (`deploy-health.ts`'s `waitForNewDeployment`) is not yet wired into the
+ * org-level calls stack deploy (`executor.ts`'s `coolifyCalls`/
+ * `coolifyCallsService` only ever fire-and-forget deploy, and never patch a
+ * running app's image tag at all -- see `org.ts`'s `CallsConfig.versionPin`
+ * doc comment). Once that step itself throws on a failed health check, a
+ * caller's `apply` naturally does too, and this orchestration needs no
+ * change.
+ */
+/** One org's outcome from {@link applyOrgsInOrder}. */
+export interface RolloutOrgResult {
+    readonly orgId: OrgId;
+    readonly outcome: 'applied' | 'skipped' | 'failed';
+    /** Set only for `'failed'` -- the thrown error's own message. */
+    readonly error?: string;
+    /**
+     * Set only for `'applied'`, when `soakMs` names one for this org: the ISO
+     * time the caller should wait until before applying the next org. Never
+     * slept here (CLAUDE.md "Platform steps" rule 5, and the issue's own "Make
+     * the soak a declared value the caller supplies, not a sleep inside
+     * foundry") -- a caller that wants to honour it re-invokes later, from
+     * `orgIds` sliced after this result's own org.
+     */
+    readonly soakUntil?: string;
+}
+export interface RolloutOptions {
+    /** This org's soak window in milliseconds, or `undefined`/`0` for none (a stateless service). */
+    soakMs?: (orgId: OrgId) => number | undefined;
+    /** Overridable for tests; defaults to `Date.now`. */
+    now?: () => number;
+}
+/**
+ * Applies every org in `orgIds`, in order, stopping at the first `apply`
+ * that throws: every org after it is reported `'skipped'` without `apply`
+ * ever being called for it, so it is left exactly as it was. An org whose
+ * own `apply` throws is reported `'failed'` with that error's message --
+ * `apply`'s own implementation decides what, if anything, it recorded
+ * before throwing (this function never inspects or rolls back that state).
+ */
+export declare function applyOrgsInOrder(orgIds: readonly OrgId[], apply: (orgId: OrgId) => Promise<unknown>, options?: RolloutOptions): Promise<RolloutOrgResult[]>;

package/dist/plan/rollout.js

@@ -0,0 +1,37 @@
+/**
+ * Applies every org in `orgIds`, in order, stopping at the first `apply`
+ * that throws: every org after it is reported `'skipped'` without `apply`
+ * ever being called for it, so it is left exactly as it was. An org whose
+ * own `apply` throws is reported `'failed'` with that error's message --
+ * `apply`'s own implementation decides what, if anything, it recorded
+ * before throwing (this function never inspects or rolls back that state).
+ */
+export async function applyOrgsInOrder(orgIds, apply, options = {}) {
+    const now = options.now ?? Date.now;
+    const results = [];
+    let stopped = false;
+    for (const orgId of orgIds) {
+        if (stopped) {
+            results.push({ orgId, outcome: 'skipped' });
+            continue;
+        }
+        try {
+            await apply(orgId);
+            const soak = options.soakMs?.(orgId);
+            results.push({
+                orgId,
+                outcome: 'applied',
+                ...(soak ? { soakUntil: new Date(now() + soak).toISOString() } : {}),
+            });
+        }
+        catch (error) {
+            results.push({
+                orgId,
+                outcome: 'failed',
+                error: error instanceof Error ? error.message : String(error),
+            });
+            stopped = true;
+        }
+    }
+    return results;
+}

package/dist/plan/step-system.d.ts

@@ -0,0 +1,22 @@
+import type { PlanStep } from '../plan.js';
+import type { StepAction } from './diff.js';
+import type { LiveResource } from './live.js';
+/**
+ * The system a plan step or progress event touches, for Archon to draw as a
+ * tag. A superset of {@link LiveResource}'s `system` (where a resource
+ * lives): a step that deploys Stalwart, Synapse or a Postgres database
+ * through Coolify names that system, not the deployer.
+ *
+ * `foundry` is for a progress event that covers more than one system, or
+ * none (a round of mixed steps, the closing event). No plan step carries it.
+ */
+export type StepSystem = LiveResource['system'] | 'stalwart' | 'matrix' | 'postgres' | 'foundry';
+/** The system `action` touches. The one place that decides it, so no planner sets it by hand. */
+export declare function stepSystemOf(action: StepAction): StepSystem;
+/** The step with its `system` set from `action`. */
+export declare function withStepSystem<T extends {
+    step: Omit<PlanStep, 'system'>;
+    action: StepAction;
+}>(planned: T): T & {
+    step: PlanStep;
+};

package/dist/plan/step-system.js

@@ -0,0 +1,37 @@
+/** Which system a platform `app` step (keyed `platform:<service>`) runs. */
+const PLATFORM_APP_SYSTEMS = {
+    'platform:auth': 'zitadel',
+    'platform:mail': 'stalwart',
+    'platform:files': 'files',
+    'platform:ai': 'ai',
+};
+/** The system `action` touches. The one place that decides it, so no planner sets it by hand. */
+export function stepSystemOf(action) {
+    switch (action.kind) {
+        case 'mail':
+        case 'mail-copy':
+            return 'stalwart';
+        case 'chat':
+        case 'calls':
+        case 'calls-service':
+            return 'matrix';
+        case 'database':
+        case 'adopt-database':
+        case 'backup':
+            return 'postgres';
+        // Re-registers the R2 bucket's credentials with Coolify: the bucket is what it writes to.
+        case 'backup-storage':
+            return 'cloudflare';
+        // The platform's jobs scheduler app, like the org's own `jobs` registration.
+        case 'jobs':
+            return 'jobs';
+        case 'app':
+            return PLATFORM_APP_SYSTEMS[action.key] ?? action.system;
+        default:
+            return action.system;
+    }
+}
+/** The step with its `system` set from `action`. */
+export function withStepSystem(planned) {
+    return { ...planned, step: { ...planned.step, system: stepSystemOf(planned.action) } };
+}

package/dist/plan.d.ts

@@ -1,4 +1,5 @@
 import type { OrgId } from './org.js';
+import type { StepSystem } from './plan/step-system.js';
 /**
  * One step of a {@link Plan}.
  *
@@ -9,6 +10,8 @@ import type { OrgId } from './org.js';
  */
 export interface PlanStep {
     description: string;
+    /** The system this step touches, for Archon to tag it with. Set from the step's action, never by hand (`plan/step-system.ts`). */
+    system: StepSystem;
     /**
      * True when this step deletes or replaces data the org cannot get back
      * without foundry's own backup: a chat re-key, an issuer move, a mail

package/dist/state.d.ts

@@ -12,6 +12,17 @@ export interface Checkpoint {
     step: string;
     completedAt: string;
 }
+/** One step of a destroy: `finished`, `failed` (with `error`), `started` (in flight; a crash leaves it so), or `planned` (not reached yet). */
+export interface DestroyStepRecord {
+    step: string;
+    status: 'planned' | 'started' | 'finished' | 'failed';
+    completedAt?: string;
+    error?: string;
+}
+/** Foundry's record of the current or most recent destroy of an org, in step order. */
+export interface DestroyRecord {
+    steps: DestroyStepRecord[];
+}
 /**
  * When an apply last completed, and against which declared org version.
  *
@@ -81,4 +92,6 @@ export interface AppliedState {
     failedFields: string[];
     /** `null` before this org has ever had a completed apply. */
     lastApplied: LastApplied | null;
+    /** The destroy that started for this org, if any. Absent until one has. */
+    destroy?: DestroyRecord | null;
 }

package/dist/store/audit.js

@@ -14,10 +14,11 @@ const FOUNDRY_LEDGER_VOCABULARY = ledgerVocabulary({
         'plan.computed': { tenantVisible: false },
         'apply.recorded': { tenantVisible: false },
         'destroy.recorded': { tenantVisible: false },
+        'adoption.recorded': { tenantVisible: false },
     },
     actorClasses: ['operator'],
     contexts: ['operator'],
-    outcomes: ['recorded', 'applied', 'destroyed', 'refused', 'failed'],
+    outcomes: ['recorded', 'applied', 'destroyed', 'refused', 'failed', 'adopted', 'released'],
 });
 /**
  * The ledger table's CHECKs (migration 0024): reason <= 512 chars, `after`
@@ -110,6 +111,19 @@ export function createPostgresAuditLog(db, options = {}) {
                 occurredAt: at,
             });
         },
+        async recordAdoption({ actor, orgId, action, entryKey, outcome, reason, at }) {
+            await ledger.sign(db, {
+                action: 'adoption.recorded',
+                tenantId: null,
+                actor: { class: 'operator', id: actor.id, display: boundDisplay(actor) },
+                context: 'operator',
+                target: targetFor(orgId),
+                outcome,
+                reason: boundReason(reason),
+                after: { action, entryKey },
+                occurredAt: at,
+            });
+        },
         async recordDestroy({ actor, orgId, outcome, reason, at }) {
             await ledger.sign(db, {
                 action: 'destroy.recorded',

package/dist/store/postgres.d.ts

@@ -1,5 +1,5 @@
 import type { PgDatabase, PgQueryResultHKT } from 'drizzle-orm/pg-core';
-import type { AppliedVersionsStore, DeclaredOrgStore, PlatformStore, RequestedChangeStore } from '../store.js';
+import { type AppliedVersionsStore, type DeclaredOrgStore, type PlatformStore, type RequestedChangeStore } from '../store.js';
 /**
  * The host's own drizzle handle or a transaction open on it, same shape
  * `@wtfalch/keys`'s `HeldKeysDb` uses: postgres-js in a real host, PGlite in

package/dist/store/postgres.js

@@ -1,11 +1,31 @@
 import { and, asc, desc, eq, sql } from 'drizzle-orm';
-import { APP_ENTRY_KEY, DEFAULT_MAIL_APPS, DEFAULT_NO_REPLY_LOCAL_PART, validateBuyerIdentity, validateDomain, validateHosting, validateMail, validateOwners, validateSite, } from '../org.js';
+import { APP_ENTRY_KEY, DEFAULT_MAIL_APPS, DEFAULT_NO_REPLY_LOCAL_PART, validateBuyerIdentity, validateCalls, validateDomain, validateHosting, validateMail, validateOwners, validateSite, } from '../org.js';
 import { lockedHostnames } from '../plan/locked-hostnames.js';
 import { validatePlatform } from '../platform.js';
 import { RequestedChangeError, classifyChange } from '../requested-changes.js';
 import { validateSlug } from '../slug.js';
-import { declaredOrgs, foundryAppliedState, foundryAppliedVersions, foundryDeclaredPlatform, foundryRequestedChanges, } from './schema.js';
+import { StaleLeaseError, } from '../store.js';
+import { declaredOrgs, foundryAppliedState, foundryAppliedVersions, foundryDeclaredPlatform, foundryMutationLeases, foundryRequestedChanges, } from './schema.js';
 const UNIQUE_VIOLATION = '23505';
+/**
+ * #441: runs `write`, and with a `fence` only if its token is still the
+ * scope's current one. The lease row is locked for the write, so a takeover
+ * cannot slip between the check and the write.
+ */
+async function writeFenced(db, fence, write) {
+    if (!fence)
+        return write(db);
+    await db.transaction(async (tx) => {
+        const [row] = await tx
+            .select({ token: foundryMutationLeases.token })
+            .from(foundryMutationLeases)
+            .where(eq(foundryMutationLeases.scope, fence.scope))
+            .for('update');
+        if (!row || row.token !== fence.token)
+            throw new StaleLeaseError(fence.scope);
+        await write(tx);
+    });
+}
 /** `migrations/0004_slug_unique.sql` / `migrations/0015_domain_unique.sql`'s index names, read back off a caught unique-violation to tell which one fired. */
 const SLUG_UNIQUE_INDEX = 'foundry_declared_orgs_slug_idx';
 const DOMAIN_UNIQUE_INDEX = 'foundry_declared_orgs_domain_idx';
@@ -75,7 +95,21 @@ function rowToOrg(row) {
             roleMailboxes: row.roleMailboxes,
         },
         chat: { enabled: row.chatEnabled, usesDomain: row.chatUsesDomain },
-        calls: { enabled: row.callsEnabled, usesDomain: row.callsUsesDomain },
+        calls: {
+            enabled: row.callsEnabled,
+            usesDomain: row.callsUsesDomain,
+            // Omitted, not `null`, while neither column is set: every existing
+            // row (and every test fixture that builds a `CallsConfig` literal
+            // before this field existed) round-trips unchanged.
+            ...(row.callsVersionPinSynapse || row.callsVersionPinMas
+                ? {
+                    versionPin: {
+                        ...(row.callsVersionPinSynapse ? { synapse: row.callsVersionPinSynapse } : {}),
+                        ...(row.callsVersionPinMas ? { mas: row.callsVersionPinMas } : {}),
+                    },
+                }
+                : {}),
+        },
         issuer: { usesDomain: row.issuerUsesDomain },
         site: { enabled: row.siteEnabled, usesDomain: row.siteUsesDomain },
         hosting: {
@@ -119,6 +153,8 @@ function orgToRow(org) {
         chatUsesDomain: org.chat.usesDomain,
         callsEnabled: org.calls.enabled,
         callsUsesDomain: org.calls.usesDomain,
+        callsVersionPinSynapse: org.calls.versionPin?.synapse ?? null,
+        callsVersionPinMas: org.calls.versionPin?.mas ?? null,
         issuerUsesDomain: org.issuer.usesDomain,
         siteEnabled: org.site.enabled,
         siteUsesDomain: org.site.usesDomain,
@@ -268,11 +304,25 @@ export function createPostgresDeclaredOrgStore(db) {
     // `mail.ownerMailboxAddress` just because mail is on -- `validateMail`'s
     // own doc comment says why. Also covers #34's `mailApps` check, folded
     // into the same `validateMail`.
-    function requireValidMail(org) {
-        const reason = validateMail(org);
+    //
+    // #422: `allowExistingTier2` grandfathers an org already stored as a
+    // domain plus `mail.mode: 'received'` -- `update` passes it true only
+    // when that exact combination was already the row's state before this
+    // patch, so an unrelated edit to an already-tier-2 org still goes
+    // through. `create` never passes it: a brand new org cannot already be
+    // grandfathered.
+    function requireValidMail(org, opts) {
+        const reason = validateMail(org, opts);
         if (reason)
             throw new DeclaredOrgError(`mail invalid: ${reason} (#162)`);
     }
+    // #259: same place `requireValidMail` checks mail, on both `create` and
+    // the merged result of `update`.
+    function requireValidCalls(org) {
+        const reason = validateCalls(org);
+        if (reason)
+            throw new DeclaredOrgError(`calls invalid: ${reason} (#259)`);
+    }
     // `as`: `update` is overloaded in the interface (#351), which one object-literal method cannot express.
     return {
         async create(org) {
@@ -284,6 +334,7 @@ export function createPostgresDeclaredOrgStore(db) {
             requireValidSite(org);
             requireValidOwner(org);
             requireValidMail(org);
+            requireValidCalls(org);
             try {
                 await db.insert(declaredOrgs).values(orgToRow(org));
             }
@@ -339,6 +390,23 @@ export function createPostgresDeclaredOrgStore(db) {
             }
             return null;
         },
+        async findOtherOrgRecordingCoolifyId(id, exceptOrgId) {
+            const rows = await db
+                .select({ orgId: foundryAppliedState.orgId, serviceIds: foundryAppliedState.serviceIds })
+                .from(foundryAppliedState);
+            for (const row of rows) {
+                if (row.orgId === exceptOrgId)
+                    continue;
+                for (const [key, value] of Object.entries(row.serviceIds)) {
+                    const coolify = key === 'coolify_project' ||
+                        key.startsWith('coolify:app:') ||
+                        key.startsWith('coolify:database:');
+                    if (coolify && value === id)
+                        return row.orgId;
+                }
+            }
+            return null;
+        },
         async update(id, patch, opts) {
             const current = rowToOrg(await requireRow(id));
             // #351: already behind, so refuse without validating a write that will not happen.
@@ -366,7 +434,11 @@ export function createPostgresDeclaredOrgStore(db) {
             requireValidHosting(next);
             requireValidSite(next);
             requireValidOwner(next);
-            requireValidMail(next);
+            // #422: grandfather an org already stored as domain + `received` --
+            // refuse only when this patch is what newly puts it in that state.
+            const wasTier2 = current.domain !== null && current.mail.mode === 'received';
+            requireValidMail(next, { allowExistingTier2: wasTier2 });
+            requireValidCalls(next);
             try {
                 // #351: with `expectedVersion` the version check is part of this one
                 // statement, so an edit that lands after the read above makes it match
@@ -420,10 +492,44 @@ export function createPostgresDeclaredOrgStore(db) {
                         declaredOrgVersion: row.lastAppliedDeclaredOrgVersion,
                     }
                     : null,
+                ...(row.destroy ? { destroy: row.destroy } : {}),
             };
             return state;
         },
-        async putAppliedState(state) {
+        async acquireMutationLease(scope, holder, ttlMs) {
+            const expiresAt = sql `now() + ${ttlMs} * interval '1 millisecond'`;
+            const [row] = await db
+                .insert(foundryMutationLeases)
+                .values({ scope, token: 1, holder, expiresAt })
+                .onConflictDoUpdate({
+                target: foundryMutationLeases.scope,
+                set: { token: sql `${foundryMutationLeases.token} + 1`, holder, expiresAt },
+                setWhere: sql `${foundryMutationLeases.expiresAt} <= now()`,
+            })
+                .returning({ token: foundryMutationLeases.token });
+            if (row)
+                return { scope, token: row.token };
+            const [held] = await db
+                .select({ expiresAt: foundryMutationLeases.expiresAt })
+                .from(foundryMutationLeases)
+                .where(eq(foundryMutationLeases.scope, scope));
+            return { heldUntil: held?.expiresAt ?? new Date() };
+        },
+        async renewMutationLease(lease, ttlMs) {
+            const rows = await db
+                .update(foundryMutationLeases)
+                .set({ expiresAt: sql `now() + ${ttlMs} * interval '1 millisecond'` })
+                .where(and(eq(foundryMutationLeases.scope, lease.scope), eq(foundryMutationLeases.token, lease.token)))
+                .returning({ token: foundryMutationLeases.token });
+            return rows.length > 0;
+        },
+        async releaseMutationLease(lease) {
+            await db
+                .update(foundryMutationLeases)
+                .set({ expiresAt: sql `now()` })
+                .where(and(eq(foundryMutationLeases.scope, lease.scope), eq(foundryMutationLeases.token, lease.token)));
+        },
+        async putAppliedState(state, fence) {
             const values = {
                 orgId: state.orgId,
                 serviceIds: state.serviceIds,
@@ -431,21 +537,25 @@ export function createPostgresDeclaredOrgStore(db) {
                 failedFields: state.failedFields,
                 lastAppliedAt: state.lastApplied ? new Date(state.lastApplied.at) : null,
                 lastAppliedDeclaredOrgVersion: state.lastApplied?.declaredOrgVersion ?? null,
+                destroy: state.destroy ?? null,
             };
-            await db
+            await writeFenced(db, fence, (tx) => tx
                 .insert(foundryAppliedState)
                 .values(values)
-                .onConflictDoUpdate({ target: foundryAppliedState.orgId, set: values });
+                .onConflictDoUpdate({ target: foundryAppliedState.orgId, set: values })
+                .then(() => undefined));
         },
-        async delete(id) {
+        async delete(id, fence) {
             // Applied state first: `0002_applied_state.sql`'s
             // `foundry_applied_state_org_fkey` references the declared org with no
             // cascade, so deleting the org first would fail while its applied
             // state row still points at it. Both deletes are no-ops (idempotent)
             // when the row is already gone, matching this method's own doc
             // comment on `../store.ts`.
-            await db.delete(foundryAppliedState).where(eq(foundryAppliedState.orgId, id));
-            await db.delete(declaredOrgs).where(eq(declaredOrgs.id, id));
+            await writeFenced(db, fence, async (tx) => {
+                await tx.delete(foundryAppliedState).where(eq(foundryAppliedState.orgId, id));
+                await tx.delete(declaredOrgs).where(eq(declaredOrgs.id, id));
+            });
         },
     };
 }
@@ -549,8 +659,11 @@ export function createPostgresPlatformStore(db) {
                 .limit(1);
             return row?.serviceIds ?? {};
         },
-        async putServiceIds(serviceIds) {
-            await db.update(foundryDeclaredPlatform).set({ serviceIds });
+        async putServiceIds(serviceIds, fence) {
+            await writeFenced(db, fence, (tx) => tx
+                .update(foundryDeclaredPlatform)
+                .set({ serviceIds })
+                .then(() => undefined));
         },
     };
 }

package/dist/store/schema.d.ts

@@ -1,6 +1,6 @@
 import type { AppEnvSource, HostingEntry, IssuerApp, OwnerIdentity } from '../org.js';
 import type { Plan } from '../plan.js';
-import type { Checkpoint } from '../state.js';
+import type { Checkpoint, DestroyRecord } from '../state.js';
 /**
  * Mirrors `migrations/0001_declared_org.sql`, which is the source of truth:
  * the SQL carries the CHECKs drizzle-kit does not generate here (this
@@ -270,6 +270,40 @@ export declare const declaredOrgs: import("drizzle-orm/pg-core").PgTableWithColu
             identity: undefined;
             generated: undefined;
         }, {}, {}>;
+        callsVersionPinSynapse: import("drizzle-orm/pg-core").PgColumn<{
+            name: "calls_version_pin_synapse";
+            tableName: "foundry_declared_orgs";
+            dataType: "string";
+            columnType: "PgText";
+            data: string;
+            driverParam: string;
+            notNull: false;
+            hasDefault: false;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: [string, ...string[]];
+            baseColumn: never;
+            identity: undefined;
+            generated: undefined;
+        }, {}, {}>;
+        callsVersionPinMas: import("drizzle-orm/pg-core").PgColumn<{
+            name: "calls_version_pin_mas";
+            tableName: "foundry_declared_orgs";
+            dataType: "string";
+            columnType: "PgText";
+            data: string;
+            driverParam: string;
+            notNull: false;
+            hasDefault: false;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: [string, ...string[]];
+            baseColumn: never;
+            identity: undefined;
+            generated: undefined;
+        }, {}, {}>;
         issuerUsesDomain: import("drizzle-orm/pg-core").PgColumn<{
             name: "issuer_uses_domain";
             tableName: "foundry_declared_orgs";
@@ -945,6 +979,101 @@ export declare const foundryAppliedState: import("drizzle-orm/pg-core").PgTableW
             identity: undefined;
             generated: undefined;
         }, {}, {}>;
+        destroy: import("drizzle-orm/pg-core").PgColumn<{
+            name: "destroy";
+            tableName: "foundry_applied_state";
+            dataType: "json";
+            columnType: "PgJsonb";
+            data: DestroyRecord;
+            driverParam: unknown;
+            notNull: false;
+            hasDefault: false;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: undefined;
+            baseColumn: never;
+            identity: undefined;
+            generated: undefined;
+        }, {}, {
+            $type: DestroyRecord;
+        }>;
+    };
+    dialect: "pg";
+}>;
+/** Mirrors `migrations/0042_mutation_leases.sql`: one row per lock scope; `token` only ever rises (#441). */
+export declare const foundryMutationLeases: import("drizzle-orm/pg-core").PgTableWithColumns<{
+    name: "foundry_mutation_leases";
+    schema: undefined;
+    columns: {
+        scope: import("drizzle-orm/pg-core").PgColumn<{
+            name: "scope";
+            tableName: "foundry_mutation_leases";
+            dataType: "string";
+            columnType: "PgText";
+            data: string;
+            driverParam: string;
+            notNull: true;
+            hasDefault: false;
+            isPrimaryKey: true;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: [string, ...string[]];
+            baseColumn: never;
+            identity: undefined;
+            generated: undefined;
+        }, {}, {}>;
+        token: import("drizzle-orm/pg-core").PgColumn<{
+            name: "token";
+            tableName: "foundry_mutation_leases";
+            dataType: "number";
+            columnType: "PgBigInt53";
+            data: number;
+            driverParam: string | number;
+            notNull: true;
+            hasDefault: false;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: undefined;
+            baseColumn: never;
+            identity: undefined;
+            generated: undefined;
+        }, {}, {}>;
+        holder: import("drizzle-orm/pg-core").PgColumn<{
+            name: "holder";
+            tableName: "foundry_mutation_leases";
+            dataType: "string";
+            columnType: "PgText";
+            data: string;
+            driverParam: string;
+            notNull: true;
+            hasDefault: false;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: [string, ...string[]];
+            baseColumn: never;
+            identity: undefined;
+            generated: undefined;
+        }, {}, {}>;
+        expiresAt: import("drizzle-orm/pg-core").PgColumn<{
+            name: "expires_at";
+            tableName: "foundry_mutation_leases";
+            dataType: "date";
+            columnType: "PgTimestamp";
+            data: Date;
+            driverParam: string;
+            notNull: true;
+            hasDefault: false;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: undefined;
+            baseColumn: never;
+            identity: undefined;
+            generated: undefined;
+        }, {}, {}>;
     };
     dialect: "pg";
 }>;
@@ -1107,7 +1236,7 @@ export declare const foundryAuditEvents: import("drizzle-orm/pg-core").PgTableWi
             tableName: "foundry_audit_events";
             dataType: "string";
             columnType: "PgText";
-            data: "plan" | "apply" | "destroy";
+            data: "plan" | "destroy" | "apply";
             driverParam: string;
             notNull: true;
             hasDefault: false;
@@ -1119,7 +1248,7 @@ export declare const foundryAuditEvents: import("drizzle-orm/pg-core").PgTableWi
             identity: undefined;
             generated: undefined;
         }, {}, {
-            $type: "plan" | "apply" | "destroy";
+            $type: "plan" | "destroy" | "apply";
         }>;
         actorId: import("drizzle-orm/pg-core").PgColumn<{
             name: "actor_id";
@@ -1177,7 +1306,7 @@ export declare const foundryAuditEvents: import("drizzle-orm/pg-core").PgTableWi
             tableName: "foundry_audit_events";
             dataType: "string";
             columnType: "PgText";
-            data: "applied" | "refused" | "failed" | "destroyed";
+            data: "applied" | "failed" | "refused" | "destroyed";
             driverParam: string;
             notNull: false;
             hasDefault: false;
@@ -1189,7 +1318,7 @@ export declare const foundryAuditEvents: import("drizzle-orm/pg-core").PgTableWi
             identity: undefined;
             generated: undefined;
         }, {}, {
-            $type: "applied" | "refused" | "failed" | "destroyed";
+            $type: "applied" | "failed" | "refused" | "destroyed";
         }>;
         reason: import("drizzle-orm/pg-core").PgColumn<{
             name: "reason";