@wtfalch/foundry 0.68.3 → 0.69.0

package/dist/audit/seal.d.ts

@@ -28,6 +28,8 @@ export interface SealResult {
     treeSize?: number;
     /** How many checkpoints the authority stamped in this tick. */
     anchored: number;
+    /** How many erased rows this tick sealed the erasure of; on a sweep that failed part way, the rows sealed before the failure. */
+    erasures: number;
     /** Plain words on why a step did not happen. Present whenever `outcome` is not `sealed`, or anchoring did not run. */
     reason?: string;
     at: string;

package/dist/audit/seal.js

@@ -1,4 +1,5 @@
-import { anchorCheckpoints, sealCheckpoint } from '@wtfalch/audit-sealing';
+import { anchorCheckpoints, computeErasureHash, sealCheckpoint } from '@wtfalch/audit-sealing';
+import { sql } from 'drizzle-orm';
 import { isUnavailable } from './connector.js';
 /**
  * The sealing and anchoring tick (foundry#929, audit#56). The host calls {@link sealLedgers} on
@@ -51,6 +52,7 @@ async function sealOne(deps, ledger, now) {
             ...base,
             outcome: 'failed',
             anchored: 0,
+            erasures: 0,
             reason: `could not open the ledger: ${plainFailure(error)}`,
             at: now().toISOString(),
         };
@@ -60,6 +62,7 @@ async function sealOne(deps, ledger, now) {
             ...base,
             outcome: 'skipped',
             anchored: 0,
+            erasures: 0,
             reason: `not sealed, the ledger is not reachable: ${connection.unavailable}`,
             at: now().toISOString(),
         };
@@ -68,17 +71,33 @@ async function sealOne(deps, ledger, now) {
     let outcome = 'unchanged';
     let treeSize;
     let anchored = 0;
+    let erasures = 0;
     try {
+        const progress = { sealed: 0 };
+        try {
+            await sealErasures(connection.handle, progress);
+        }
+        catch (error) {
+            if (isMissingGrant(error)) {
+                notes.push("erasures not sealed yet: the sealing role gets the grant on the app's next apply");
+            }
+            else {
+                outcome = 'failed';
+                notes.push(`sealing erasures failed: ${plainFailure(error)}`);
+            }
+        }
+        erasures = progress.sealed;
         try {
             const checkpoint = await sealCheckpoint(connection.handle, {
                 ledger: ledger.ledger,
                 signer: deps.signer,
             });
             if (checkpoint) {
-                outcome = 'sealed';
+                if (outcome !== 'failed')
+                    outcome = 'sealed';
                 treeSize = checkpoint.tree_size;
             }
-            else {
+            else if (outcome !== 'failed') {
                 notes.push('nothing sealed, no entry since the last checkpoint');
             }
         }
@@ -87,7 +106,8 @@ async function sealOne(deps, ledger, now) {
                 ...base,
                 outcome: 'failed',
                 anchored: 0,
-                reason: `sealing failed: ${plainFailure(error)}`,
+                erasures,
+                reason: [`sealing failed: ${plainFailure(error)}`, ...notes].join('; '),
                 at: now().toISOString(),
             };
         }
@@ -125,7 +145,33 @@ async function sealOne(deps, ledger, now) {
         outcome,
         ...(treeSize === undefined ? {} : { treeSize }),
         anchored,
+        erasures,
         ...(notes.length > 0 ? { reason: notes.join('; ') } : {}),
         at: now().toISOString(),
     };
 }
+const rowsOf = (result) => Array.isArray(result) ? result : (result.rows ?? []);
+/**
+ * An existing sealing role gets the erasure grants only on its app's next apply, so 42501 (insufficient privilege)
+ * and 42883 (undefined function) mean "not yet", not broken. Read on the error or the driver error it wraps.
+ */
+function isMissingGrant(error) {
+    for (let e = error, depth = 0; e && depth < 3; depth++) {
+        const code = e.code;
+        if (code === '42501' || code === '42883')
+            return true;
+        e = e.cause;
+    }
+    return false;
+}
+async function sealErasures(handle, progress) {
+    const pending = rowsOf(await handle.execute(sql `select id, row_hash, erased_at from audit_pending_erasures()`));
+    for (const row of pending) {
+        if (!row.row_hash || row.erased_at === null || row.erased_at === undefined)
+            continue;
+        const erasedAt = row.erased_at instanceof Date ? row.erased_at : new Date(String(row.erased_at));
+        const erasureHash = await computeErasureHash(row.row_hash, erasedAt);
+        await handle.execute(sql `select audit_seal_erasure(${row.id}, ${erasureHash})`);
+        progress.sealed++;
+    }
+}

package/dist/audit/sealer-role.d.ts

@@ -26,7 +26,7 @@ export interface SealerRoleSql {
 }
 /**
  * Makes `user` true: it can log in with `password`, is no superuser and bypasses no row security, may read and
- * insert into the checkpoint, signing-key and anchor tables and run the two sealing functions, and holds nothing
+ * insert into the checkpoint, signing-key and anchor tables and run the sealing functions (leaves, key retirement, pending erasures, erasure sealing), and holds nothing
  * else. The grants are listed here and in `AUDIT_SEALER_GRANTS`; `audit/sealer-role.test.ts` runs a real
  * checkpoint as this role to prove the list is enough.
  */

package/dist/audit/sealer-role.js

@@ -36,7 +36,7 @@ const ident = (name) => `"${name.replace(/"/g, '""')}"`;
 const literal = (value) => `'${value.replace(/'/g, "''")}'`;
 /**
  * Makes `user` true: it can log in with `password`, is no superuser and bypasses no row security, may read and
- * insert into the checkpoint, signing-key and anchor tables and run the two sealing functions, and holds nothing
+ * insert into the checkpoint, signing-key and anchor tables and run the sealing functions (leaves, key retirement, pending erasures, erasure sealing), and holds nothing
  * else. The grants are listed here and in `AUDIT_SEALER_GRANTS`; `audit/sealer-role.test.ts` runs a real
  * checkpoint as this role to prove the list is enough.
  */

package/dist/audit/tick.js

@@ -15,6 +15,7 @@ export async function runAuditSealTick(deps) {
             entryKey: ledger.entryKey,
             outcome: 'skipped',
             anchored: 0,
+            erasures: 0,
             reason,
             at: now().toISOString(),
         };

package/dist/modules/audit-ledger.d.ts

@@ -12,13 +12,15 @@ export declare const AUDIT_PACKAGE_VERSION = "0.14.0";
 /** Insert and read only: the runtime role has UPDATE, DELETE and TRUNCATE revoked on each. */
 export declare const AUDIT_APPEND_ONLY_TABLES: readonly string[];
 /**
- * What the app's runtime role may run: the two functions the chain is written through. Not granted: the erase
- * functions (`audit_erase_person`, `audit_seal_erasure`, `audit_pending_erasures`), because they change what the
- * ledger shows and whether the app may call them is an open decision (foundry#929 item 10); and the sealing
- * functions (`audit_chain_leaves`, `audit_retire_signing_key`), which only the platform's sealing role runs.
+ * What the app's runtime role may run: the two functions the chain is written through. Not granted: the sealing
+ * functions (`audit_chain_leaves`, `audit_retire_signing_key`) and the erasure sealing functions
+ * (`audit_pending_erasures`, `audit_seal_erasure`), which only the platform's sealing role runs. An app may list
+ * `audit_erase_person(text, text, text)` itself and nothing else from the erase set: it pseudonymises, and the
+ * sealing role seals each erasure in the next seal tick (William, 2026-10-26, settles foundry#929 item 10 for
+ * this case).
  */
 export declare const AUDIT_APP_GRANTS: readonly string[];
-/** What the platform's sealing role runs, beside the app's own: reads every leaf, retires a signing key. */
+/** What the platform's sealing role runs, beside the app's own: reads every leaf, retires a signing key, seals erasures. */
 export declare const AUDIT_SEALER_GRANTS: readonly string[];
 type Database = NonNullable<WorkerAppConfig['database']>;
 /**

package/dist/modules/audit-ledger.js

@@ -16,16 +16,20 @@ export const AUDIT_APPEND_ONLY_TABLES = [
     'audit_anchors',
 ];
 /**
- * What the app's runtime role may run: the two functions the chain is written through. Not granted: the erase
- * functions (`audit_erase_person`, `audit_seal_erasure`, `audit_pending_erasures`), because they change what the
- * ledger shows and whether the app may call them is an open decision (foundry#929 item 10); and the sealing
- * functions (`audit_chain_leaves`, `audit_retire_signing_key`), which only the platform's sealing role runs.
+ * What the app's runtime role may run: the two functions the chain is written through. Not granted: the sealing
+ * functions (`audit_chain_leaves`, `audit_retire_signing_key`) and the erasure sealing functions
+ * (`audit_pending_erasures`, `audit_seal_erasure`), which only the platform's sealing role runs. An app may list
+ * `audit_erase_person(text, text, text)` itself and nothing else from the erase set: it pseudonymises, and the
+ * sealing role seals each erasure in the next seal tick (William, 2026-10-26, settles foundry#929 item 10 for
+ * this case).
  */
 export const AUDIT_APP_GRANTS = ['audit_chain_tail()', 'audit_chain_tail_v2()'];
-/** What the platform's sealing role runs, beside the app's own: reads every leaf, retires a signing key. */
+/** What the platform's sealing role runs, beside the app's own: reads every leaf, retires a signing key, seals erasures. */
 export const AUDIT_SEALER_GRANTS = [
     'audit_chain_leaves(bigint, integer)',
     'audit_retire_signing_key(text)',
+    'audit_pending_erasures()',
+    'audit_seal_erasure(bigint, text)',
 ];
 const without = (list, drop) => (list ?? []).filter((item) => !drop.includes(item));
 /**

package/dist/plan/worker-app.d.ts

@@ -167,6 +167,8 @@ export interface WorkerAppWant {
         noDelete?: string[];
         grants?: string[];
         migrationsSha256?: string;
+        /** `uses.audit`: a hash of `AUDIT_SEALER_GRANTS`, so an applied app is planned again when the list changes and its sealing role gets the new grants. */
+        auditSealerGrants?: string;
     };
     /** `workerApp.triggers.crons`, sorted. Absent when none, so a Worker without cron keeps the marker it already has. */
     crons?: string[];

package/dist/plan/worker-app.js

@@ -1,4 +1,5 @@
 import { createHash, randomBytes } from 'node:crypto';
+import { AUDIT_SEALER_GRANTS } from '../modules/audit-ledger.js';
 import { APPS_DOMAIN, heldEnvRef } from '../org.js';
 import { WORKER_APP_KEYS_SECRET, WORKER_APP_KEYS_URL_VAR, workerAppHasBuild, workerAppHostId, } from '../worker-app-config.js';
 import { WORKER_APP_DNS_RECORD, pendingWorkerAppMigrations, strayContainerImage, withCallTimeout, workerAppRegistryPrefix, workerAppShape, workerAppUpload, } from '../worker-app-upload.js';
@@ -203,6 +204,15 @@ export function wantedWorkerApp(org, entry, recorded, input) {
                         ...(app.database.migrationsSha256
                             ? { migrationsSha256: app.database.migrationsSha256 }
                             : {}),
+                        // The order of AUDIT_SEALER_GRANTS is part of the hash: a reorder plans every audit app once.
+                        ...(entry.uses?.audit === true
+                            ? {
+                                auditSealerGrants: createHash('sha256')
+                                    .update(JSON.stringify(AUDIT_SEALER_GRANTS))
+                                    .digest('hex')
+                                    .slice(0, 16),
+                            }
+                            : {}),
                     },
                 }
                 : {}),

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@wtfalch/foundry",
-  "version": "0.68.3",
+  "version": "0.69.0",
   "description": "Foundry's SDK: the declared org's types, the plan and apply contracts, and the state store's interface.",
   "repository": {
     "type": "git",