@wtfalch/foundry 0.16.15 → 0.17.0

package/dist/store/schema.js

@@ -1,4 +1,4 @@
-import { bigserial, boolean, integer, jsonb, pgTable, text, timestamp } from 'drizzle-orm/pg-core';
+import { bigint, bigserial, boolean, integer, jsonb, pgTable, text, timestamp, } from 'drizzle-orm/pg-core';
 /**
  * Mirrors `migrations/0001_declared_org.sql`, which is the source of truth:
  * the SQL carries the CHECKs drizzle-kit does not generate here (this
@@ -31,6 +31,9 @@ export const declaredOrgs = pgTable('foundry_declared_orgs', {
     chatUsesDomain: boolean('chat_uses_domain').notNull().default(false),
     callsEnabled: boolean('calls_enabled').notNull().default(false),
     callsUsesDomain: boolean('calls_uses_domain').notNull().default(false),
+    // #259: null holds no pin -- the stack follows versions.json, same as today.
+    callsVersionPinSynapse: text('calls_version_pin_synapse'),
+    callsVersionPinMas: text('calls_version_pin_mas'),
     issuerUsesDomain: boolean('issuer_uses_domain').notNull().default(false),
     // SiteConfig (org.ts, T10). A brand new org has no cms site.
     siteEnabled: boolean('site_enabled').notNull().default(false),
@@ -101,6 +104,14 @@ export const foundryAppliedState = pgTable('foundry_applied_state', {
     failedFields: jsonb('failed_fields').notNull().default([]).$type(),
     lastAppliedAt: timestamp('last_applied_at', { withTimezone: true }),
     lastAppliedDeclaredOrgVersion: text('last_applied_declared_org_version'),
+    destroy: jsonb('destroy').$type(),
+});
+/** Mirrors `migrations/0042_mutation_leases.sql`: one row per lock scope; `token` only ever rises (#441). */
+export const foundryMutationLeases = pgTable('foundry_mutation_leases', {
+    scope: text('scope').primaryKey(),
+    token: bigint('token', { mode: 'number' }).notNull(),
+    holder: text('holder').notNull(),
+    expiresAt: timestamp('expires_at', { withTimezone: true }).notNull(),
 });
 /**
  * Mirrors `migrations/0036_applied_versions.sql`, the source of truth: an

package/dist/store.d.ts

@@ -13,6 +13,24 @@ export interface StaleUpdate {
     /** The org as it stands now. */
     current: DeclaredOrg;
 }
+/**
+ * A held mutation lease (#441). `token` rises on every acquire of a scope, so
+ * a worker whose lease expired and was taken over holds a token the store no
+ * longer accepts: its fenced writes are refused.
+ */
+export interface MutationLease {
+    scope: string;
+    token: number;
+}
+/** What `acquireMutationLease` returns while another holder has the scope: when that lease runs out. */
+export interface HeldLease {
+    heldUntil: Date;
+}
+/** A fenced write (`putAppliedState`, `putServiceIds`) came from a lease that is no longer the current one (#441). Nothing was written. */
+export declare class StaleLeaseError extends Error {
+    readonly scope: string;
+    constructor(scope: string);
+}
 /**
  * The persistence seam https://github.com/wtfalch/foundry/issues/18
  * implements: create, read and edit a {@link DeclaredOrg}, and read and
@@ -44,6 +62,12 @@ export interface DeclaredOrgStore {
      * record instead.
      */
     findOrgIdForZone(zoneId: string): Promise<OrgId | null>;
+    /**
+     * Archon#271: an org other than `exceptOrgId` whose applied state records
+     * `id` as a Coolify app, database or project, or `null`. Adopt refuses a
+     * resource another org already holds.
+     */
+    findOtherOrgRecordingCoolifyId(id: string, exceptOrgId: OrgId): Promise<OrgId | null>;
     /**
      * Combinations foundry knows are impossible are rejected with a reason
      * (#18 "Done when"), so a caller must be ready for this to throw rather
@@ -58,7 +82,26 @@ export interface DeclaredOrgStore {
      */
     update(id: OrgId, patch: Partial<DeclaredOrg>, opts: UpdateOptions): Promise<DeclaredOrg | StaleUpdate>;
     getAppliedState(id: OrgId): Promise<AppliedState | null>;
-    putAppliedState(state: AppliedState): Promise<void>;
+    /**
+     * With `fence` (#441), compare-and-set: the write happens only while
+     * `fence.token` is still the scope's current lease token, otherwise it
+     * throws {@link StaleLeaseError} and writes nothing.
+     */
+    putAppliedState(state: AppliedState, fence?: MutationLease): Promise<void>;
+    /**
+     * #441: takes the exclusive mutation lease for `scope` (`company:<orgId>`
+     * or `platform`), or returns {@link HeldLease} while another holder's lease
+     * has not expired. Every successful acquire issues a higher token than the last.
+     */
+    acquireMutationLease(scope: string, holder: string, ttlMs: number): Promise<MutationLease | HeldLease>;
+    /**
+     * Extends the lease to `ttlMs` from now, only while `lease.token` is still
+     * the scope's current token. Returns false once it is not: the holder lost
+     * the scope and must stop before its next provider step.
+     */
+    renewMutationLease(lease: MutationLease, ttlMs: number): Promise<boolean>;
+    /** Frees the lease at once. A no-op if the lease was already taken over. */
+    releaseMutationLease(lease: MutationLease): Promise<void>;
     /**
      * Removes the declared org and its applied state together. Called only by
      * `FoundryPlanApply.destroy` (`plan/plan-apply.ts`), once every resource it
@@ -68,7 +111,7 @@ export interface DeclaredOrgStore {
      * not an error, so a retried destroy that reaches this step twice never
      * throws.
      */
-    delete(id: OrgId): Promise<void>;
+    delete(id: OrgId, fence?: MutationLease): Promise<void>;
 }
 /**
  * The persistence seam for #166's {@link DeclaredPlatform}, mirroring
@@ -87,8 +130,8 @@ export interface PlatformStore {
      * before the first apply. `put` never touches it.
      */
     getServiceIds(): Promise<Record<string, string>>;
-    /** Replaces the recorded ids. A no-op until the platform is declared. */
-    putServiceIds(serviceIds: Record<string, string>): Promise<void>;
+    /** Replaces the recorded ids. A no-op until the platform is declared. With `fence` (#441), compare-and-set as {@link DeclaredOrgStore.putAppliedState}. */
+    putServiceIds(serviceIds: Record<string, string>, fence?: MutationLease): Promise<void>;
 }
 /**
  * One recorded apply, appended to the history #253 keeps beside

package/dist/store.js

@@ -1 +1,9 @@
-export {};
+/** A fenced write (`putAppliedState`, `putServiceIds`) came from a lease that is no longer the current one (#441). Nothing was written. */
+export class StaleLeaseError extends Error {
+    scope;
+    constructor(scope) {
+        super(`mutation lease for ${scope} was lost to a newer holder; nothing written`);
+        this.scope = scope;
+        this.name = 'StaleLeaseError';
+    }
+}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@wtfalch/foundry",
-  "version": "0.16.15",
+  "version": "0.17.0",
   "description": "Foundry's SDK: the declared org's types, the plan and apply contracts, and the state store's interface.",
   "repository": {
     "type": "git",
@@ -43,7 +43,7 @@
     "@wtfalch/audit": "0.6.0",
     "@wtfalch/auth": "0.16.0",
     "@wtfalch/email": "^0.17.0",
-    "@wtfalch/providers": "0.7.2",
+    "@wtfalch/providers": "0.7.3",
     "ssh2": "1.17.0",
     "zod": "4.6.5"
   },