@wtfalch/foundry 0.24.0 → 0.25.0

package/dist/plan/platform-providers.js

@@ -9,8 +9,9 @@ import { ACCESS_POLICY_NAME, getDatabaseStarted, isNotFoundError, isRunningOrSta
 import { ACCESS_PROVIDER_RECORD_KEY, GATE_CLAIM_NAME } from './gates.js';
 import { healthCheckSettings } from './health-check-settings.js';
 import { coolifyDomains, coolifyTunnelDomains, filesShareHostname } from './hostnames.js';
-import { AUTH_ZITADEL_RUN_OPTIONS, JOBS_DEPLOY_PENDING_SCOPE_KEY, JOBS_INTERNAL_URL_SCOPE_KEY, JOBS_SCHEDULER_KEY, PLATFORM_ACCESS_PROVIDER_APPLIED_AUTH_DOMAIN_SCOPE_KEY, PLATFORM_ACCESS_PROVIDER_APPLIED_HOSTNAME_SCOPE_KEY, PLATFORM_ACCESS_PROVIDER_UNDELIVERED_SCOPE_KEY, PLATFORM_AI_APPLIED_GITREF_SCOPE_KEY, PLATFORM_AI_APPLIED_HOSTNAME_SCOPE_KEY, PLATFORM_AI_DEPLOY_PENDING_SCOPE_KEY, PLATFORM_AI_INTERNAL_URL_SCOPE_KEY, PLATFORM_AI_KEY, PLATFORM_AI_MANAGEMENT_KEY_CONFLICT_SCOPE_KEY, PLATFORM_AI_MANAGEMENT_KEY_SCOPE_KEY, PLATFORM_AI_MANAGEMENT_KEY_UNDELIVERED_SCOPE_KEY, PLATFORM_AI_MIGRATE_BLOCKED_SCOPE_KEY, PLATFORM_AI_ORGANISATION_SCOPE_KEY, PLATFORM_AI_SIGNING_KEY_SET_SCOPE_KEY, PLATFORM_AI_SIGNING_KEY_UNDELIVERED_SCOPE_KEY, PLATFORM_ARCHON_APPLIED_BROKER_SCOPE_KEY, PLATFORM_ARCHON_APPLIED_GIT_REF_SCOPE_KEY, PLATFORM_ARCHON_APPLIED_HOSTNAME_SCOPE_KEY, PLATFORM_ARCHON_APPLIED_OPERATOR_SCOPE_KEY, PLATFORM_ARCHON_APPLIED_ROLLING_UPDATE_SCOPE_KEY, PLATFORM_ARCHON_CONNECTOR_APP_SCOPE_KEY, PLATFORM_ARCHON_COOLIFY_READ_TOKEN_REF, PLATFORM_ARCHON_DEPLOYMENT_SCOPE_KEY, PLATFORM_ARCHON_ENVS_DEPLOYED_SCOPE_KEY, PLATFORM_ARCHON_GATE_CLOSED_SCOPE_KEY, PLATFORM_ARCHON_INTEGRATIONS_KEY_SYNCED_SCOPE_KEY, PLATFORM_ARCHON_KEY, PLATFORM_ARCHON_MASTER_CLOUDFLARE_TOKEN_REF, PLATFORM_ARCHON_MASTER_COOLIFY_TOKEN_REF, PLATFORM_ARCHON_MASTER_COOLIFY_URL_REF, PLATFORM_AUTH_ADMIN_UNDELIVERED_SCOPE_KEY, PLATFORM_AUTH_ADMIN_USER_SCOPE_KEY, PLATFORM_AUTH_BROKER_DEPLOYED_SCOPE_KEY, PLATFORM_AUTH_BROKER_SCOPE_KEY, PLATFORM_AUTH_CONNECTOR_APP_SCOPE_KEY, PLATFORM_AUTH_INSTANCE_SCOPE_KEY, PLATFORM_AUTH_INSTANCE_UNDELIVERED_SCOPE_KEY, PLATFORM_AUTH_KEY, PLATFORM_AUTH_LOGIN_CLIENT_UNDELIVERED_SCOPE_KEY, PLATFORM_AUTH_LOGIN_CLIENT_USER_SCOPE_KEY, PLATFORM_AUTH_OWNER_INVITE_SCOPE_KEY, PLATFORM_AUTH_SMTP_SCOPE_KEY, PLATFORM_AUTH_ZITADEL_APPLIED_IMAGE_TAG_SCOPE_KEY, PLATFORM_AUTH_ZITADEL_RUN_OPTIONS_SCOPE_KEY, PLATFORM_BACKUP_DATABASE_SCOPE_KEYS, PLATFORM_BACKUP_SERVICE_KEYS, PLATFORM_EDGE_APPLIED_GIT_REF_SCOPE_KEY, PLATFORM_EDGE_APPLIED_HOSTNAME_SCOPE_KEY, PLATFORM_EDGE_CLOUDFLARE_TOKEN_REF, PLATFORM_EDGE_INTERNAL_URL_SCOPE_KEY, PLATFORM_EDGE_KEY, PLATFORM_EDGE_KEY_REF, PLATFORM_EDGE_PLATFORM_KEY_SET_SCOPE_KEY, PLATFORM_EDGE_PLATFORM_KEY_UNDELIVERED_SCOPE_KEY, PLATFORM_FILES_APPLIED_GIT_REF_SCOPE_KEY, PLATFORM_FILES_APPLIED_HOSTNAME_SCOPE_KEY, PLATFORM_FILES_INTERNAL_URL_SCOPE_KEY, PLATFORM_FILES_INTROSPECTION_SCOPE_KEY, PLATFORM_FILES_INTROSPECTION_UNDELIVERED_SCOPE_KEY, PLATFORM_FILES_KEY, PLATFORM_FILES_MANAGEMENT_KEY_SCOPE_KEY, PLATFORM_FILES_MANAGEMENT_UNDELIVERED_SCOPE_KEY, PLATFORM_FILES_ZITADEL_PROJECT_SCOPE_KEY, PLATFORM_HC_API_KEY_REF, PLATFORM_HC_APPLIED_GIT_REF_SCOPE_KEY, PLATFORM_HC_APPLIED_HOSTNAME_SCOPE_KEY, PLATFORM_HC_KEY, PLATFORM_HEARTBEATS_APPLIED_SCOPE_KEY, PLATFORM_INTEGRATIONS_APPLIED_GITREF_SCOPE_KEY, PLATFORM_INTEGRATIONS_APPLIED_HOSTNAME_SCOPE_KEY, PLATFORM_INTEGRATIONS_KEY, PLATFORM_INTEGRATIONS_KEY_ID_SCOPE_KEY, PLATFORM_INTEGRATIONS_KEY_ROTATION_PREVIOUS_SCOPE_KEY, PLATFORM_INTEGRATIONS_KEY_ROTATION_REQUESTED_SCOPE_KEY, PLATFORM_INTEGRATIONS_KEY_ROTATION_UNDELIVERED_SCOPE_KEY, PLATFORM_INTEGRATIONS_KEY_SET_SCOPE_KEY, PLATFORM_INTEGRATIONS_KEY_UNDELIVERED_SCOPE_KEY, PLATFORM_INTEGRATIONS_RUNNER_KEYRING_DEPLOYED_SCOPE_KEY, PLATFORM_MAIL_ADMIN_KEY_SCOPE_KEY, PLATFORM_MAIL_ADMIN_UNDELIVERED_SCOPE_KEY, PLATFORM_MAIL_APPLIED_GIT_REF_SCOPE_KEY, PLATFORM_MAIL_APPLIED_HOSTNAME_SCOPE_KEY, PLATFORM_MAIL_CONNECTOR_APP_SCOPE_KEY, PLATFORM_MAIL_INTERNAL_URL_SCOPE_KEY, PLATFORM_MAIL_KEY, PLATFORM_MAIL_ZITADEL_PROJECT_SCOPE_KEY, PLATFORM_UPTIME_HEARTBEAT_CHECK_NAME, archonBootstrapOperator, desiredHeartbeatCheckNames, heartbeatCheckUrlRef, parseBrokerDeployRecord, parseLoginClientRecord, platformBackupHeartbeatCheckName, platformMailMxHost, } from './platform-diff.js';
+import { AUTH_ZITADEL_RUN_OPTIONS, JOBS_DEPLOY_PENDING_SCOPE_KEY, JOBS_INTERNAL_URL_SCOPE_KEY, JOBS_SCHEDULER_KEY, PLATFORM_ACCESS_PROVIDER_APPLIED_AUTH_DOMAIN_SCOPE_KEY, PLATFORM_ACCESS_PROVIDER_APPLIED_HOSTNAME_SCOPE_KEY, PLATFORM_ACCESS_PROVIDER_UNDELIVERED_SCOPE_KEY, PLATFORM_AI_APPLIED_GITREF_SCOPE_KEY, PLATFORM_AI_APPLIED_HOSTNAME_SCOPE_KEY, PLATFORM_AI_DEPLOY_PENDING_SCOPE_KEY, PLATFORM_AI_INTERNAL_URL_SCOPE_KEY, PLATFORM_AI_KEY, PLATFORM_AI_MANAGEMENT_KEY_CONFLICT_SCOPE_KEY, PLATFORM_AI_MANAGEMENT_KEY_SCOPE_KEY, PLATFORM_AI_MANAGEMENT_KEY_UNDELIVERED_SCOPE_KEY, PLATFORM_AI_MIGRATE_BLOCKED_SCOPE_KEY, PLATFORM_AI_ORGANISATION_SCOPE_KEY, PLATFORM_AI_SIGNING_KEY_SET_SCOPE_KEY, PLATFORM_AI_SIGNING_KEY_UNDELIVERED_SCOPE_KEY, PLATFORM_ARCHON_APPLIED_BROKER_SCOPE_KEY, PLATFORM_ARCHON_APPLIED_GIT_REF_SCOPE_KEY, PLATFORM_ARCHON_APPLIED_HOSTNAME_SCOPE_KEY, PLATFORM_ARCHON_APPLIED_OPERATOR_SCOPE_KEY, PLATFORM_ARCHON_APPLIED_ROLLING_UPDATE_SCOPE_KEY, PLATFORM_ARCHON_CONNECTOR_APP_SCOPE_KEY, PLATFORM_ARCHON_COOLIFY_READ_TOKEN_REF, PLATFORM_ARCHON_DEPLOYMENT_SCOPE_KEY, PLATFORM_ARCHON_ENVS_DEPLOYED_SCOPE_KEY, PLATFORM_ARCHON_GATE_CLOSED_SCOPE_KEY, PLATFORM_ARCHON_INTEGRATIONS_KEY_SYNCED_SCOPE_KEY, PLATFORM_ARCHON_KEY, PLATFORM_ARCHON_MASTER_CLOUDFLARE_TOKEN_REF, PLATFORM_ARCHON_MASTER_COOLIFY_TOKEN_REF, PLATFORM_ARCHON_MASTER_COOLIFY_URL_REF, PLATFORM_ARCHON_UPTIME_TOKEN_SYNCED_SCOPE_KEY, PLATFORM_AUTH_ADMIN_UNDELIVERED_SCOPE_KEY, PLATFORM_AUTH_ADMIN_USER_SCOPE_KEY, PLATFORM_AUTH_BROKER_DEPLOYED_SCOPE_KEY, PLATFORM_AUTH_BROKER_SCOPE_KEY, PLATFORM_AUTH_CONNECTOR_APP_SCOPE_KEY, PLATFORM_AUTH_INSTANCE_SCOPE_KEY, PLATFORM_AUTH_INSTANCE_UNDELIVERED_SCOPE_KEY, PLATFORM_AUTH_KEY, PLATFORM_AUTH_LOGIN_CLIENT_UNDELIVERED_SCOPE_KEY, PLATFORM_AUTH_LOGIN_CLIENT_USER_SCOPE_KEY, PLATFORM_AUTH_OWNER_INVITE_SCOPE_KEY, PLATFORM_AUTH_SMTP_SCOPE_KEY, PLATFORM_AUTH_ZITADEL_APPLIED_IMAGE_TAG_SCOPE_KEY, PLATFORM_AUTH_ZITADEL_RUN_OPTIONS_SCOPE_KEY, PLATFORM_BACKUP_DATABASE_SCOPE_KEYS, PLATFORM_BACKUP_SERVICE_KEYS, PLATFORM_EDGE_APPLIED_GIT_REF_SCOPE_KEY, PLATFORM_EDGE_APPLIED_HOSTNAME_SCOPE_KEY, PLATFORM_EDGE_CLOUDFLARE_TOKEN_REF, PLATFORM_EDGE_INTERNAL_URL_SCOPE_KEY, PLATFORM_EDGE_KEY, PLATFORM_EDGE_KEY_REF, PLATFORM_EDGE_PLATFORM_KEY_SET_SCOPE_KEY, PLATFORM_EDGE_PLATFORM_KEY_UNDELIVERED_SCOPE_KEY, PLATFORM_FILES_APPLIED_GIT_REF_SCOPE_KEY, PLATFORM_FILES_APPLIED_HOSTNAME_SCOPE_KEY, PLATFORM_FILES_INTERNAL_URL_SCOPE_KEY, PLATFORM_FILES_INTROSPECTION_SCOPE_KEY, PLATFORM_FILES_INTROSPECTION_UNDELIVERED_SCOPE_KEY, PLATFORM_FILES_KEY, PLATFORM_FILES_MANAGEMENT_KEY_SCOPE_KEY, PLATFORM_FILES_MANAGEMENT_UNDELIVERED_SCOPE_KEY, PLATFORM_FILES_ZITADEL_PROJECT_SCOPE_KEY, PLATFORM_HC_API_KEY_REF, PLATFORM_HC_APPLIED_GIT_REF_SCOPE_KEY, PLATFORM_HC_APPLIED_HOSTNAME_SCOPE_KEY, PLATFORM_HC_KEY, PLATFORM_HEARTBEATS_APPLIED_SCOPE_KEY, PLATFORM_INTEGRATIONS_APPLIED_GITREF_SCOPE_KEY, PLATFORM_INTEGRATIONS_APPLIED_HOSTNAME_SCOPE_KEY, PLATFORM_INTEGRATIONS_KEY, PLATFORM_INTEGRATIONS_KEY_ID_SCOPE_KEY, PLATFORM_INTEGRATIONS_KEY_ROTATION_PREVIOUS_SCOPE_KEY, PLATFORM_INTEGRATIONS_KEY_ROTATION_REQUESTED_SCOPE_KEY, PLATFORM_INTEGRATIONS_KEY_ROTATION_UNDELIVERED_SCOPE_KEY, PLATFORM_INTEGRATIONS_KEY_SET_SCOPE_KEY, PLATFORM_INTEGRATIONS_KEY_UNDELIVERED_SCOPE_KEY, PLATFORM_INTEGRATIONS_RUNNER_KEYRING_DEPLOYED_SCOPE_KEY, PLATFORM_MAIL_ADMIN_KEY_SCOPE_KEY, PLATFORM_MAIL_ADMIN_UNDELIVERED_SCOPE_KEY, PLATFORM_MAIL_APPLIED_GIT_REF_SCOPE_KEY, PLATFORM_MAIL_APPLIED_HOSTNAME_SCOPE_KEY, PLATFORM_MAIL_CONNECTOR_APP_SCOPE_KEY, PLATFORM_MAIL_INTERNAL_URL_SCOPE_KEY, PLATFORM_MAIL_KEY, PLATFORM_MAIL_ZITADEL_PROJECT_SCOPE_KEY, PLATFORM_UPTIME_ACCESS_CLIENT_ID_REF, PLATFORM_UPTIME_ACCESS_CLIENT_SECRET_REF, PLATFORM_UPTIME_ACCESS_TOKEN_ID_SCOPE_KEY, PLATFORM_UPTIME_ACCESS_TOKEN_NAME, PLATFORM_UPTIME_ACCESS_UNDELIVERED_SCOPE_KEY, PLATFORM_UPTIME_HEARTBEAT_CHECK_NAME, PLATFORM_UPTIME_KEY, PLATFORM_UPTIME_REMOVED_SCOPE_KEY, PLATFORM_UPTIME_SCRIPT_NAME, PLATFORM_UPTIME_TOKEN_ID_SCOPE_KEY, PLATFORM_UPTIME_TOKEN_REF, archonBootstrapOperator, desiredHeartbeatCheckNames, heartbeatCheckUrlRef, parseBrokerDeployRecord, parseLoginClientRecord, platformBackupHeartbeatCheckName, platformMailMxHost, uptimeAccessTokenConflict, uptimeRecorded, uptimeVarsDigest, } from './platform-diff.js';
 import { applyCallsSfuPlatformStep } from './platform-sfu.js';
+import { heldUptimeValues, provisionPlatformUptime, } from './uptime-worker.js';
 import { CreateInstanceError, createZitadelInstance, generateSystemApiKeypair, instanceWithoutBearerMessage, systemApiUsersEnv, } from './zitadel-system-api.js';
 /** The key `runPlatformSteps` records the apex zone's id under (`system:kind:key`). */
 function apexZoneKey(apex) {
@@ -156,6 +157,7 @@ export class FoundryPlatformStepExecutor {
     backup;
     hc;
     heartbeats;
+    uptime;
     accessProvider;
     constructor(cloudflare, declaredOrgStore, options = {}) {
         this.cloudflare = cloudflare;
@@ -174,6 +176,7 @@ export class FoundryPlatformStepExecutor {
         this.backup = options.backup;
         this.hc = options.hc;
         this.heartbeats = options.heartbeats;
+        this.uptime = options.uptime;
         this.accessProvider = options.accessProvider;
     }
     async blockedSteps(platform, recordedIds = {}) {
@@ -326,6 +329,7 @@ export class FoundryPlatformStepExecutor {
             if (!apiKey)
                 blocked.heartbeatsApiKeyMissing = true;
         }
+        await this.uptimeBlocked(platform, recordedIds, blocked);
         // #604: only once edge and sign-in are applied (the planner reports
         // that case itself) and no provider is recorded yet.
         if (platform.edge.enabled &&
@@ -360,6 +364,69 @@ export class FoundryPlatformStepExecutor {
         }
         return blocked;
     }
+    /**
+     * foundry#542: why the uptime Worker cannot run yet, which optional secrets
+     * are held, and whether the minted values are held. A Worker token or Access
+     * pair that is gone is not a block here: the step repairs it. The planner
+     * checks the pin and Archon first, so none of the reads here happens before
+     * they hold.
+     */
+    async uptimeBlocked(platform, recordedIds, blocked) {
+        const deployed = Boolean(recordedIds[`cloudflare:worker:${PLATFORM_UPTIME_KEY}`]) &&
+            !recordedIds[PLATFORM_UPTIME_REMOVED_SCOPE_KEY];
+        if (!platform.uptime.enabled && !uptimeRecorded(recordedIds))
+            return;
+        const deps = this.uptime;
+        if (!deps) {
+            blocked.uptime =
+                'the uptime Worker is blocked, not planned: the host built the platform executor without its uptime dependencies';
+            return;
+        }
+        if (!platform.uptime.enabled)
+            return;
+        blocked.uptimeSecretsHeld = Object.keys(await heldUptimeValues(deps));
+        const accessTokenId = recordedIds[PLATFORM_UPTIME_ACCESS_TOKEN_ID_SCOPE_KEY];
+        const accessHeld = Boolean((await deps.heldKeys.resolve(PLATFORM_UPTIME_ACCESS_CLIENT_ID_REF)) &&
+            (await deps.heldKeys.resolve(PLATFORM_UPTIME_ACCESS_CLIENT_SECRET_REF)));
+        blocked.uptimeHeld = {
+            token: Boolean(await deps.heldKeys.resolve(PLATFORM_UPTIME_TOKEN_REF)),
+            access: accessHeld,
+            vars: uptimeVarsDigest(deps.vars),
+        };
+        const edgeUrl = recordedIds[PLATFORM_EDGE_INTERNAL_URL_SCOPE_KEY];
+        // A token of the name with no id recorded cannot be minted over, and
+        // foundry does not remove what it did not make. With an id recorded the
+        // step removes that token through edge and mints again.
+        if (!accessTokenId &&
+            !recordedIds[PLATFORM_UPTIME_ACCESS_UNDELIVERED_SCOPE_KEY] &&
+            edgeUrl &&
+            platform.uptime.tag) {
+            try {
+                const access = await deps.access(edgeUrl);
+                if (await access.findServiceTokenByName(PLATFORM_UPTIME_ACCESS_TOKEN_NAME)) {
+                    blocked.uptime = uptimeAccessTokenConflict();
+                    return;
+                }
+            }
+            catch {
+                blocked.uptime =
+                    'the uptime Worker is blocked, not planned: edge could not be asked whether the Access service token exists';
+                return;
+            }
+        }
+        if (!deployed && edgeUrl && platform.uptime.tag) {
+            try {
+                const workers = await deps.workers(edgeUrl);
+                if (await workers.scriptExists(PLATFORM_UPTIME_SCRIPT_NAME)) {
+                    blocked.uptime = `the uptime Worker is blocked, not planned: a Worker named ${PLATFORM_UPTIME_SCRIPT_NAME} already exists at Cloudflare and foundry did not make it; remove it by hand`;
+                }
+            }
+            catch {
+                blocked.uptime =
+                    'the uptime Worker is blocked, not planned: edge could not be asked whether the Worker exists';
+            }
+        }
+    }
     /**
      * Whether Archon's live Access policy lets through anyone but the declared
      * emails, or (#211 round 4) the broker it last registered with no longer
@@ -372,7 +439,9 @@ export class FoundryPlatformStepExecutor {
         if (platform.archon.enabled &&
             this.archon &&
             recordedIds[`coolify:app:${PLATFORM_ARCHON_KEY}`]) {
-            const accessDrifted = await archonAccessDrifted(this.archon, recordedIds, platform.archon.hostname, this.archon.accessEmails);
+            const accessDrifted = await archonAccessDrifted(this.archon, recordedIds, platform.archon.hostname, this.archon.accessEmails, platform.uptime.enabled
+                ? recordedIds[PLATFORM_UPTIME_ACCESS_TOKEN_ID_SCOPE_KEY]
+                : undefined);
             const brokerDrifted = !accessDrifted && (await archonBrokerRegistrationDrifted(this.archon.coolify, recordedIds));
             const bootstrapOperatorDrifted = !accessDrifted &&
                 !brokerDrifted &&
@@ -525,6 +594,14 @@ export class FoundryPlatformStepExecutor {
             }
             return provisionPlatformHeartbeats(context, this.heartbeats);
         }
+        if (action.system === 'cloudflare' &&
+            action.kind === 'worker' &&
+            action.key === PLATFORM_UPTIME_KEY) {
+            if (!this.uptime) {
+                throw new Error('platform:uptime needs FoundryPlatformStepExecutor to be constructed with its uptime dependencies (foundry#542)');
+            }
+            return provisionPlatformUptime(context, this.uptime);
+        }
         if (action.system === 'cloudflare' && action.kind === 'zone') {
             return this.cloudflareZone(action, context);
         }
@@ -2944,6 +3021,15 @@ async function provisionPlatformArchon(context, deps) {
             envs.push({ key: 'COOLIFY_URL', value: coolifyUrl }, { key: 'COOLIFY_READ_TOKEN', value: coolifyReadToken });
         }
     }
+    // foundry#542: the token the uptime Worker sends, once the Worker step has
+    // minted and delivered it. Absent until then; that step's guard makes
+    // `planArchon` plan this one again.
+    const uptimeTokenId = platform.uptime.enabled
+        ? recorded[PLATFORM_UPTIME_TOKEN_ID_SCOPE_KEY]
+        : undefined;
+    const uptimeToken = uptimeTokenId ? await deps.heldKeys.resolve(PLATFORM_UPTIME_TOKEN_REF) : null;
+    if (uptimeToken)
+        envs.push({ key: 'UPTIME_TOKEN', value: uptimeToken });
     const changed = await envsDiffer(deps.coolify, appId, envs);
     // #467: this run's intended env set, hashed before anything below writes
     // it -- compared against {@link PLATFORM_ARCHON_ENVS_DEPLOYED_SCOPE_KEY}
@@ -2972,7 +3058,9 @@ async function provisionPlatformArchon(context, deps) {
     // what either hash names (#467).
     let staleKeyDeleted = false;
     for (const stale of await deps.coolify.listEnvs(appId)) {
-        if (stale.key === 'FILES_MANAGEMENT_KEY' && stale.uuid) {
+        // foundry#542: a disabled Worker's token leaves Archon's env too.
+        const staleUptime = !platform.uptime.enabled && stale.key === 'UPTIME_TOKEN';
+        if ((stale.key === 'FILES_MANAGEMENT_KEY' || staleUptime) && stale.uuid) {
             await deps.coolify.deleteEnv(appId, stale.uuid);
             staleKeyDeleted = true;
         }
@@ -3064,7 +3152,10 @@ async function provisionPlatformArchon(context, deps) {
     const tunnels = await platformTunnels(deps, context.recordedIds(), 'platform:archon');
     const access = await platformAccess(deps, context.recordedIds(), 'platform:archon');
     let gateClosed = Boolean(recorded[PLATFORM_ARCHON_GATE_CLOSED_SCOPE_KEY]);
-    const accessAppId = await ensureArchonAccess(access, hostname, deps.accessEmails, async () => {
+    const uptimeAccessTokenId = platform.uptime.enabled
+        ? recorded[PLATFORM_UPTIME_ACCESS_TOKEN_ID_SCOPE_KEY]
+        : undefined;
+    const accessAppId = await ensureArchonAccess(access, hostname, deps.accessEmails, uptimeAccessTokenId, async () => {
         // The Access app is about to be rebuilt: answer 404 for every hostname
         // meanwhile, so it is never served without the gate. The marker is
         // persisted first: a failure before the real ingress is written back
@@ -3206,6 +3297,18 @@ async function provisionPlatformArchon(context, deps) {
     if (keyUnsynced && integrationsKeyId && (!selfRedeploy || deployState === 'finished')) {
         await record(PLATFORM_ARCHON_INTEGRATIONS_KEY_SYNCED_SCOPE_KEY, integrationsKeyId);
     }
+    // foundry#542: the same confirmation for the uptime token, and for its removal.
+    if (!platform.uptime.enabled &&
+        recorded[PLATFORM_ARCHON_UPTIME_TOKEN_SYNCED_SCOPE_KEY] &&
+        (!selfRedeploy || deployState === 'finished')) {
+        await record(PLATFORM_ARCHON_UPTIME_TOKEN_SYNCED_SCOPE_KEY, '');
+    }
+    if (uptimeToken &&
+        uptimeTokenId &&
+        recorded[PLATFORM_ARCHON_UPTIME_TOKEN_SYNCED_SCOPE_KEY] !== uptimeTokenId &&
+        (!selfRedeploy || deployState === 'finished')) {
+        await record(PLATFORM_ARCHON_UPTIME_TOKEN_SYNCED_SCOPE_KEY, uptimeTokenId);
+    }
     // #475: confirmed only now, after the health check above has passed on a
     // container that was deployed with the alias patch in place -- the same
     // confirm-after-health-check timing as the two records just above.
@@ -3525,14 +3628,18 @@ async function putArchonMasterKeys(heldKeys, masterKeys) {
         await heldKeys.put?.(ref, value);
     }
 }
+/** The policy that lets the uptime Worker's Access service token through Archon's app, beside {@link ACCESS_POLICY_NAME}. */
+const PLATFORM_ARCHON_UPTIME_POLICY_NAME = 'foundry: uptime service token';
 /**
  * `executor.ts`'s `cloudflareAccess`, for the platform's Archon: reuses only
  * an Access app named {@link PLATFORM_ARCHON_ACCESS_APP_NAME}, refuses to
  * adopt any other Access app already holding the hostname, and refuses when
  * its own app carries a policy foundry did not create, since that policy
- * could let others in.
+ * could let others in. foundry#542: with `uptimeTokenId` the app also carries
+ * a `non_identity` policy for the uptime Worker's service token; a missing one
+ * is added in place, one for another token rebuilds the app.
  */
-async function ensureArchonAccess(cf, domain, emails, closeGate) {
+async function ensureArchonAccess(cf, domain, emails, uptimeTokenId, closeGate) {
     const onDomain = (await cf.listAccessApps()).filter((a) => a.domain === domain);
     const foreign = onDomain.find((a) => a.name !== PLATFORM_ARCHON_ACCESS_APP_NAME);
     if (foreign) {
@@ -3545,22 +3652,31 @@ async function ensureArchonAccess(cf, domain, emails, closeGate) {
             type: 'self_hosted',
         });
         await cf.createAccessPolicy(created.id, archonAccessPolicy(emails));
+        if (uptimeTokenId) {
+            await cf.createAccessPolicy(created.id, archonUptimePolicy(uptimeTokenId));
+        }
         return created;
     };
     const existing = onDomain[0];
     if (!existing)
         return (await create()).id;
     const policies = await cf.listAccessPolicies(existing.id);
-    const other = policies.find((p) => p.name !== ACCESS_POLICY_NAME);
+    const other = policies.find((p) => p.name !== ACCESS_POLICY_NAME && p.name !== PLATFORM_ARCHON_UPTIME_POLICY_NAME);
     if (other) {
         throw new Error(`platform:archon: Access app ${existing.id} has policy '${other.name}' that foundry did not create`);
     }
-    if (policies.length === 0) {
-        await cf.createAccessPolicy(existing.id, archonAccessPolicy(emails));
+    const emailPolicies = policies.filter((p) => p.name === ACCESS_POLICY_NAME);
+    const tokenPolicies = policies.filter((p) => p.name === PLATFORM_ARCHON_UPTIME_POLICY_NAME);
+    const staleToken = tokenPolicies.some((p) => !uptimePolicyIntact(p, uptimeTokenId));
+    if (emailPolicies.every((p) => sameEmails(p.include, emails)) && !staleToken) {
+        if (emailPolicies.length === 0) {
+            await cf.createAccessPolicy(existing.id, archonAccessPolicy(emails));
+        }
+        if (uptimeTokenId && tokenPolicies.length === 0) {
+            await cf.createAccessPolicy(existing.id, archonUptimePolicy(uptimeTokenId));
+        }
         return existing.id;
     }
-    if (policies.every((p) => sameEmails(p.include, emails)))
-        return existing.id;
     // No call updates an app's policy: rebuild the app, hostname closed meanwhile.
     await closeGate();
     await cf.deleteAccessApp(existing.id);
@@ -3573,6 +3689,30 @@ function archonAccessPolicy(emails) {
         include: emails.map((email) => ({ email: { email } })),
     };
 }
+function archonUptimePolicy(tokenId) {
+    return {
+        name: PLATFORM_ARCHON_UPTIME_POLICY_NAME,
+        decision: 'non_identity',
+        include: [{ service_token: { token_id: tokenId } }],
+    };
+}
+/**
+ * Whether the uptime policy is what foundry makes: decision `non_identity` and
+ * exactly one include, a service token -- the recorded `tokenId` when there is
+ * one, any token when none is recorded (the Worker is off or not applied yet).
+ */
+function uptimePolicyIntact(policy, tokenId) {
+    if (policy.decision !== 'non_identity')
+        return false;
+    const include = policy.include;
+    if (!Array.isArray(include) || include.length !== 1)
+        return false;
+    const entry = include[0];
+    if (Object.keys(entry ?? {}).length !== 1)
+        return false;
+    const live = entry?.service_token?.token_id;
+    return typeof live === 'string' && live !== '' && (tokenId === undefined || live === tokenId);
+}
 /** Whether an Access policy's include list is exactly `emails` (case-insensitive) and nothing else. */
 function sameEmails(include, emails) {
     if (!Array.isArray(include))
@@ -3592,14 +3732,23 @@ function sameEmails(include, emails) {
  * exactly the declared emails. A failed read is not drift: the next plan reads
  * again.
  */
-async function archonAccessDrifted(deps, recorded, domain, emails) {
+async function archonAccessDrifted(deps, recorded, domain, emails, uptimeTokenId) {
     try {
         const cf = await platformAccess(deps, recorded, 'platform:archon');
         const app = (await cf.listAccessApps()).find((a) => a.domain === domain && a.name === PLATFORM_ARCHON_ACCESS_APP_NAME);
         if (!app)
             return true;
         const policies = await cf.listAccessPolicies(app.id);
-        return !(policies.length > 0 && policies.every((p) => sameEmails(p.include, emails)));
+        const emailPolicies = policies.filter((p) => p.name === ACCESS_POLICY_NAME);
+        const tokenPolicies = policies.filter((p) => p.name === PLATFORM_ARCHON_UPTIME_POLICY_NAME);
+        if (policies.length !== emailPolicies.length + tokenPolicies.length)
+            return true;
+        if (emailPolicies.length === 0 || !emailPolicies.every((p) => sameEmails(p.include, emails))) {
+            return true;
+        }
+        if (!tokenPolicies.every((p) => uptimePolicyIntact(p, uptimeTokenId)))
+            return true;
+        return uptimeTokenId !== undefined && tokenPolicies.length === 0;
     }
     catch {
         return false;

package/dist/plan/uptime-worker.d.ts

@@ -0,0 +1,50 @@
+import type { AccessPort } from './edge-access.js';
+import type { PlatformWorkersPort } from './edge-workers.js';
+import type { PlatformStepExecutionContext } from './plan-apply.js';
+/** The optional plain text variables the Worker reads, supplied by the host (not secrets). */
+export declare const UPTIME_OPTIONAL_VARS: readonly ["CHAT_HOMESERVER_URL", "CHAT_ROOM_ID", "ALERT_EMAIL_FROM", "ALERT_EMAIL_TO"];
+/** Builds the Workers port at edge's recorded address, the {@link import('./platform-providers.js').PlatformDnsFactory} way. */
+export type PlatformWorkersFactory = (edgeUrl: string) => PlatformWorkersPort | Promise<PlatformWorkersPort>;
+/** The Access calls the uptime step makes: it mints, finds and removes its one service token. */
+export type PlatformUptimeAccessPort = Pick<AccessPort, 'createServiceToken' | 'removeServiceToken' | 'findServiceTokenByName'>;
+/** Builds the Access port at edge's recorded address, the {@link PlatformWorkersFactory} way. */
+export type PlatformUptimeAccessFactory = (edgeUrl: string) => PlatformUptimeAccessPort | Promise<PlatformUptimeAccessPort>;
+/**
+ * Dependencies of the uptime Worker step. `deliverSecret` and `heldKeys` are
+ * the host's: the minted token goes only to `deliverSecret`, and every secret
+ * is read back only to be handed to edge, which never returns one.
+ */
+export interface PlatformUptimeDeps {
+    workers: PlatformWorkersFactory;
+    /** The Access service token the Worker passes Archon's gate with, minted through edge. */
+    access: PlatformUptimeAccessFactory;
+    /**
+     * Holds `secret` under `ref`. An empty `secret` clears it, which is how the
+     * step forgets the Access pair when the Worker is removed.
+     */
+    deliverSecret: (ref: string, secret: string) => Promise<void>;
+    heldKeys: {
+        resolve(ref: string): Promise<string | null>;
+    };
+    /** Host config for the Worker's optional plain text variables; an absent one is left unset. */
+    vars?: Partial<Record<(typeof UPTIME_OPTIONAL_VARS)[number], string>>;
+}
+/**
+ * What is held now: the optional secrets, and `UPTIME_HEARTBEAT_URL` (a ping
+ * URL that works as a capability, so a secret too), name to value. Callers
+ * that report or record take the names only.
+ */
+export declare function heldUptimeValues(deps: Pick<PlatformUptimeDeps, 'heldKeys'>): Promise<Record<string, string>>;
+/**
+ * foundry#542: makes the uptime Worker true, in an order where every failure
+ * is repaired by the next apply and none needs a hand edit. Upload the pinned
+ * Archon release (the host fetches and verifies it) and record the script at
+ * once, so a later failure is a half-made Worker foundry owns. Then hold the
+ * Worker token and the Access pair (minted once each, each guard recorded as
+ * soon as its value is held), set every held secret on the Worker, and last
+ * the cron trigger, so the Worker never runs a round without its token. The
+ * applied values are recorded only when all of it succeeded.
+ */
+export declare function provisionPlatformUptime(context: PlatformStepExecutionContext, deps: PlatformUptimeDeps): Promise<{
+    resourceId?: string;
+}>;

package/dist/plan/uptime-worker.js

@@ -0,0 +1,229 @@
+import { randomBytes, randomUUID } from 'node:crypto';
+import { EdgeApiError } from '@wtfalch/edge';
+import { uptimeArtifactUrl } from '../platform.js';
+import { PLATFORM_EDGE_INTERNAL_URL_SCOPE_KEY, PLATFORM_UPTIME_ACCESS_CLIENT_ID_REF, PLATFORM_UPTIME_ACCESS_CLIENT_SECRET_REF, PLATFORM_UPTIME_ACCESS_TOKEN_ID_SCOPE_KEY, PLATFORM_UPTIME_ACCESS_TOKEN_NAME, PLATFORM_UPTIME_ACCESS_UNDELIVERED_SCOPE_KEY, PLATFORM_UPTIME_APPLIED_HOSTNAME_SCOPE_KEY, PLATFORM_UPTIME_APPLIED_SECRETS_SCOPE_KEY, PLATFORM_UPTIME_APPLIED_SHA256_SCOPE_KEY, PLATFORM_UPTIME_APPLIED_TAG_SCOPE_KEY, PLATFORM_UPTIME_APPLIED_VARS_SCOPE_KEY, PLATFORM_UPTIME_HEARTBEAT_URL_REF, PLATFORM_UPTIME_KEY, PLATFORM_UPTIME_KV_TITLE, PLATFORM_UPTIME_OPTIONAL_SECRETS, PLATFORM_UPTIME_REMOVED_SCOPE_KEY, PLATFORM_UPTIME_SCRIPT_NAME, PLATFORM_UPTIME_TOKEN_ID_SCOPE_KEY, PLATFORM_UPTIME_TOKEN_REF, PLATFORM_UPTIME_TOKEN_UNDELIVERED_SCOPE_KEY, uptimeAccessTokenConflict, uptimeSecretNames, uptimeVarsDigest, } from './platform-diff.js';
+/** The Worker's cron trigger, from Archon's `workers/uptime/manifest.json`. */
+const UPTIME_CRONS = ['* * * * *'];
+/** The date Archon's own Worker config used. */
+const UPTIME_COMPATIBILITY_DATE = '2026-09-27';
+/** How many times a delivery or a secrets write is tried before the step fails. */
+const UPTIME_ATTEMPTS = 3;
+/** The optional plain text variables the Worker reads, supplied by the host (not secrets). */
+export const UPTIME_OPTIONAL_VARS = [
+    'CHAT_HOMESERVER_URL',
+    'CHAT_ROOM_ID',
+    'ALERT_EMAIL_FROM',
+    'ALERT_EMAIL_TO',
+];
+/**
+ * What is held now: the optional secrets, and `UPTIME_HEARTBEAT_URL` (a ping
+ * URL that works as a capability, so a secret too), name to value. Callers
+ * that report or record take the names only.
+ */
+export async function heldUptimeValues(deps) {
+    const refs = {
+        ...PLATFORM_UPTIME_OPTIONAL_SECRETS,
+        UPTIME_HEARTBEAT_URL: PLATFORM_UPTIME_HEARTBEAT_URL_REF,
+    };
+    const held = {};
+    for (const [name, ref] of Object.entries(refs)) {
+        const value = await deps.heldKeys.resolve(ref);
+        if (value)
+            held[name] = value;
+    }
+    return held;
+}
+/** Retries `task`; the cause is dropped in case it echoes a secret, and the error names `what` only. */
+async function attempt(what, task) {
+    for (let n = 1; n <= UPTIME_ATTEMPTS; n++) {
+        try {
+            await task();
+            return;
+        }
+        catch {
+            // Retried; the error is dropped.
+        }
+    }
+    throw new Error(`platform:uptime: ${what} failed after ${UPTIME_ATTEMPTS} attempts`);
+}
+/** Removes an Access token edge made; one already gone is success. */
+async function removeAccessToken(access, id, what) {
+    try {
+        await access.removeServiceToken(id);
+    }
+    catch (error) {
+        if (error instanceof EdgeApiError && error.code === 'not_found')
+            return;
+        // The cause is dropped; edge's text is not ours to pass on.
+        throw new Error(`platform:uptime: ${what} ${id} could not be removed through edge`);
+    }
+}
+/**
+ * foundry#542: makes the uptime Worker true, in an order where every failure
+ * is repaired by the next apply and none needs a hand edit. Upload the pinned
+ * Archon release (the host fetches and verifies it) and record the script at
+ * once, so a later failure is a half-made Worker foundry owns. Then hold the
+ * Worker token and the Access pair (minted once each, each guard recorded as
+ * soon as its value is held), set every held secret on the Worker, and last
+ * the cron trigger, so the Worker never runs a round without its token. The
+ * applied values are recorded only when all of it succeeded.
+ */
+export async function provisionPlatformUptime(context, deps) {
+    const { platform } = context;
+    const { uptime } = platform;
+    const recorded = context.recordedIds();
+    const edgeUrl = recorded[PLATFORM_EDGE_INTERNAL_URL_SCOPE_KEY];
+    if (!edgeUrl) {
+        throw new Error(`platform:uptime: edge has not been applied yet (no recorded ${PLATFORM_EDGE_INTERNAL_URL_SCOPE_KEY}); the Worker is managed through it`);
+    }
+    const workers = await deps.workers(edgeUrl);
+    if (!uptime.enabled) {
+        // Whatever of a (possibly half-made) deploy exists is removed; what does not exist is tolerated.
+        await workers.deleteScript(PLATFORM_UPTIME_SCRIPT_NAME);
+        const accessTokenId = recorded[PLATFORM_UPTIME_ACCESS_TOKEN_ID_SCOPE_KEY] ||
+            recorded[PLATFORM_UPTIME_ACCESS_UNDELIVERED_SCOPE_KEY];
+        if (accessTokenId) {
+            await removeAccessToken(await deps.access(edgeUrl), accessTokenId, 'Access token');
+        }
+        for (const ref of [
+            PLATFORM_UPTIME_TOKEN_REF,
+            PLATFORM_UPTIME_ACCESS_CLIENT_ID_REF,
+            PLATFORM_UPTIME_ACCESS_CLIENT_SECRET_REF,
+        ]) {
+            await attempt('clearing a held uptime value', () => deps.deliverSecret(ref, ''));
+        }
+        for (const key of [
+            PLATFORM_UPTIME_ACCESS_TOKEN_ID_SCOPE_KEY,
+            PLATFORM_UPTIME_ACCESS_UNDELIVERED_SCOPE_KEY,
+            PLATFORM_UPTIME_TOKEN_ID_SCOPE_KEY,
+            PLATFORM_UPTIME_TOKEN_UNDELIVERED_SCOPE_KEY,
+        ]) {
+            context.recordScopeId(key, '');
+        }
+        context.recordScopeId(PLATFORM_UPTIME_REMOVED_SCOPE_KEY, '1');
+        return {};
+    }
+    if (!uptime.tag || !uptime.sha256) {
+        throw new Error('platform:uptime: no artifact is pinned (uptime.tag, uptime.sha256)');
+    }
+    const hostname = platform.archon.hostname;
+    const held = await heldUptimeValues(deps);
+    const bindings = [
+        { type: 'kv_namespace', name: 'UPTIME_KV', title: PLATFORM_UPTIME_KV_TITLE },
+        { type: 'plain_text', name: 'ARCHON_BASE_URL', text: `https://${hostname}` },
+        ...UPTIME_OPTIONAL_VARS.flatMap((name) => {
+            const text = deps.vars?.[name];
+            return text ? [{ type: 'plain_text', name, text }] : [];
+        }),
+    ];
+    await workers.uploadScript({
+        name: PLATFORM_UPTIME_SCRIPT_NAME,
+        artifactUrl: uptimeArtifactUrl(uptime.tag),
+        artifactSha256: uptime.sha256,
+        compatibilityDate: UPTIME_COMPATIBILITY_DATE,
+        bindings,
+    });
+    // The script is foundry's from here on. Recorded now, not at the end: after
+    // a later failure the next plan must repair this Worker, not take it for a
+    // foreign one. "Fully applied" is the applied values recorded at the end.
+    context.recordScopeId(`cloudflare:worker:${PLATFORM_UPTIME_KEY}`, PLATFORM_UPTIME_SCRIPT_NAME);
+    context.recordScopeId(PLATFORM_UPTIME_REMOVED_SCOPE_KEY, '');
+    await context.persist?.();
+    // The Worker token. It is generated here and registered nowhere else until
+    // it is held (the Worker and Archon get it from the held value, later), so a
+    // marker without its guard means the value never left this process, and a
+    // guard with nothing held means it is gone: either way a new one is
+    // generated and the old id is dropped. Nothing is blocked and nothing needs
+    // a hand edit.
+    let tokenId = recorded[PLATFORM_UPTIME_TOKEN_ID_SCOPE_KEY];
+    let token = tokenId ? await deps.heldKeys.resolve(PLATFORM_UPTIME_TOKEN_REF) : null;
+    if (!token) {
+        const newId = randomUUID();
+        const minted = randomBytes(32).toString('hex');
+        context.recordScopeId(PLATFORM_UPTIME_TOKEN_UNDELIVERED_SCOPE_KEY, newId);
+        await context.persist?.();
+        await attempt(`holding token ${newId}`, () => deps.deliverSecret(PLATFORM_UPTIME_TOKEN_REF, minted));
+        // Guard as soon as the value is held.
+        context.recordScopeId(PLATFORM_UPTIME_TOKEN_ID_SCOPE_KEY, newId);
+        context.recordScopeId(PLATFORM_UPTIME_TOKEN_UNDELIVERED_SCOPE_KEY, '');
+        await context.persist?.();
+        tokenId = newId;
+        token = minted;
+    }
+    // The Access service token pair, minted through edge. The id is recorded
+    // and persisted before the pair is held, the guard once both are held. A
+    // pair that may be lost (marker without guard, or guard with nothing held)
+    // is repaired here: edge made that token, so it is removed through edge and
+    // minted again, never two live tokens. A token of the name with no id
+    // recorded is not ours to remove: edge answers `conflict` and the planner
+    // reports it as blocked; the throw here is only a race with that report.
+    let accessId = recorded[PLATFORM_UPTIME_ACCESS_TOKEN_ID_SCOPE_KEY];
+    let clientId = accessId
+        ? await deps.heldKeys.resolve(PLATFORM_UPTIME_ACCESS_CLIENT_ID_REF)
+        : null;
+    let clientSecret = accessId
+        ? await deps.heldKeys.resolve(PLATFORM_UPTIME_ACCESS_CLIENT_SECRET_REF)
+        : null;
+    if (!accessId || !clientId || !clientSecret) {
+        const access = await deps.access(edgeUrl);
+        const lost = accessId || recorded[PLATFORM_UPTIME_ACCESS_UNDELIVERED_SCOPE_KEY];
+        if (lost) {
+            await removeAccessToken(access, lost, 'lost Access token');
+            context.recordScopeId(PLATFORM_UPTIME_ACCESS_TOKEN_ID_SCOPE_KEY, '');
+            context.recordScopeId(PLATFORM_UPTIME_ACCESS_UNDELIVERED_SCOPE_KEY, '');
+            await context.persist?.();
+        }
+        let minted;
+        try {
+            minted = await access.createServiceToken(PLATFORM_UPTIME_ACCESS_TOKEN_NAME);
+        }
+        catch (error) {
+            if (error instanceof EdgeApiError && error.code === 'conflict') {
+                throw new Error(`platform:uptime: ${uptimeAccessTokenConflict()}`);
+            }
+            throw error;
+        }
+        context.recordScopeId(PLATFORM_UPTIME_ACCESS_UNDELIVERED_SCOPE_KEY, minted.id);
+        await context.persist?.();
+        if (!minted.clientId || !minted.clientSecret) {
+            await removeAccessToken(access, minted.id, 'incomplete Access token');
+            context.recordScopeId(PLATFORM_UPTIME_ACCESS_UNDELIVERED_SCOPE_KEY, '');
+            await context.persist?.();
+            throw new Error(`platform:uptime: edge returned Access token ${minted.id} without a client id or secret; it was removed`);
+        }
+        const newId = minted.id;
+        const idToHold = minted.clientId;
+        const secretToHold = minted.clientSecret;
+        await attempt(`holding Access token ${newId} client id`, () => deps.deliverSecret(PLATFORM_UPTIME_ACCESS_CLIENT_ID_REF, idToHold));
+        await attempt(`holding Access token ${newId} client secret`, () => deps.deliverSecret(PLATFORM_UPTIME_ACCESS_CLIENT_SECRET_REF, secretToHold));
+        context.recordScopeId(PLATFORM_UPTIME_ACCESS_TOKEN_ID_SCOPE_KEY, newId);
+        context.recordScopeId(PLATFORM_UPTIME_ACCESS_UNDELIVERED_SCOPE_KEY, '');
+        await context.persist?.();
+        accessId = newId;
+        clientId = idToHold;
+        clientSecret = secretToHold;
+    }
+    // Set on the Worker from the held values, every time this step runs. The
+    // held secrets' version label is the pinned digest, so a new release sets
+    // them again. The held-key reader exposes no per-value id or update time,
+    // so a value rotated at the same pin is not seen; the minted ones carry
+    // their id.
+    const version = `pin-${uptime.sha256.slice(0, 12)}`;
+    const secrets = [
+        { name: 'UPTIME_TOKEN', value: token, version: tokenId },
+        { name: 'CF_ACCESS_CLIENT_ID', value: clientId, version: accessId },
+        { name: 'CF_ACCESS_CLIENT_SECRET', value: clientSecret, version: accessId },
+        // A ping URL works as a capability: a secret, not a plain text binding.
+        ...Object.entries(held).map(([name, value]) => ({ name, value, version })),
+    ];
+    await attempt(`setting the Worker's secrets (${secrets.map((s) => s.name).join(', ')})`, () => workers.setSecrets(PLATFORM_UPTIME_SCRIPT_NAME, secrets));
+    // After the secrets: the Worker never runs a round without its token.
+    await workers.setSchedules(PLATFORM_UPTIME_SCRIPT_NAME, UPTIME_CRONS);
+    // Last, after every write the applied values depend on.
+    context.recordScopeId(PLATFORM_UPTIME_APPLIED_TAG_SCOPE_KEY, uptime.tag);
+    context.recordScopeId(PLATFORM_UPTIME_APPLIED_SHA256_SCOPE_KEY, uptime.sha256);
+    context.recordScopeId(PLATFORM_UPTIME_APPLIED_HOSTNAME_SCOPE_KEY, hostname);
+    context.recordScopeId(PLATFORM_UPTIME_APPLIED_VARS_SCOPE_KEY, uptimeVarsDigest(deps.vars));
+    context.recordScopeId(PLATFORM_UPTIME_APPLIED_SECRETS_SCOPE_KEY, uptimeSecretNames(Object.keys(held)));
+    return { resourceId: PLATFORM_UPTIME_SCRIPT_NAME };
+}

package/dist/platform.d.ts

@@ -24,6 +24,22 @@ export interface PlatformService {
 export interface PlatformMailService extends PlatformService {
     lettermintProjectId?: string | null;
 }
+/**
+ * The uptime Worker (foundry#542): the outside prober Archon publishes as a
+ * built script with each `v*` release. Foundry deploys the pinned release and
+ * never builds it. `tag` and `sha256` are the pin; both empty means nothing is
+ * pinned yet, and the planner reports that instead of planning the step.
+ * It has no hostname: it answers no request, only probes on a cron trigger.
+ */
+export interface PlatformUptimeWorker {
+    enabled: boolean;
+    /** An Archon release tag, `v1.2.3`. */
+    tag: string;
+    /** Lower-case hex SHA-256 of `archon-uptime-worker.js` at that tag. */
+    sha256: string;
+}
+/** Where Archon publishes the Worker script for `tag` (a private repo; the host's `fetchArtifact` fetches it). */
+export declare function uptimeArtifactUrl(tag: string): string;
 /**
  * The shared services a declared platform names, decided in #165, plus
  * `edge` (#317, F7): the service that mints an entry's own edge key and
@@ -87,6 +103,8 @@ export interface DeclaredPlatform {
      * `gitRef` empty.
      */
     coolify: PlatformService;
+    /** foundry#542: the outside prober Worker; see {@link PlatformUptimeWorker}. */
+    uptime: PlatformUptimeWorker;
 }
 /** `<service>.<apex>` -- the default `hostname` for a platform service, before an operator overrides it. */
 export declare function defaultPlatformHostname(service: PlatformServiceKey, apex: string): string;

package/dist/platform.js

@@ -1,5 +1,9 @@
 import { isIPv4 } from 'node:net';
 import { validateDomain } from './org.js';
+/** Where Archon publishes the Worker script for `tag` (a private repo; the host's `fetchArtifact` fetches it). */
+export function uptimeArtifactUrl(tag) {
+    return `https://github.com/wtfalch/archon/releases/download/${tag}/archon-uptime-worker.js`;
+}
 export const PLATFORM_SERVICE_KEYS = [
     'auth',
     'mail',
@@ -50,6 +54,16 @@ export function validatePlatform(platform) {
             return `${key}.gitRef must not be empty once ${key}.enabled is true`;
         }
     }
+    const { uptime } = platform;
+    if (Boolean(uptime.tag.trim()) !== Boolean(uptime.sha256.trim())) {
+        return 'uptime.tag and uptime.sha256 must be set together: a pin is both';
+    }
+    if (uptime.tag && !/^v[0-9A-Za-z][0-9A-Za-z.+_-]*$/.test(uptime.tag)) {
+        return `uptime.tag '${uptime.tag}' must be a release tag such as v1.2.3`;
+    }
+    if (uptime.sha256 && !/^[0-9a-f]{64}$/.test(uptime.sha256)) {
+        return 'uptime.sha256 must be 64 lower-case hex characters';
+    }
     // #491: declared, never discovered -- a present-but-blank id is refused the
     // same way `serverIpv4`'s blank string is, rather than being read as unset.
     if (platform.mail.lettermintProjectId != null && !platform.mail.lettermintProjectId.trim()) {