@wtfalch/foundry 0.42.1 → 0.44.0

package/dist/plan/remote-database.js

@@ -0,0 +1,373 @@
+import { pinnedRef } from '../bootstrap/versions.js';
+import { PRIMARY_SERVER_SCOPE_KEY, splitServers } from './blue-green.js';
+import { isNotFoundError } from './executor.js';
+import { appNameFor } from './platform-diff.js';
+/**
+ * A blue/green app on a server other than the database's reaches its one database through a
+ * Cloudflare tunnel TCP route behind an Access service token (William, 2026-10-15). The tunnel has a
+ * `tcp://<org>-db:5432` rule on an internal hostname; Access lets only the service token in; a
+ * `cloudflared access tcp` sidecar on each other server listens on 5432 under the name
+ * {@link remoteDatabaseHost}.
+ */
+export const REMOTE_DATABASE_PORT = 5432;
+const DELIVERY_ATTEMPTS = 3;
+/** The sidecar's name on the Docker network of `serverUuid`, or `null` on the database's own server. */
+export function remoteDatabaseHost(entryKey, serverUuid, primaryUuid) {
+    return serverUuid === primaryUuid ? null : `${entryKey}-db-access`;
+}
+/** The `host:port` a color on a server other than the database's connects to. */
+export const remoteDatabaseAddress = (host) => `${host}:${REMOTE_DATABASE_PORT}`;
+/**
+ * The facts for {@link planRemoteDatabase}, from what the planner already read. The zone is the one the org's
+ * tunnel names live in (`org.domain`); `access` says the host can reach Access, tunnels, DNS and zones.
+ */
+export function remoteDatabaseFactsFrom(input) {
+    const { up } = splitServers(input.servers);
+    return {
+        serverUuids: up,
+        primaryUuid: input.recorded[PRIMARY_SERVER_SCOPE_KEY] ?? up[0] ?? null,
+        zone: input.org.domain ?? null,
+        access: input.access,
+    };
+}
+/** The scope ids one entry's step keeps. None holds a secret. */
+export const remoteDatabaseKeys = (entryKey) => ({
+    /** The service token's id, from its mint until its secret reached every sidecar. No `:`. */
+    undelivered: `bgdb.${entryKey}.undelivered`,
+    /** The service token's id once delivered. */
+    token: `bgdb.${entryKey}.token`,
+    access: `bgdb.${entryKey}.access`,
+    route: `bgdb.${entryKey}.route`,
+    applied: `bgdb.${entryKey}.applied`,
+    sidecar: (serverUuid) => `bgdb.${entryKey}.sidecar.${serverUuid}`,
+});
+/** The tunnel's HTTP rules as the org tunnel step last wrote them (JSON), so a later write keeps them. */
+export const TUNNEL_HTTP_INGRESS_SCOPE_KEY = 'cloudflare_tunnel_http_ingress';
+const ROUTE_KEY = /^bgdb\.[^.:]+\.route$/;
+/** Every TCP route recorded for the org, in key order. */
+export function recordedTcpRoutes(recorded) {
+    const routes = [];
+    for (const key of Object.keys(recorded).sort()) {
+        if (!ROUTE_KEY.test(key) || !recorded[key])
+            continue;
+        try {
+            const parsed = JSON.parse(recorded[key]);
+            if (typeof parsed.hostname === 'string' && typeof parsed.service === 'string') {
+                routes.push({ hostname: parsed.hostname, service: parsed.service });
+            }
+        }
+        catch {
+            // A record that is not JSON is ignored; the next apply of the step writes it again.
+        }
+    }
+    return routes;
+}
+/** The HTTP rules recorded by the tunnel step, catch-all included; `[]` if none or unreadable. */
+export function recordedHttpIngress(recorded) {
+    try {
+        const parsed = JSON.parse(recorded[TUNNEL_HTTP_INGRESS_SCOPE_KEY] ?? '[]');
+        return Array.isArray(parsed) ? parsed : [];
+    }
+    catch {
+        return [];
+    }
+}
+/**
+ * The tunnel's whole ingress: the TCP rules first (their names are exact), then every HTTP rule, the
+ * catch-all last. `putTunnelConfig` replaces the whole list, so every writer builds it through this.
+ */
+export function mergeTcpIngress(http, tcp) {
+    const names = new Set(tcp.map((r) => r.hostname));
+    const rules = http.filter((r) => !(r.hostname && names.has(r.hostname)));
+    const catchAll = rules.filter((r) => !r.hostname);
+    return [
+        ...tcp.map((r) => ({ hostname: r.hostname, service: r.service })),
+        ...rules.filter((r) => r.hostname),
+        ...(catchAll.length > 0 ? catchAll : [{ service: 'http_status:404' }]),
+    ];
+}
+/** The entry that gets a remote route: blue/green with the org's database. */
+function routedEntry(org) {
+    if (!org.hosting.enabled)
+        return undefined;
+    return org.hosting.entries.find((e) => e.database && e.blueGreen);
+}
+const appliedMarker = (d) => JSON.stringify({ hostname: d.hostname, database: d.database, servers: d.servers });
+/** Whether the route step has been applied for `serverUuid`: its marker names the server. */
+export function remoteDatabaseAppliedFor(recorded, entryKey, serverUuid) {
+    try {
+        const marker = JSON.parse(recorded[remoteDatabaseKeys(entryKey).applied] ?? 'null');
+        return Array.isArray(marker?.servers) && marker.servers.includes(serverUuid);
+    }
+    catch {
+        return false;
+    }
+}
+/**
+ * Plans the remote database route for the org's blue/green database entry. One server, or no facts,
+ * plans nothing. A missing zone, port, tunnel or primary is a blocked line (rule 2), and so is a token
+ * that was minted and never delivered (rule 1): it is never minted again.
+ */
+export function planRemoteDatabase(org, facts, recorded) {
+    const entry = routedEntry(org);
+    if (!entry || !facts || facts.serverUuids.length < 2)
+        return { step: null, blocked: null };
+    const key = `cloudflare:db-route:${org.id}`;
+    const block = (reason) => ({
+        step: null,
+        blocked: {
+            description: `${org.slug}'s remote database route for ${entry.key} is blocked, not planned: ${reason}`,
+            key,
+        },
+    });
+    const keys = remoteDatabaseKeys(entry.key);
+    const lost = recorded[keys.undelivered];
+    if (lost) {
+        return block(`its Access service token ${lost} was minted and its secret never reached every sidecar; delete the token in Cloudflare and clear the recorded id before minting again`);
+    }
+    if (!facts.access)
+        return block('the host supplies no Access, tunnel, DNS or zone port');
+    if (!facts.zone)
+        return block("the platform's edge has no internal zone");
+    if (!facts.primaryUuid)
+        return block('no primary server is recorded');
+    if (!recorded[`cloudflare:tunnel:${org.id}`]) {
+        return block(`${org.slug}'s Cloudflare tunnel is not applied yet`);
+    }
+    const database = recorded[`coolify:database:${org.id}`];
+    if (!database)
+        return block(`${org.slug}'s database is not applied yet`);
+    const app = appNameFor(org, entry);
+    const desired = {
+        entry: entry.key,
+        app,
+        hostname: `${app}-db.${facts.zone}`,
+        database,
+        primary: facts.primaryUuid,
+        servers: facts.serverUuids.filter((s) => s !== facts.primaryUuid).sort(),
+        zone: facts.zone,
+    };
+    // A server added after the token was minted gets its sidecar's secret copied from another sidecar;
+    // with no sidecar to copy from there is nothing to give it.
+    if (recorded[keys.token] && desired.servers.every((server) => !recorded[keys.sidecar(server)])) {
+        return block(`service token ${recorded[keys.token]} cannot be shown again and no sidecar holds it to copy; delete the token in Cloudflare and clear the recorded ids to mint it again`);
+    }
+    if (recorded[keys.applied] === appliedMarker(desired))
+        return { step: null, blocked: null };
+    return {
+        blocked: null,
+        step: {
+            action: {
+                system: 'cloudflare',
+                kind: 'db-route',
+                key: org.id,
+                desired: { ...desired },
+            },
+            step: {
+                description: `reach ${org.slug}'s database from ${desired.servers.length} other server(s) through a tunnel route behind an Access service token`,
+                destroys: false,
+                migrates: false,
+            },
+        },
+    };
+}
+/** The Dockerfile of the sidecar: the pinned `cloudflared`, listening on 5432 for the Access-protected route. */
+export function remoteDatabaseDockerfile(hostname) {
+    return [
+        `FROM cloudflare/cloudflared:${pinnedRef('cloudflared')}`,
+        `CMD ["access", "tcp", "--hostname", "${hostname}", "--url", "0.0.0.0:${REMOTE_DATABASE_PORT}"]`,
+        // The image is distroless (no shell, no nc): the exec-form check proves only that the binary runs.
+        'HEALTHCHECK --interval=30s --timeout=5s --start-period=10s --retries=3 CMD ["cloudflared", "version"]',
+        '',
+    ].join('\n');
+}
+const TOKEN_ID_ENV = 'TUNNEL_SERVICE_TOKEN_ID';
+const TOKEN_SECRET_ENV = 'TUNNEL_SERVICE_TOKEN_SECRET';
+/**
+ * Applies one entry's route. The Access app and its service-token policy come first, so the tunnel route
+ * and the DNS record never exist without the gate in front of them. The service token is minted once
+ * (rule 1): its id is recorded and persisted before delivery, the secret goes only to the sidecars' env
+ * (rule 6), the delivered id replaces it, and the applied marker is the last write. A failure halfway
+ * leaves a repair for the next run: the Access app, sidecars, route and DNS are found again; a minted
+ * token is never minted again. A sidecar made after the mint takes its secret from an existing sidecar's
+ * env. Every outside call is bounded by the ports' own timeouts (edge SDK and Coolify client).
+ */
+export async function applyRemoteDatabase(deps, run) {
+    const { desired, org } = run;
+    const keys = remoteDatabaseKeys(desired.entry);
+    const tunnelId = run.recorded()[`cloudflare:tunnel:${org.id}`];
+    if (!tunnelId)
+        throw new Error(`remote database for ${org.slug}: the Cloudflare tunnel is not applied`);
+    const zone = await deps.zones.findZoneByApex(desired.zone);
+    if (!zone)
+        throw new Error(`remote database for ${org.slug}: zone ${desired.zone} is not live`);
+    let accessAppId = run.recorded()[keys.access];
+    if (!accessAppId) {
+        const live = (await deps.access.listAccessApps()).find((a) => a.domain === desired.hostname);
+        accessAppId = (live ??
+            (await deps.access.createAccessApp({
+                name: `${desired.app}-db-access`,
+                domain: desired.hostname,
+                type: 'self_hosted',
+            }))).id;
+        run.record(keys.access, accessAppId);
+        await run.persist();
+    }
+    // Sidecars exist before the secret does, so the secret has somewhere to go the moment it is minted.
+    const { environment } = await deps.coolify.findOrCreateEnvironment(run.projectUuid, 'production');
+    const sidecars = [];
+    for (const server of desired.servers) {
+        const host = remoteDatabaseHost(desired.app, server, desired.primary);
+        if (!host)
+            continue;
+        const recordedId = run.recorded()[keys.sidecar(server)];
+        let appId = null;
+        if (recordedId) {
+            try {
+                await deps.coolify.getApplication(recordedId);
+                appId = recordedId;
+            }
+            catch (error) {
+                if (!isNotFoundError(error))
+                    throw error;
+            }
+        }
+        let fresh = false;
+        if (!appId) {
+            const created = await deps.coolify.createDockerfileApplication({
+                project_uuid: run.projectUuid,
+                server_uuid: server,
+                environment_name: environment.name,
+                environment_uuid: environment.uuid,
+                dockerfile: remoteDatabaseDockerfile(desired.hostname),
+                name: host,
+                description: `cloudflared access sidecar: ${org.slug}'s database over the tunnel`,
+                instant_deploy: false,
+                autogenerate_domain: false,
+            });
+            appId = created.uuid;
+            fresh = true;
+            // The internal name is what `<app>-db-access` resolves to on the server's Docker network.
+            await deps.coolify.updateApplication(appId, {
+                custom_internal_name: host,
+                health_check_enabled: false,
+            });
+            run.record(keys.sidecar(server), appId);
+            await run.persist();
+        }
+        sidecars.push({ server, appId, fresh });
+    }
+    // The token: found by recorded id first. A token of the name that foundry has no id for is not
+    // minted over; the step fails with fixed text.
+    const lost = run.recorded()[keys.undelivered];
+    if (lost) {
+        throw new Error(`remote database for ${org.slug}: service token ${lost} was minted and not delivered; delete it in Cloudflare and clear the recorded id before minting again`);
+    }
+    let tokenId = run.recorded()[keys.token];
+    let secrets = null;
+    let deliverTo = sidecars;
+    if (!tokenId) {
+        const name = `${desired.app}-db-access`;
+        if (await deps.access.findServiceTokenByName(name)) {
+            throw new Error(`remote database for ${org.slug}: a service token named ${name} exists and foundry holds no id for it; delete it in Cloudflare before applying again`);
+        }
+        const minted = await deps.access.createServiceToken(name);
+        deps.secret(minted.clientSecret);
+        deps.secret(minted.clientId);
+        run.record(keys.undelivered, minted.id);
+        await run.persist();
+        tokenId = minted.id;
+        secrets = { clientId: minted.clientId, clientSecret: minted.clientSecret };
+    }
+    else {
+        // A sidecar made after the token was minted takes the secret from a sidecar that already holds it.
+        deliverTo = sidecars.filter((sidecar) => sidecar.fresh);
+        if (deliverTo.length > 0) {
+            secrets = await secretsOf(deps, sidecars.filter((sidecar) => !sidecar.fresh));
+            if (!secrets) {
+                throw new Error(`remote database for ${org.slug}: the sidecar on server ${deliverTo[0]?.server} is new and no existing sidecar holds service token ${tokenId} to copy; delete the token in Cloudflare and clear the recorded ids to mint it again`);
+            }
+        }
+    }
+    if (secrets) {
+        const failed = [];
+        for (const sidecar of deliverTo) {
+            if (!(await deliver(deps, sidecar.appId, secrets)))
+                failed.push(sidecar.server);
+        }
+        if (failed.length > 0) {
+            // Ids only: the cause of a failed write can echo the request body.
+            throw new Error(`remote database for ${org.slug}: service token ${tokenId} could not be delivered to the sidecar on server ${failed.join(', ')} after ${DELIVERY_ATTEMPTS} attempts; delete the token in Cloudflare and clear the recorded id before minting again`);
+        }
+        if (run.recorded()[keys.undelivered]) {
+            run.record(keys.token, tokenId);
+            run.record(keys.undelivered, '');
+            await run.persist();
+        }
+    }
+    const policies = await deps.access.listAccessPolicies(accessAppId);
+    const hasPolicy = policies.some((p) => p.decision === 'non_identity' &&
+        (p.include ?? []).some((r) => r.service_token?.token_id === tokenId));
+    if (!hasPolicy) {
+        await deps.access.createAccessPolicy(accessAppId, {
+            name: 'database sidecars',
+            decision: 'non_identity',
+            include: [{ service_token: { token_id: tokenId } }],
+        });
+    }
+    // The gate exists: now the route and the name that reach the database.
+    run.record(keys.route, JSON.stringify({
+        hostname: desired.hostname,
+        service: `tcp://${run.databaseHost}:${REMOTE_DATABASE_PORT}`,
+    }));
+    await deps.tunnels.putTunnelConfig(tunnelId, {
+        ingress: mergeTcpIngress(recordedHttpIngress(run.recorded()), recordedTcpRoutes(run.recorded())),
+    });
+    if ((await deps.dns.findDnsRecord(zone.name, desired.hostname, 'CNAME')).length === 0) {
+        await deps.dns.createDnsRecord(zone.name, {
+            type: 'CNAME',
+            name: desired.hostname,
+            content: `${tunnelId}.cfargotunnel.com`,
+            proxied: true,
+        });
+    }
+    for (const sidecar of sidecars) {
+        const live = await deps.coolify.getApplication(sidecar.appId);
+        const up = Boolean(live.status?.startsWith('running') || live.status?.startsWith('starting'));
+        if (secrets || sidecar.fresh || !up)
+            await deps.coolify.deploy(sidecar.appId);
+    }
+    run.record(keys.applied, appliedMarker(desired));
+    await run.persist();
+}
+/** The service token an existing sidecar already holds in its env, registered for redaction; `null` when none does. */
+async function secretsOf(deps, sidecars) {
+    for (const sidecar of sidecars) {
+        const envs = await deps.coolify.listEnvs(sidecar.appId);
+        const envValue = (key) => envs.find((e) => e.key === key && !e.is_preview)?.value;
+        const clientId = envValue(TOKEN_ID_ENV);
+        const clientSecret = envValue(TOKEN_SECRET_ENV);
+        if (clientId && clientSecret) {
+            deps.secret(clientId);
+            deps.secret(clientSecret);
+            return { clientId, clientSecret };
+        }
+    }
+    return null;
+}
+/** Writes the token to one sidecar's env, up to {@link DELIVERY_ATTEMPTS} times; the error is dropped. */
+async function deliver(deps, appId, secrets) {
+    for (let attempt = 1; attempt <= DELIVERY_ATTEMPTS; attempt++) {
+        try {
+            await deps.coolify.bulkUpsertEnvs(appId, [
+                { key: TOKEN_ID_ENV, value: secrets.clientId, literal: true },
+                { key: TOKEN_SECRET_ENV, value: secrets.clientSecret, literal: true },
+            ]);
+            return true;
+        }
+        catch {
+            // Retried; the error is dropped in case it echoes the secret.
+        }
+    }
+    return false;
+}

package/dist/plan/worker-app-database.d.ts

@@ -0,0 +1,148 @@
+import type { DeclaredOrg, HostingEntry } from '../org.js';
+import type { AccessPort } from './edge-access.js';
+import type { DnsPort } from './edge-dns.js';
+import type { TunnelPort } from './edge-tunnels.js';
+import type { ZonePort } from './edge-zones.js';
+import type { StepExecutionContext } from './plan-apply.js';
+/**
+ * C2 (campaign 2026-10-15): a Worker app with `workerApp.database` reaches the org's Coolify
+ * Postgres through a Hyperdrive config. The database host is Docker-internal, so Hyperdrive
+ * connects over the org's Cloudflare tunnel (a `tcp://<db container>:5432` rule on an internal
+ * hostname) behind an Access service token, the route `plan/remote-database.ts` already uses
+ * between servers.
+ *
+ * Order on apply, inside the `cloudflare:worker-app` step and before the upload, so a failure at
+ * any point leaves a state the next apply repairs and the Worker is never deployed against a
+ * database it cannot use:
+ * Access app and service token -> tunnel rule and DNS -> `<db>_rt` password -> release
+ * `migrations.json` (its sha256 checked against `database.migrationsSha256`) applied with the owner credentials -> runtime role (UPDATE, DELETE and
+ * TRUNCATE revoked on `appendOnly`) -> Hyperdrive config with the runtime credentials.
+ * A failed migration throws, so the Worker is not uploaded.
+ */
+/** Everything needed to open a connection to the org's database over the tunnel. */
+export interface HyperdriveOrigin {
+    /** The tunnel hostname that fronts the database (Access protected). */
+    host: string;
+    database: string;
+    user: string;
+    password: string;
+    accessClientId: string;
+    accessClientSecret: string;
+}
+/** One migration of a release's `migrations.json`. */
+export interface DatabaseMigration {
+    id: string;
+    sql: string;
+}
+/**
+ * The calls a Worker app database needs beyond Cloudflare's Access, tunnel and DNS. Edge's
+ * Hyperdrive SDK (`client.platform.hyperdrive`) and the SQL runner behind the tunnel
+ * (`@wtfalch/db`'s migrate and `ensureRuntimeRole`) are the host's to implement; foundry only
+ * calls this port. Every method is idempotent.
+ */
+export interface WorkerAppDatabasePort {
+    /** Creates or updates the Hyperdrive config `name`; returns its id. */
+    upsertHyperdrive(input: {
+        name: string;
+        origin: HyperdriveOrigin;
+    }): Promise<{
+        id: string;
+    }>;
+    /** A no-op when the config is gone. */
+    deleteHyperdrive(name: string): Promise<void>;
+    /** The text of a release asset of a wtfalch repo, or `null` when the release has no such asset. */
+    fetchReleaseAsset(url: string): Promise<string | null>;
+    /** The migration ids the database's ledger holds, in the order applied. */
+    appliedMigrationIds(owner: HyperdriveOrigin): Promise<string[]>;
+    /** Runs `migration.sql` and records `migration.id` in the ledger in one transaction. */
+    applyMigration(owner: HyperdriveOrigin, migration: DatabaseMigration): Promise<void>;
+    /**
+     * Creates or updates the `runtime.user` role with `runtime.password`, grants it DML on the
+     * tables and revokes UPDATE, DELETE and TRUNCATE from it on each `appendOnly` table.
+     */
+    ensureRuntimeRole(input: {
+        owner: HyperdriveOrigin;
+        runtime: {
+            user: string;
+            password: string;
+        };
+        appendOnly: string[];
+    }): Promise<void>;
+}
+export declare const WORKER_APP_MIGRATION_TIMEOUT_MS = 300000;
+export declare const MIGRATIONS_ASSET_NAME = "migrations.json";
+/** The Hyperdrive config, `{name, id}` as JSON. No secret. */
+export declare const workerAppHyperdriveScopeKey: (entryKey: string) => string;
+/** The migration ids applied, a JSON list, for the plan and the operator. The database's ledger is the fact. */
+export declare const workerAppMigrationsScopeKey: (entryKey: string) => string;
+/** The applied route marker (`{hostname, database}`). */
+export declare const workerAppDbRouteMarkerScopeKey: (entryKey: string) => string;
+/** The Hyperdrive config name of an entry: the Worker's script name plus `-db`. */
+export declare const hyperdriveName: (scriptName: string) => string;
+/** The tunnel hostname of an entry's database route: `<8 hex of org id>-<key>-hd.<zone>`. */
+export declare const hyperdriveHostname: (org: DeclaredOrg, entryKey: string, zone: string) => string;
+/**
+ * Reads a release's `migrations.json`. `null` text is an absent file: no migrations. A file that is
+ * not a list of `{id, sql}` with unique ids is refused, naming no SQL.
+ */
+export declare function parseMigrations(text: string | null): DatabaseMigration[];
+/**
+ * A present `migrations.json` runs as the database owner, so its bytes must be the ones the
+ * declaration pinned. No file needs no digest; a file with no declared digest, or a different
+ * one, is refused before it is parsed. The message names neither the SQL nor the wanted digest.
+ */
+export declare function verifyMigrationsDigest(text: string | null, declared: string | undefined): void;
+/** The URL of `migrations.json` beside the module: the same release, another file. */
+export declare const migrationsUrl: (artifactUrl: string) => string;
+/**
+ * The migrations the database does not hold, in order. The applied ledger must be the first
+ * migrations of the file: a missing or reordered one is refused (migrations are append-only).
+ */
+export declare function unappliedDatabaseMigrations(all: readonly DatabaseMigration[], applied: readonly string[]): DatabaseMigration[];
+export interface WorkerAppDatabaseDeps {
+    port: WorkerAppDatabasePort;
+    tunnels: Pick<TunnelPort, 'putTunnelConfig'>;
+    access: Pick<AccessPort, 'listAccessApps' | 'createAccessApp' | 'listAccessPolicies' | 'createAccessPolicy' | 'findServiceTokenByName' | 'createServiceToken' | 'deleteAccessApp' | 'removeServiceToken'>;
+    dns: Pick<DnsPort, 'findDnsRecord' | 'createDnsRecord' | 'deleteDnsRecord'>;
+    zones: Pick<ZonePort, 'findZoneByApex'>;
+    /** The owner connection string of the org's database, as Coolify reports it. Registered for redaction by the host. */
+    ownerUrl(databaseId: string): Promise<string>;
+    /** Registers a value for redaction before it is written anywhere. */
+    secret(value: string): void;
+    heldKeys?: {
+        resolve(ref: string): Promise<string | null | undefined>;
+        put?(ref: string, value: string): Promise<void>;
+    };
+    /** Test hook: the timeout of a call, in ms. */
+    timeoutMs?: number;
+    /** Test hook: the timeout of one migration, in ms. */
+    migrationTimeoutMs?: number;
+}
+type Call = <T>(label: string, task: () => Promise<T>, ms?: number) => Promise<T>;
+/**
+ * Makes the database true and returns the Hyperdrive config id for the `HYPERDRIVE` binding.
+ * Secrets (the owner and runtime passwords, the Access service token) go only to the port and the
+ * held-key store, never into an error, a recorded id or a return value. Each outside call is
+ * bounded by a timeout; the error names the call, never the cause.
+ */
+export declare function applyWorkerAppDatabase(deps: WorkerAppDatabaseDeps, org: DeclaredOrg, entry: HostingEntry, scriptName: string, want: {
+    artifactUrl: string;
+    database: {
+        appendOnly: string[];
+        migrationsSha256?: string;
+    };
+}, context: StepExecutionContext, zoneApex: string): Promise<{
+    hyperdriveId: string;
+}>;
+/** Deletes the entry's Hyperdrive config, found by the recorded name, and clears the record. */
+export declare function deleteWorkerAppHyperdrive(port: Pick<WorkerAppDatabasePort, 'deleteHyperdrive'> | undefined, entryKey: string, recorded: Readonly<Record<string, string>>, context: Pick<StepExecutionContext, 'recordScopeId' | 'persistScopeIds'> | null, call: Call): Promise<void>;
+/**
+ * Removes the Cloudflare state the database route made, in the order that never leaves a name
+ * pointing at nothing: the DNS record, the tunnel rule (the tunnel config is rewritten without
+ * it), the Access app, the service token (also one minted and never delivered), then the held
+ * token and runtime password and the recorded ids. Each step tolerates "already gone", and the
+ * ids are cleared last, so a failed run is repeated by the next one. With `context` null (org
+ * destroy) the ids are not cleared: destroy drops them with the org.
+ */
+export declare function deleteWorkerAppDatabaseRoute(database: WorkerAppDatabaseDeps | undefined, heldKeys: Pick<NonNullable<WorkerAppDatabaseDeps['heldKeys']>, 'put'> | undefined, orgId: string, entryKey: string, recorded: Readonly<Record<string, string>>, context: Pick<StepExecutionContext, 'recordScopeId' | 'persistScopeIds'> | null, call: Call): Promise<void>;
+export {};