@kedge/cli 0.10.1 → 0.11.0

package/src/deploy.ts

@@ -37,9 +37,16 @@ import {
   sha256,
   storeNames,
   type WranglerJson,
+  withDatabaseId,
 } from "./store";
 
 export const SCOPE = "production";
+/**
+ * The settings a release leaves: no Logpush, no invocation logs, query strings
+ * redacted, because a logged or thrown request is recorded with its URL, which
+ * erasure can't reach (docs/10; p0.11 row 18).
+ */
+const RELEASE_SETTINGS: WorkerSettings = { logpush: false, invocationLogs: false, redactQueryString: true };
 /** Core's secrets, generated only at a first deploy and only where missing (§6.1). */
 export const CORE_SECRETS = [
   "CART_TOKEN_SECRET",
@@ -714,6 +721,25 @@ export class Deployer {
         else blocking.push(i);
         continue;
       }
+      if (i.kind === "triggers") {
+        // A schedule PUT or a settings PATCH sets whole values, so a read-back showing them settles it,
+        // and a lost answer to one that landed doesn't block --resume (salve's codex r7). A mismatch
+        // stays unknown: replaying could race a late landing of the original.
+        const d = JSON.parse(i.detail) as { crons?: string[] } & Partial<WorkerSettings>;
+        const shows = d.crons
+          ? JSON.stringify(await this.d.cf.schedules(this.names.worker)) === JSON.stringify(d.crons)
+          : await this.d.cf
+              .settings(this.names.worker)
+              .then((s) =>
+                (["logpush", "invocationLogs", "redactQueryString"] as const).every(
+                  (k) => d[k] === undefined || s[k] === d[k],
+                ),
+              );
+        if (shows) {
+          await this.ops.closeIntent(i.id, "done", "a read-back shows what it set");
+          continue;
+        }
+      }
       if (i.kind === "activate") {
         const deps = await this.d.cf.deployments(this.names.worker);
         const landed = deps.find((d) => d.message?.includes(i.tag));
@@ -918,8 +944,9 @@ export class Deployer {
     if (!existsSync(file)) return;
     const text = readFileSync(file, "utf8");
     if (this.names.databaseId === PLACEHOLDER_ID) {
-      if (text.includes(PLACEHOLDER_ID)) {
-        writeFileSync(file, text.replace(PLACEHOLDER_ID, id));
+      const written = withDatabaseId(text, id);
+      if (written !== text) {
+        writeFileSync(file, written);
         this.log(`wrangler.jsonc now names database ${id}: commit it`);
       }
     } else if (this.names.databaseId !== id)
@@ -1015,10 +1042,9 @@ export class Deployer {
     const cf = this.d.cf;
     const applied = new Set(await appliedNames(cf, p.databaseId as string));
     const pending = (p.pending ?? []).filter((f) => !applied.has(f));
-    for (const f of [...applied]) {
-      const e = this.d.lock.entries.find((x) => x.file === f);
-      if (e) await this.ops.recordApplied(f, e.sha256);
-    }
+    await this.ops.recordApplied(
+      this.d.lock.entries.filter((e) => applied.has(e.file)).map((e) => [e.file, e.sha256] as const),
+    );
     if (pending.length === 0) return;
     await this.step("migrate");
     const dir = this.dir(this.opId);
@@ -1047,7 +1073,9 @@ export class Deployer {
       );
     } finally {
       const now = new Set(await appliedNames(cf, p.databaseId as string));
-      for (const f of pending) if (now.has(f)) await this.ops.recordApplied(f, this.plan.files[f] as string);
+      await this.ops.recordApplied(
+        pending.filter((f) => now.has(f)).map((f) => [f, this.plan.files[f] as string] as const),
+      );
     }
   }
 
@@ -1116,7 +1144,7 @@ export class Deployer {
     }
     if (!classChange) await this.activate("activate", p.appVersion as string);
     await this.markReleased();
-    await this.triggers(this.plan.config.triggers?.crons ?? [], { logpush: false, invocationLogs: false });
+    await this.triggers(this.plan.config.triggers?.crons ?? [], RELEASE_SETTINGS);
   }
 
   /** Crons and settings, each a single-attempt call read back before it counts (§3.1). */
@@ -1132,13 +1160,17 @@ export class Deployer {
         throw new DeployRefused("the cron schedules didn't read back as set");
     }
     const s = await cf.settings(this.names.worker);
-    if (s.logpush !== settings.logpush || s.invocationLogs !== settings.invocationLogs) {
+    if (
+      s.logpush !== settings.logpush ||
+      s.invocationLogs !== settings.invocationLogs ||
+      s.redactQueryString !== settings.redactQueryString
+    ) {
       await this.step("settings");
       await this.intent("settings", "triggers", this.tag("settings"), settings, () =>
         cf.patchSettings(this.names.worker, settings),
       );
       const back = await cf.settings(this.names.worker);
-      if (back.invocationLogs !== settings.invocationLogs)
+      if (back.invocationLogs !== settings.invocationLogs || back.redactQueryString !== settings.redactQueryString)
         throw new DeployRefused("the Worker's settings didn't read back as set");
     }
   }
@@ -1341,7 +1373,9 @@ export class Deployer {
         );
       await this.reconcile();
       await this.activate("abort", before.versionId);
-      await this.triggers(before.crons ?? [], before.settings ?? { logpush: false, invocationLogs: false });
+      // Redaction stays on through a rollback: a "before" read under 0.10 never
+      // recorded it, and turning it off would put query strings back in the logs.
+      await this.triggers(before.crons ?? [], { ...(before.settings ?? RELEASE_SETTINGS), redactQueryString: true });
       await ops.completeDeployment(p.deploymentId as string, {
         ...before,
         commit: servingCommit((await ops.deployments()).filter((r) => r.id !== p.deploymentId)),
@@ -1612,8 +1646,9 @@ export class Deployer {
     const qid = await cf.findQueue(this.names.queue);
     if (qid) await ops.recordResource("queue", this.names.queue, qid, "ours");
     await ops.recordResource("worker", this.names.worker, null, "ours");
-    for (const f of applied)
-      await ops.recordApplied(f, (this.d.lock.entries.find((e) => e.file === f) as LockEntry).sha256);
+    await ops.recordApplied(
+      applied.map((f) => [f, (this.d.lock.entries.find((e) => e.file === f) as LockEntry).sha256] as const),
+    );
     const half: Half = {
       lockSha: sha256(
         JSON.stringify(this.d.lock.entries.filter((e) => applied.includes(e.file)).map((e) => [e.file, e.sha256])),

package/src/doctor.ts

@@ -50,7 +50,8 @@ type WranglerConfig = {
     renamed_classes?: { from: string; to: string }[];
   }[];
   queues?: { producers?: { binding?: string }[] };
-  observability?: { enabled?: boolean; logs?: { invocation_logs?: boolean } };
+  observability?: { enabled?: boolean; redact_query_string?: boolean; logs?: { invocation_logs?: boolean } };
+  workers_dev?: boolean;
   assets?: { directory?: string; binding?: string; not_found_handling?: string; run_worker_first?: unknown };
   env?: Record<string, { observability?: WranglerConfig["observability"] }>;
 };
@@ -382,8 +383,11 @@ export async function doctor(input: DoctorInput): Promise<CheckResult[]> {
       problems.length ? fail("wrangler", "wrangler.jsonc isn't what a Kedge Worker needs", problems) : pass("wrangler"),
     );
 
-    // invocation-logs: Cloudflare's per-request log records the URL, which erasure can't reach.
-    const off = (o: WranglerConfig["observability"]) => o?.logs?.invocation_logs === false;
+    // invocation-logs: Cloudflare records a request with its URL, which erasure can't reach: every
+    // request with invocation logs on, and one that logs or throws with them off unless its query
+    // string is redacted (p0.11 row 18).
+    const off = (o: WranglerConfig["observability"]) =>
+      o?.logs?.invocation_logs === false && o.redact_query_string === true;
     const where = [
       ...(off(c.observability) ? [] : ["the top level"]),
       ...Object.entries(c.env ?? {})
@@ -394,7 +398,7 @@ export async function doctor(input: DoctorInput): Promise<CheckResult[]> {
       where.length
         ? fail(
             "invocation-logs",
-            `set "observability": { "logs": { "invocation_logs": false } } at ${where.join(", ")}: invocation logs record each request's URL, which can carry a customer's data that erasure can't reach`,
+            `set "observability": { "redact_query_string": true, "logs": { "invocation_logs": false } } at ${where.join(", ")}: Cloudflare records a request with its URL, which can carry a customer's data that erasure can't reach`,
           )
         : pass("invocation-logs"),
     );
@@ -461,13 +465,21 @@ export async function credentialsChecks(input: {
   cf: import("./cf").Cloudflare;
   source: string;
   base: string;
+  /** Whether the store is served at workers.dev; when it isn't, a missing subdomain is no failure (codex code r3). */
+  workersDev?: boolean;
 }): Promise<CheckResult[]> {
   const { NeedsPerson } = await import("./cf");
   const where = `from ${input.source}, sent to ${input.base}, account ${input.cf.account}`;
   const read = await input.cf.readable();
-  const refused = Object.entries(read).filter(([, status]) => status !== null);
+  const refused = Object.entries(read).filter(([, status]) => status !== null && status !== "not served");
+  // A list the platform doesn't serve (salve hosting's Workers) is reported, never a failed credential (p0.11 row 5).
+  const notServed = Object.entries(read)
+    .filter(([, s]) => s === "not served")
+    .map(([kind]) => kind);
+  const lists = (["Workers", "D1", "Queues"] as const).filter((k) => !notServed.includes(k));
+  const unserved = notServed.length ? `; ${notServed.join(" and ")} listing not available here` : "";
   const out: CheckResult[] = [];
-  if (refused.length === Object.keys(read).length && refused.every(([, s]) => s === 401 || s === 403))
+  if (refused.length && refused.length === lists.length && refused.every(([, s]) => s === 401 || s === 403))
     out.push(fail("credentials", `the token doesn't answer for this account (${where})`));
   else if (refused.length)
     out.push(
@@ -481,7 +493,7 @@ export async function credentialsChecks(input: {
     out.push(
       pass(
         "credentials",
-        `${where}; lists Workers, D1 and Queues. Writes are unverified until the first deploy: Workers Scripts Edit, D1 Edit, Queues Edit`,
+        `${where}; lists ${lists.join(", ").replace(/, ([^,]*)$/, " and $1")}${unserved}. Writes are unverified until the first deploy: Workers Scripts Edit, D1 Edit, Queues Edit`,
       ),
     );
   try {
@@ -489,7 +501,9 @@ export async function credentialsChecks(input: {
   } catch (e) {
     // Any answer is a report: a token that can't read the subdomain fails this check, never the run (codex code r7).
     // An account without one is the owner's to choose: a handoff, not a technical failure (codex code r9).
-    if (e instanceof NeedsPerson) out.push({ ...fail("workers.dev", e.handoff), handoff: e.handoff });
+    if (e instanceof NeedsPerson && input.workersDev === false)
+      out.push(skip("workers.dev", 'none, and none needed: wrangler.jsonc says "workers_dev": false'));
+    else if (e instanceof NeedsPerson) out.push({ ...fail("workers.dev", e.handoff), handoff: e.handoff });
     else out.push(fail("workers.dev", (e as Error).message));
   }
   return out;
@@ -549,7 +563,9 @@ export async function doctorRemote(input: RemoteDoctorInput): Promise<CheckResul
     if (last.crons && JSON.stringify(crons) !== JSON.stringify(last.crons))
       problems.push(`crons are ${JSON.stringify(crons)}, recorded ${JSON.stringify(last.crons)}`);
     const settings = await input.cf.settings(names.worker);
-    if (last.settings && JSON.stringify(settings) !== JSON.stringify(last.settings))
+    // Only what was recorded: a 0.10 deployment recorded no redaction, and isn't drift for lacking it.
+    const recorded = last.settings;
+    if (recorded && (Object.keys(recorded) as (keyof typeof recorded)[]).some((k) => settings[k] !== recorded[k]))
       problems.push(`settings are ${JSON.stringify(settings)}, recorded ${JSON.stringify(last.settings)}`);
     const held = await ops.current(SCOPE);
     out.push(
@@ -560,6 +576,15 @@ export async function doctorRemote(input: RemoteDoctorInput): Promise<CheckResul
             held ? `operation ${held.op_id} (${held.kind}) holds the store at "${held.step}"` : undefined,
           ),
     );
+    // workers-dev: Wrangler enables workers.dev after a deploy lands, and a platform serving the store elsewhere
+    // refuses that (salve hosting, 400/10400), so every `wrangler deploy` would exit non-zero after landing.
+    if (readWrangler(input.cwd)?.config.workers_dev !== false && !(await input.cf.workersDevUrl(names.worker)))
+      out.push(
+        fail(
+          "workers-dev",
+          `wrangler.jsonc has "workers_dev": true, but ${names.worker} isn't served at workers.dev: on a host that serves it at its own address (salve hosting), set "workers_dev": false and commit it`,
+        ),
+      );
     // do-classes: rollback across a class change is blocked (a warning).
     const planned = (readWrangler(input.cwd)?.config.migrations ?? []) as unknown[];
     if (JSON.stringify(planned) !== JSON.stringify(last.doMigrations ?? []))

package/src/main.ts

@@ -37,7 +37,7 @@ import {
 } from "./commands";
 import { ComposeError, compose, type Lock } from "./compose";
 import { type Executor, wranglerExecute } from "./d1-batch";
-import { credentialsChecks, doctor, doctorRemote, formatReport } from "./doctor";
+import { credentialsChecks, doctor, doctorRemote, formatReport, readWrangler } from "./doctor";
 import { invariantsMarkdown, invariantsOf } from "./invariants";
 import { installedPackages } from "./manifest";
 import { emit, withJsonOutput } from "./output";
@@ -128,8 +128,8 @@ async function inviteOrigin(
     }
   }
   try {
-    const worker = storeNames(cwd).names.worker;
-    return `https://${worker}.${await (cf ?? (await cloudflareFor(env, cwd))).workersSubdomain()}.workers.dev`;
+    // Only where it's served: elsewhere (salve hosting) the link needs --url, the address its host gives.
+    return await (cf ?? (await cloudflareFor(env, cwd))).workersDevUrl(storeNames(cwd).names.worker);
   } catch {
     return null;
   }
@@ -368,7 +368,12 @@ async function run(argv: string[], cwd: string, deps: RunDeps & { json: boolean
       if (auth) {
         const cf = restCloudflare(d.env, fetch, wranglerBin(), auth);
         const lock = JSON.parse(readFileSync(join(cwd, "kedge.lock.json"), "utf8")) as Lock;
-        const creds = await credentialsChecks({ cf, source: auth.source, base: cloudflareBase(d.env) });
+        const creds = await credentialsChecks({
+          cf,
+          source: auth.source,
+          base: cloudflareBase(d.env),
+          workersDev: readWrangler(cwd)?.config.workers_dev !== false,
+        });
         results.push(...creds);
         // Credentials that can't read the account would make every later check throw, not report (codex code r7).
         if (creds.some((c) => c.status === "fail"))

package/src/ops.ts

@@ -53,6 +53,15 @@ export const OPS_SCHEMA = [
     classes TEXT NOT NULL DEFAULT '[]', destroyed_at INTEGER NOT NULL)`,
 ];
 
+/** Every table and index OPS_SCHEMA makes, by name. */
+const OPS_OBJECTS = OPS_SCHEMA.map((s) => (/IF NOT EXISTS (\w+)/.exec(s) as RegExpExecArray)[1] as string);
+
+/**
+ * Rows per INSERT into `applied`: three bound parameters each, under D1's 100
+ * per query (https://developers.cloudflare.com/d1/platform/limits/).
+ */
+const APPLIED_ROWS = 33;
+
 export class OperationHeld extends Error {
   constructor(readonly held: OperationRow) {
     super(
@@ -128,7 +137,13 @@ export class OpsStore {
   ) {}
 
   async init(store: string): Promise<void> {
-    for (const s of OPS_SCHEMA) await this.q(s);
+    // Every object already there: the statements would change nothing, and a platform's rate limit counts
+    // each one (salve: 120 a minute per app, p0.11 row 16). The schema only ever gains objects, never columns.
+    const present = await this.q(
+      `SELECT name FROM sqlite_master WHERE name IN (${OPS_OBJECTS.map(() => "?").join(", ")})`,
+      OPS_OBJECTS,
+    );
+    if (present.length !== OPS_OBJECTS.length) for (const s of OPS_SCHEMA) await this.q(s);
     await this.q("INSERT INTO kedge_ops_meta (id, store, created_at) VALUES (1, ?, ?) ON CONFLICT (id) DO NOTHING", [
       store,
       this.now(),
@@ -344,12 +359,16 @@ export class OpsStore {
     return new Map((await this.q("SELECT file, sha256 FROM applied")).map((r) => [String(r.file), String(r.sha256)]));
   }
 
-  async recordApplied(file: string, sha256: string): Promise<void> {
-    await this.q("INSERT INTO applied (file, sha256, applied_at) VALUES (?, ?, ?) ON CONFLICT (file) DO NOTHING", [
-      file,
-      sha256,
-      this.now(),
-    ]);
+  /** Each applied file's hash, the first recorded kept: one statement per 33 files, not one per file (p0.11 row 16). */
+  async recordApplied(files: readonly (readonly [file: string, sha256: string])[]): Promise<void> {
+    const t = this.now();
+    for (let i = 0; i < files.length; i += APPLIED_ROWS) {
+      const chunk = files.slice(i, i + APPLIED_ROWS);
+      await this.q(
+        `INSERT INTO applied (file, sha256, applied_at) VALUES ${chunk.map(() => "(?, ?, ?)").join(", ")} ON CONFLICT (file) DO NOTHING`,
+        chunk.flatMap(([f, h]) => [f, h, t]),
+      );
+    }
   }
 
   // ---- the store's own resources (§6.1) ------------------------------------------------------------------

package/src/preview.ts

@@ -200,6 +200,7 @@ export function previewConfig(source: WranglerJson, p: PreviewWorker): Record<st
     workers_dev: true,
     observability: {
       ...observability,
+      redact_query_string: true,
       logs: { ...((observability.logs as object | undefined) ?? {}), invocation_logs: false },
     },
     vars: { ...vars, ADMIN_ORIGINS: [...origins].join(","), KEDGE_ENVIRONMENT: "preview" },
@@ -720,6 +721,10 @@ class PreviewRun {
         // recreates under a new nonce, where a late landing can't replace it, and the sweep removes
         // what lands on the old name (codex code r4).
         if (e instanceof UnknownOutcome) await this.write("state = 'destroying', lost_create = 1", []);
+        // A host that serves one Worker per store refuses this upload (salve hosting), after the preview's
+        // database and queue exist: the way out is named, never inferred from the platform's words (p0.11 row 8).
+        if (e instanceof Error)
+          e.message += `\nThe preview's database and queue exist: remove what it made with kedge preview destroy --name ${this.name}. A host that serves one Worker per store (salve hosting) has no previews: test on kedge dev instead.`;
         throw e;
       } finally {
         if (secretsFile) rmSync(secretsFile, { force: true });

package/src/store-api.ts

@@ -18,11 +18,18 @@ export async function storeRequest(
   const write = (init.method ?? "GET") !== "GET";
   let r: Response;
   try {
-    r = await f(url, init);
+    // No redirect is followed (p0.11 §3): a session is bound to the origin it was sent to, and the
+    // person names the store's URL, not something in front of it that sends the request elsewhere.
+    r = await f(url, { ...init, redirect: "manual" });
   } catch {
     if (write) throw new UnknownOutcome(what, "the store");
     throw new DeployRefused(`${what}: the store didn't answer`);
   }
+  // Kedge's API never redirects, so this answer came from in front of the Worker, which ran nothing.
+  if (r.status >= 300 && r.status < 400)
+    throw new DeployRefused(
+      `${what} answered a redirect${r.headers.get("location") ? ` to ${r.headers.get("location")}` : ""}: the CLI follows none, so give the store's own URL`,
+    );
   let body: Record<string, unknown>;
   try {
     body = (await r.json()) as Record<string, unknown>;

package/src/store.ts

@@ -13,6 +13,17 @@ import { byCodePoint } from "./order";
 /** The starter's id until a first deploy writes the real one (§6.1). */
 export const PLACEHOLDER_ID = "00000000-0000-0000-0000-000000000000";
 
+/**
+ * wrangler.jsonc with `id` written over the placeholder `database_id`, and
+ * only there: `preview_database_id` keeps the zeros, because Wrangler keys the
+ * local database by it, and rewriting it would open an empty local store after
+ * the first deploy (p0.11 row 17). The opening quote keeps the pattern off
+ * `"preview_database_id"`, so the keys' order doesn't matter.
+ */
+export function withDatabaseId(text: string, id: string): string {
+  return text.replace(new RegExp(`("database_id"\\s*:\\s*")${PLACEHOLDER_ID}"`), `$1${id}"`);
+}
+
 export interface StoreNames {
   worker: string;
   database: string;
@@ -24,7 +35,13 @@ export interface StoreNames {
 export type WranglerJson = Record<string, unknown> & {
   name?: string;
   main?: string;
-  d1_databases?: { binding?: string; database_name?: string; database_id?: string; migrations_dir?: string }[];
+  d1_databases?: {
+    binding?: string;
+    database_name?: string;
+    database_id?: string;
+    preview_database_id?: string;
+    migrations_dir?: string;
+  }[];
   queues?: { producers?: { binding?: string; queue?: string }[]; consumers?: { queue?: string }[] };
   migrations?: Record<string, unknown>[];
   triggers?: { crons?: string[] };
@@ -75,14 +92,19 @@ export function git(cwd: string): Git {
       if (r.status !== 0) throw new Error("kedge deploy needs a Git repository with a commit");
       return r.stdout.trim();
     },
+    // A store may sit below its repository's root (create-kedge reuses a workspace's repository, p0.11
+    // row 12): status covers the store's own directory, and its paths are the store's, as `show` reads
+    // them (codex code r5).
     dirty() {
-      return run(["status", "--porcelain"])
+      const prefix = run(["rev-parse", "--show-prefix"]).stdout.trim();
+      return run(["status", "--porcelain", "--", "."])
         .stdout.split("\n")
         .filter(Boolean)
-        .map((l) => l.slice(3));
+        .map((l) => l.slice(3))
+        .map((p) => (p.startsWith(prefix) ? p.slice(prefix.length) : p));
     },
     show(path) {
-      const r = run(["show", `HEAD:${path}`]);
+      const r = run(["show", `HEAD:./${path}`]);
       return r.status === 0 ? r.stdout : null;
     },
     isAncestor(older, newer) {
@@ -100,7 +122,7 @@ export function dirtyBeyondId(cwd: string, g: Git, databaseId: string | null): s
   return g.dirty().filter((p) => {
     if (p !== "wrangler.jsonc" || !databaseId) return true;
     const head = g.show("wrangler.jsonc");
-    return head === null || head.replace(PLACEHOLDER_ID, databaseId) !== readFileSync(join(cwd, p), "utf8");
+    return head === null || withDatabaseId(head, databaseId) !== readFileSync(join(cwd, p), "utf8");
   });
 }
 

package/src/target.ts

@@ -1,11 +1,13 @@
 // Which store a URL is (docs/proposals/p0.10-agent-path.md §4, §6.2). The CLI
 // sends a session, a saved key or a run's record only to a target it can name
 // by identity: production or a preview this store's `<store>-ops` records, or
-// `kedge dev` on this machine. Anything else gets nothing, so an unknown
-// endpoint never receives a token. A store is its account, Worker and
+// `kedge dev` on this machine. Any other https URL may be production under
+// another name (salve hosting's, a custom domain), and is proved before it
+// gets anything but the proof's own session, bound to that URL's origin and so
+// useless anywhere else (p0.11 §3). A store is its account, Worker and
 // database, not its URL: the account's owner can change the workers.dev
 // subdomain, so the URL is computed from the current one on every run.
-import type { Cloudflare } from "./cf";
+import { type Cloudflare, NeedsPerson } from "./cf";
 import { openOps } from "./deploy";
 import { storeNames } from "./store";
 
@@ -17,6 +19,12 @@ export interface StoreTarget {
   identity: { account: string; worker: string; database: string };
   /** Where a CLI session's row is written: that target's own database, and no other. */
   database: { name: string; id: string | null };
+  /**
+   * A URL the person gave rather than one the CLI derived (salve's, a custom
+   * domain): it's proved to be this store before any other request goes there
+   * (p0.11 §3).
+   */
+  proof?: true;
 }
 
 /**
@@ -55,8 +63,7 @@ export async function resolveTarget(
   if (!(await cf.findD1(names.ops))) return null;
   const { ops } = await openOps(cf, names);
   const host = (worker: string, subdomain: string) => `https://${worker}.${subdomain}.workers.dev`;
-  const subdomain = await cf.workersSubdomain();
-  if (u.origin === host(names.worker, subdomain)) {
+  const production = async (proof: boolean): Promise<StoreTarget | null> => {
     const db = await ops.resource("d1", names.database);
     if (!db?.id) return null;
     return {
@@ -64,14 +71,35 @@ export async function resolveTarget(
       url: u.origin,
       identity: { account: cf.account, worker: names.worker, database: db.id },
       database: { name: names.database, id: db.id },
+      ...(proof ? { proof: true as const } : {}),
     };
+  };
+  // Derived only where the Worker is served at workers.dev: a platform's stand-in subdomain (salve's) names
+  // a host the store isn't on, which then gets the proof like any other URL (p0.11 row 2).
+  // A store served only at its own domain, on an account without a subdomain, still resolves (codex code r3).
+  const devUrl = await cf.workersDevUrl(names.worker).catch((e: unknown) => {
+    if (e instanceof NeedsPerson) return null;
+    throw e;
+  });
+  if (u.origin === devUrl) return production(false);
+  // A preview is only ever at workers.dev, so only such a host asks for the account's subdomain. The whole
+  // origin, as a preview's is made: a host that only begins with a preview's name isn't it.
+  let p: Record<string, unknown> | undefined;
+  if (u.hostname.endsWith(".workers.dev")) {
+    const subdomain = await cf.workersSubdomain().catch((e: unknown) => {
+      if (e instanceof NeedsPerson) return null;
+      throw e;
+    });
+    const rows = subdomain
+      ? await ops.query(
+          "SELECT worker, database_name, database_id FROM preview WHERE state = 'bootstrapped' AND database_id IS NOT NULL",
+        )
+      : [];
+    p = rows.find((r) => u.origin === host(String(r.worker), subdomain as string));
   }
-  // The whole origin, as a preview's is made: a host that only begins with a preview's name isn't it.
-  const rows = await ops.query(
-    "SELECT worker, database_name, database_id FROM preview WHERE state = 'bootstrapped' AND database_id IS NOT NULL",
-  );
-  const p = rows.find((r) => u.origin === host(String(r.worker), subdomain));
-  if (!p) return null;
+  // Any other https origin may be production under another name (salve hosting's, a custom domain):
+  // the proof decides, before a session's token goes there (p0.11 row 1).
+  if (!p) return production(true);
   return {
     kind: "preview",
     url: u.origin,