@wtfalch/foundry 0.59.0 → 0.61.0

package/dist/plan/stage-isolation.d.ts

@@ -36,10 +36,31 @@ export declare function isAllowed(kind: StageKind, name: string): boolean;
 export declare const SHARED_WITH_PROD: Readonly<Record<string, string>>;
 /** Whether `name` may equal production's value. */
 export declare const isSharedWithProd: (name: string) => boolean;
+/** The live app's own sign-in values. Stage must hold none of them. */
+export interface LiveSignIn {
+    /** The live customers organisation's id. */
+    customersOrgId?: string;
+    /** The live app's client ids. */
+    clientIds: readonly string[];
+    /** The live workspaces keys. */
+    workspacesKeys: readonly string[];
+    /** The live apps' MCP audiences (the ZITADEL project ids). */
+    mcpAudiences?: readonly string[];
+    /** The live apps' MCP resources (their public MCP addresses). */
+    mcpResources?: readonly string[];
+}
+/** What a stage with its own sign-in says about it, for the isolation check. */
+export interface StageSignInGuard {
+    /** Stage signs in its own test customers organisation, so its organisation id may differ from production's. */
+    customers: boolean;
+    live: LiveSignIn;
+}
 export interface StageIsolationInput {
     kind: StageKind;
     prod: Surface;
     stage: Surface;
+    /** Present for a stage with its own sign-in (a workspace). */
+    signIn?: StageSignInGuard;
     /** The mail env stage is allowed to hold: the sink's wiring. Empty: stage holds no mail env. */
     sinkMail?: Readonly<Record<string, string>>;
 }
@@ -51,6 +72,9 @@ export interface StageIsolationInput {
  *    {@link SHARED_WITH_PROD} differs from production's), `live_mode_key`.
  *  - A4 names: `resource_shared`, `host_is_prod_internal`.
  *  - A5 mail: `mail_not_sink`, `mail_token`.
+ *  - A6 sign-in (with `signIn`): `live_customers_org`, `live_client_id`, `live_workspaces_key`,
+ *    `live_mcp_audience`, `live_mcp_resource` when stage holds the live customers organisation id, a live client
+ *    id, the live workspaces key, or a live MCP audience or resource.
  */
 export declare function assertStageIsolated(input: StageIsolationInput): string[];
 /** The sha256 of the stage env name set plus the resource set: what `bg.<id>.stageisolation` records. */

package/dist/plan/stage-isolation.js

@@ -87,6 +87,11 @@ export const STAGE_ALLOWLIST = {
         'JOBS_SYNC_KEY',
         'ANALYTICS_URL',
         'ANALYTICS_SITE_KEY',
+        'WORKSPACES_URL',
+        'WORKSPACES_API_KEY',
+        'MCP_AUDIENCE',
+        'MCP_RESOURCE',
+        'MCP_ISSUER',
     ],
 };
 /** Names no stage holds, whatever the app. */
@@ -159,6 +164,8 @@ export const SHARED_WITH_PROD = {
     AI_URL: 'the ai service is shared; stage reaches it only with its own organisation and key',
     JOBS_SCHEDULER_URL: 'the jobs service is shared; stage reaches it only with its own project and signing secret',
     ANALYTICS_URL: 'the analytics collector is shared; stage reports under its own site key',
+    MCP_ISSUER: 'the sign-in service is shared by decision; the issuer is a public address, not a credential',
+    WORKSPACES_URL: "the broker is shared; stage's own workspaces key opens its own product tenant, which holds no live customers' workspaces",
 };
 /** Whether `name` may equal production's value. */
 export const isSharedWithProd = (name) => Object.keys(SHARED_WITH_PROD).some((p) => globMatches(p, name));
@@ -174,6 +181,9 @@ const hostOf = (value) => URL_HOST.exec(value)?.[1]?.toLowerCase() ?? null;
  *    {@link SHARED_WITH_PROD} differs from production's), `live_mode_key`.
  *  - A4 names: `resource_shared`, `host_is_prod_internal`.
  *  - A5 mail: `mail_not_sink`, `mail_token`.
+ *  - A6 sign-in (with `signIn`): `live_customers_org`, `live_client_id`, `live_workspaces_key`,
+ *    `live_mcp_audience`, `live_mcp_resource` when stage holds the live customers organisation id, a live client
+ *    id, the live workspaces key, or a live MCP audience or resource.
  */
 export function assertStageIsolated(input) {
     const { kind, prod, stage } = input;
@@ -211,9 +221,27 @@ export function assertStageIsolated(input) {
             out.add(`env_not_allowed:${name}`);
         if (item.value !== undefined && LIVE_MODE_KEY.test(item.value))
             out.add(`live_mode_key:${name}`);
+        if (input.signIn && item.value !== undefined) {
+            const { live } = input.signIn;
+            if (name === 'AUTH_ORGANIZATION_ID' && item.value === live.customersOrgId) {
+                out.add(`live_customers_org:${name}`);
+            }
+            if (name === 'AUTH_CLIENT_ID' && live.clientIds.includes(item.value)) {
+                out.add(`live_client_id:${name}`);
+            }
+            if (name === 'WORKSPACES_API_KEY' && live.workspacesKeys.includes(item.value)) {
+                out.add(`live_workspaces_key:${name}`);
+            }
+            if (name === 'MCP_AUDIENCE' && live.mcpAudiences?.includes(item.value)) {
+                out.add(`live_mcp_audience:${name}`);
+            }
+            if (name === 'MCP_RESOURCE' && live.mcpResources?.includes(item.value)) {
+                out.add(`live_mcp_resource:${name}`);
+            }
+        }
         if (item.class === 'literal')
             continue;
-        const shared = isSharedWithProd(name);
+        const shared = isSharedWithProd(name) && !(input.signIn?.customers && name === 'AUTH_ORGANIZATION_ID');
         const counterpart = prodByName.get(name);
         if (shared) {
             const same = item.value !== undefined && counterpart?.value !== undefined

package/dist/plan/worker-app-database.d.ts

@@ -1,9 +1,11 @@
 import type { DeclaredOrg, HostingEntry } from '../org.js';
+import { type DatabaseMigration, MIGRATIONS_ASSET_NAME, WORKER_APP_MIGRATION_TIMEOUT_MS, type WorkerAppMigrationRunner, migrationsUrl, parseMigrations, runWorkerAppMigrations, unappliedDatabaseMigrations, verifyMigrationsDigest } from '../worker-app-migrations.js';
 import type { AccessPort } from './edge-access.js';
 import type { DnsPort } from './edge-dns.js';
 import type { TunnelPort } from './edge-tunnels.js';
 import type { ZonePort } from './edge-zones.js';
 import type { StepExecutionContext } from './plan-apply.js';
+export { type DatabaseMigration, MIGRATIONS_ASSET_NAME, WORKER_APP_MIGRATION_TIMEOUT_MS, type WorkerAppMigrationRunner, migrationsUrl, parseMigrations, runWorkerAppMigrations, unappliedDatabaseMigrations, verifyMigrationsDigest, };
 /**
  * C2 (campaign 2026-10-15): a Worker app with `workerApp.database` reaches the org's Coolify
  * Postgres through a Hyperdrive config. The database host is Docker-internal, so Hyperdrive
@@ -35,18 +37,13 @@ export interface HyperdriveOrigin {
         caPem: string;
     };
 }
-/** One migration of a release's `migrations.json`. */
-export interface DatabaseMigration {
-    id: string;
-    sql: string;
-}
 /**
  * The calls a Worker app database needs beyond Cloudflare's Access, tunnel and DNS. Edge's
  * Hyperdrive SDK (`client.platform.hyperdrive`) and the SQL runner behind the tunnel
  * (`@wtfalch/db`'s migrate and `ensureRuntimeRole`) are the host's to implement; foundry only
  * calls this port. Every method is idempotent.
  */
-export interface WorkerAppDatabasePort {
+export interface WorkerAppDatabasePort extends WorkerAppMigrationRunner<HyperdriveOrigin> {
     /** Creates or updates the Hyperdrive config `name`; returns its id. */
     upsertHyperdrive(input: {
         name: string;
@@ -63,27 +60,22 @@ export interface WorkerAppDatabasePort {
     }): Promise<{
         id: string;
     }>;
-    /** The text of a release asset of a wtfalch repo, or `null` when the release has no such asset. */
-    fetchReleaseAsset(url: string): Promise<string | null>;
-    /** The migration ids the database's ledger holds, in the order applied. */
-    appliedMigrationIds(owner: HyperdriveOrigin): Promise<string[]>;
-    /** Runs `migration.sql` and records `migration.id` in the ledger in one transaction. */
-    applyMigration(owner: HyperdriveOrigin, migration: DatabaseMigration): Promise<void>;
     /**
-     * Creates or updates the `runtime.user` role with `runtime.password`, grants it DML on the
-     * tables and revokes UPDATE, DELETE and TRUNCATE from it on each `appendOnly` table.
+     * `uses.audit`: runs the sealing role's SQL (`audit/sealer-role.ts`) as the database owner. Idempotent: it makes
+     * the role or sets its password again, and grants. Optional: a host without it gets no sealing role, the entry's
+     * `audit:ledger` step stays blocked and says so.
      */
-    ensureRuntimeRole(input: {
+    ensureSealerRole?(input: {
         owner: HyperdriveOrigin;
-        runtime: {
+        sealer: {
             user: string;
             password: string;
         };
-        appendOnly: string[];
+        statements: string[];
     }): Promise<void>;
+    /** The text of a release asset of a wtfalch repo, or `null` when the release has no such asset. */
+    fetchReleaseAsset(url: string): Promise<string | null>;
 }
-export declare const WORKER_APP_MIGRATION_TIMEOUT_MS = 300000;
-export declare const MIGRATIONS_ASSET_NAME = "migrations.json";
 /** The Hyperdrive config, `{name, id}` as JSON. No secret. */
 export declare const workerAppHyperdriveScopeKey: (entryKey: string) => string;
 /** The migration ids applied, a JSON list, for the plan and the operator. The database's ledger is the fact. */
@@ -94,24 +86,6 @@ export declare const workerAppDbRouteMarkerScopeKey: (entryKey: string) => strin
 export declare const hyperdriveName: (scriptName: string) => string;
 /** The tunnel hostname of an entry's database route: `<8 hex of org id>-<key>-hd.<zone>`. */
 export declare const hyperdriveHostname: (org: DeclaredOrg, entryKey: string, zone: string) => string;
-/**
- * Reads a release's `migrations.json`. `null` text is an absent file: no migrations. A file that is
- * not a list of `{id, sql}` with unique ids is refused, naming no SQL.
- */
-export declare function parseMigrations(text: string | null): DatabaseMigration[];
-/**
- * A present `migrations.json` runs as the database owner, so its bytes must be the ones the
- * declaration pinned. No file needs no digest; a file with no declared digest, or a different
- * one, is refused before it is parsed. The message names neither the SQL nor the wanted digest.
- */
-export declare function verifyMigrationsDigest(text: string | null, declared: string | undefined): void;
-/** The URL of `migrations.json` beside the module: the same release, another file. */
-export declare const migrationsUrl: (artifactUrl: string) => string;
-/**
- * The migrations the database does not hold, in order. The applied ledger must be the first
- * migrations of the file: a missing or reordered one is refused (migrations are append-only).
- */
-export declare function unappliedDatabaseMigrations(all: readonly DatabaseMigration[], applied: readonly string[]): DatabaseMigration[];
 export interface WorkerAppDatabaseDeps {
     port: WorkerAppDatabasePort;
     tunnels: Pick<TunnelPort, 'putTunnelConfig'>;
@@ -133,12 +107,19 @@ export interface WorkerAppDatabaseDeps {
         resolve(ref: string): Promise<string | null | undefined>;
         put?(ref: string, value: string): Promise<void>;
     };
+    /** One plain line for the operator's log (never a secret). */
+    log?: (line: string) => void;
     /** Test hook: the timeout of a call, in ms. */
     timeoutMs?: number;
     /** Test hook: the timeout of one migration, in ms. */
     migrationTimeoutMs?: number;
 }
-type Call = <T>(label: string, task: () => Promise<T>, ms?: number) => Promise<T>;
+export type Call = <T>(label: string, task: () => Promise<T>, ms?: number) => Promise<T>;
+export interface HeldAccess {
+    id: string;
+    clientId: string;
+    clientSecret: string;
+}
 /**
  * Makes the database true and returns the Hyperdrive config id for the `HYPERDRIVE` binding.
  * Secrets (the owner and runtime passwords, the Access service token) go only to the port and the
@@ -149,11 +130,38 @@ export declare function applyWorkerAppDatabase(deps: WorkerAppDatabaseDeps, org:
     artifactUrl: string;
     database: {
         appendOnly: string[];
+        grants?: string[];
         migrationsSha256?: string;
     };
 }, context: StepExecutionContext, zoneApex: string): Promise<{
     hyperdriveId: string;
 }>;
+export interface DatabaseRouteInput {
+    /** The scope-id family (`bgdb.<entryKey>.*`) the route is recorded under. */
+    entryKey: string;
+    accessName: string;
+    hostname: string;
+    /** The database host the tunnel reaches, inside the Docker network. */
+    upstreamHost: string;
+    /** Part of the applied marker: a change of database rewrites the route. */
+    markerDatabase: string;
+    tunnelId: string;
+    zoneApex: string;
+    tokenId: string;
+    at: string;
+}
+/**
+ * The Access app (service-token policy), the tunnel TCP rule and the proxied CNAME that put a
+ * database behind `hostname`. Idempotent; the ids are recorded and persisted as they appear.
+ * Shared by a Worker app's database (above) and the company's apps database (F4, #925).
+ */
+export declare function ensureDatabaseRoute(deps: Pick<WorkerAppDatabaseDeps, 'tunnels' | 'access' | 'dns' | 'zones'>, call: Call, context: StepExecutionContext, input: DatabaseRouteInput): Promise<void>;
+/**
+ * The Access service token Hyperdrive and the migration runner present. Minted once: its id is
+ * recorded under an undelivered key and persisted before the secret is held, the delivered id
+ * replaces it after the hold. A token minted and never held is never minted again.
+ */
+export declare function ensureServiceToken(deps: Pick<WorkerAppDatabaseDeps, 'access' | 'heldKeys' | 'secret'>, org: DeclaredOrg, entry: Pick<HostingEntry, 'key'>, scriptName: string, at: string, call: Call, context: StepExecutionContext, put: (ref: string, value: string) => Promise<void>): Promise<HeldAccess>;
 /** Deletes the entry's Hyperdrive config, found by the recorded name, and clears the record. */
 export declare function deleteWorkerAppHyperdrive(port: Pick<WorkerAppDatabasePort, 'deleteHyperdrive'> | undefined, entryKey: string, recorded: Readonly<Record<string, string>>, context: Pick<StepExecutionContext, 'recordScopeId' | 'persistScopeIds'> | null, call: Call): Promise<void>;
 /**
@@ -164,5 +172,4 @@ export declare function deleteWorkerAppHyperdrive(port: Pick<WorkerAppDatabasePo
  * ids are cleared last, so a failed run is repeated by the next one. With `context` null (org
  * destroy) the ids are not cleared: destroy drops them with the org.
  */
-export declare function deleteWorkerAppDatabaseRoute(database: WorkerAppDatabaseDeps | undefined, heldKeys: Pick<NonNullable<WorkerAppDatabaseDeps['heldKeys']>, 'put'> | undefined, orgId: string, entryKey: string, recorded: Readonly<Record<string, string>>, context: Pick<StepExecutionContext, 'recordScopeId' | 'persistScopeIds'> | null, call: Call): Promise<void>;
-export {};
+export declare function deleteWorkerAppDatabaseRoute(database: Pick<WorkerAppDatabaseDeps, 'tunnels' | 'access' | 'dns' | 'zones'> | undefined, heldKeys: Pick<NonNullable<WorkerAppDatabaseDeps['heldKeys']>, 'put'> | undefined, orgId: string, entryKey: string, recorded: Readonly<Record<string, string>>, context: Pick<StepExecutionContext, 'recordScopeId' | 'persistScopeIds'> | null, call: Call): Promise<void>;

package/dist/plan/worker-app-database.js

@@ -1,12 +1,12 @@
 import { createHash, randomBytes } from 'node:crypto';
+import { auditMigrations } from '../audit/migrations.js';
+import { auditSealerRef, auditSealerScopeKey, auditSealerUndeliveredScopeKey, sealerRoleName, sealerRoleSql, } from '../audit/sealer-role.js';
+import { MIGRATIONS_ASSET_NAME, WORKER_APP_MIGRATION_TIMEOUT_MS, migrationsUrl, parseMigrations, runWorkerAppMigrations, unappliedDatabaseMigrations, verifyMigrationsDigest, } from '../worker-app-migrations.js';
 import { REMOTE_DATABASE_PORT, mergeTcpIngress, recordedHttpIngress, recordedTcpRoutes, remoteDatabaseKeys, } from './remote-database.js';
 import { WORKER_APP_DB_SCOPE_KEYS } from './worker-app-db.js';
 import { WORKER_APP_CALL_TIMEOUT_MS, withCallTimeout, workerAppSecretRef } from './worker-app.js';
-export const WORKER_APP_MIGRATION_TIMEOUT_MS = 300_000;
-export const MIGRATIONS_ASSET_NAME = 'migrations.json';
-const MIGRATIONS_MAX_CHARS = 4_000_000;
-const MIGRATIONS_MAX_COUNT = 1000;
-const MIGRATION_ID = /^[A-Za-z0-9][A-Za-z0-9._-]{0,127}$/;
+// The pure parts moved to `src/worker-app-migrations.ts` (FM4); they stay exported from here.
+export { MIGRATIONS_ASSET_NAME, WORKER_APP_MIGRATION_TIMEOUT_MS, migrationsUrl, parseMigrations, runWorkerAppMigrations, unappliedDatabaseMigrations, verifyMigrationsDigest, };
 const HOLD_DELIVERY_ATTEMPTS = 3;
 // ---- scope keys ------------------------------------------------------------
 /** The Hyperdrive config, `{name, id}` as JSON. No secret. */
@@ -19,78 +19,6 @@ export const workerAppDbRouteMarkerScopeKey = (entryKey) => `workerapp_dbroute_$
 export const hyperdriveName = (scriptName) => `${scriptName}-db`;
 /** The tunnel hostname of an entry's database route: `<8 hex of org id>-<key>-hd.<zone>`. */
 export const hyperdriveHostname = (org, entryKey, zone) => `${createHash('sha256').update(org.id).digest('hex').slice(0, 8)}-${entryKey}-hd.${zone}`;
-// ---- parsing ---------------------------------------------------------------
-/**
- * Reads a release's `migrations.json`. `null` text is an absent file: no migrations. A file that is
- * not a list of `{id, sql}` with unique ids is refused, naming no SQL.
- */
-export function parseMigrations(text) {
-    if (text === null)
-        return [];
-    if (text.length > MIGRATIONS_MAX_CHARS) {
-        throw new Error(`${MIGRATIONS_ASSET_NAME} is larger than ${MIGRATIONS_MAX_CHARS} characters`);
-    }
-    let parsed;
-    try {
-        parsed = JSON.parse(text);
-    }
-    catch {
-        throw new Error(`${MIGRATIONS_ASSET_NAME} is not JSON`);
-    }
-    if (!Array.isArray(parsed) || parsed.length > MIGRATIONS_MAX_COUNT) {
-        throw new Error(`${MIGRATIONS_ASSET_NAME} must be a list of at most ${MIGRATIONS_MAX_COUNT} migrations`);
-    }
-    const seen = new Set();
-    return parsed.map((item, index) => {
-        const record = item;
-        if (typeof item !== 'object' ||
-            item === null ||
-            Array.isArray(item) ||
-            Object.keys(item).some((key) => key !== 'id' && key !== 'sql') ||
-            typeof record?.id !== 'string' ||
-            !MIGRATION_ID.test(record.id) ||
-            typeof record.sql !== 'string' ||
-            record.sql.trim() === '') {
-            throw new Error(`${MIGRATIONS_ASSET_NAME} entry ${index} must be { id, sql } with an id of letters, digits, '.', '_' or '-' and a non-empty sql`);
-        }
-        if (seen.has(record.id)) {
-            throw new Error(`${MIGRATIONS_ASSET_NAME} names migration '${record.id}' twice`);
-        }
-        seen.add(record.id);
-        return { id: record.id, sql: record.sql };
-    });
-}
-/**
- * A present `migrations.json` runs as the database owner, so its bytes must be the ones the
- * declaration pinned. No file needs no digest; a file with no declared digest, or a different
- * one, is refused before it is parsed. The message names neither the SQL nor the wanted digest.
- */
-export function verifyMigrationsDigest(text, declared) {
-    if (text === null)
-        return;
-    if (!declared) {
-        throw new Error(`${MIGRATIONS_ASSET_NAME} is present and workerApp.database.migrationsSha256 is not declared`);
-    }
-    if (createHash('sha256').update(text, 'utf8').digest('hex') !== declared) {
-        throw new Error(`${MIGRATIONS_ASSET_NAME} does not match workerApp.database.migrationsSha256`);
-    }
-}
-/** The URL of `migrations.json` beside the module: the same release, another file. */
-export const migrationsUrl = (artifactUrl) => artifactUrl.slice(0, artifactUrl.lastIndexOf('/') + 1) + MIGRATIONS_ASSET_NAME;
-/**
- * The migrations the database does not hold, in order. The applied ledger must be the first
- * migrations of the file: a missing or reordered one is refused (migrations are append-only).
- */
-export function unappliedDatabaseMigrations(all, applied) {
-    const appliedSet = new Set(applied);
-    const head = new Set(all.slice(0, applied.length).map((m) => m.id));
-    for (const id of appliedSet) {
-        if (!head.has(id)) {
-            throw new Error(`migration '${id}' was applied and is no longer in the same place in ${MIGRATIONS_ASSET_NAME}; migrations are append-only`);
-        }
-    }
-    return all.filter((m) => !appliedSet.has(m.id));
-}
 const parseHeldAccess = (raw) => {
     if (!raw)
         return null;
@@ -141,7 +69,6 @@ export async function applyWorkerAppDatabase(deps, org, entry, scriptName, want,
     if (!heldKeys?.put)
         throw new Error(`${at}: needs a held-key store that can put`);
     const put = heldKeys.put;
-    const keys = remoteDatabaseKeys(entry.key);
     // The foundry-made TLS database (worker-app-db) when recorded, else the legacy Coolify database.
     const databaseId = context.recordedIds()[WORKER_APP_DB_SCOPE_KEYS.app] ||
         context.recordedIds()[`coolify:database:${org.id}`];
@@ -158,49 +85,17 @@ export async function applyWorkerAppDatabase(deps, org, entry, scriptName, want,
     // 1. The service token: minted once (rule 1), its secret held before anything else uses it.
     const access = await ensureServiceToken(deps, org, entry, scriptName, at, call, context, put);
     // 2. The Access gate and the route behind it.
-    const zone = await call('find the zone', () => deps.zones.findZoneByApex(zoneApex));
-    if (!zone)
-        throw new Error(`${at}: zone ${zoneApex} is not live`);
-    let accessAppId = context.recordedIds()[keys.access];
-    if (!accessAppId) {
-        const live = (await call('list Access apps', () => deps.access.listAccessApps())).find((a) => a.domain === hostname);
-        accessAppId = (live ??
-            (await call('create the Access app', () => deps.access.createAccessApp({
-                name: `${scriptName}-db-access`,
-                domain: hostname,
-                type: 'self_hosted',
-            })))).id;
-        context.recordScopeId(keys.access, accessAppId);
-        await context.persistScopeIds();
-    }
-    const appId = accessAppId;
-    const policies = await call('list Access policies', () => deps.access.listAccessPolicies(appId));
-    const hasPolicy = policies.some((p) => p.decision === 'non_identity' &&
-        (p.include ?? []).some((r) => r.service_token?.token_id === access.id));
-    if (!hasPolicy) {
-        await call('create the Access policy', () => deps.access.createAccessPolicy(appId, {
-            name: 'hyperdrive',
-            decision: 'non_identity',
-            include: [{ service_token: { token_id: access.id } }],
-        }));
-    }
-    const marker = JSON.stringify({ hostname, database: databaseId });
-    if (context.recordedIds()[workerAppDbRouteMarkerScopeKey(entry.key)] !== marker) {
-        context.recordScopeId(keys.route, JSON.stringify({ hostname, service: `tcp://${owner.host}:${REMOTE_DATABASE_PORT}` }));
-        await call('write the tunnel route', () => deps.tunnels.putTunnelConfig(tunnelId, {
-            ingress: mergeTcpIngress(recordedHttpIngress(context.recordedIds()), recordedTcpRoutes(context.recordedIds())),
-        }));
-        if ((await call('look for the DNS record', () => deps.dns.findDnsRecord(zone.name, hostname, 'CNAME'))).length === 0) {
-            await call('create the DNS record', () => deps.dns.createDnsRecord(zone.name, {
-                type: 'CNAME',
-                name: hostname,
-                content: `${tunnelId}.cfargotunnel.com`,
-                proxied: true,
-            }));
-        }
-        context.recordScopeId(workerAppDbRouteMarkerScopeKey(entry.key), marker);
-        await context.persistScopeIds();
-    }
+    await ensureDatabaseRoute(deps, call, context, {
+        entryKey: entry.key,
+        accessName: `${scriptName}-db-access`,
+        hostname,
+        upstreamHost: owner.host,
+        markerDatabase: databaseId,
+        tunnelId,
+        zoneApex,
+        tokenId: access.id,
+        at,
+    });
     // 3. The runtime password: minted once and held, so a rerun hands out the same one.
     const runtimeUser = `${owner.database}_rt`;
     const rtRef = workerAppSecretRef(org.id, entry.key, 'DATABASE_RT_PASSWORD');
@@ -233,38 +128,30 @@ export async function applyWorkerAppDatabase(deps, org, entry, scriptName, want,
         accessClientSecret: access.clientSecret,
         ...(tls ? { tls } : {}),
     };
-    // 4. Migrations with the owner credentials. A failure stops the deploy; ids already applied stay.
+    // 4. Migrations with the owner credentials, then 5. the runtime role. A failure stops the
+    // deploy; ids already applied stay.
     const text = await call('fetch the release migrations', () => port.fetchReleaseAsset(migrationsUrl(want.artifactUrl)));
-    let migrations;
-    try {
-        verifyMigrationsDigest(text, want.database.migrationsSha256);
-        migrations = parseMigrations(text);
-    }
-    catch (error) {
-        // The message names the file and the entry index, never SQL.
-        throw new Error(`${at}: ${error.message}`);
-    }
-    const applied = await call('read the applied migrations', () => port.appliedMigrationIds(ownerOrigin));
-    let pending;
-    try {
-        pending = unappliedDatabaseMigrations(migrations, applied);
-    }
-    catch (error) {
-        throw new Error(`${at}: ${error.message}`);
+    await runWorkerAppMigrations(port, ownerOrigin, text, want.database, { user: runtimeUser, password: runtimePassword }, {
+        at,
+        call,
+        ...(deps.migrationTimeoutMs !== undefined
+            ? { migrationTimeoutMs: deps.migrationTimeoutMs }
+            : {}),
+        // `uses.audit`: the pinned audit migrations, so an app need not ship them. One it ships itself is skipped.
+        ...(entry.uses?.audit === true ? { platform: auditMigrations() } : {}),
+        ...(deps.log ? { log: deps.log } : {}),
+        onApplied: async (done) => {
+            context.recordScopeId(workerAppMigrationsScopeKey(entry.key), JSON.stringify(done));
+            await context.persistScopeIds();
+        },
+    });
+    // 5b. `uses.audit`: the sealing role, apart from the runtime role, after the audit tables exist.
+    if (entry.uses?.audit === true && port.ensureSealerRole) {
+        await ensureAuditSealer(deps, org, entry, owner.database, ownerOrigin, at, call, context, put);
     }
-    const done = [...applied];
-    for (const migration of pending) {
-        await call(`apply migration '${migration.id}'`, () => port.applyMigration(ownerOrigin, migration), deps.migrationTimeoutMs ?? WORKER_APP_MIGRATION_TIMEOUT_MS);
-        done.push(migration.id);
-        context.recordScopeId(workerAppMigrationsScopeKey(entry.key), JSON.stringify(done));
-        await context.persistScopeIds();
+    else if (entry.uses?.audit === true) {
+        deps.log?.(`${at}: the sealing role was not made, the host's database port cannot make one (no ensureSealerRole); the audit log stays unregistered`);
     }
-    // 5. The runtime role, after the migrations so the tables exist for the revokes.
-    await call('ensure the runtime role', () => port.ensureRuntimeRole({
-        owner: ownerOrigin,
-        runtime: { user: runtimeUser, password: runtimePassword },
-        appendOnly: [...want.database.appendOnly],
-    }));
     // 6. Hyperdrive, with the runtime credentials only.
     const name = hyperdriveName(scriptName);
     const { id } = await call('upsert the Hyperdrive config', () => port.upsertHyperdrive({
@@ -283,12 +170,121 @@ export async function applyWorkerAppDatabase(deps, org, entry, scriptName, want,
     await context.persistScopeIds();
     return { hyperdriveId: id };
 }
+/**
+ * The Access app (service-token policy), the tunnel TCP rule and the proxied CNAME that put a
+ * database behind `hostname`. Idempotent; the ids are recorded and persisted as they appear.
+ * Shared by a Worker app's database (above) and the company's apps database (F4, #925).
+ */
+export async function ensureDatabaseRoute(deps, call, context, input) {
+    const { hostname, tunnelId, zoneApex, entryKey } = input;
+    const keys = remoteDatabaseKeys(entryKey);
+    const zone = await call('find the zone', () => deps.zones.findZoneByApex(zoneApex));
+    if (!zone)
+        throw new Error(`${input.at}: zone ${zoneApex} is not live`);
+    let accessAppId = context.recordedIds()[keys.access];
+    if (!accessAppId) {
+        const live = (await call('list Access apps', () => deps.access.listAccessApps())).find((a) => a.domain === hostname);
+        accessAppId = (live ??
+            (await call('create the Access app', () => deps.access.createAccessApp({
+                name: input.accessName,
+                domain: hostname,
+                type: 'self_hosted',
+            })))).id;
+        context.recordScopeId(keys.access, accessAppId);
+        await context.persistScopeIds();
+    }
+    const appId = accessAppId;
+    const policies = await call('list Access policies', () => deps.access.listAccessPolicies(appId));
+    const hasPolicy = policies.some((p) => p.decision === 'non_identity' &&
+        (p.include ?? []).some((r) => r.service_token?.token_id ===
+            input.tokenId));
+    if (!hasPolicy) {
+        await call('create the Access policy', () => deps.access.createAccessPolicy(appId, {
+            name: 'hyperdrive',
+            decision: 'non_identity',
+            include: [{ service_token: { token_id: input.tokenId } }],
+        }));
+    }
+    const marker = JSON.stringify({ hostname, database: input.markerDatabase });
+    if (context.recordedIds()[workerAppDbRouteMarkerScopeKey(entryKey)] !== marker) {
+        context.recordScopeId(keys.route, JSON.stringify({ hostname, service: `tcp://${input.upstreamHost}:${REMOTE_DATABASE_PORT}` }));
+        await call('write the tunnel route', () => deps.tunnels.putTunnelConfig(tunnelId, {
+            ingress: mergeTcpIngress(recordedHttpIngress(context.recordedIds()), recordedTcpRoutes(context.recordedIds())),
+        }));
+        const existingRecords = await call('look for the DNS record', () => deps.dns.findDnsRecord(zone.name, hostname, 'CNAME'));
+        const mine = `${tunnelId}.cfargotunnel.com`;
+        if (existingRecords.some((r) => r.content !== mine)) {
+            throw new Error(`${input.at}: a DNS record named ${hostname} already exists and does not point at this company's tunnel; foundry will not reuse or change it. Delete that record in Cloudflare if it is not needed, then apply again`);
+        }
+        if (existingRecords.length === 0) {
+            await call('create the DNS record', () => deps.dns.createDnsRecord(zone.name, {
+                type: 'CNAME',
+                name: hostname,
+                content: `${tunnelId}.cfargotunnel.com`,
+                proxied: true,
+            }));
+        }
+        context.recordScopeId(workerAppDbRouteMarkerScopeKey(entryKey), marker);
+        await context.persistScopeIds();
+    }
+}
+/**
+ * `uses.audit` (foundry#929): the role the platform seals this entry's ledger as. Its password is minted once
+ * (rule 1): the role name is recorded as undelivered and persisted before the password is held, and a password
+ * minted and never held is never minted again. The password reaches only the held keys and the port; the
+ * recorded delivered key holds the role name alone.
+ */
+async function ensureAuditSealer(deps, org, entry, database, ownerOrigin, at, call, context, put) {
+    const ensure = deps.port.ensureSealerRole;
+    const heldKeys = deps.heldKeys;
+    if (!ensure)
+        return;
+    const user = sealerRoleName(database);
+    const ref = auditSealerRef(org.id, entry.key);
+    const undeliveredKey = auditSealerUndeliveredScopeKey(entry.key);
+    let password = (await call('read the held sealing password', () => heldKeys.resolve(ref))) ?? '';
+    if (!password) {
+        const lost = context.recordedIds()[undeliveredKey];
+        if (lost) {
+            throw new Error(`${at}: the sealing password for role ${lost} was minted and never reached the held-key store; clear the recorded ${undeliveredKey} to mint it again`);
+        }
+        password = randomBytes(24).toString('base64url');
+        deps.secret(password);
+        context.recordScopeId(undeliveredKey, user);
+        await context.persistScopeIds();
+        const minted = password;
+        let stored = false;
+        for (let attempt = 1; attempt <= HOLD_DELIVERY_ATTEMPTS && !stored; attempt++) {
+            try {
+                await call('hold the sealing password', () => put(ref, minted));
+                stored = true;
+            }
+            catch {
+                // Retried; the cause may echo the secret and is dropped.
+            }
+        }
+        if (!stored) {
+            throw new Error(`${at}: the sealing password for role ${user} could not be held after ${HOLD_DELIVERY_ATTEMPTS} attempts; clear the recorded ${undeliveredKey} to mint it again`);
+        }
+        context.recordScopeId(undeliveredKey, '');
+        await context.persistScopeIds();
+    }
+    deps.secret(password);
+    const sealer = { user, password };
+    await call('make the sealing role', () => ensure.call(deps.port, {
+        owner: ownerOrigin,
+        sealer,
+        statements: sealerRoleSql(user, password).statements,
+    }));
+    context.recordScopeId(auditSealerScopeKey(entry.key), user);
+    await context.persistScopeIds();
+}
 /**
  * The Access service token Hyperdrive and the migration runner present. Minted once: its id is
  * recorded under an undelivered key and persisted before the secret is held, the delivered id
  * replaces it after the hold. A token minted and never held is never minted again.
  */
-async function ensureServiceToken(deps, org, entry, scriptName, at, call, context, put) {
+export async function ensureServiceToken(deps, org, entry, scriptName, at, call, context, put) {
     const keys = remoteDatabaseKeys(entry.key);
     const ref = workerAppSecretRef(org.id, entry.key, 'HYPERDRIVE_ACCESS');
     const heldKeys = deps.heldKeys;
@@ -404,8 +400,10 @@ export async function deleteWorkerAppDatabaseRoute(database, heldKeys, orgId, en
             const zone = await call('find the zone', () => database.zones.findZoneByApex(hostname.slice(hostname.indexOf('.') + 1)));
             if (zone) {
                 const records = await call('look for the DNS record', () => database.dns.findDnsRecord(zone.name, hostname, 'CNAME'));
+                const ownTunnel = recorded[`cloudflare:tunnel:${orgId}`];
                 for (const record of records) {
-                    if (!record.content.endsWith('.cfargotunnel.com'))
+                    // Only this company's own tunnel's record; anything else at that name is not ours to delete.
+                    if (!ownTunnel || record.content !== `${ownTunnel}.cfargotunnel.com`)
                         continue;
                     await call('delete the DNS record', () => tolerateGone(() => database.dns.deleteDnsRecord(zone.name, record.id)));
                 }