@wtfalch/foundry 0.16.16 → 0.17.1

package/dist/plan/providers-readers.d.ts

@@ -94,6 +94,8 @@ export declare class ProvidersCoolifyReader implements CoolifyReader {
     private readonly resolveRecordedIds;
     constructor(client: CoolifyClient, resolveScope: ScopeResolver, resolveRecordedIds: RecordedIds);
     listResources(orgId: OrgId): Promise<LiveResource[]>;
+    /** The project's resources as Coolify reports them, unmapped: what adopt checks against a declaration. */
+    listProject(projectUuid: string): Promise<LiveResource[]>;
 }
 /**
  * Backed by `@wtfalch/providers/cloudflare`'s `CloudflareClient.listResources`:

package/dist/plan/providers-readers.js

@@ -243,6 +243,10 @@ export class ProvidersCoolifyReader {
         const withBouleConfig = await Promise.all(withAgoraConfig.map((r) => withBouleEnvConfig(this.client, r, recorded)));
         return applyRecordedIds(withBouleConfig, recorded);
     }
+    /** The project's resources as Coolify reports them, unmapped: what adopt checks against a declaration. */
+    async listProject(projectUuid) {
+        return toFoundryResources('coolify', await this.client.listResources(projectUuid));
+    }
 }
 /**
  * Backed by `@wtfalch/providers/cloudflare`'s `CloudflareClient.listResources`:

package/dist/plan/rollout.d.ts

@@ -0,0 +1,52 @@
+import type { OrgId } from '../org.js';
+/**
+ * #259: ordered, stop-on-failure rollout across several orgs' own applies.
+ *
+ * Where the order itself comes from is still open (#259 "Decide": the
+ * platform declaration, one place, vs. spread across each org) -- this
+ * takes the order as a plain, caller-supplied list, so it works unchanged
+ * whichever way that is answered. `apply` is the caller's own one-org apply
+ * (typically `plan` then `PlanApply.apply`, confirmation and all) -- this
+ * file knows nothing about that shape, only whether it threw.
+ *
+ * "Stop at the first failed health check" (the issue's own words) is, today,
+ * "stop at the first `apply` that throws" -- the shared health helper
+ * (`deploy-health.ts`'s `waitForNewDeployment`) is not yet wired into the
+ * org-level calls stack deploy (`executor.ts`'s `coolifyCalls`/
+ * `coolifyCallsService` only ever fire-and-forget deploy, and never patch a
+ * running app's image tag at all -- see `org.ts`'s `CallsConfig.versionPin`
+ * doc comment). Once that step itself throws on a failed health check, a
+ * caller's `apply` naturally does too, and this orchestration needs no
+ * change.
+ */
+/** One org's outcome from {@link applyOrgsInOrder}. */
+export interface RolloutOrgResult {
+    readonly orgId: OrgId;
+    readonly outcome: 'applied' | 'skipped' | 'failed';
+    /** Set only for `'failed'` -- the thrown error's own message. */
+    readonly error?: string;
+    /**
+     * Set only for `'applied'`, when `soakMs` names one for this org: the ISO
+     * time the caller should wait until before applying the next org. Never
+     * slept here (CLAUDE.md "Platform steps" rule 5, and the issue's own "Make
+     * the soak a declared value the caller supplies, not a sleep inside
+     * foundry") -- a caller that wants to honour it re-invokes later, from
+     * `orgIds` sliced after this result's own org.
+     */
+    readonly soakUntil?: string;
+}
+export interface RolloutOptions {
+    /** This org's soak window in milliseconds, or `undefined`/`0` for none (a stateless service). */
+    soakMs?: (orgId: OrgId) => number | undefined;
+    /** Overridable for tests; defaults to `Date.now`. */
+    now?: () => number;
+}
+/**
+ * Applies every org in `orgIds`, in order, stopping at the first `apply`
+ * that throws: every org after it is reported `'skipped'` without `apply`
+ * ever being called for it, so it is left exactly as it was. An org whose
+ * own `apply` throws is reported `'failed'` with that error's message --
+ * `apply`'s own implementation decides what, if anything, it recorded
+ * before throwing (this function never inspects or rolls back that state).
+ */
+export declare function applyOrgsInOrder(orgIds: readonly OrgId[], apply: (orgId: OrgId) => Promise<unknown>, options?: RolloutOptions): Promise<RolloutOrgResult[]>;

package/dist/plan/rollout.js

@@ -0,0 +1,37 @@
+/**
+ * Applies every org in `orgIds`, in order, stopping at the first `apply`
+ * that throws: every org after it is reported `'skipped'` without `apply`
+ * ever being called for it, so it is left exactly as it was. An org whose
+ * own `apply` throws is reported `'failed'` with that error's message --
+ * `apply`'s own implementation decides what, if anything, it recorded
+ * before throwing (this function never inspects or rolls back that state).
+ */
+export async function applyOrgsInOrder(orgIds, apply, options = {}) {
+    const now = options.now ?? Date.now;
+    const results = [];
+    let stopped = false;
+    for (const orgId of orgIds) {
+        if (stopped) {
+            results.push({ orgId, outcome: 'skipped' });
+            continue;
+        }
+        try {
+            await apply(orgId);
+            const soak = options.soakMs?.(orgId);
+            results.push({
+                orgId,
+                outcome: 'applied',
+                ...(soak ? { soakUntil: new Date(now() + soak).toISOString() } : {}),
+            });
+        }
+        catch (error) {
+            results.push({
+                orgId,
+                outcome: 'failed',
+                error: error instanceof Error ? error.message : String(error),
+            });
+            stopped = true;
+        }
+    }
+    return results;
+}

package/dist/plan/step-system.d.ts

@@ -0,0 +1,22 @@
+import type { PlanStep } from '../plan.js';
+import type { StepAction } from './diff.js';
+import type { LiveResource } from './live.js';
+/**
+ * The system a plan step or progress event touches, for Archon to draw as a
+ * tag. A superset of {@link LiveResource}'s `system` (where a resource
+ * lives): a step that deploys Stalwart, Synapse or a Postgres database
+ * through Coolify names that system, not the deployer.
+ *
+ * `foundry` is for a progress event that covers more than one system, or
+ * none (a round of mixed steps, the closing event). No plan step carries it.
+ */
+export type StepSystem = LiveResource['system'] | 'stalwart' | 'matrix' | 'postgres' | 'foundry';
+/** The system `action` touches. The one place that decides it, so no planner sets it by hand. */
+export declare function stepSystemOf(action: StepAction): StepSystem;
+/** The step with its `system` set from `action`. */
+export declare function withStepSystem<T extends {
+    step: Omit<PlanStep, 'system'>;
+    action: StepAction;
+}>(planned: T): T & {
+    step: PlanStep;
+};

package/dist/plan/step-system.js

@@ -0,0 +1,38 @@
+/** Which system a platform `app` step (keyed `platform:<service>`) runs. */
+const PLATFORM_APP_SYSTEMS = {
+    'platform:auth': 'zitadel',
+    'platform:mail': 'stalwart',
+    'platform:files': 'files',
+    'platform:ai': 'ai',
+    'platform:names': 'names',
+};
+/** The system `action` touches. The one place that decides it, so no planner sets it by hand. */
+export function stepSystemOf(action) {
+    switch (action.kind) {
+        case 'mail':
+        case 'mail-copy':
+            return 'stalwart';
+        case 'chat':
+        case 'calls':
+        case 'calls-service':
+            return 'matrix';
+        case 'database':
+        case 'adopt-database':
+        case 'backup':
+            return 'postgres';
+        // Re-registers the R2 bucket's credentials with Coolify: the bucket is what it writes to.
+        case 'backup-storage':
+            return 'cloudflare';
+        // The platform's jobs scheduler app, like the org's own `jobs` registration.
+        case 'jobs':
+            return 'jobs';
+        case 'app':
+            return PLATFORM_APP_SYSTEMS[action.key] ?? action.system;
+        default:
+            return action.system;
+    }
+}
+/** The step with its `system` set from `action`. */
+export function withStepSystem(planned) {
+    return { ...planned, step: { ...planned.step, system: stepSystemOf(planned.action) } };
+}

package/dist/plan.d.ts

@@ -1,4 +1,5 @@
 import type { OrgId } from './org.js';
+import type { StepSystem } from './plan/step-system.js';
 /**
  * One step of a {@link Plan}.
  *
@@ -9,6 +10,8 @@ import type { OrgId } from './org.js';
  */
 export interface PlanStep {
     description: string;
+    /** The system this step touches, for Archon to tag it with. Set from the step's action, never by hand (`plan/step-system.ts`). */
+    system: StepSystem;
     /**
      * True when this step deletes or replaces data the org cannot get back
      * without foundry's own backup: a chat re-key, an issuer move, a mail

package/dist/platform.d.ts

@@ -12,8 +12,25 @@ export interface PlatformService {
     hostname: string;
     gitRef: string;
 }
-/** The eight shared services a declared platform names, decided in #165. */
-export type PlatformServiceKey = 'auth' | 'mail' | 'sfu' | 'files' | 'ai' | 'jobs' | 'integrations' | 'archon';
+/**
+ * #491: `mail`'s own extra field, on top of every other service's shape.
+ * Company Included (or whichever org's mail domain is the platform's own
+ * apex) sends through the platform's existing Lettermint project rather than
+ * a second `<slug>-app` one of its own -- `undefined`/`null` until an
+ * operator declares which project that is. A ref only, never a value: the
+ * project's own sending token stays where it already lived, held under
+ * `PLATFORM_AUTH_BROKER_MAIL_KEY_REF` (`plan/platform-providers.ts`).
+ */
+export interface PlatformMailService extends PlatformService {
+    lettermintProjectId?: string | null;
+}
+/**
+ * The shared services a declared platform names, decided in #165, plus
+ * `names` (#317, F7): the service that mints an entry's own names key and
+ * holds the Cloudflare token `<username>.<org domain>` claims use, so no
+ * hosting entry ever holds that credential itself.
+ */
+export type PlatformServiceKey = 'auth' | 'mail' | 'sfu' | 'files' | 'ai' | 'jobs' | 'integrations' | 'archon' | 'names';
 export declare const PLATFORM_SERVICE_KEYS: readonly PlatformServiceKey[];
 /**
  * The one shared platform every org's services run on -- decided in #165 as
@@ -42,13 +59,15 @@ export interface DeclaredPlatform {
      */
     serverIpv4?: string | null;
     auth: PlatformService;
-    mail: PlatformService;
+    mail: PlatformMailService;
     sfu: PlatformService;
     files: PlatformService;
     ai: PlatformService;
     jobs: PlatformService;
     integrations: PlatformService;
     archon: PlatformService;
+    /** #317 (F7). No deploy step reads this service's own `gitRef` yet -- `N1` is deployed by hand until it exists. */
+    names: PlatformService;
 }
 /** `<service>.<apex>` -- the default `hostname` for a platform service, before an operator overrides it. */
 export declare function defaultPlatformHostname(service: PlatformServiceKey, apex: string): string;

package/dist/platform.js

@@ -9,6 +9,7 @@ export const PLATFORM_SERVICE_KEYS = [
     'jobs',
     'integrations',
     'archon',
+    'names',
 ];
 /** `<service>.<apex>` -- the default `hostname` for a platform service, before an operator overrides it. */
 export function defaultPlatformHostname(service, apex) {
@@ -47,5 +48,10 @@ export function validatePlatform(platform) {
             return `${key}.gitRef must not be empty once ${key}.enabled is true`;
         }
     }
+    // #491: declared, never discovered -- a present-but-blank id is refused the
+    // same way `serverIpv4`'s blank string is, rather than being read as unset.
+    if (platform.mail.lettermintProjectId != null && !platform.mail.lettermintProjectId.trim()) {
+        return 'mail.lettermintProjectId must not be empty when set';
+    }
     return null;
 }

package/dist/state.d.ts

@@ -12,6 +12,17 @@ export interface Checkpoint {
     step: string;
     completedAt: string;
 }
+/** One step of a destroy: `finished`, `failed` (with `error`), `started` (in flight; a crash leaves it so), or `planned` (not reached yet). */
+export interface DestroyStepRecord {
+    step: string;
+    status: 'planned' | 'started' | 'finished' | 'failed';
+    completedAt?: string;
+    error?: string;
+}
+/** Foundry's record of the current or most recent destroy of an org, in step order. */
+export interface DestroyRecord {
+    steps: DestroyStepRecord[];
+}
 /**
  * When an apply last completed, and against which declared org version.
  *
@@ -81,4 +92,6 @@ export interface AppliedState {
     failedFields: string[];
     /** `null` before this org has ever had a completed apply. */
     lastApplied: LastApplied | null;
+    /** The destroy that started for this org, if any. Absent until one has. */
+    destroy?: DestroyRecord | null;
 }

package/dist/store/audit.js

@@ -14,10 +14,11 @@ const FOUNDRY_LEDGER_VOCABULARY = ledgerVocabulary({
         'plan.computed': { tenantVisible: false },
         'apply.recorded': { tenantVisible: false },
         'destroy.recorded': { tenantVisible: false },
+        'adoption.recorded': { tenantVisible: false },
     },
     actorClasses: ['operator'],
     contexts: ['operator'],
-    outcomes: ['recorded', 'applied', 'destroyed', 'refused', 'failed'],
+    outcomes: ['recorded', 'applied', 'destroyed', 'refused', 'failed', 'adopted', 'released'],
 });
 /**
  * The ledger table's CHECKs (migration 0024): reason <= 512 chars, `after`
@@ -110,6 +111,19 @@ export function createPostgresAuditLog(db, options = {}) {
                 occurredAt: at,
             });
         },
+        async recordAdoption({ actor, orgId, action, entryKey, outcome, reason, at }) {
+            await ledger.sign(db, {
+                action: 'adoption.recorded',
+                tenantId: null,
+                actor: { class: 'operator', id: actor.id, display: boundDisplay(actor) },
+                context: 'operator',
+                target: targetFor(orgId),
+                outcome,
+                reason: boundReason(reason),
+                after: { action, entryKey },
+                occurredAt: at,
+            });
+        },
         async recordDestroy({ actor, orgId, outcome, reason, at }) {
             await ledger.sign(db, {
                 action: 'destroy.recorded',

package/dist/store/postgres.d.ts

@@ -1,5 +1,5 @@
 import type { PgDatabase, PgQueryResultHKT } from 'drizzle-orm/pg-core';
-import type { AppliedVersionsStore, DeclaredOrgStore, PlatformStore, RequestedChangeStore } from '../store.js';
+import { type AppliedVersionsStore, type DeclaredOrgStore, type PlatformStore, type RequestedChangeStore } from '../store.js';
 /**
  * The host's own drizzle handle or a transaction open on it, same shape
  * `@wtfalch/keys`'s `HeldKeysDb` uses: postgres-js in a real host, PGlite in

package/dist/store/postgres.js

@@ -1,11 +1,31 @@
 import { and, asc, desc, eq, sql } from 'drizzle-orm';
-import { APP_ENTRY_KEY, DEFAULT_MAIL_APPS, DEFAULT_NO_REPLY_LOCAL_PART, validateBuyerIdentity, validateDomain, validateHosting, validateMail, validateOwners, validateSite, } from '../org.js';
+import { APP_ENTRY_KEY, DEFAULT_MAIL_APPS, DEFAULT_NO_REPLY_LOCAL_PART, validateBuyerIdentity, validateCalls, validateDomain, validateHosting, validateMail, validateOwners, validateSite, } from '../org.js';
 import { lockedHostnames } from '../plan/locked-hostnames.js';
 import { validatePlatform } from '../platform.js';
 import { RequestedChangeError, classifyChange } from '../requested-changes.js';
 import { validateSlug } from '../slug.js';
-import { declaredOrgs, foundryAppliedState, foundryAppliedVersions, foundryDeclaredPlatform, foundryRequestedChanges, } from './schema.js';
+import { StaleLeaseError, } from '../store.js';
+import { declaredOrgs, foundryAppliedState, foundryAppliedVersions, foundryDeclaredPlatform, foundryMutationLeases, foundryRequestedChanges, } from './schema.js';
 const UNIQUE_VIOLATION = '23505';
+/**
+ * #441: runs `write`, and with a `fence` only if its token is still the
+ * scope's current one. The lease row is locked for the write, so a takeover
+ * cannot slip between the check and the write.
+ */
+async function writeFenced(db, fence, write) {
+    if (!fence)
+        return write(db);
+    await db.transaction(async (tx) => {
+        const [row] = await tx
+            .select({ token: foundryMutationLeases.token })
+            .from(foundryMutationLeases)
+            .where(eq(foundryMutationLeases.scope, fence.scope))
+            .for('update');
+        if (!row || row.token !== fence.token)
+            throw new StaleLeaseError(fence.scope);
+        await write(tx);
+    });
+}
 /** `migrations/0004_slug_unique.sql` / `migrations/0015_domain_unique.sql`'s index names, read back off a caught unique-violation to tell which one fired. */
 const SLUG_UNIQUE_INDEX = 'foundry_declared_orgs_slug_idx';
 const DOMAIN_UNIQUE_INDEX = 'foundry_declared_orgs_domain_idx';
@@ -75,7 +95,21 @@ function rowToOrg(row) {
             roleMailboxes: row.roleMailboxes,
         },
         chat: { enabled: row.chatEnabled, usesDomain: row.chatUsesDomain },
-        calls: { enabled: row.callsEnabled, usesDomain: row.callsUsesDomain },
+        calls: {
+            enabled: row.callsEnabled,
+            usesDomain: row.callsUsesDomain,
+            // Omitted, not `null`, while neither column is set: every existing
+            // row (and every test fixture that builds a `CallsConfig` literal
+            // before this field existed) round-trips unchanged.
+            ...(row.callsVersionPinSynapse || row.callsVersionPinMas
+                ? {
+                    versionPin: {
+                        ...(row.callsVersionPinSynapse ? { synapse: row.callsVersionPinSynapse } : {}),
+                        ...(row.callsVersionPinMas ? { mas: row.callsVersionPinMas } : {}),
+                    },
+                }
+                : {}),
+        },
         issuer: { usesDomain: row.issuerUsesDomain },
         site: { enabled: row.siteEnabled, usesDomain: row.siteUsesDomain },
         hosting: {
@@ -119,6 +153,8 @@ function orgToRow(org) {
         chatUsesDomain: org.chat.usesDomain,
         callsEnabled: org.calls.enabled,
         callsUsesDomain: org.calls.usesDomain,
+        callsVersionPinSynapse: org.calls.versionPin?.synapse ?? null,
+        callsVersionPinMas: org.calls.versionPin?.mas ?? null,
         issuerUsesDomain: org.issuer.usesDomain,
         siteEnabled: org.site.enabled,
         siteUsesDomain: org.site.usesDomain,
@@ -268,11 +304,25 @@ export function createPostgresDeclaredOrgStore(db) {
     // `mail.ownerMailboxAddress` just because mail is on -- `validateMail`'s
     // own doc comment says why. Also covers #34's `mailApps` check, folded
     // into the same `validateMail`.
-    function requireValidMail(org) {
-        const reason = validateMail(org);
+    //
+    // #422: `allowExistingTier2` grandfathers an org already stored as a
+    // domain plus `mail.mode: 'received'` -- `update` passes it true only
+    // when that exact combination was already the row's state before this
+    // patch, so an unrelated edit to an already-tier-2 org still goes
+    // through. `create` never passes it: a brand new org cannot already be
+    // grandfathered.
+    function requireValidMail(org, opts) {
+        const reason = validateMail(org, opts);
         if (reason)
             throw new DeclaredOrgError(`mail invalid: ${reason} (#162)`);
     }
+    // #259: same place `requireValidMail` checks mail, on both `create` and
+    // the merged result of `update`.
+    function requireValidCalls(org) {
+        const reason = validateCalls(org);
+        if (reason)
+            throw new DeclaredOrgError(`calls invalid: ${reason} (#259)`);
+    }
     // `as`: `update` is overloaded in the interface (#351), which one object-literal method cannot express.
     return {
         async create(org) {
@@ -284,6 +334,7 @@ export function createPostgresDeclaredOrgStore(db) {
             requireValidSite(org);
             requireValidOwner(org);
             requireValidMail(org);
+            requireValidCalls(org);
             try {
                 await db.insert(declaredOrgs).values(orgToRow(org));
             }
@@ -339,6 +390,23 @@ export function createPostgresDeclaredOrgStore(db) {
             }
             return null;
         },
+        async findOtherOrgRecordingCoolifyId(id, exceptOrgId) {
+            const rows = await db
+                .select({ orgId: foundryAppliedState.orgId, serviceIds: foundryAppliedState.serviceIds })
+                .from(foundryAppliedState);
+            for (const row of rows) {
+                if (row.orgId === exceptOrgId)
+                    continue;
+                for (const [key, value] of Object.entries(row.serviceIds)) {
+                    const coolify = key === 'coolify_project' ||
+                        key.startsWith('coolify:app:') ||
+                        key.startsWith('coolify:database:');
+                    if (coolify && value === id)
+                        return row.orgId;
+                }
+            }
+            return null;
+        },
         async update(id, patch, opts) {
             const current = rowToOrg(await requireRow(id));
             // #351: already behind, so refuse without validating a write that will not happen.
@@ -366,7 +434,11 @@ export function createPostgresDeclaredOrgStore(db) {
             requireValidHosting(next);
             requireValidSite(next);
             requireValidOwner(next);
-            requireValidMail(next);
+            // #422: grandfather an org already stored as domain + `received` --
+            // refuse only when this patch is what newly puts it in that state.
+            const wasTier2 = current.domain !== null && current.mail.mode === 'received';
+            requireValidMail(next, { allowExistingTier2: wasTier2 });
+            requireValidCalls(next);
             try {
                 // #351: with `expectedVersion` the version check is part of this one
                 // statement, so an edit that lands after the read above makes it match
@@ -420,10 +492,44 @@ export function createPostgresDeclaredOrgStore(db) {
                         declaredOrgVersion: row.lastAppliedDeclaredOrgVersion,
                     }
                     : null,
+                ...(row.destroy ? { destroy: row.destroy } : {}),
             };
             return state;
         },
-        async putAppliedState(state) {
+        async acquireMutationLease(scope, holder, ttlMs) {
+            const expiresAt = sql `now() + ${ttlMs} * interval '1 millisecond'`;
+            const [row] = await db
+                .insert(foundryMutationLeases)
+                .values({ scope, token: 1, holder, expiresAt })
+                .onConflictDoUpdate({
+                target: foundryMutationLeases.scope,
+                set: { token: sql `${foundryMutationLeases.token} + 1`, holder, expiresAt },
+                setWhere: sql `${foundryMutationLeases.expiresAt} <= now()`,
+            })
+                .returning({ token: foundryMutationLeases.token });
+            if (row)
+                return { scope, token: row.token };
+            const [held] = await db
+                .select({ expiresAt: foundryMutationLeases.expiresAt })
+                .from(foundryMutationLeases)
+                .where(eq(foundryMutationLeases.scope, scope));
+            return { heldUntil: held?.expiresAt ?? new Date() };
+        },
+        async renewMutationLease(lease, ttlMs) {
+            const rows = await db
+                .update(foundryMutationLeases)
+                .set({ expiresAt: sql `now() + ${ttlMs} * interval '1 millisecond'` })
+                .where(and(eq(foundryMutationLeases.scope, lease.scope), eq(foundryMutationLeases.token, lease.token)))
+                .returning({ token: foundryMutationLeases.token });
+            return rows.length > 0;
+        },
+        async releaseMutationLease(lease) {
+            await db
+                .update(foundryMutationLeases)
+                .set({ expiresAt: sql `now()` })
+                .where(and(eq(foundryMutationLeases.scope, lease.scope), eq(foundryMutationLeases.token, lease.token)));
+        },
+        async putAppliedState(state, fence) {
             const values = {
                 orgId: state.orgId,
                 serviceIds: state.serviceIds,
@@ -431,21 +537,25 @@ export function createPostgresDeclaredOrgStore(db) {
                 failedFields: state.failedFields,
                 lastAppliedAt: state.lastApplied ? new Date(state.lastApplied.at) : null,
                 lastAppliedDeclaredOrgVersion: state.lastApplied?.declaredOrgVersion ?? null,
+                destroy: state.destroy ?? null,
             };
-            await db
+            await writeFenced(db, fence, (tx) => tx
                 .insert(foundryAppliedState)
                 .values(values)
-                .onConflictDoUpdate({ target: foundryAppliedState.orgId, set: values });
+                .onConflictDoUpdate({ target: foundryAppliedState.orgId, set: values })
+                .then(() => undefined));
         },
-        async delete(id) {
+        async delete(id, fence) {
             // Applied state first: `0002_applied_state.sql`'s
             // `foundry_applied_state_org_fkey` references the declared org with no
             // cascade, so deleting the org first would fail while its applied
             // state row still points at it. Both deletes are no-ops (idempotent)
             // when the row is already gone, matching this method's own doc
             // comment on `../store.ts`.
-            await db.delete(foundryAppliedState).where(eq(foundryAppliedState.orgId, id));
-            await db.delete(declaredOrgs).where(eq(declaredOrgs.id, id));
+            await writeFenced(db, fence, async (tx) => {
+                await tx.delete(foundryAppliedState).where(eq(foundryAppliedState.orgId, id));
+                await tx.delete(declaredOrgs).where(eq(declaredOrgs.id, id));
+            });
         },
     };
 }
@@ -468,7 +578,12 @@ function rowToPlatform(row) {
         apex: row.apex,
         ...(row.serverIpv4 ? { serverIpv4: row.serverIpv4 } : {}),
         auth: { enabled: row.authEnabled, hostname: row.authHostname, gitRef: row.authGitRef },
-        mail: { enabled: row.mailEnabled, hostname: row.mailHostname, gitRef: row.mailGitRef },
+        mail: {
+            enabled: row.mailEnabled,
+            hostname: row.mailHostname,
+            gitRef: row.mailGitRef,
+            ...(row.mailLettermintProjectId ? { lettermintProjectId: row.mailLettermintProjectId } : {}),
+        },
         sfu: { enabled: row.sfuEnabled, hostname: row.sfuHostname, gitRef: row.sfuGitRef },
         files: { enabled: row.filesEnabled, hostname: row.filesHostname, gitRef: row.filesGitRef },
         ai: { enabled: row.aiEnabled, hostname: row.aiHostname, gitRef: row.aiGitRef },
@@ -483,6 +598,11 @@ function rowToPlatform(row) {
             hostname: row.archonHostname,
             gitRef: row.archonGitRef,
         },
+        names: {
+            enabled: row.namesEnabled,
+            hostname: row.namesHostname,
+            gitRef: row.namesGitRef,
+        },
     };
 }
 function platformToRow(platform) {
@@ -497,6 +617,7 @@ function platformToRow(platform) {
         mailEnabled: platform.mail.enabled,
         mailHostname: platform.mail.hostname,
         mailGitRef: platform.mail.gitRef,
+        mailLettermintProjectId: platform.mail.lettermintProjectId ?? null,
         sfuEnabled: platform.sfu.enabled,
         sfuHostname: platform.sfu.hostname,
         sfuGitRef: platform.sfu.gitRef,
@@ -515,6 +636,9 @@ function platformToRow(platform) {
         archonEnabled: platform.archon.enabled,
         archonHostname: platform.archon.hostname,
         archonGitRef: platform.archon.gitRef,
+        namesEnabled: platform.names.enabled,
+        namesHostname: platform.names.hostname,
+        namesGitRef: platform.names.gitRef,
     };
 }
 /**
@@ -549,8 +673,11 @@ export function createPostgresPlatformStore(db) {
                 .limit(1);
             return row?.serviceIds ?? {};
         },
-        async putServiceIds(serviceIds) {
-            await db.update(foundryDeclaredPlatform).set({ serviceIds });
+        async putServiceIds(serviceIds, fence) {
+            await writeFenced(db, fence, (tx) => tx
+                .update(foundryDeclaredPlatform)
+                .set({ serviceIds })
+                .then(() => undefined));
         },
     };
 }