@wtfalch/foundry 0.24.0 → 0.25.0

package/dist/bootstrap/declare.js

@@ -146,5 +146,9 @@ export function declaredPlatformFor(apex, serverIpv4) {
         apex,
         ...(serverIpv4 ? { serverIpv4 } : {}),
         ...services,
+        // Off, like `sfu`: the pin is an Archon release tag and digest, which exist
+        // only after Archon runs. Declared on with no pin, it would be reported
+        // blocked and the bootstrap would never be complete.
+        uptime: { enabled: false, tag: '', sha256: '' },
     };
 }

package/dist/index.d.ts

@@ -41,7 +41,7 @@ export { checkMailIdentityAudience } from './plan/index.js';
 export type { MailAllowlistApp } from './plan/index.js';
 export { checkMailAppsAllowlist } from './plan/index.js';
 export { FoundryPlatformStepExecutor, ProvidersPlatformCloudflareReader, ProvidersPlatformCoolifyReader, createZitadelAdminMinter, createZitadelProjectRoles, PLATFORM_AUTH_KEY, PLATFORM_MAIL_KEY, PLATFORM_MAIL_ADMIN_KEY_DESCRIPTION, } from './plan/index.js';
-export type { PlatformAuthDeps, PlatformAuthRuntime, PlatformFilesDeps, PlatformFilesRuntime, PlatformEdgeDeps, PlatformDnsFactory, PlatformAccessFactory, PlatformAccessPort, PlatformTunnelsFactory, PlatformEdgeRuntime, } from './plan/index.js';
+export type { PlatformAuthDeps, PlatformAuthRuntime, PlatformFilesDeps, PlatformFilesRuntime, PlatformEdgeDeps, PlatformDnsFactory, PlatformAccessFactory, PlatformUptimeAccessFactory, PlatformUptimeAccessPort, PlatformUptimeDeps, PlatformWorkersFactory, PlatformWorkersPort, PlatformAccessPort, PlatformTunnelsFactory, PlatformEdgeRuntime, } from './plan/index.js';
 export type { PlatformMailDeps, PlatformMailAdminPort, PlatformMailRuntime, } from './plan/index.js';
 export { FILES_INTROSPECTION_SECRET_REF, FILES_MANAGEMENT_ISSUER, FILES_MANAGEMENT_KEY_ID, FILES_MANAGEMENT_KEY_REF, PLATFORM_AUTH_INSTANCE_BEARER_REF, } from './plan/index.js';
 export { AI_MANAGEMENT_ISSUER, AI_MANAGEMENT_KEY_ID, AI_SIGNING_KEY_REF, AiManagementKeyExistsError, createAiManagementKeyMinter, PLATFORM_AI_MANAGEMENT_KEY_REF, PLATFORM_AI_MANAGEMENT_PERMISSIONS, } from './plan/index.js';

package/dist/migrations/0049_platform_uptime.sql

@@ -0,0 +1,11 @@
+-- @wtfalch/foundry: the uptime Worker on the declared platform (foundry#542).
+-- Mirrors `src/store/schema.ts`'s `foundryDeclaredPlatform` additions.
+-- `uptime_tag` and `uptime_sha256` are the pin of the Archon release whose
+-- built Worker foundry deploys; both empty means nothing is pinned yet, and
+-- the planner reports that instead of planning the step. The Worker is on by
+-- default, like every service except sfu and coolify.
+
+alter table foundry_declared_platform
+  add column if not exists uptime_enabled boolean not null default true,
+  add column if not exists uptime_tag text not null default '',
+  add column if not exists uptime_sha256 text not null default '';

package/dist/plan/edge-access.d.ts

@@ -29,6 +29,7 @@ export interface AccessPort {
     listAccessPolicies(appId: string): Promise<Array<{
         id: string;
         name: string;
+        decision?: AccessDecision;
         include?: AccessPolicyRule[];
     }>>;
     createAccessPolicy(appId: string, policy: {
@@ -46,6 +47,19 @@ export interface AccessPort {
     findServiceTokenByName(name: string): Promise<{
         id: string;
     } | undefined>;
+    /**
+     * Mints a service token through edge (edge 0.12.0). `clientId` and
+     * `clientSecret` come back once and are never returned again; a token of that
+     * name, made by edge or not, answers `EdgeApiError` `conflict`.
+     */
+    createServiceToken(name: string): Promise<{
+        id: string;
+        name: string;
+        clientId: string;
+        clientSecret: string;
+    }>;
+    /** Removes a token edge created. `not_found` for any other; a token already gone is success. */
+    removeServiceToken(id: string): Promise<void>;
     deleteAccessApp(appId: string): Promise<void>;
     /**
      * A company's gate: an Access application over `hostnames`, one policy

package/dist/plan/edge-access.js

@@ -26,6 +26,8 @@ export function createEdgeAccess(client, options = {}) {
         listPolicies: (appId) => retrying(() => client.listPolicies(appId)),
         createPolicy: (appId, input) => retrying(() => client.createPolicy(appId, input)),
         findServiceToken: (name) => retrying(() => client.findServiceToken(name)),
+        createServiceToken: (input) => retrying(() => client.createServiceToken(input)),
+        removeServiceToken: (id) => retrying(() => client.removeServiceToken(id)),
         adopt: (input) => retrying(() => client.adopt(input)),
         readiness: () => retrying(() => client.readiness()),
         ensureProvider: (input) => retrying(() => client.ensureProvider(input)),
@@ -103,7 +105,12 @@ export function createEdgeAccess(client, options = {}) {
         },
         async listAccessPolicies(appId) {
             const { policies } = await onApp(appId, () => access.listPolicies(appId));
-            return policies.map((p) => ({ id: p.id, name: p.name, include: p.include }));
+            return policies.map((p) => ({
+                id: p.id,
+                name: p.name,
+                decision: p.decision,
+                include: p.include,
+            }));
         },
         async createAccessPolicy(appId, policy) {
             const created = await onApp(appId, () => writeSlot(() => access.createPolicy(appId, policy)));
@@ -121,6 +128,19 @@ export function createEdgeAccess(client, options = {}) {
                 throw error;
             }
         },
+        async createServiceToken(name) {
+            // Not retried on anything but `rate_limited`: a second mint would be a second token.
+            const minted = await writeSlot(() => access.createServiceToken({ name }));
+            return {
+                id: minted.token.id,
+                name: minted.token.name,
+                clientId: minted.clientId,
+                clientSecret: minted.clientSecret,
+            };
+        },
+        async removeServiceToken(id) {
+            await writeSlot(() => access.removeServiceToken(id));
+        },
         async deleteAccessApp(appId) {
             await onApp(appId, () => writeSlot(() => access.remove(appId)));
         },

package/dist/plan/edge-workers.d.ts

@@ -5,6 +5,21 @@ import type { WorkersPort } from './executor.js';
 export type EdgePlatformWorkers = ReturnType<typeof createEdgeClient>['platform']['workers'];
 /** Edge answers a first upload of a name that another upload is making, or a delete in flight, `conflict` + `busy`. */
 export declare const EDGE_WORKERS_BUSY_ATTEMPTS = 5;
+/**
+ * What the platform's uptime Worker step needs beyond {@link WorkersPort}
+ * (edge 0.11.0): cron triggers and write-only secrets, both for a script edge
+ * owns. A secret with a `version` edge already holds is skipped; a new
+ * `version` sets the value again. Edge never returns a value, and nothing here
+ * keeps one.
+ */
+export interface PlatformWorkersPort extends WorkersPort {
+    setSchedules(name: string, crons: readonly string[]): Promise<void>;
+    setSecrets(name: string, secrets: readonly {
+        name: string;
+        value: string;
+        version: string;
+    }[]): Promise<void>;
+}
 /** What the host supplies: fetches the artifact and returns its bytes, verified against `sha256`. Foundry never fetches. */
 export interface EdgeWorkersOptions {
     fetchArtifact: (url: string, sha256: string) => Promise<Uint8Array>;
@@ -28,4 +43,4 @@ export interface EdgeWorkersOptions {
  * foundry refuses to overwrite is never adopted. A 404 on a delete means gone.
  * A `rate_limited` or `busy` answer is retried.
  */
-export declare function createEdgeWorkers(client: EdgePlatformWorkers, options: EdgeWorkersOptions): WorkersPort;
+export declare function createEdgeWorkers(client: EdgePlatformWorkers, options: EdgeWorkersOptions): PlatformWorkersPort;

package/dist/plan/edge-workers.js

@@ -149,6 +149,14 @@ export function createEdgeWorkers(client, options) {
             }
             adoptedRoutes.delete(`${zoneId}/${routeId}`);
         },
+        async setSchedules(name, crons) {
+            await adoptScript(name);
+            await writeSlot(() => retrying(() => client.setSchedules(name, { crons: [...crons] })));
+        },
+        async setSecrets(name, secrets) {
+            await adoptScript(name);
+            await writeSlot(() => retrying(() => client.setSecrets(name, { secrets: secrets.map((s) => ({ ...s })) })));
+        },
         async deleteScript(name) {
             if (!(await adoptScript(name)))
                 return;

package/dist/plan/executor.d.ts

@@ -449,6 +449,19 @@ export interface WorkersRateLimitBinding {
         period: number;
     };
 }
+/** A Workers KV namespace binding (edge 0.11.0): edge reuses the namespace titled `title` or creates it, and deletes one it created with the script. */
+export interface WorkersKvBinding {
+    type: 'kv_namespace';
+    name: string;
+    title: string;
+}
+/** A plain text variable binding (edge 0.11.0). Never for a secret: those go through {@link PlatformWorkersPort.setSecrets}. */
+export interface WorkersPlainTextBinding {
+    type: 'plain_text';
+    name: string;
+    text: string;
+}
+export type WorkersBinding = WorkersRateLimitBinding | WorkersKvBinding | WorkersPlainTextBinding;
 /**
  * The Workers calls `cloudflareWorker` makes (#318, F8), served by edge's
  * `platform.workers` through `createEdgeWorkers` (`edge-workers.ts`): deploys
@@ -484,7 +497,7 @@ export interface WorkersPort {
         artifactUrl: string;
         artifactSha256: string;
         compatibilityDate: string;
-        bindings?: WorkersRateLimitBinding[];
+        bindings?: WorkersBinding[];
     }): Promise<void>;
     /** The script name currently bound to `pattern` in `zoneId`, or `undefined` for no route there. */
     findRoute(zoneId: string, pattern: string): Promise<{

package/dist/plan/index.d.ts

@@ -46,7 +46,8 @@ export type { DnsPort, DnsRecordInput, DnsRecordSummary, EdgePlatformDns } from
 export { createEdgeAccess } from './edge-access.js';
 export type { AccessAppSummary, AccessDecision, AccessPolicyRule, AccessPort, EdgePlatformAccess, } from './edge-access.js';
 export { createEdgeWorkers } from './edge-workers.js';
-export type { EdgePlatformWorkers, EdgeWorkersOptions } from './edge-workers.js';
+export type { EdgePlatformWorkers, EdgeWorkersOptions, PlatformWorkersPort, } from './edge-workers.js';
+export type { PlatformUptimeAccessFactory, PlatformUptimeAccessPort, PlatformUptimeDeps, PlatformWorkersFactory, } from './uptime-worker.js';
 export { createEdgeRateLimits } from './edge-ratelimits.js';
 export type { EdgePlatformRateLimits, EdgeRateLimitsOptions, RateLimitPort, RateLimitRuleInput, } from './edge-ratelimits.js';
 export { createEdgeZones } from './edge-zones.js';

package/dist/plan/plan-apply.d.ts

@@ -224,6 +224,10 @@ export interface PlatformStepExecutor {
         hc?: string;
         /** #540: see `PlanPlatformOptions.blocked.heartbeatsExecutorMissing` (`platform-diff.ts`). */
         heartbeatsExecutorMissing?: boolean;
+        /** foundry#542: see `PlanPlatformOptions.blocked.uptime` (`platform-diff.ts`). */
+        uptime?: string;
+        /** foundry#542: see `PlanPlatformOptions.blocked.uptimeSecretsHeld` (`platform-diff.ts`). */
+        uptimeSecretsHeld?: string[];
         /** See `PlanPlatformOptions.blocked.archonRunsInsideApp`. */
         archonRunsInsideApp?: boolean;
         /** See `PlanPlatformOptions.blocked.archonDeployRunning`. */

package/dist/plan/platform-diff.d.ts

@@ -822,6 +822,79 @@ export declare function heartbeatCheckUrlRef(name: string): string;
  * bootstrapping at all.
  */
 export declare const PLATFORM_HEARTBEATS_APPLIED_SCOPE_KEY = "heartbeats_applied_desired";
+/**
+ * foundry#542: the uptime Worker, Archon's outside prober, deployed from the
+ * built script Archon publishes with each release. The step is
+ * `cloudflare:worker` keyed {@link PLATFORM_UPTIME_KEY}; `runPlatformSteps`
+ * records the script name under `cloudflare:worker:platform:uptime` once it
+ * succeeds, which is what stops `planUptime` planning it again.
+ */
+export declare const PLATFORM_UPTIME_KEY = "platform:uptime";
+/** The Worker script's name at Cloudflare. */
+export declare const PLATFORM_UPTIME_SCRIPT_NAME = "platform-uptime";
+/** The Workers KV namespace title behind the Worker's `UPTIME_KV` binding. */
+export declare const PLATFORM_UPTIME_KV_TITLE = "platform-uptime";
+/**
+ * foundry#542: the held-key refs of the Worker's secrets. `UPTIME_TOKEN` is
+ * minted by the step (the token Archon's `UPTIME_TOKEN` env var also takes);
+ * the Access pair is minted through edge by the step, and the other two are held by a person. A missing one is reported as
+ * a blocked item, never a throw.
+ */
+export declare const PLATFORM_UPTIME_TOKEN_REF = "uptime:worker:token";
+export declare const PLATFORM_UPTIME_ACCESS_CLIENT_ID_REF = "uptime:worker:access-client-id";
+export declare const PLATFORM_UPTIME_ACCESS_CLIENT_SECRET_REF = "uptime:worker:access-client-secret";
+export declare const PLATFORM_UPTIME_CHAT_TOKEN_REF = "uptime:worker:chat-token";
+export declare const PLATFORM_UPTIME_MAIL_KEY_REF = "uptime:worker:mail-key";
+/**
+ * Worker secret name to the held-key ref it is read from, for the secrets a
+ * person holds. `UPTIME_TOKEN` and the two `CF_ACCESS_CLIENT_*` secrets are
+ * minted by the step and always set, so they are not listed.
+ */
+export declare const PLATFORM_UPTIME_OPTIONAL_SECRETS: Readonly<Record<string, string>>;
+/**
+ * foundry#542: scope keys (colon-free), the {@link PLATFORM_EDGE_PLATFORM_KEY_UNDELIVERED_SCOPE_KEY}
+ * pattern once. The undelivered id is recorded and persisted the moment the
+ * token is generated; the guard is recorded as soon as the value is durably
+ * held, before anything is sent to the Worker or Archon. Setting the value on
+ * the Worker and on Archon is repeated from the held value on every apply
+ * that needs it. Neither key holds the token; the id is the Worker secret's
+ * version label.
+ */
+export declare const PLATFORM_UPTIME_TOKEN_UNDELIVERED_SCOPE_KEY = "uptime_token_undelivered";
+export declare const PLATFORM_UPTIME_TOKEN_ID_SCOPE_KEY = "uptime_token_id";
+/** The token id Archon's env was last written with; `planArchon` plans again when it differs from {@link PLATFORM_UPTIME_TOKEN_ID_SCOPE_KEY}. */
+export declare const PLATFORM_ARCHON_UPTIME_TOKEN_SYNCED_SCOPE_KEY = "archon_uptime_token_synced";
+/** The tag, sha256 and Archon hostname the last successful run applied; a change plans the step again and mints nothing. */
+export declare const PLATFORM_UPTIME_APPLIED_TAG_SCOPE_KEY = "uptime_applied_tag";
+export declare const PLATFORM_UPTIME_APPLIED_SHA256_SCOPE_KEY = "uptime_applied_sha256";
+export declare const PLATFORM_UPTIME_APPLIED_HOSTNAME_SCOPE_KEY = "uptime_applied_hostname";
+/** The secret names (names only) the last run set, sorted and comma-joined: a newly held secret plans the step again. */
+export declare const PLATFORM_UPTIME_APPLIED_SECRETS_SCOPE_KEY = "uptime_applied_secrets";
+/** A digest of the plain text variables the last run uploaded (they are not secrets): a changed one plans the step again. */
+export declare const PLATFORM_UPTIME_APPLIED_VARS_SCOPE_KEY = "uptime_applied_vars";
+/** `'1'` once the step removed the Worker because the platform no longer enables it; cleared when it deploys again. */
+export declare const PLATFORM_UPTIME_REMOVED_SCOPE_KEY = "uptime_removed";
+/** The digest of the Worker's plain text variables that are set; empty when none is. */
+export declare function uptimeVarsDigest(vars?: Readonly<Record<string, string | undefined>>): string;
+/** The Worker secret names the step sets: the three it mints, and each held one. */
+export declare function uptimeSecretNames(held: readonly string[]): string;
+/** The Access service token's name at Cloudflare; edge answers `conflict` when a token of this name exists. */
+export declare const PLATFORM_UPTIME_ACCESS_TOKEN_NAME = "platform-uptime";
+/**
+ * The Access service token pair, minted through edge once: the same
+ * undelivered-then-guard pattern as the Worker token above. The undelivered
+ * id is recorded and persisted the moment edge returns the pair; the guard is
+ * recorded once both values are held. A pair that may be lost (the undelivered
+ * id without its guard, or the guard with nothing held) is repaired by the
+ * next apply: it removes that token through edge and mints again. Both are
+ * ids, never a value. Archon's step reads the guard to allow the token.
+ */
+export declare const PLATFORM_UPTIME_ACCESS_UNDELIVERED_SCOPE_KEY = "uptime_access_undelivered";
+export declare const PLATFORM_UPTIME_ACCESS_TOKEN_ID_SCOPE_KEY = "uptime_access_token_id";
+/** Why the pair cannot be minted: a token of the name exists and foundry has no id recorded for it. */
+export declare function uptimeAccessTokenConflict(): string;
+/** Whether anything of the uptime Worker is recorded that disabling it must remove. */
+export declare function uptimeRecorded(recordedIds: Readonly<Record<string, string>>): boolean;
 /**
  * Options for {@link planPlatform}, replacing four positional arguments that
  * shifted on every merge that added a platform service (#186, #187, #188) --
@@ -898,6 +971,21 @@ export interface PlanPlatformOptions {
          * Not a block.
          */
         archonRunsInsideApp?: boolean;
+        /** foundry#542: why the uptime Worker is blocked, or absent when it is not. */
+        uptime?: string;
+        /** foundry#542: the optional Worker secret names (`CF_ACCESS_CLIENT_ID`, ...) that are held now; names only. */
+        uptimeSecretsHeld?: string[];
+        /**
+         * foundry#542: what the host reads back for the uptime Worker: whether the
+         * Worker token and the Access pair are held, and the digest of its plain
+         * text variables ({@link uptimeVarsDigest}). Nothing held plans the step
+         * again; it repairs that, it is not a block.
+         */
+        uptimeHeld?: {
+            token: boolean;
+            access: boolean;
+            vars: string;
+        };
         /** Why Archon's step must wait: the deployment it triggered is still running. Blocks even an applied step. */
         archonDeployRunning?: string;
     };

package/dist/plan/platform-diff.js

@@ -1,3 +1,4 @@
+import { createHash } from 'node:crypto';
 import { VERSIONS } from '../bootstrap/versions.js';
 import { APP_ENTRY_KEY } from '../org.js';
 import { VERSION_CHANGE_KIND, } from '../plan.js';
@@ -920,6 +921,100 @@ export function heartbeatCheckUrlRef(name) {
  * bootstrapping at all.
  */
 export const PLATFORM_HEARTBEATS_APPLIED_SCOPE_KEY = 'heartbeats_applied_desired';
+/**
+ * foundry#542: the uptime Worker, Archon's outside prober, deployed from the
+ * built script Archon publishes with each release. The step is
+ * `cloudflare:worker` keyed {@link PLATFORM_UPTIME_KEY}; `runPlatformSteps`
+ * records the script name under `cloudflare:worker:platform:uptime` once it
+ * succeeds, which is what stops `planUptime` planning it again.
+ */
+export const PLATFORM_UPTIME_KEY = 'platform:uptime';
+/** The Worker script's name at Cloudflare. */
+export const PLATFORM_UPTIME_SCRIPT_NAME = 'platform-uptime';
+/** The Workers KV namespace title behind the Worker's `UPTIME_KV` binding. */
+export const PLATFORM_UPTIME_KV_TITLE = 'platform-uptime';
+/**
+ * foundry#542: the held-key refs of the Worker's secrets. `UPTIME_TOKEN` is
+ * minted by the step (the token Archon's `UPTIME_TOKEN` env var also takes);
+ * the Access pair is minted through edge by the step, and the other two are held by a person. A missing one is reported as
+ * a blocked item, never a throw.
+ */
+export const PLATFORM_UPTIME_TOKEN_REF = 'uptime:worker:token';
+export const PLATFORM_UPTIME_ACCESS_CLIENT_ID_REF = 'uptime:worker:access-client-id';
+export const PLATFORM_UPTIME_ACCESS_CLIENT_SECRET_REF = 'uptime:worker:access-client-secret';
+export const PLATFORM_UPTIME_CHAT_TOKEN_REF = 'uptime:worker:chat-token';
+export const PLATFORM_UPTIME_MAIL_KEY_REF = 'uptime:worker:mail-key';
+/**
+ * Worker secret name to the held-key ref it is read from, for the secrets a
+ * person holds. `UPTIME_TOKEN` and the two `CF_ACCESS_CLIENT_*` secrets are
+ * minted by the step and always set, so they are not listed.
+ */
+export const PLATFORM_UPTIME_OPTIONAL_SECRETS = {
+    CHAT_ACCESS_TOKEN: PLATFORM_UPTIME_CHAT_TOKEN_REF,
+    MAIL_API_KEY: PLATFORM_UPTIME_MAIL_KEY_REF,
+};
+/**
+ * foundry#542: scope keys (colon-free), the {@link PLATFORM_EDGE_PLATFORM_KEY_UNDELIVERED_SCOPE_KEY}
+ * pattern once. The undelivered id is recorded and persisted the moment the
+ * token is generated; the guard is recorded as soon as the value is durably
+ * held, before anything is sent to the Worker or Archon. Setting the value on
+ * the Worker and on Archon is repeated from the held value on every apply
+ * that needs it. Neither key holds the token; the id is the Worker secret's
+ * version label.
+ */
+export const PLATFORM_UPTIME_TOKEN_UNDELIVERED_SCOPE_KEY = 'uptime_token_undelivered';
+export const PLATFORM_UPTIME_TOKEN_ID_SCOPE_KEY = 'uptime_token_id';
+/** The token id Archon's env was last written with; `planArchon` plans again when it differs from {@link PLATFORM_UPTIME_TOKEN_ID_SCOPE_KEY}. */
+export const PLATFORM_ARCHON_UPTIME_TOKEN_SYNCED_SCOPE_KEY = 'archon_uptime_token_synced';
+/** The tag, sha256 and Archon hostname the last successful run applied; a change plans the step again and mints nothing. */
+export const PLATFORM_UPTIME_APPLIED_TAG_SCOPE_KEY = 'uptime_applied_tag';
+export const PLATFORM_UPTIME_APPLIED_SHA256_SCOPE_KEY = 'uptime_applied_sha256';
+export const PLATFORM_UPTIME_APPLIED_HOSTNAME_SCOPE_KEY = 'uptime_applied_hostname';
+/** The secret names (names only) the last run set, sorted and comma-joined: a newly held secret plans the step again. */
+export const PLATFORM_UPTIME_APPLIED_SECRETS_SCOPE_KEY = 'uptime_applied_secrets';
+/** A digest of the plain text variables the last run uploaded (they are not secrets): a changed one plans the step again. */
+export const PLATFORM_UPTIME_APPLIED_VARS_SCOPE_KEY = 'uptime_applied_vars';
+/** `'1'` once the step removed the Worker because the platform no longer enables it; cleared when it deploys again. */
+export const PLATFORM_UPTIME_REMOVED_SCOPE_KEY = 'uptime_removed';
+/** The digest of the Worker's plain text variables that are set; empty when none is. */
+export function uptimeVarsDigest(vars = {}) {
+    const set = Object.entries(vars)
+        .filter(([, value]) => Boolean(value))
+        .sort(([a], [b]) => a.localeCompare(b));
+    if (set.length === 0)
+        return '';
+    return createHash('sha256').update(JSON.stringify(set)).digest('hex').slice(0, 16);
+}
+/** The Worker secret names the step sets: the three it mints, and each held one. */
+export function uptimeSecretNames(held) {
+    return ['UPTIME_TOKEN', 'CF_ACCESS_CLIENT_ID', 'CF_ACCESS_CLIENT_SECRET', ...held]
+        .sort()
+        .join(',');
+}
+/** The Access service token's name at Cloudflare; edge answers `conflict` when a token of this name exists. */
+export const PLATFORM_UPTIME_ACCESS_TOKEN_NAME = 'platform-uptime';
+/**
+ * The Access service token pair, minted through edge once: the same
+ * undelivered-then-guard pattern as the Worker token above. The undelivered
+ * id is recorded and persisted the moment edge returns the pair; the guard is
+ * recorded once both values are held. A pair that may be lost (the undelivered
+ * id without its guard, or the guard with nothing held) is repaired by the
+ * next apply: it removes that token through edge and mints again. Both are
+ * ids, never a value. Archon's step reads the guard to allow the token.
+ */
+export const PLATFORM_UPTIME_ACCESS_UNDELIVERED_SCOPE_KEY = 'uptime_access_undelivered';
+export const PLATFORM_UPTIME_ACCESS_TOKEN_ID_SCOPE_KEY = 'uptime_access_token_id';
+/** Why the pair cannot be minted: a token of the name exists and foundry has no id recorded for it. */
+export function uptimeAccessTokenConflict() {
+    return `the uptime Worker is blocked, not planned: a Cloudflare Access service token named '${PLATFORM_UPTIME_ACCESS_TOKEN_NAME}' already exists and foundry did not make it; remove that token in Cloudflare Zero Trust (Access, Service Auth), then the next apply mints one through edge`;
+}
+/** Whether anything of the uptime Worker is recorded that disabling it must remove. */
+export function uptimeRecorded(recordedIds) {
+    return ((Boolean(recordedIds[resourceKey('cloudflare', 'worker', PLATFORM_UPTIME_KEY)]) &&
+        !recordedIds[PLATFORM_UPTIME_REMOVED_SCOPE_KEY]) ||
+        Boolean(recordedIds[PLATFORM_UPTIME_ACCESS_TOKEN_ID_SCOPE_KEY]) ||
+        Boolean(recordedIds[PLATFORM_UPTIME_ACCESS_UNDELIVERED_SCOPE_KEY]));
+}
 /**
  * #167: the platform's own diff engine, mirroring `diff.ts`'s
  * `computePlanDetail` for the one shared {@link DeclaredPlatform} record
@@ -1035,6 +1130,11 @@ export function planPlatform(platform, live, options = {}) {
     const heartbeats = planHeartbeats(platform, recordedIds, hcReady, blocked.heartbeatsExecutorMissing ?? false, blocked.heartbeatsApiKeyMissing ?? false);
     if (heartbeats.step)
         plannedSteps.push(heartbeats.step);
+    // foundry#542: after Archon is applied (never merely planned): the Worker
+    // probes Archon, and Archon's env takes the token this step mints.
+    const uptime = planUptime(platform, recordedIds, blocked.uptime, blocked.uptimeSecretsHeld ?? [], Boolean(recordedIds[resourceKey('coolify', 'app', PLATFORM_ARCHON_KEY)]), blocked.uptimeHeld);
+    if (uptime.step)
+        plannedSteps.push(uptime.step);
     if (archon.step && blocked.archonRunsInsideApp)
         plannedSteps.push(archon.step);
     // #251: one line per service whose recorded applied ref no longer matches
@@ -1120,6 +1220,8 @@ export function planPlatform(platform, live, options = {}) {
     unmanaged.push(...backups.blocked);
     if (heartbeats.blocked)
         unmanaged.push({ description: heartbeats.blocked, key: 'heartbeats' });
+    for (const description of uptime.blocked)
+        unmanaged.push({ description, key: 'uptime' });
     return { plannedSteps: plannedSteps.map(withStepSystem), unmanaged, versionChanges };
 }
 /**
@@ -2235,6 +2337,106 @@ function planHeartbeats(platform, recordedIds, hcReady, executorMissing, apiKeyM
         blocked: null,
     };
 }
+/**
+ * foundry#542: the uptime Worker, one `cloudflare:worker` step. Blocked, not
+ * planned (rule 2), while no artifact is pinned, Archon is not applied, the
+ * executor lacks its dependencies, a Worker or Access token of the name exists
+ * that foundry did not make. A lost Worker token or Access pair is not a
+ * block: the step is planned and repairs it (rule 4). Planned again when the
+ * pinned tag or sha256, the Archon hostname (`ARCHON_BASE_URL`), the plain
+ * text variables or the set of secrets that can be set changed (rule 3), or
+ * when a half-made deploy never recorded its applied values; it mints nothing
+ * that is already held. When the platform no longer enables the Worker, a
+ * destructive step removes whatever of it is recorded (edge removes its KV
+ * namespace with the script).
+ *
+ * The returned `blocked` lines are reported in `unmanaged`; some accompany a
+ * planned step (a secret whose source does not exist yet), because the step
+ * still delivers everything that exists.
+ */
+function planUptime(platform, recordedIds, executorBlocked, heldOptional, archonApplied, uptimeHeld = {
+    token: true,
+    access: true,
+    vars: '',
+}) {
+    const { uptime } = platform;
+    const deployed = Boolean(recordedIds[resourceKey('cloudflare', 'worker', PLATFORM_UPTIME_KEY)]) &&
+        !recordedIds[PLATFORM_UPTIME_REMOVED_SCOPE_KEY];
+    const action = (desired) => ({
+        system: 'cloudflare',
+        kind: 'worker',
+        key: PLATFORM_UPTIME_KEY,
+        desired,
+    });
+    if (!uptime.enabled) {
+        if (!uptimeRecorded(recordedIds))
+            return { step: null, blocked: [] };
+        if (executorBlocked)
+            return { step: null, blocked: [executorBlocked] };
+        return {
+            step: {
+                action: action({ remove: true }),
+                step: {
+                    description: `remove the uptime Worker ${PLATFORM_UPTIME_SCRIPT_NAME} and, with it, its KV namespace, its Access service token and its held token`,
+                    destroys: true,
+                    migrates: false,
+                },
+            },
+            blocked: [],
+        };
+    }
+    if (!uptime.tag || !uptime.sha256) {
+        return {
+            step: null,
+            blocked: [
+                'the uptime Worker is blocked, not planned: no artifact is pinned; declare uptime.tag (an Archon release tag) and uptime.sha256 (the digest of archon-uptime-worker.js at that tag)',
+            ],
+        };
+    }
+    if (!archonApplied) {
+        return {
+            step: null,
+            blocked: [
+                'the uptime Worker is blocked, not planned: platform:archon has not been applied yet',
+            ],
+        };
+    }
+    if (executorBlocked)
+        return { step: null, blocked: [executorBlocked] };
+    const missing = [];
+    if (!heldOptional.includes('CHAT_ACCESS_TOKEN')) {
+        missing.push(`the uptime Worker has no chat credential (CHAT_ACCESS_TOKEN): hold one under ${PLATFORM_UPTIME_CHAT_TOKEN_REF} and it is set on the next apply; until then it sends no chat alerts`);
+    }
+    if (!heldOptional.includes('MAIL_API_KEY')) {
+        missing.push(`the uptime Worker has no mail API key (MAIL_API_KEY): hold one under ${PLATFORM_UPTIME_MAIL_KEY_REF} and it is set on the next apply; until then it sends no alert email`);
+    }
+    const hostname = platform.archon.hostname;
+    // Applied only once a run got to its end and recorded these: a Worker that
+    // was uploaded and then failed has its key but none of the applied values.
+    const applied = deployed &&
+        Boolean(recordedIds[PLATFORM_UPTIME_TOKEN_ID_SCOPE_KEY]) &&
+        uptimeHeld.token &&
+        Boolean(recordedIds[PLATFORM_UPTIME_ACCESS_TOKEN_ID_SCOPE_KEY]) &&
+        uptimeHeld.access &&
+        recordedIds[PLATFORM_UPTIME_APPLIED_TAG_SCOPE_KEY] === uptime.tag &&
+        recordedIds[PLATFORM_UPTIME_APPLIED_SHA256_SCOPE_KEY] === uptime.sha256 &&
+        recordedIds[PLATFORM_UPTIME_APPLIED_HOSTNAME_SCOPE_KEY] === hostname &&
+        (recordedIds[PLATFORM_UPTIME_APPLIED_VARS_SCOPE_KEY] ?? '') === uptimeHeld.vars &&
+        recordedIds[PLATFORM_UPTIME_APPLIED_SECRETS_SCOPE_KEY] === uptimeSecretNames(heldOptional);
+    if (applied)
+        return { step: null, blocked: missing };
+    return {
+        step: {
+            action: action({ hostname, gitRef: uptime.tag, sha256: uptime.sha256 }),
+            step: {
+                description: `deploy the uptime Worker ${PLATFORM_UPTIME_SCRIPT_NAME} from Archon release ${uptime.tag}, probing https://${hostname}, with its KV namespace, secrets and cron trigger`,
+                destroys: false,
+                migrates: false,
+            },
+        },
+        blocked: missing,
+    };
+}
 /**
  * #172: the platform's AI host (https://github.com/wtfalch/ai) -- a Coolify
  * Postgres plus three apps built from that repo's root Dockerfile, one per
@@ -2382,6 +2584,14 @@ function planArchon(platform, recordedIds, executorBlocked, authReady, drifted,
         // other drift reason.
         recordedIds[PLATFORM_ARCHON_APPLIED_ROLLING_UPDATE_SCOPE_KEY] === '1' &&
         !recordedIds[PLATFORM_ARCHON_GATE_CLOSED_SCOPE_KEY] &&
+        // foundry#542: the uptime token minted after Archon's last apply is not
+        // in Archon's env yet.
+        // A disabled Worker leaves the token in Archon's env until the step drops it.
+        (platform.uptime.enabled
+            ? !recordedIds[PLATFORM_UPTIME_TOKEN_ID_SCOPE_KEY] ||
+                recordedIds[PLATFORM_UPTIME_TOKEN_ID_SCOPE_KEY] ===
+                    recordedIds[PLATFORM_ARCHON_UPTIME_TOKEN_SYNCED_SCOPE_KEY]
+            : !recordedIds[PLATFORM_ARCHON_UPTIME_TOKEN_SYNCED_SCOPE_KEY]) &&
         // #398: a rotated integrations key id Archon's env was not yet written
         // with (see PLATFORM_ARCHON_INTEGRATIONS_KEY_SYNCED_SCOPE_KEY). Absent
         // before the first rotation on a platform applied before #398.

package/dist/plan/platform-providers.d.ts

@@ -12,6 +12,7 @@ import type { LiveResource, PlatformCloudflareReader, PlatformCoolifyReader } fr
 import type { PlatformStepExecutionContext, PlatformStepExecutor } from './plan-apply.js';
 import { type BrokerDeployRecord } from './platform-diff.js';
 import { type CallsSfuPlatformDeps } from './platform-sfu.js';
+import { type PlatformUptimeDeps } from './uptime-worker.js';
 /**
  * #168: everything {@link provisionPlatformAuth} needs beyond
  * {@link PlatformStepExecutionContext} -- a bundle, not more constructor
@@ -197,6 +198,12 @@ export interface FoundryPlatformStepExecutorOptions {
      * heartbeat checks reported as blocked rather than planned.
      */
     heartbeats?: PlatformHeartbeatsDeps;
+    /**
+     * foundry#542: dependencies for the uptime Worker step
+     * (`cloudflare:worker` keyed {@link PLATFORM_UPTIME_KEY}) -- optional for
+     * the same reason as `auth`; without it the step is reported blocked.
+     */
+    uptime?: PlatformUptimeDeps;
     /**
      * #604: dependencies for the `cloudflare:access-provider` step -- optional
      * for the same reason as `auth`; edge and sign-in applied with this unset
@@ -285,6 +292,7 @@ export declare class FoundryPlatformStepExecutor implements PlatformStepExecutor
     private readonly backup?;
     private readonly hc?;
     private readonly heartbeats?;
+    private readonly uptime?;
     private readonly accessProvider?;
     constructor(cloudflare: Pick<CloudflarePort, 'findZoneByApex' | 'createZone'>, declaredOrgStore: Pick<DeclaredOrgStore, 'findOrgIdForZone' | 'list' | 'get'>, options?: FoundryPlatformStepExecutorOptions);
     blockedSteps(platform: DeclaredPlatform, recordedIds?: Readonly<Record<string, string>>): Promise<{
@@ -302,9 +310,24 @@ export declare class FoundryPlatformStepExecutor implements PlatformStepExecutor
         hc?: string;
         heartbeatsExecutorMissing?: boolean;
         heartbeatsApiKeyMissing?: boolean;
+        uptime?: string;
+        uptimeSecretsHeld?: string[];
+        uptimeHeld?: {
+            token: boolean;
+            access: boolean;
+            vars: string;
+        };
         archonRunsInsideApp?: boolean;
         archonDeployRunning?: string;
     }>;
+    /**
+     * foundry#542: why the uptime Worker cannot run yet, which optional secrets
+     * are held, and whether the minted values are held. A Worker token or Access
+     * pair that is gone is not a block here: the step repairs it. The planner
+     * checks the pin and Archon first, so none of the reads here happens before
+     * they hold.
+     */
+    private uptimeBlocked;
     /**
      * Whether Archon's live Access policy lets through anyone but the declared
      * emails, or (#211 round 4) the broker it last registered with no longer