@wtfalch/foundry 0.68.2 → 0.69.0

package/dist/audit/seal.d.ts

@@ -28,6 +28,8 @@ export interface SealResult {
     treeSize?: number;
     /** How many checkpoints the authority stamped in this tick. */
     anchored: number;
+    /** How many erased rows this tick sealed the erasure of; on a sweep that failed part way, the rows sealed before the failure. */
+    erasures: number;
     /** Plain words on why a step did not happen. Present whenever `outcome` is not `sealed`, or anchoring did not run. */
     reason?: string;
     at: string;

package/dist/audit/seal.js

@@ -1,4 +1,5 @@
-import { anchorCheckpoints, sealCheckpoint } from '@wtfalch/audit-sealing';
+import { anchorCheckpoints, computeErasureHash, sealCheckpoint } from '@wtfalch/audit-sealing';
+import { sql } from 'drizzle-orm';
 import { isUnavailable } from './connector.js';
 /**
  * The sealing and anchoring tick (foundry#929, audit#56). The host calls {@link sealLedgers} on
@@ -51,6 +52,7 @@ async function sealOne(deps, ledger, now) {
             ...base,
             outcome: 'failed',
             anchored: 0,
+            erasures: 0,
             reason: `could not open the ledger: ${plainFailure(error)}`,
             at: now().toISOString(),
         };
@@ -60,6 +62,7 @@ async function sealOne(deps, ledger, now) {
             ...base,
             outcome: 'skipped',
             anchored: 0,
+            erasures: 0,
             reason: `not sealed, the ledger is not reachable: ${connection.unavailable}`,
             at: now().toISOString(),
         };
@@ -68,17 +71,33 @@ async function sealOne(deps, ledger, now) {
     let outcome = 'unchanged';
     let treeSize;
     let anchored = 0;
+    let erasures = 0;
     try {
+        const progress = { sealed: 0 };
+        try {
+            await sealErasures(connection.handle, progress);
+        }
+        catch (error) {
+            if (isMissingGrant(error)) {
+                notes.push("erasures not sealed yet: the sealing role gets the grant on the app's next apply");
+            }
+            else {
+                outcome = 'failed';
+                notes.push(`sealing erasures failed: ${plainFailure(error)}`);
+            }
+        }
+        erasures = progress.sealed;
         try {
             const checkpoint = await sealCheckpoint(connection.handle, {
                 ledger: ledger.ledger,
                 signer: deps.signer,
             });
             if (checkpoint) {
-                outcome = 'sealed';
+                if (outcome !== 'failed')
+                    outcome = 'sealed';
                 treeSize = checkpoint.tree_size;
             }
-            else {
+            else if (outcome !== 'failed') {
                 notes.push('nothing sealed, no entry since the last checkpoint');
             }
         }
@@ -87,7 +106,8 @@ async function sealOne(deps, ledger, now) {
                 ...base,
                 outcome: 'failed',
                 anchored: 0,
-                reason: `sealing failed: ${plainFailure(error)}`,
+                erasures,
+                reason: [`sealing failed: ${plainFailure(error)}`, ...notes].join('; '),
                 at: now().toISOString(),
             };
         }
@@ -125,7 +145,33 @@ async function sealOne(deps, ledger, now) {
         outcome,
         ...(treeSize === undefined ? {} : { treeSize }),
         anchored,
+        erasures,
         ...(notes.length > 0 ? { reason: notes.join('; ') } : {}),
         at: now().toISOString(),
     };
 }
+const rowsOf = (result) => Array.isArray(result) ? result : (result.rows ?? []);
+/**
+ * An existing sealing role gets the erasure grants only on its app's next apply, so 42501 (insufficient privilege)
+ * and 42883 (undefined function) mean "not yet", not broken. Read on the error or the driver error it wraps.
+ */
+function isMissingGrant(error) {
+    for (let e = error, depth = 0; e && depth < 3; depth++) {
+        const code = e.code;
+        if (code === '42501' || code === '42883')
+            return true;
+        e = e.cause;
+    }
+    return false;
+}
+async function sealErasures(handle, progress) {
+    const pending = rowsOf(await handle.execute(sql `select id, row_hash, erased_at from audit_pending_erasures()`));
+    for (const row of pending) {
+        if (!row.row_hash || row.erased_at === null || row.erased_at === undefined)
+            continue;
+        const erasedAt = row.erased_at instanceof Date ? row.erased_at : new Date(String(row.erased_at));
+        const erasureHash = await computeErasureHash(row.row_hash, erasedAt);
+        await handle.execute(sql `select audit_seal_erasure(${row.id}, ${erasureHash})`);
+        progress.sealed++;
+    }
+}

package/dist/audit/sealer-role.d.ts

@@ -26,7 +26,7 @@ export interface SealerRoleSql {
 }
 /**
  * Makes `user` true: it can log in with `password`, is no superuser and bypasses no row security, may read and
- * insert into the checkpoint, signing-key and anchor tables and run the two sealing functions, and holds nothing
+ * insert into the checkpoint, signing-key and anchor tables and run the sealing functions (leaves, key retirement, pending erasures, erasure sealing), and holds nothing
  * else. The grants are listed here and in `AUDIT_SEALER_GRANTS`; `audit/sealer-role.test.ts` runs a real
  * checkpoint as this role to prove the list is enough.
  */

package/dist/audit/sealer-role.js

@@ -36,7 +36,7 @@ const ident = (name) => `"${name.replace(/"/g, '""')}"`;
 const literal = (value) => `'${value.replace(/'/g, "''")}'`;
 /**
  * Makes `user` true: it can log in with `password`, is no superuser and bypasses no row security, may read and
- * insert into the checkpoint, signing-key and anchor tables and run the two sealing functions, and holds nothing
+ * insert into the checkpoint, signing-key and anchor tables and run the sealing functions (leaves, key retirement, pending erasures, erasure sealing), and holds nothing
  * else. The grants are listed here and in `AUDIT_SEALER_GRANTS`; `audit/sealer-role.test.ts` runs a real
  * checkpoint as this role to prove the list is enough.
  */

package/dist/audit/tick.js

@@ -15,6 +15,7 @@ export async function runAuditSealTick(deps) {
             entryKey: ledger.entryKey,
             outcome: 'skipped',
             anchored: 0,
+            erasures: 0,
             reason,
             at: now().toISOString(),
         };

package/dist/modules/audit-ledger.d.ts

@@ -12,13 +12,15 @@ export declare const AUDIT_PACKAGE_VERSION = "0.14.0";
 /** Insert and read only: the runtime role has UPDATE, DELETE and TRUNCATE revoked on each. */
 export declare const AUDIT_APPEND_ONLY_TABLES: readonly string[];
 /**
- * What the app's runtime role may run: the two functions the chain is written through. Not granted: the erase
- * functions (`audit_erase_person`, `audit_seal_erasure`, `audit_pending_erasures`), because they change what the
- * ledger shows and whether the app may call them is an open decision (foundry#929 item 10); and the sealing
- * functions (`audit_chain_leaves`, `audit_retire_signing_key`), which only the platform's sealing role runs.
+ * What the app's runtime role may run: the two functions the chain is written through. Not granted: the sealing
+ * functions (`audit_chain_leaves`, `audit_retire_signing_key`) and the erasure sealing functions
+ * (`audit_pending_erasures`, `audit_seal_erasure`), which only the platform's sealing role runs. An app may list
+ * `audit_erase_person(text, text, text)` itself and nothing else from the erase set: it pseudonymises, and the
+ * sealing role seals each erasure in the next seal tick (William, 2026-10-26, settles foundry#929 item 10 for
+ * this case).
  */
 export declare const AUDIT_APP_GRANTS: readonly string[];
-/** What the platform's sealing role runs, beside the app's own: reads every leaf, retires a signing key. */
+/** What the platform's sealing role runs, beside the app's own: reads every leaf, retires a signing key, seals erasures. */
 export declare const AUDIT_SEALER_GRANTS: readonly string[];
 type Database = NonNullable<WorkerAppConfig['database']>;
 /**

package/dist/modules/audit-ledger.js

@@ -16,16 +16,20 @@ export const AUDIT_APPEND_ONLY_TABLES = [
     'audit_anchors',
 ];
 /**
- * What the app's runtime role may run: the two functions the chain is written through. Not granted: the erase
- * functions (`audit_erase_person`, `audit_seal_erasure`, `audit_pending_erasures`), because they change what the
- * ledger shows and whether the app may call them is an open decision (foundry#929 item 10); and the sealing
- * functions (`audit_chain_leaves`, `audit_retire_signing_key`), which only the platform's sealing role runs.
+ * What the app's runtime role may run: the two functions the chain is written through. Not granted: the sealing
+ * functions (`audit_chain_leaves`, `audit_retire_signing_key`) and the erasure sealing functions
+ * (`audit_pending_erasures`, `audit_seal_erasure`), which only the platform's sealing role runs. An app may list
+ * `audit_erase_person(text, text, text)` itself and nothing else from the erase set: it pseudonymises, and the
+ * sealing role seals each erasure in the next seal tick (William, 2026-10-26, settles foundry#929 item 10 for
+ * this case).
  */
 export const AUDIT_APP_GRANTS = ['audit_chain_tail()', 'audit_chain_tail_v2()'];
-/** What the platform's sealing role runs, beside the app's own: reads every leaf, retires a signing key. */
+/** What the platform's sealing role runs, beside the app's own: reads every leaf, retires a signing key, seals erasures. */
 export const AUDIT_SEALER_GRANTS = [
     'audit_chain_leaves(bigint, integer)',
     'audit_retire_signing_key(text)',
+    'audit_pending_erasures()',
+    'audit_seal_erasure(bigint, text)',
 ];
 const without = (list, drop) => (list ?? []).filter((item) => !drop.includes(item));
 /**

package/dist/plan/apps-db-route.js

@@ -49,7 +49,9 @@ export const APPS_DB_ROUTE_APPLIED_SCOPE_KEY = 'apps_db_route_applied';
 export const appsDbHostname = (org) => hyperdriveHostname(org, APPS_DB_ENTRY_KEY, workerAppApex(org));
 /** The applied marker: the tunnel hostname and the server it reaches. A route recorded with the hostname alone (the old Postgres server) differs, so it is planned again. */
 export const appsDbRouteMarker = (org) => `${appsDbHostname(org)}|${appsDbName(org)}`;
-const routeKeys = remoteDatabaseKeys(APPS_DB_ENTRY_KEY);
+// Read on use, not at load: `./audit` loaded first reaches this module before `worker-app.ts` has set
+// APPS_DB_ENTRY_KEY (a cycle), and a top-level read then throws (0.68.2).
+const routeKeys = () => remoteDatabaseKeys(APPS_DB_ENTRY_KEY);
 /**
  * Pure. `apply` once the company's apps are on and everything the route needs is recorded or planned;
  * `retire` when they went off and the route is still recorded. Anything missing is blocked, not planned
@@ -67,10 +69,10 @@ export function planAppsDbRoute(org, recordedIds, plannedSteps, options) {
         action: { system: 'cloudflare', kind: 'apps-db-route', key: org.id, desired },
         step: { description, destroys: desired.mode === 'retire', migrates: false },
     });
-    const recordedRoute = Boolean(recordedIds[routeKeys.route] ||
-        recordedIds[routeKeys.access] ||
-        recordedIds[routeKeys.token] ||
-        recordedIds[routeKeys.undelivered] ||
+    const recordedRoute = Boolean(recordedIds[routeKeys().route] ||
+        recordedIds[routeKeys().access] ||
+        recordedIds[routeKeys().token] ||
+        recordedIds[routeKeys().undelivered] ||
         recordedIds[APPS_DB_ROUTE_APPLIED_SCOPE_KEY]);
     if (!appsOn(org)) {
         if (!recordedRoute)
@@ -93,7 +95,7 @@ export function planAppsDbRoute(org, recordedIds, plannedSteps, options) {
         return block('the host supplies no Access, tunnel, DNS or zone port');
     if (!options.canHoldSecrets)
         return block('the host cannot hold secrets');
-    const lost = recordedIds[routeKeys.undelivered];
+    const lost = recordedIds[routeKeys().undelivered];
     if (lost) {
         return block(`service token ${lost} was created but its secret was never saved, so it cannot be used. To start over, turn apps off and apply (that removes the route and clears this note), delete the token ${lost} in Cloudflare Zero Trust if it is still listed, then turn apps on again`);
     }

package/dist/plan/worker-app.d.ts

@@ -167,6 +167,8 @@ export interface WorkerAppWant {
         noDelete?: string[];
         grants?: string[];
         migrationsSha256?: string;
+        /** `uses.audit`: a hash of `AUDIT_SEALER_GRANTS`, so an applied app is planned again when the list changes and its sealing role gets the new grants. */
+        auditSealerGrants?: string;
     };
     /** `workerApp.triggers.crons`, sorted. Absent when none, so a Worker without cron keeps the marker it already has. */
     crons?: string[];

package/dist/plan/worker-app.js

@@ -1,4 +1,5 @@
 import { createHash, randomBytes } from 'node:crypto';
+import { AUDIT_SEALER_GRANTS } from '../modules/audit-ledger.js';
 import { APPS_DOMAIN, heldEnvRef } from '../org.js';
 import { WORKER_APP_KEYS_SECRET, WORKER_APP_KEYS_URL_VAR, workerAppHasBuild, workerAppHostId, } from '../worker-app-config.js';
 import { WORKER_APP_DNS_RECORD, pendingWorkerAppMigrations, strayContainerImage, withCallTimeout, workerAppRegistryPrefix, workerAppShape, workerAppUpload, } from '../worker-app-upload.js';
@@ -203,6 +204,15 @@ export function wantedWorkerApp(org, entry, recorded, input) {
                         ...(app.database.migrationsSha256
                             ? { migrationsSha256: app.database.migrationsSha256 }
                             : {}),
+                        // The order of AUDIT_SEALER_GRANTS is part of the hash: a reorder plans every audit app once.
+                        ...(entry.uses?.audit === true
+                            ? {
+                                auditSealerGrants: createHash('sha256')
+                                    .update(JSON.stringify(AUDIT_SEALER_GRANTS))
+                                    .digest('hex')
+                                    .slice(0, 16),
+                            }
+                            : {}),
                     },
                 }
                 : {}),

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@wtfalch/foundry",
-  "version": "0.68.2",
+  "version": "0.69.0",
   "description": "Foundry's SDK: the declared org's types, the plan and apply contracts, and the state store's interface.",
   "repository": {
     "type": "git",