breakaway 2.0.0-main.99 → 2.0.0

package/src/infra-cloudflare.js

@@ -13,15 +13,24 @@
  * (src/infra-cloudflare-analytics.js, one query per dataset for the whole environment), times PRICES, a price table kept
  * as data with where and when it was read. Plan and apply (BRK-192) are in infra-cloudflare-plan.js.
  *
- * Observe (BRK-191) reads each resource's health from the same analytics over the last few minutes, plus a queue's
- * backlog and a container application's instance counts; a route or custom domain takes its Worker's health. Events
+ * Observe (BRK-191, BRK-266) reads each resource's health from the same analytics over the last few minutes, allowing
+ * for their lag and looking further back for a quiet resource before it calls it idle, plus a queue's backlog and a
+ * container application's instance counts; a route or custom domain takes its Worker's health. Events
  * (BRK-191) reads the account's alert history and reports each alert as a signal on the Worker it names, the same way
  * the board's alert webhook does (`alertFields`), and `alertSetup` reads which alerts are set up and which reach the
  * board. Alerts need Notifications Read; the token never has Notifications Write. Pure apart from `fetch`, so the CLI
  * can import it.
  */
-import { COST_DATASETS, HEALTH_DATASETS, HEALTH_WINDOW_MINUTES, readDataset } from './infra-cloudflare-analytics.js';
+import {
+  COST_DATASETS,
+  HEALTH_DATASETS,
+  HEALTH_LAG_MINUTES,
+  HEALTH_WINDOWS,
+  HEALTH_WINDOW_MINUTES,
+  readDataset,
+} from './infra-cloudflare-analytics.js';
 import { apply, estimate, plan } from './infra-cloudflare-plan.js';
+import { tokenTemplate, WRITE_SECRET, writePermissions } from './infra-cloudflare-tokens.js';
 
 /** @typedef {import('./infra-provider.js').Provider} Provider */
 /** @typedef {import('./infra-provider.js').ProviderContext} ProviderContext */
@@ -71,22 +80,44 @@ export const CLOUDFLARE_KINDS = Object.fromEntries(
         ? { changes: [...BASE, ...ENVELOPE[k].changes], scales: ENVELOPE[k].scales, settings: [...settings] }
         : { changes: [...BASE], settings: [...settings] }),
       ...(ACCESS.includes(k) ? { access: true } : {}),
+      // A Worker is what an environment's discovery starts from (BRK-291).
+      ...(k === 'worker' ? { target: true } : {}),
     },
   ]),
 );
 
 /**
- * How a Worker's binding names the resource it binds, for the console (BRK-262): by the resource's ID in the desired
- * state, which the plan resolves, or a Worker by its name.
+ * How a Worker's binding names the resource it binds, for the console (BRK-262): in Cloudflare's own field, the one
+ * the plan compares with what runs (BINDING_TARGETS; BRK-285), by the resource's ID on Cloudflare (a D1 database, a KV
+ * namespace) or its name (a bucket, a queue, a Worker). A database or namespace the plan still makes has no ID yet, so
+ * a binding names it by its ID in the desired state, in `resource`, until it runs.
  * @type {import('./infra-provider.js').BindingTarget[]}
  */
 const BINDABLE = [
-  { type: 'd1', label: 'D1 database', kind: 'd1', field: 'resource', by: 'id' },
-  { type: 'kv_namespace', label: 'KV namespace', kind: 'kv', field: 'resource', by: 'id' },
-  { type: 'r2_bucket', label: 'R2 bucket', kind: 'r2', field: 'resource', by: 'id' },
-  { type: 'queue', label: 'Queue', kind: 'queue', field: 'resource', by: 'id' },
+  { type: 'd1', label: 'D1 database', kind: 'd1', field: 'id', by: 'id' },
+  { type: 'kv_namespace', label: 'KV namespace', kind: 'kv', field: 'namespace_id', by: 'id' },
+  { type: 'r2_bucket', label: 'R2 bucket', kind: 'r2', field: 'bucket_name', by: 'name' },
+  { type: 'queue', label: 'Queue', kind: 'queue', field: 'queue_name', by: 'name' },
   { type: 'service', label: 'Worker', kind: 'worker', field: 'service', by: 'name' },
 ];
+/** The binding types BINDABLE doesn't list, in words, for a change's lines (WEB-110). */
+const BINDING_WORDS = {
+  durable_object_namespace: 'Durable Object',
+  assets: 'static assets',
+  plain_text: 'variable',
+  secret_text: 'secret',
+  json: 'variable',
+  analytics_engine: 'Analytics Engine',
+  ai: 'Workers AI',
+  browser: 'Browser Rendering',
+  hyperdrive: 'Hyperdrive',
+  vectorize: 'Vectorize index',
+  version_metadata: 'version metadata',
+  workflow: 'Workflow',
+  send_email: 'email',
+  mtls_certificate: 'mTLS certificate',
+  dispatch_namespace: 'dispatch namespace',
+};
 const CRON = '^\\S+( \\S+){4}$';
 const VALUES_ELSEWHERE = 'Set with the Worker’s deploy, never here.';
 
@@ -151,6 +182,7 @@ export const EDITABLE = {
         label: 'Bindings',
         type: 'bindings',
         targets: BINDABLE,
+        typeLabels: BINDING_WORDS,
         help: 'The environment’s databases, namespaces, buckets, queues, and Workers it reaches, each by a name its code uses. Variables and secrets are kept as they are.',
       },
     ],
@@ -316,6 +348,193 @@ export const EDITABLE = {
  */
 export const editable = (kind) => EDITABLE[kind] ?? null;
 
+/**
+ * How a Worker binds each kind the console adds, as BINDABLE says; `required` when the plan makes one only if a Worker
+ * binds it.
+ */
+const bindAs = (kind, required = false) => {
+  const target = BINDABLE.find((t) => t.kind === kind);
+  return target ? { bind: { kind: 'worker', list: 'bindings', target, ...(required ? { required } : {}) } } : {};
+};
+/** Names Cloudflare gives Workers, queues, and containers: lowercase letters, digits, and dashes, up to 63. */
+const DNS_LABEL = '^[a-z0-9](?:[a-z0-9-]{0,61}[a-z0-9])?$';
+const HOSTNAME = '^(?=.{1,253}$)(?:[a-z0-9](?:[a-z0-9-]{0,61}[a-z0-9])?\\.)+[a-z]{2,63}$';
+const ZONE_FIELD = {
+  path: 'zone',
+  label: 'Zone',
+  type: 'text',
+  pattern: HOSTNAME,
+  help: 'The domain on Cloudflare it’s on, like acme.example: one the environment’s token reaches.',
+};
+
+/**
+ * The kinds the console may add (BRK-270), every kind Architect plans. Name rules are Cloudflare's as last read
+ * (developers.cloudflare.com: Workers, Queues, R2, KV, and D1 limits). A database, namespace, bucket, or queue is made
+ * only when a Worker in the environment binds it, so each says how one binds it. A Durable Object class and a container
+ * application are made by their Worker's code and deploy, so the plan won't make one: the console adds it to the file,
+ * `needsCode` says what code must exist, and the plan finds it by name once the deploy has made it.
+ * @type {Record<string, Omit<import('./infra-provider.js').Creatable, 'defaults'> & { defaults?: () => Record<string, unknown> }>}
+ */
+export const CREATABLE = {
+  worker: {
+    label: 'Worker',
+    help: 'Runs the code that answers requests. It starts with a script that answers /health, until the repository’s deploy puts its own code on it.',
+    name: {
+      label: 'Name',
+      pattern: DNS_LABEL,
+      max: 63,
+      help: 'Lowercase letters, digits, and dashes, up to 63, unique in the account, like acme-jobs.',
+    },
+    required: ['compatibilityDate'],
+    defaults: () => ({ compatibilityDate: new Date().toISOString().slice(0, 10), observability: true }),
+    ...bindAs('worker'),
+  },
+  queue: {
+    label: 'Queue',
+    help: 'Holds messages one Worker sends until another takes them, one batch at a time.',
+    name: {
+      label: 'Name',
+      pattern: DNS_LABEL,
+      max: 63,
+      help: 'Lowercase letters, digits, and dashes, up to 63, unique in the account, like acme-jobs.',
+    },
+    defaults: () => ({ deliveryDelay: 0, deliveryPaused: false, retention: 345_600 }),
+    ...bindAs('queue', true),
+  },
+  r2: {
+    label: 'R2 bucket',
+    help: 'Keeps files (objects) by key: uploads, images, exports.',
+    name: {
+      label: 'Name',
+      pattern: '^[a-z0-9][a-z0-9-]{1,61}[a-z0-9]$',
+      max: 63,
+      help: 'Lowercase letters, digits, and dashes, 3 to 63, unique in the account, like acme-uploads.',
+    },
+    fields: [
+      {
+        path: 'location',
+        label: 'Location',
+        type: 'choice',
+        optional: true,
+        options: [
+          { value: 'wnam', label: 'Western North America' },
+          { value: 'enam', label: 'Eastern North America' },
+          { value: 'weur', label: 'Western Europe' },
+          { value: 'eeur', label: 'Eastern Europe' },
+          { value: 'apac', label: 'Asia-Pacific' },
+          { value: 'oc', label: 'Oceania' },
+        ],
+        help: 'Where Cloudflare keeps it, as a hint. Unset puts it near whoever makes it. It can’t move later.',
+      },
+    ],
+    ...bindAs('r2', true),
+  },
+  kv: {
+    label: 'KV namespace',
+    help: 'Keeps small values by key, read often and written now and then: settings, flags, sessions.',
+    name: {
+      label: 'Title',
+      pattern: '^\\S(?:.*\\S)?$',
+      max: 512,
+      help: 'Up to 512 characters, unique in the account, like acme-flags.',
+    },
+    ...bindAs('kv', true),
+  },
+  d1: {
+    label: 'D1 database',
+    help: 'A SQL database (SQLite) for the Worker’s data.',
+    name: {
+      label: 'Name',
+      pattern: '^[a-z0-9][a-z0-9_-]{0,63}$',
+      max: 64,
+      help: 'Lowercase letters, digits, dashes, and underscores, up to 64, unique in the account, like acme-db.',
+    },
+    ...bindAs('d1', true),
+  },
+  route: {
+    label: 'Route',
+    help: 'Sends the requests that match a pattern on one of your domains to a Worker.',
+    name: { ...EDITABLE.route.name, label: 'Pattern', max: 255 },
+    fields: [ZONE_FIELD],
+    required: ['zone', 'worker'],
+  },
+  'custom-domain': {
+    label: 'Custom domain',
+    help: 'Makes a hostname answer with a Worker, with its DNS record and certificate.',
+    name: {
+      label: 'Hostname',
+      pattern: HOSTNAME,
+      max: 253,
+      help: 'A hostname on one of your zones, like api.acme.example, that no other Worker has.',
+    },
+    fields: [ZONE_FIELD],
+    required: ['zone', 'worker'],
+  },
+  'durable-object': {
+    label: 'Durable Object',
+    help: 'One object per ID that keeps its own state, made from a class in a Worker’s code: a counter, a room, a lock.',
+    name: {
+      label: 'Name',
+      pattern: '^[a-z0-9][a-z0-9-]{0,62}_[A-Za-z_$][A-Za-z0-9_$]*$',
+      max: 128,
+      help: 'Its Worker’s name and its class’s, joined by _, like acme-api_Counter.',
+    },
+    fields: [
+      {
+        path: 'class',
+        label: 'Class',
+        type: 'text',
+        pattern: '^[A-Za-z_$][A-Za-z0-9_$]*$',
+        help: 'The class in the Worker’s code that each object is, like Counter.',
+      },
+      {
+        path: 'script',
+        label: 'Worker',
+        type: 'resource',
+        kinds: ['worker'],
+        help: 'The Worker whose code has the class.',
+      },
+    ],
+    required: ['class', 'script'],
+    needsCode:
+      'The Worker’s code exports the class, its wrangler config binds it and adds it in a migration, and the Worker is deployed. Until then, the plan won’t apply.',
+  },
+  container: {
+    label: 'Container',
+    help: 'Runs a container image next to a Durable Object, for code that can’t run in a Worker.',
+    name: {
+      label: 'Name',
+      pattern: DNS_LABEL,
+      max: 63,
+      help: 'Lowercase letters, digits, and dashes, up to 63, unique in the account, like acme-render.',
+    },
+    fields: [
+      {
+        path: 'image',
+        label: 'Image',
+        type: 'text',
+        help: 'What it runs: the Dockerfile in the repository, like ./Dockerfile, or an image’s address.',
+      },
+    ],
+    required: ['image', 'maxInstances'],
+    defaults: () => ({ maxInstances: 1 }),
+    needsCode:
+      'The image, the Durable Object class that starts it, and the container in the Worker’s wrangler config, and the Worker is deployed. Until then, the plan won’t apply.',
+  },
+};
+
+/**
+ * Whether the console may add a resource of `kind` (BRK-270), what a new one is given, and its name's rule.
+ * @param {string} kind
+ * @returns {import('./infra-provider.js').Creatable | null}
+ */
+export function creatable(kind) {
+  const c = CREATABLE[kind];
+  if (!c) return null;
+  const { defaults, ...rest } = c;
+  return { ...structuredClone(rest), ...(defaults ? { defaults: defaults() } : {}) };
+}
+
 /** The scheduling policy whose container applications Cloudflare scales and rolls out; any other is the code's. */
 export const DEFAULT_SCHEDULING = 'default';
 
@@ -619,9 +838,8 @@ function workerAttrs(script, settings, deployments, secrets, schedules) {
     usageModel: settings.usage_model ?? script.usage_model ?? null,
     observability: Boolean(settings.observability?.enabled),
     placement: settings.placement?.mode ?? script.placement_mode ?? null,
-    bindings: (settings.bindings ?? [])
-      .map((b) => ({ name: String(b.name), type: String(b.type) }))
-      .sort((a, b) => a.name.localeCompare(b.name)),
+    // What each binding binds, by ID or name (BINDING_TARGETS), so a draft names it as the plan compares it (BRK-285).
+    bindings: (settings.bindings ?? []).map(bindingTarget).sort((a, b) => a.name.localeCompare(b.name)),
     secrets: sorted(secrets.map((s) => String(s.name))),
     crons: sorted((schedules?.schedules ?? []).map((s) => String(s.cron))),
     versions: (live?.versions ?? []).map((v) => ({ id: String(v.version_id), percentage: Number(v.percentage) })),
@@ -717,7 +935,65 @@ export async function discover(ctx, { live = false } = {}) {
     ),
   );
   seen.scripts = [...scripts.keys()];
-  if (!scripts.has(target)) return done();
+  /** @param {Set<string>} workers the Workers in scope, whose routes and custom domains are resources */
+  async function serving(workers) {
+    // Routes, on the zones the token reaches, that send to a Worker in scope. The zones list holds every zone on the
+    // account for an account-owned token, so a 403 on one zone's routes is skipped and named in `skipped`, never an
+    // error (BRK-254); only when every zone refuses does discovery fail, naming the permission.
+    const zones = await cf.all(`/zones?account.id=${a}`, { permission: 'Zone Read' }, 50);
+    /** @type {Array<{ zone: string, error: any }>} */
+    const refused = [];
+    for (const zone of zones) {
+      seen.zones[String(zone.name)] = String(zone.id);
+      let routes;
+      try {
+        routes =
+          (await cf.get(`/zones/${enc(zone.id)}/workers/routes`, { permission: 'Workers Routes Read' })).result ?? [];
+      } catch (error) {
+        if (error?.status !== 403) throw error;
+        refused.push({ zone: String(zone.name), error });
+        continue;
+      }
+      for (const route of routes) {
+        seen.routes.push({
+          pattern: String(route.pattern),
+          zone: String(zone.name),
+          worker: String(route.script ?? ''),
+        });
+        if (!workers.has(String(route.script))) continue;
+        add({
+          id: rid('route', route.id),
+          kind: 'route',
+          name: String(route.pattern),
+          attrs: { zone: zone.name, worker: String(route.script) },
+        });
+        relate(rid('worker', String(route.script)), rid('route', route.id), 'serves');
+      }
+    }
+    if (refused.length && refused.length === zones.length) throw refused[0].error;
+    if (refused.length) skipped.push(routesSkipped(refused));
+
+    // Custom domains attached to a Worker in scope.
+    const domains = (await cf.get(`/accounts/${a}/workers/domains`, { permission: WORKERS_READ })).result ?? [];
+    for (const d of domains) {
+      seen.domains.push({ hostname: String(d.hostname), worker: String(d.service ?? '') });
+      if (!workers.has(String(d.service))) continue;
+      add({
+        id: rid('custom-domain', d.id),
+        kind: 'custom-domain',
+        name: String(d.hostname),
+        attrs: { zone: d.zone_name ?? null, environment: d.environment ?? null, worker: String(d.service) },
+      });
+      relate(rid('worker', String(d.service)), rid('custom-domain', d.id), 'serves');
+    }
+  }
+
+  // A target that doesn't run yet (a new environment built from the console, BRK-291) has nothing in scope, but a plan
+  // still needs the zones, routes, and domains, so its first change can serve a hostname (BRK-292).
+  if (!scripts.has(target)) {
+    if (live) await serving(new Set());
+    return done();
+  }
 
   // The Workers in scope: the target, and the Workers it calls or whose Durable Objects it binds.
   /** @type {Map<string, any[]>} */
@@ -949,52 +1225,7 @@ export async function discover(ctx, { live = false } = {}) {
       missing.push('Containers Read');
     }
 
-  // Routes, on the zones the token reaches, that send to a Worker in scope. The zones list holds every zone on the
-  // account for an account-owned token, so a 403 on one zone's routes is skipped and named in `skipped`, never an
-  // error (BRK-254); only when every zone refuses does discovery fail, naming the permission.
-  const zones = await cf.all(`/zones?account.id=${a}`, { permission: 'Zone Read' }, 50);
-  /** @type {Array<{ zone: string, error: any }>} */
-  const refused = [];
-  for (const zone of zones) {
-    seen.zones[String(zone.name)] = String(zone.id);
-    let routes;
-    try {
-      routes =
-        (await cf.get(`/zones/${enc(zone.id)}/workers/routes`, { permission: 'Workers Routes Read' })).result ?? [];
-    } catch (error) {
-      if (error?.status !== 403) throw error;
-      refused.push({ zone: String(zone.name), error });
-      continue;
-    }
-    for (const route of routes) {
-      seen.routes.push({ pattern: String(route.pattern), zone: String(zone.name), worker: String(route.script ?? '') });
-      if (!workers.has(String(route.script))) continue;
-      add({
-        id: rid('route', route.id),
-        kind: 'route',
-        name: String(route.pattern),
-        attrs: { zone: zone.name, worker: String(route.script) },
-      });
-      relate(rid('worker', String(route.script)), rid('route', route.id), 'serves');
-    }
-  }
-  if (refused.length && refused.length === zones.length) throw refused[0].error;
-  if (refused.length) skipped.push(routesSkipped(refused));
-
-  // Custom domains attached to a Worker in scope.
-  const domains = (await cf.get(`/accounts/${a}/workers/domains`, { permission: WORKERS_READ })).result ?? [];
-  for (const d of domains) {
-    seen.domains.push({ hostname: String(d.hostname), worker: String(d.service ?? '') });
-    if (!workers.has(String(d.service))) continue;
-    add({
-      id: rid('custom-domain', d.id),
-      kind: 'custom-domain',
-      name: String(d.hostname),
-      attrs: { zone: d.zone_name ?? null, environment: d.environment ?? null, worker: String(d.service) },
-    });
-    relate(rid('worker', String(d.service)), rid('custom-domain', d.id), 'serves');
-  }
-
+  await serving(workers);
   return done();
 }
 
@@ -1245,11 +1476,16 @@ export const HEALTH_LIMITS = {
 
 const MINUTE = 60_000;
 const pct = (n) => `${Math.round(n * 100)}%`;
-const since = `in the last ${HEALTH_WINDOW_MINUTES} minutes`;
+/** A health window in words: "in the last 15 minutes", "in the last hour", "in the last day". */
+const sinceWords = (minutes) =>
+  minutes === 60 ? 'in the last hour' : minutes === 24 * 60 ? 'in the last day' : `in the last ${minutes} minutes`;
 
-/** Health from requests and the ones that failed: unknown with no requests, then by HEALTH_LIMITS. */
-function byErrors(requests, errors, noun = 'requests') {
-  if (!requests) return { state: 'unknown', text: `No ${noun} ${since}` };
+/**
+ * Health from requests and the ones that failed over a window: idle with none (BRK-266: deployed, no traffic, no
+ * errors seen), then by HEALTH_LIMITS.
+ */
+function byErrors(requests, errors, since, noun = 'requests', alive = '') {
+  if (!requests) return { state: 'idle', text: `Idle: no ${noun} ${since}${alive}` };
   const share = errors / requests;
   const said = `${pct(share)} of ${requests} ${noun} failed ${since}`;
   if (share >= HEALTH_LIMITS.downErrors) return { state: 'down', text: said };
@@ -1258,23 +1494,31 @@ function byErrors(requests, errors, noun = 'requests') {
 }
 
 /**
- * One resource's health from what the analytics and the APIs said.
+ * One resource's health from what the analytics and the APIs said. A quiet resource is idle, never unknown: discover
+ * just found it, which is the metadata read that says it exists, and a Worker's deployment says it serves (BRK-266).
+ * Unknown is only for what the board couldn't read, and says which call.
  * @param {Resource} r
  * @param {Record<string, number> | undefined} u its usage over the window
- * @param {{ backlog_count?: number, oldest_message_timestamp_ms?: number } | undefined} backlog a queue's, now
+ * @param {{ result?: any, refused?: string, missing?: boolean } | undefined} backlog a queue's backlog now, or why not
  * @param {number} now
+ * @param {number} minutes the window its usage came from
  * @returns {{ state: string, text: string }}
  */
-function judge(r, u = {}, backlog, now) {
+function judge(r, u = {}, backlog, now, minutes = HEALTH_WINDOW_MINUTES) {
   const n = (k) => Number(u[k] ?? 0) || 0;
   const attrs = /** @type {Record<string, any>} */ (r.attrs ?? {});
+  const since = sinceWords(minutes);
   switch (r.kind) {
-    case 'worker':
+    case 'worker': {
       if (Array.isArray(attrs.versions) && attrs.versions.length === 0)
         return { state: 'down', text: 'No deployment: it serves nothing' };
-      return byErrors(n('requests'), n('errors'));
+      const live = Array.isArray(attrs.versions)
+        ? attrs.versions.reduce((sum, v) => sum + (Number(v?.percentage) || 0), 0)
+        : 0;
+      return byErrors(n('requests'), n('errors'), since, 'requests', live >= 100 ? '; deployed and serving' : '');
+    }
     case 'durable-object':
-      return byErrors(n('requests'), n('errors'));
+      return byErrors(n('requests'), n('errors'), since);
     case 'r2': {
       let all = 0;
       let failed = 0;
@@ -1283,11 +1527,11 @@ function judge(r, u = {}, backlog, now) {
         all += v;
         if (Number(k.slice('requests:'.length)) >= 500) failed += v;
       }
-      return byErrors(all, failed, 'operations');
+      return byErrors(all, failed, since, 'operations');
     }
     case 'd1': {
       const queries = n('readQueries') + n('writeQueries');
-      if (!queries) return { state: 'unknown', text: `No queries ${since}` };
+      if (!queries) return { state: 'idle', text: `Idle: no queries ${since}` };
       const ms = Math.round(n('queryBatchTimeMs'));
       if (ms > HEALTH_LIMITS.slowQueryMs)
         return { state: 'degraded', text: `Queries took ${ms} ms on average ${since}` };
@@ -1296,12 +1540,22 @@ function judge(r, u = {}, backlog, now) {
     case 'kv':
       return n('requests')
         ? { state: 'healthy', text: `${n('requests')} operations ${since}` }
-        : { state: 'unknown', text: `No operations ${since}` };
+        : { state: 'idle', text: `Idle: no operations ${since}` };
     case 'queue': {
       if (attrs.deliveryPaused) return { state: 'degraded', text: 'Delivery is paused' };
-      if (!backlog) return { state: 'unknown', text: 'Its backlog couldn’t be read' };
-      const count = Number(backlog.backlog_count ?? 0) || 0;
-      const oldest = Number(backlog.oldest_message_timestamp_ms ?? 0) || 0;
+      const consumers = Array.isArray(attrs.consumers) ? attrs.consumers : null;
+      if (consumers && consumers.length === 0)
+        return { state: 'degraded', text: 'No consumer is attached, so nothing reads its messages' };
+      if (backlog?.refused) return { state: 'unknown', text: backlog.refused };
+      if (!backlog?.result)
+        return {
+          state: 'idle',
+          text: consumers
+            ? 'Idle: a consumer is attached, and Cloudflare has no backlog figures for it'
+            : 'Idle: Cloudflare has no backlog figures for it',
+        };
+      const count = Number(backlog.result.backlog_count ?? 0) || 0;
+      const oldest = Number(backlog.result.oldest_message_timestamp_ms ?? 0) || 0;
       const waited = count && oldest ? Math.floor((now - oldest) / MINUTE) : 0;
       if (waited > HEALTH_LIMITS.staleQueueMinutes)
         return { state: 'degraded', text: `The oldest message has waited ${waited} minutes; ${count} in the backlog` };
@@ -1314,23 +1568,32 @@ function judge(r, u = {}, backlog, now) {
       const active = attrs.active;
       const assigned = attrs.assigned;
       if (typeof active !== 'number' || typeof assigned !== 'number')
-        return { state: 'unknown', text: 'Its instance counts aren’t known' };
+        return {
+          state: 'unknown',
+          text: 'Cloudflare gave no instance counts when its application was read (GET …/containers/applications): try again at the next refresh',
+        };
+      if (assigned === 0 && active === 0) return { state: 'idle', text: 'Idle: no instances are assigned' };
       if (assigned > 0 && active === 0) return { state: 'down', text: `None of ${assigned} instances is running` };
       if (active < assigned) return { state: 'degraded', text: `${active} of ${assigned} instances are running` };
       return { state: 'healthy', text: `${active} of ${assigned} instances are running` };
     }
     default:
-      return { state: 'unknown', text: 'Cloudflare reports no health for it' };
+      return { state: 'unknown', text: 'Cloudflare reports no health for its kind' };
   }
 }
 
 /**
- * Each resource's health now (BRK-188's "Observe" rows): errors and slowness over the last HEALTH_WINDOW_MINUTES from
- * the analytics, one query per dataset for the whole environment; a queue's backlog now; a container application's
- * instance counts as discover found them; and a route's or custom domain's from the Worker it serves. A dataset
- * Cloudflare won't answer leaves its resources unknown, saying so; anything else (a 429, a 403, Cloudflare out of
- * reach) stops it, so the store keeps the last health. Uses `ctx.resources` when the store passes what discover just
- * found, and discovers otherwise.
+ * Each resource's health now (BRK-188's "Observe" rows; BRK-266): errors and slowness from the analytics, one query
+ * per dataset for the whole environment, over a window that ends HEALTH_LAG_MINUTES back, since Cloudflare's analytics
+ * arrive late. A resource with no traffic in the first of HEALTH_WINDOWS is read again over the next (an hour, then a
+ * day) before it's idle, and its text names the window its verdict came from. A queue's backlog now; a container
+ * application's instance counts as discover found them; and a route's or custom domain's from the Worker it serves.
+ *
+ * Unknown only when the board couldn't read: a dataset Cloudflare won't answer, or a queue's backlog the token may not
+ * read, says which call and what to do, and the store keeps the last health with its age. A longer window Cloudflare
+ * won't answer only stops the fallback. Anything else (a 429, a 403 on the analytics, Cloudflare out of reach) stops
+ * it, so the store keeps the last health. Uses `ctx.resources` when the store passes what discover just found, and
+ * discovers otherwise.
  * @param {ProviderContext} ctx
  * @returns {Promise<import('./infra-provider.js').Health[]>}
  */
@@ -1340,35 +1603,53 @@ export async function observe(ctx) {
   const cf = reader(ctx);
   const account = await accountOf(cf, ctx);
   const now = Date.now();
-  const to = new Date(now);
-  const from = new Date(now - HEALTH_WINDOW_MINUTES * MINUTE);
+  const to = new Date(now - HEALTH_LAG_MINUTES * MINUTE);
   /** @type {Map<string, Record<string, number>>} usage by resource ID */
   const usage = new Map();
+  /** @type {Map<string, number>} the window each resource's verdict comes from, in minutes */
+  const windowOf = new Map();
   /** @type {Map<string, string>} what the analytics didn't answer, by resource ID */
   const unread = new Map();
   for (const d of Object.values(HEALTH_DATASETS)) {
     const mine = resources.filter((r) => r.kind === d.kind);
     if (!mine.length) continue;
     const byKey = new Map(mine.map((r) => [usageKey(r), r.id]));
-    let found;
-    try {
-      found = await readDataset(ctx, { account, dataset: d, keys: [...byKey.keys()], from, to });
-    } catch (error) {
-      if (error?.status !== 400) throw error;
-      for (const r of mine) unread.set(r.id, d.label);
-      continue;
+    let quiet = [...byKey.keys()];
+    for (const [i, minutes] of (d.busy ? HEALTH_WINDOWS : HEALTH_WINDOWS.slice(0, 1)).entries()) {
+      if (!quiet.length) break;
+      const from = new Date(to.getTime() - minutes * MINUTE);
+      let found;
+      try {
+        found = await readDataset(ctx, { account, dataset: d, keys: quiet, from, to });
+      } catch (error) {
+        if (error?.status !== 400) throw error;
+        // The first window unanswered leaves them unread; a longer one only stops looking further back.
+        if (i === 0)
+          for (const r of mine)
+            unread.set(
+              r.id,
+              `Couldn’t read its health: Cloudflare’s analytics didn’t answer for its ${d.label} (${d.dataset}). The last health is kept; if it lasts, check the token has Account Analytics Read`,
+            );
+        break;
+      }
+      for (const key of quiet) windowOf.set(/** @type {string} */ (byKey.get(key)), minutes);
+      for (const [key, u] of found) usage.set(/** @type {string} */ (byKey.get(key)), u);
+      quiet = d.busy ? quiet.filter((key) => !d.busy?.(found.get(key) ?? {})) : [];
     }
-    for (const [key, u] of found) usage.set(/** @type {string} */ (byKey.get(key)), u);
   }
-  /** @type {Map<string, any>} a queue's backlog now, by resource ID */
+  /** @type {Map<string, { result?: any, refused?: string }>} a queue's backlog now, or why it couldn't be read */
   const backlogs = new Map();
   for (const r of resources.filter((q) => q.kind === 'queue')) {
     const path = `/accounts/${enc(account)}/queues/${enc(r.id.slice('queue:'.length))}/metrics`;
     try {
       const json = await cf.get(path, { permission: 'Queues Read', missingOk: true });
-      if (json?.result) backlogs.set(r.id, json.result);
+      backlogs.set(r.id, json?.result ? { result: json.result } : {});
     } catch (error) {
       if (error?.status !== 403) throw error;
+      backlogs.set(r.id, {
+        refused:
+          'Couldn’t read its backlog: Cloudflare refused GET …/queues/<id>/metrics. Give the read-only token Queues Read on Connections',
+      });
     }
   }
 
@@ -1376,12 +1657,12 @@ export async function observe(ctx) {
   const health = new Map();
   for (const r of resources) {
     if (r.kind === 'route' || r.kind === 'custom-domain') continue;
-    const label = unread.get(r.id);
+    const said = unread.get(r.id);
     health.set(
       r.id,
-      label
-        ? { state: 'unknown', text: `Cloudflare’s analytics didn’t answer for its ${label}` }
-        : judge(r, usage.get(r.id), backlogs.get(r.id), now),
+      said
+        ? { state: 'unknown', text: said }
+        : judge(r, usage.get(r.id), backlogs.get(r.id), now, windowOf.get(r.id) ?? HEALTH_WINDOW_MINUTES),
     );
   }
   for (const r of resources) {
@@ -1392,10 +1673,10 @@ export async function observe(ctx) {
       r.id,
       its
         ? { state: its.state, text: `Its Worker, ${worker}: ${its.text}` }
-        : { state: 'unknown', text: 'Its Worker isn’t in this environment' },
+        : { state: 'unknown', text: 'Its Worker isn’t in this environment, so the board can’t read its health' },
     );
   }
-  const at = to.toISOString();
+  const at = new Date(now).toISOString();
   return resources.map((r) => {
     const h = /** @type {{ state: string, text: string }} */ (health.get(r.id));
     return { resource: r.id, state: h.state, at, text: h.text };
@@ -1659,10 +1940,13 @@ export const cloudflare = {
     permissions: READ_PERMISSIONS,
     url: 'https://dash.cloudflare.com/profile/api-tokens',
     check: checkToken,
+    template: tokenTemplate,
   },
+  writeToken: { secret: WRITE_SECRET, permissions: writePermissions, template: tokenTemplate },
   refuses,
   outside,
   editable,
+  creatable,
   discover,
   plan: (ctx, desired) => plan(ctx, desired),
   apply: (ctx, p) => apply(ctx, p),