From 69a66e5d071244f2cc3fd3168a8d796006123e3d Mon Sep 17 00:00:00 2001
From: NB <208086304+chitcommit@users.noreply.github.com>
Date: Sat, 3 Oct 2026 07:00:16 +0000
Subject: [PATCH] feat(mercury): keep the seven API tokens alive and report
 which survived
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Mercury deletes an API token after any 45-day period with no API call
(docs.mercury.com/docs/api-token-security-policies). ChittyFinance had no
outbound Mercury client at all — not one reference to api.mercury.com — so the
seven per-entity tokens have been idle since they were provisioned and some are
probably already gone. The keepalive is therefore also the liveness probe: its
first run is the inventory.

One read-only GET https://api.mercury.com/api/v1/accounts?limit=1 per entity,
on the existing 09:00 UTC cron. No new scheduled trigger, so no new recurring
spend. No write endpoint is ever called.

Three states, not two. A 401 is a successful probe with a negative result, so
alive (2xx), dead (401/403) and indeterminate (timeout, 429, 5xx, unexpected
status, absent binding) are classified separately by a pure function —
conflating "the token is dead" with "we could not reach Mercury" would make the
probe useless. Mercury's errors.errorCode is carried alongside the status so a
403 from an IP-allowlist rejection stays distinguishable from a revoked token.

The seven bindings are declared as secrets_store_secrets against the
account-level store e914522471964c3c8cf1e601770edcc3, the same store and
binding names CHITTYOS/chittysecrets/wrangler.json uses. Because the store is
account-level this needs no ChittySecrets broker in the path. Bindings do not
inherit into env blocks, so top level and all three envs carry them in both
configs; deploy/system-wrangler.jsonc is the live deploy path and the root
config is the Workers Builds one (#111), mirrored to stop them drifting further.

Credential handling: bindings are referenced by name, .get() happens at the call
site, and the value exists only inside the Authorization header. Nothing logged,
returned or persisted holds a token. The 2xx body is cancelled unread because
/accounts carries account and routing numbers; only non-2xx bodies are parsed,
and only for errorCode — never Mercury's prose message.

Recorded in FINANCE_KV rather than a new Neon table: the only vaguely related
existing table, integrations, is tenant-FK'd and these bindings have no tenant
mapping; a new table means a destructive drizzle-kit push for seven rows a day;
and KV is already this repo's operational-state store (sessions, inbound-email
index, Wave webhook secrets). Token liveness is rotation state, which the
operator KV policy allows. Per-token and latest-run keys carry no TTL.

GET /api/v1/mercury-tokens reads the last run; POST .../probe runs it now, so
liveness is readable without waiting for 09:00 UTC. Both are behind serviceAuth:
the /api/v1/* neighbours are all public, but an open endpoint enumerating which
banking tokens are alive is an information leak.

The two cron jobs are isolated with allSettled — processLeaseExpirations throws
outright on an unbound DATABASE_URL and must not be able to skip the keepalive.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
---
 deploy/system-wrangler.jsonc                  |  46 +++
 .../__tests__/mercury-token-keepalive.test.ts | 289 ++++++++++++++
 .../__tests__/routes-mercury-tokens.test.ts   | 101 +++++
 server/app.ts                                 |  13 +
 server/env.ts                                 |  17 +
 server/lib/mercury-token-keepalive.ts         | 354 ++++++++++++++++++
 server/routes/mercury-tokens.ts               |  56 +++
 server/worker.ts                              |  29 +-
 wrangler.jsonc                                |  46 +++
 9 files changed, 947 insertions(+), 4 deletions(-)
 create mode 100644 server/__tests__/mercury-token-keepalive.test.ts
 create mode 100644 server/__tests__/routes-mercury-tokens.test.ts
 create mode 100644 server/lib/mercury-token-keepalive.ts
 create mode 100644 server/routes/mercury-tokens.ts

diff --git a/deploy/system-wrangler.jsonc b/deploy/system-wrangler.jsonc
index 9ccc1c1..206a31a 100644
--- a/deploy/system-wrangler.jsonc
+++ b/deploy/system-wrangler.jsonc
@@ -38,6 +38,22 @@
     { "name": "EMAIL", "allowed_sender_addresses": ["finance@chitty.cc", "noreply@chitty.cc"] }
   ],
 
+  // Mercury API tokens — one per entity — from the ACCOUNT-LEVEL Cloudflare Secrets
+  // Store. Same store and same binding names as CHITTYOS/chittysecrets/wrangler.json;
+  // because the store is account-level, chittyfinance binds them directly and does not
+  // need the ChittySecrets broker in the path. Consumed by the daily keepalive probe in
+  // server/lib/mercury-token-keepalive.ts — Mercury deletes a token after 45 days with
+  // no API call. Bindings do NOT inherit into env blocks, so each env repeats them.
+  "secrets_store_secrets": [
+    { "binding": "MERCURY_TOKEN_ARIBIA_LLC", "store_id": "e914522471964c3c8cf1e601770edcc3", "secret_name": "MERCURY_TOKEN_ARIBIA_LLC" },
+    { "binding": "MERCURY_TOKEN_ARIBIA_LLC_CITY_STUDIO", "store_id": "e914522471964c3c8cf1e601770edcc3", "secret_name": "MERCURY_TOKEN_ARIBIA_LLC_CITY_STUDIO" },
+    { "binding": "MERCURY_TOKEN_ARIBIA_LLC_APT_ARLENE", "store_id": "e914522471964c3c8cf1e601770edcc3", "secret_name": "MERCURY_TOKEN_ARIBIA_LLC_APT_ARLENE" },
+    { "binding": "MERCURY_TOKEN_CHICAGO_FURNISHED_CONDOS", "store_id": "e914522471964c3c8cf1e601770edcc3", "secret_name": "MERCURY_TOKEN_CHICAGO_FURNISHED_CONDOS" },
+    { "binding": "MERCURY_TOKEN_IT_CAN_BE_LLC", "store_id": "e914522471964c3c8cf1e601770edcc3", "secret_name": "MERCURY_TOKEN_IT_CAN_BE_LLC" },
+    { "binding": "MERCURY_TOKEN_CHITTY_SERVICES", "store_id": "e914522471964c3c8cf1e601770edcc3", "secret_name": "MERCURY_TOKEN_CHITTY_SERVICES" },
+    { "binding": "MERCURY_TOKEN_JEAN_ARLENE_VENTURING", "store_id": "e914522471964c3c8cf1e601770edcc3", "secret_name": "MERCURY_TOKEN_JEAN_ARLENE_VENTURING" }
+  ],
+
   "vars": {
     "MODE": "system",
     "NODE_ENV": "production",
@@ -112,6 +128,16 @@
       "send_email": [
         { "name": "EMAIL" }
       ],
+      "secrets_store_secrets": [
+        { "binding": "MERCURY_TOKEN_ARIBIA_LLC", "store_id": "e914522471964c3c8cf1e601770edcc3", "secret_name": "MERCURY_TOKEN_ARIBIA_LLC" },
+        { "binding": "MERCURY_TOKEN_ARIBIA_LLC_CITY_STUDIO", "store_id": "e914522471964c3c8cf1e601770edcc3", "secret_name": "MERCURY_TOKEN_ARIBIA_LLC_CITY_STUDIO" },
+        { "binding": "MERCURY_TOKEN_ARIBIA_LLC_APT_ARLENE", "store_id": "e914522471964c3c8cf1e601770edcc3", "secret_name": "MERCURY_TOKEN_ARIBIA_LLC_APT_ARLENE" },
+        { "binding": "MERCURY_TOKEN_CHICAGO_FURNISHED_CONDOS", "store_id": "e914522471964c3c8cf1e601770edcc3", "secret_name": "MERCURY_TOKEN_CHICAGO_FURNISHED_CONDOS" },
+        { "binding": "MERCURY_TOKEN_IT_CAN_BE_LLC", "store_id": "e914522471964c3c8cf1e601770edcc3", "secret_name": "MERCURY_TOKEN_IT_CAN_BE_LLC" },
+        { "binding": "MERCURY_TOKEN_CHITTY_SERVICES", "store_id": "e914522471964c3c8cf1e601770edcc3", "secret_name": "MERCURY_TOKEN_CHITTY_SERVICES" },
+        { "binding": "MERCURY_TOKEN_JEAN_ARLENE_VENTURING", "store_id": "e914522471964c3c8cf1e601770edcc3", "secret_name": "MERCURY_TOKEN_JEAN_ARLENE_VENTURING" }
+      ],
+
       "vars": {
         "MODE": "system",
         "NODE_ENV": "development",
@@ -137,6 +163,16 @@
     "staging": {
       "name": "chittyfinance-staging",
       "workers_dev": true,
+      "secrets_store_secrets": [
+        { "binding": "MERCURY_TOKEN_ARIBIA_LLC", "store_id": "e914522471964c3c8cf1e601770edcc3", "secret_name": "MERCURY_TOKEN_ARIBIA_LLC" },
+        { "binding": "MERCURY_TOKEN_ARIBIA_LLC_CITY_STUDIO", "store_id": "e914522471964c3c8cf1e601770edcc3", "secret_name": "MERCURY_TOKEN_ARIBIA_LLC_CITY_STUDIO" },
+        { "binding": "MERCURY_TOKEN_ARIBIA_LLC_APT_ARLENE", "store_id": "e914522471964c3c8cf1e601770edcc3", "secret_name": "MERCURY_TOKEN_ARIBIA_LLC_APT_ARLENE" },
+        { "binding": "MERCURY_TOKEN_CHICAGO_FURNISHED_CONDOS", "store_id": "e914522471964c3c8cf1e601770edcc3", "secret_name": "MERCURY_TOKEN_CHICAGO_FURNISHED_CONDOS" },
+        { "binding": "MERCURY_TOKEN_IT_CAN_BE_LLC", "store_id": "e914522471964c3c8cf1e601770edcc3", "secret_name": "MERCURY_TOKEN_IT_CAN_BE_LLC" },
+        { "binding": "MERCURY_TOKEN_CHITTY_SERVICES", "store_id": "e914522471964c3c8cf1e601770edcc3", "secret_name": "MERCURY_TOKEN_CHITTY_SERVICES" },
+        { "binding": "MERCURY_TOKEN_JEAN_ARLENE_VENTURING", "store_id": "e914522471964c3c8cf1e601770edcc3", "secret_name": "MERCURY_TOKEN_JEAN_ARLENE_VENTURING" }
+      ],
+
       "vars": {
         "MODE": "system",
         "NODE_ENV": "staging",
@@ -168,6 +204,16 @@
       "send_email": [
         { "name": "EMAIL", "allowed_sender_addresses": ["finance@chitty.cc", "noreply@chitty.cc"] }
       ],
+      "secrets_store_secrets": [
+        { "binding": "MERCURY_TOKEN_ARIBIA_LLC", "store_id": "e914522471964c3c8cf1e601770edcc3", "secret_name": "MERCURY_TOKEN_ARIBIA_LLC" },
+        { "binding": "MERCURY_TOKEN_ARIBIA_LLC_CITY_STUDIO", "store_id": "e914522471964c3c8cf1e601770edcc3", "secret_name": "MERCURY_TOKEN_ARIBIA_LLC_CITY_STUDIO" },
+        { "binding": "MERCURY_TOKEN_ARIBIA_LLC_APT_ARLENE", "store_id": "e914522471964c3c8cf1e601770edcc3", "secret_name": "MERCURY_TOKEN_ARIBIA_LLC_APT_ARLENE" },
+        { "binding": "MERCURY_TOKEN_CHICAGO_FURNISHED_CONDOS", "store_id": "e914522471964c3c8cf1e601770edcc3", "secret_name": "MERCURY_TOKEN_CHICAGO_FURNISHED_CONDOS" },
+        { "binding": "MERCURY_TOKEN_IT_CAN_BE_LLC", "store_id": "e914522471964c3c8cf1e601770edcc3", "secret_name": "MERCURY_TOKEN_IT_CAN_BE_LLC" },
+        { "binding": "MERCURY_TOKEN_CHITTY_SERVICES", "store_id": "e914522471964c3c8cf1e601770edcc3", "secret_name": "MERCURY_TOKEN_CHITTY_SERVICES" },
+        { "binding": "MERCURY_TOKEN_JEAN_ARLENE_VENTURING", "store_id": "e914522471964c3c8cf1e601770edcc3", "secret_name": "MERCURY_TOKEN_JEAN_ARLENE_VENTURING" }
+      ],
+
       "vars": {
         "MODE": "system",
         "NODE_ENV": "production",
diff --git a/server/__tests__/mercury-token-keepalive.test.ts b/server/__tests__/mercury-token-keepalive.test.ts
new file mode 100644
index 0000000..64a9ddb
--- /dev/null
+++ b/server/__tests__/mercury-token-keepalive.test.ts
@@ -0,0 +1,289 @@
+import { describe, it, expect, vi } from 'vitest';
+import {
+  MERCURY_TOKEN_BINDINGS,
+  MERCURY_PROBE_URL,
+  classifyProbe,
+  extractErrorCode,
+  probeToken,
+  runMercuryTokenKeepalive,
+  persistKeepaliveReport,
+  readLatestKeepaliveReport,
+  KV_RUN_LATEST,
+  kvTokenKey,
+  type MercuryKeepaliveEnv,
+} from '../lib/mercury-token-keepalive';
+
+/**
+ * No DB module is mocked here. The classifier is a pure function and is tested
+ * against real `Response` objects; the fetch seam is an injected `fetchImpl`
+ * parameter, not a module mock; KV is a real in-memory Map behind the KVNamespace
+ * surface the module actually uses.
+ */
+function makeKv() {
+  const store = new Map<string, string>();
+  return {
+    store,
+    get: async (k: string) => store.get(k) ?? null,
+    put: async (k: string, v: string) => { store.set(k, v); },
+    delete: async (k: string) => { store.delete(k); },
+  } as unknown as KVNamespace & { store: Map<string, string> };
+}
+
+const secret = (value: string) => ({ get: async () => value });
+
+describe('classifyProbe — the three states are distinguished', () => {
+  // The whole point of the probe: a 401 is a successful probe with a negative
+  // result, and must never be conflated with "we could not reach Mercury".
+  it('2xx is alive', () => {
+    for (const status of [200, 204, 299]) {
+      expect(classifyProbe({ status }).liveness).toBe('alive');
+    }
+  });
+
+  it('401 is dead, not alive and not indeterminate', () => {
+    const c = classifyProbe({ status: 401, errorCode: 'noTokenInDB' });
+    expect(c.liveness).toBe('dead');
+    expect(c.liveness).not.toBe('alive');
+    expect(c.liveness).not.toBe('indeterminate');
+    expect(c.reason).toContain('401');
+    expect(c.reason).toContain('noTokenInDB');
+  });
+
+  it('403 is dead', () => {
+    expect(classifyProbe({ status: 403 }).liveness).toBe('dead');
+  });
+
+  it('timeout / network failure is indeterminate, not dead', () => {
+    const c = classifyProbe({ transportError: 'TimeoutError' });
+    expect(c.liveness).toBe('indeterminate');
+    expect(c.liveness).not.toBe('dead');
+    expect(c.reason).toContain('transport_error');
+  });
+
+  it('5xx is indeterminate, not dead', () => {
+    for (const status of [500, 502, 503]) {
+      expect(classifyProbe({ status }).liveness).toBe('indeterminate');
+    }
+  });
+
+  it('429 is indeterminate', () => {
+    expect(classifyProbe({ status: 429 }).liveness).toBe('indeterminate');
+  });
+
+  it('an absent Secrets Store binding is indeterminate, never dead', () => {
+    const c = classifyProbe({ bindingMissing: true });
+    expect(c.liveness).toBe('indeterminate');
+    expect(c.reason).toContain('binding_missing');
+  });
+
+  it('404 and other unexpected statuses are indeterminate', () => {
+    expect(classifyProbe({ status: 404 }).liveness).toBe('indeterminate');
+    expect(classifyProbe({ status: 418 }).liveness).toBe('indeterminate');
+  });
+
+  // Drive the classifier off real Response statuses rather than hand-written numbers,
+  // so a change to how status is read is caught too.
+  it('classifies real Response objects', async () => {
+    expect(classifyProbe({ status: new Response('', { status: 200 }).status }).liveness).toBe('alive');
+    expect(classifyProbe({ status: new Response('', { status: 401 }).status }).liveness).toBe('dead');
+    expect(classifyProbe({ status: new Response('', { status: 503 }).status }).liveness).toBe('indeterminate');
+  });
+});
+
+describe('extractErrorCode', () => {
+  it('pulls errors.errorCode from a Mercury error body', () => {
+    expect(extractErrorCode({ errors: { errorCode: 'noTokenInDB', message: 'No matching token found' } }))
+      .toBe('noTokenInDB');
+  });
+
+  it('handles an array of errors', () => {
+    expect(extractErrorCode({ errors: [{ errorCode: 'noAuthTokenHeader' }] })).toBe('noAuthTokenHeader');
+  });
+
+  it('returns null for shapes it does not recognise', () => {
+    expect(extractErrorCode(null)).toBeNull();
+    expect(extractErrorCode('nope')).toBeNull();
+    expect(extractErrorCode({})).toBeNull();
+    expect(extractErrorCode({ errors: {} })).toBeNull();
+  });
+
+  it('sanitizes and caps the code, and never returns the message', () => {
+    const out = extractErrorCode({ errors: { errorCode: 'bad code\n<script>' + 'x'.repeat(200), message: 'secret-token:abc' } });
+    expect(out).not.toBeNull();
+    expect(out!.length).toBeLessThanOrEqual(64);
+    expect(out).not.toContain(' ');
+    expect(out).not.toContain('<');
+  });
+});
+
+describe('probeToken', () => {
+  it('sends a read-only GET to the accounts endpoint with the token as a bearer', async () => {
+    const calls: Array<{ url: string; init?: RequestInit }> = [];
+    const fetchImpl = (async (url: any, init: any) => {
+      calls.push({ url: String(url), init });
+      return new Response(JSON.stringify({ accounts: [], page: {} }), { status: 200 });
+    }) as unknown as typeof fetch;
+
+    const env: MercuryKeepaliveEnv = { MERCURY_TOKEN_ARIBIA_LLC: secret('secret-token:live') };
+    const res = await probeToken('MERCURY_TOKEN_ARIBIA_LLC', env, fetchImpl);
+
+    expect(res.liveness).toBe('alive');
+    expect(res.status).toBe(200);
+    expect(calls).toHaveLength(1);
+    expect(calls[0].url).toBe(MERCURY_PROBE_URL);
+    expect(calls[0].init?.method).toBe('GET');
+    expect((calls[0].init?.headers as Record<string, string>).Authorization).toBe('Bearer secret-token:live');
+  });
+
+  it('only ever calls the read-only accounts endpoint — never a write path', async () => {
+    const urls: string[] = [];
+    const fetchImpl = (async (url: any) => {
+      urls.push(String(url));
+      return new Response('{}', { status: 200 });
+    }) as unknown as typeof fetch;
+
+    const env: MercuryKeepaliveEnv = Object.fromEntries(
+      MERCURY_TOKEN_BINDINGS.map((b) => [b, secret('secret-token:x')]),
+    );
+    await runMercuryTokenKeepalive(env, fetchImpl);
+
+    expect(urls).toHaveLength(7);
+    for (const u of urls) {
+      expect(u).toBe(MERCURY_PROBE_URL);
+      expect(u).toMatch(/^https:\/\/api\.mercury\.com\/api\/v1\/accounts\?limit=1$/);
+      expect(u).not.toMatch(/send-money|transaction|transfer/i);
+    }
+  });
+
+  it('records a 401 as dead and carries the errorCode', async () => {
+    const fetchImpl = (async () => new Response(
+      JSON.stringify({ errors: { errorCode: 'noTokenInDB', message: 'No matching token found' } }),
+      { status: 401 },
+    )) as unknown as typeof fetch;
+
+    const res = await probeToken('MERCURY_TOKEN_CHITTY_SERVICES', { MERCURY_TOKEN_CHITTY_SERVICES: secret('t') }, fetchImpl);
+    expect(res.liveness).toBe('dead');
+    expect(res.status).toBe(401);
+    expect(res.errorCode).toBe('noTokenInDB');
+  });
+
+  it('records a network failure as indeterminate and never as dead', async () => {
+    const fetchImpl = (async () => { throw Object.assign(new Error('timed out'), { name: 'TimeoutError' }); }) as unknown as typeof fetch;
+    const res = await probeToken('MERCURY_TOKEN_IT_CAN_BE_LLC', { MERCURY_TOKEN_IT_CAN_BE_LLC: secret('t') }, fetchImpl);
+    expect(res.liveness).toBe('indeterminate');
+    expect(res.status).toBeNull();
+    expect(res.reason).toContain('TimeoutError');
+  });
+
+  it('reports a missing binding as indeterminate without calling Mercury', async () => {
+    const fetchImpl = vi.fn(async () => new Response('{}', { status: 200 })) as unknown as typeof fetch;
+    const res = await probeToken('MERCURY_TOKEN_ARIBIA_LLC', {}, fetchImpl);
+    expect(res.liveness).toBe('indeterminate');
+    expect(res.reason).toContain('binding_missing');
+    expect(fetchImpl).not.toHaveBeenCalled();
+  });
+
+  it('reports a Secrets Store failure as indeterminate and leaks nothing from the thrown error', async () => {
+    const env: MercuryKeepaliveEnv = {
+      MERCURY_TOKEN_ARIBIA_LLC: { get: async () => { throw new Error('secret-token:leaked-value'); } },
+    };
+    const res = await probeToken('MERCURY_TOKEN_ARIBIA_LLC', env, (async () => new Response('{}')) as unknown as typeof fetch);
+    expect(res.liveness).toBe('indeterminate');
+    expect(JSON.stringify(res)).not.toContain('leaked-value');
+  });
+
+  it('never puts a token value into the recorded result', async () => {
+    const token = 'secret-token:do-not-record-me';
+    const fetchImpl = (async () => new Response('{}', { status: 200 })) as unknown as typeof fetch;
+    const res = await probeToken('MERCURY_TOKEN_ARIBIA_LLC', { MERCURY_TOKEN_ARIBIA_LLC: secret(token) }, fetchImpl);
+    expect(JSON.stringify(res)).not.toContain(token);
+    expect(JSON.stringify(res)).not.toContain('do-not-record-me');
+    expect(res.token).toBe('MERCURY_TOKEN_ARIBIA_LLC');
+  });
+
+  it('does not read the 2xx body — account and routing numbers are never touched', async () => {
+    let bodyRead = false;
+    const fetchImpl = (async () => {
+      const res = new Response(JSON.stringify({ accounts: [{ accountNumber: '9999', routingNumber: '0001' }] }), { status: 200 });
+      return new Proxy(res, {
+        get(target, prop, recv) {
+          if (prop === 'json' || prop === 'text' || prop === 'arrayBuffer') {
+            return () => { bodyRead = true; return Reflect.get(target, prop, target).call(target); };
+          }
+          const v = Reflect.get(target, prop, recv === target ? target : target);
+          return typeof v === 'function' ? v.bind(target) : v;
+        },
+      });
+    }) as unknown as typeof fetch;
+
+    const res = await probeToken('MERCURY_TOKEN_ARIBIA_LLC', { MERCURY_TOKEN_ARIBIA_LLC: secret('t') }, fetchImpl);
+    expect(res.liveness).toBe('alive');
+    expect(bodyRead).toBe(false);
+  });
+});
+
+describe('runMercuryTokenKeepalive', () => {
+  it('probes all seven and one failure does not prevent the others', async () => {
+    let n = 0;
+    const fetchImpl = (async () => {
+      n += 1;
+      if (n === 1) return new Response(JSON.stringify({ errors: { errorCode: 'noTokenInDB' } }), { status: 401 });
+      if (n === 2) throw Object.assign(new Error('boom'), { name: 'TypeError' });
+      if (n === 3) return new Response('', { status: 503 });
+      return new Response('{}', { status: 200 });
+    }) as unknown as typeof fetch;
+
+    const env: MercuryKeepaliveEnv = Object.fromEntries(
+      MERCURY_TOKEN_BINDINGS.map((b) => [b, secret('secret-token:x')]),
+    );
+    const report = await runMercuryTokenKeepalive(env, fetchImpl);
+
+    expect(report.results).toHaveLength(7);
+    expect(report.results.map((r) => r.token).sort()).toEqual([...MERCURY_TOKEN_BINDINGS].sort());
+    expect(report.counts.dead).toBe(1);
+    expect(report.counts.indeterminate).toBe(2);
+    expect(report.counts.alive).toBe(4);
+    expect(report.counts.alive + report.counts.dead + report.counts.indeterminate).toBe(7);
+  });
+
+  it('reports every token as indeterminate when no bindings are present, without calling Mercury', async () => {
+    const fetchImpl = vi.fn(async () => new Response('{}')) as unknown as typeof fetch;
+    const report = await runMercuryTokenKeepalive({}, fetchImpl);
+    expect(report.counts.indeterminate).toBe(7);
+    expect(report.counts.dead).toBe(0);
+    expect(fetchImpl).not.toHaveBeenCalled();
+  });
+});
+
+describe('durable record', () => {
+  it('writes the run and a per-token latest, and reads back', async () => {
+    const kv = makeKv();
+    const fetchImpl = (async () => new Response(JSON.stringify({ errors: { errorCode: 'noTokenInDB' } }), { status: 401 })) as unknown as typeof fetch;
+    const env: MercuryKeepaliveEnv = Object.fromEntries(
+      MERCURY_TOKEN_BINDINGS.map((b) => [b, secret('secret-token:x')]),
+    );
+
+    const report = await runMercuryTokenKeepalive(env, fetchImpl);
+    await persistKeepaliveReport(report, kv);
+
+    expect(kv.store.has(KV_RUN_LATEST)).toBe(true);
+    for (const b of MERCURY_TOKEN_BINDINGS) {
+      const raw = kv.store.get(kvTokenKey(b));
+      expect(raw).toBeTruthy();
+      const rec = JSON.parse(raw!);
+      expect(rec.token).toBe(b);
+      expect(rec.liveness).toBe('dead');
+      expect(rec.status).toBe(401);
+      expect(typeof rec.checkedAt).toBe('string');
+    }
+
+    const back = await readLatestKeepaliveReport(kv);
+    expect(back?.counts.dead).toBe(7);
+    // No token value anywhere in the persisted record.
+    expect(JSON.stringify([...kv.store.values()])).not.toContain('secret-token:');
+  });
+
+  it('readLatestKeepaliveReport returns null before the first run', async () => {
+    expect(await readLatestKeepaliveReport(makeKv())).toBeNull();
+  });
+});
diff --git a/server/__tests__/routes-mercury-tokens.test.ts b/server/__tests__/routes-mercury-tokens.test.ts
new file mode 100644
index 0000000..55dab27
--- /dev/null
+++ b/server/__tests__/routes-mercury-tokens.test.ts
@@ -0,0 +1,101 @@
+import { describe, it, expect } from 'vitest';
+import { createApp } from '../app';
+import { KV_RUN_LATEST, MERCURY_TOKEN_BINDINGS } from '../lib/mercury-token-keepalive';
+
+/**
+ * Covers the gate and the shape of /api/v1/mercury-tokens through the real app, so
+ * the middleware wiring in server/app.ts is exercised rather than assumed.
+ *
+ * `createDb` is injected (an app seam, not a module mock) because createApp's
+ * storageMiddleware builds a drizzle client for every request — these routes touch
+ * no DB, but the app factory still needs a client it can construct.
+ */
+function makeKv(seed: Record<string, string> = {}) {
+  const store = new Map<string, string>(Object.entries(seed));
+  return {
+    store,
+    get: async (k: string) => store.get(k) ?? null,
+    put: async (k: string, v: string) => { store.set(k, v); },
+    delete: async (k: string) => { store.delete(k); },
+  } as unknown as KVNamespace & { store: Map<string, string> };
+}
+
+const SERVICE_TOKEN = 'service-token-for-test';
+
+function makeEnv(kv: KVNamespace) {
+  return {
+    MODE: 'system',
+    NODE_ENV: 'test',
+    APP_VERSION: '2.0.0-test',
+    CHITTY_AUTH_SERVICE_TOKEN: SERVICE_TOKEN,
+    DATABASE_URL: 'postgres://user:pw@localhost/db',
+    FINANCE_KV: kv,
+    FINANCE_R2: {} as any,
+    ASSETS: {} as any,
+  } as any;
+}
+
+const app = createApp({ createDb: (() => ({})) as any });
+
+describe('GET /api/v1/mercury-tokens — auth gate', () => {
+  // An unauthenticated endpoint enumerating which banking tokens are alive would be
+  // an information leak, so this must not follow its public /api/v1/* neighbours.
+  it('rejects an unauthenticated request', async () => {
+    const res = await app.request('/api/v1/mercury-tokens', {}, makeEnv(makeKv()));
+    expect(res.status).toBe(401);
+  });
+
+  it('rejects a wrong bearer token', async () => {
+    const res = await app.request(
+      '/api/v1/mercury-tokens',
+      { headers: { authorization: 'Bearer wrong' } },
+      makeEnv(makeKv()),
+    );
+    expect(res.status).toBe(401);
+  });
+
+  it('rejects an unauthenticated probe trigger', async () => {
+    const res = await app.request('/api/v1/mercury-tokens/probe', { method: 'POST' }, makeEnv(makeKv()));
+    expect(res.status).toBe(401);
+  });
+});
+
+describe('GET /api/v1/mercury-tokens — response', () => {
+  it('reports no_run_recorded before the first run, and lists the bindings it will probe', async () => {
+    const res = await app.request(
+      '/api/v1/mercury-tokens',
+      { headers: { authorization: `Bearer ${SERVICE_TOKEN}` } },
+      makeEnv(makeKv()),
+    );
+    expect(res.status).toBe(200);
+    const body = await res.json() as any;
+    expect(body.status).toBe('no_run_recorded');
+    expect(body.tokens).toEqual([...MERCURY_TOKEN_BINDINGS]);
+  });
+
+  it('returns the recorded run with per-token liveness and no credential material', async () => {
+    const report = {
+      ranAt: '2026-10-03T09:00:00.000Z',
+      probeUrl: 'https://api.mercury.com/api/v1/accounts?limit=1',
+      counts: { alive: 1, dead: 1, indeterminate: 5 },
+      results: [
+        { token: 'MERCURY_TOKEN_ARIBIA_LLC', liveness: 'alive', reason: 'ok: HTTP 200', status: 200, errorCode: null, checkedAt: '2026-10-03T09:00:00.000Z' },
+        { token: 'MERCURY_TOKEN_CHITTY_SERVICES', liveness: 'dead', reason: 'rejected: HTTP 401 (noTokenInDB)', status: 401, errorCode: 'noTokenInDB', checkedAt: '2026-10-03T09:00:00.000Z' },
+      ],
+    };
+    const kv = makeKv({ [KV_RUN_LATEST]: JSON.stringify(report) });
+
+    const res = await app.request(
+      '/api/v1/mercury-tokens',
+      { headers: { authorization: `Bearer ${SERVICE_TOKEN}` } },
+      makeEnv(kv),
+    );
+    expect(res.status).toBe(200);
+    const body = await res.json() as any;
+    expect(body.status).toBe('ok');
+    expect(body.counts).toEqual({ alive: 1, dead: 1, indeterminate: 5 });
+    expect(body.results[1].liveness).toBe('dead');
+    expect(body.results[1].errorCode).toBe('noTokenInDB');
+    expect(JSON.stringify(body)).not.toContain('secret-token:');
+  });
+});
diff --git a/server/app.ts b/server/app.ts
index 9aa392a..c2a85cd 100644
--- a/server/app.ts
+++ b/server/app.ts
@@ -40,6 +40,7 @@ import { allocationRoutes } from './accounting/allocations';
 import { classificationRoutes } from './routes/classification';
 import { emailRoutes } from './routes/email';
 import { createAdminSeedRoutes } from './routes/admin-seed';
+import { mercuryTokenRoutes } from './routes/mercury-tokens';
 import { createDb } from './db/connection';
 import { SystemStorage } from './storage/system';
 
@@ -140,6 +141,17 @@ export function createApp(deps: AppDeps = {}) {
   // X-Chitty-User-Id. Service token alone does not reach this route.
   app.use('/api/admin', storageMiddleware, serviceAuth, hybridAuth, callerContext);
   app.use('/api/admin/*', storageMiddleware, serviceAuth, hybridAuth, callerContext);
+
+  // ── Mercury token keepalive / liveness (auth + service token, NO tenant, NO storage) ──
+  //
+  // The seven Mercury tokens are account-level Secrets Store bindings with no tenant
+  // scope, so tenantMiddleware (fail-closed since #144) would reject every call for a
+  // missing X-Tenant-ID, and the route touches no DB so storageMiddleware is not needed.
+  //
+  // serviceAuth rather than nothing: the /api/v1/* neighbours are all public, but an
+  // open endpoint enumerating which banking tokens are alive is an information leak.
+  app.use('/api/v1/mercury-tokens', serviceAuth);
+  app.use('/api/v1/mercury-tokens/*', serviceAuth);
   for (const prefix of protectedPrefixes) {
     app.use(prefix, ...protectedRoute);
     app.use(`${prefix}/*`, ...protectedRoute);
@@ -174,6 +186,7 @@ export function createApp(deps: AppDeps = {}) {
   app.route('/', leaseRoutes);
   app.route('/', mcpRoutes);
   app.route('/', createAdminSeedRoutes(deps.chartDocument));
+  app.route('/', mercuryTokenRoutes);
 
   // ── Fallback: try static assets, then 404 ──
   app.all('*', async (c) => {
diff --git a/server/env.ts b/server/env.ts
index d0f662f..5b384ab 100644
--- a/server/env.ts
+++ b/server/env.ts
@@ -13,6 +13,23 @@ export interface Env {
   OAUTH_STATE_SECRET?: string;
   GITHUB_TOKEN?: string;
   MERCURY_WEBHOOK_SECRET?: string;
+  /**
+   * Mercury API tokens, one per entity, bound from the ACCOUNT-LEVEL Cloudflare
+   * Secrets Store (store e914522471964c3c8cf1e601770edcc3) as `secrets_store_secrets`
+   * in deploy/system-wrangler.jsonc. Binding name == secret name, matching
+   * CHITTYOS/chittysecrets/wrangler.json. Optional because a Worker deployed before
+   * the bindings land will not have them — the keepalive probe reports that as
+   * `binding_missing` (indeterminate) rather than as a dead token.
+   *
+   * `.get()` the value at the call site and never log, return or persist it.
+   */
+  MERCURY_TOKEN_ARIBIA_LLC?: SecretsStoreSecret;
+  MERCURY_TOKEN_ARIBIA_LLC_CITY_STUDIO?: SecretsStoreSecret;
+  MERCURY_TOKEN_ARIBIA_LLC_APT_ARLENE?: SecretsStoreSecret;
+  MERCURY_TOKEN_CHICAGO_FURNISHED_CONDOS?: SecretsStoreSecret;
+  MERCURY_TOKEN_IT_CAN_BE_LLC?: SecretsStoreSecret;
+  MERCURY_TOKEN_CHITTY_SERVICES?: SecretsStoreSecret;
+  MERCURY_TOKEN_JEAN_ARLENE_VENTURING?: SecretsStoreSecret;
   CHITTYAGENT_API_BASE?: string;
   CHITTYAGENT_API_TOKEN?: string;
   CHITTY_LEDGER_BASE?: string;
diff --git a/server/lib/mercury-token-keepalive.ts b/server/lib/mercury-token-keepalive.ts
new file mode 100644
index 0000000..c78f3e4
--- /dev/null
+++ b/server/lib/mercury-token-keepalive.ts
@@ -0,0 +1,354 @@
+/**
+ * Mercury API token keepalive + liveness probe.
+ *
+ * WHY THIS EXISTS
+ * ---------------
+ * Mercury deletes API tokens after any 45-day period with no API call
+ * (docs.mercury.com/docs/api-token-security-policies: "Tokens inactive for any
+ * 45-day period face automatic deletion"). ChittyFinance had no outbound Mercury
+ * client at all — no reference to api.mercury.com anywhere in the tree — so the
+ * seven per-entity tokens have been idle since they were provisioned. A daily
+ * read-only call is both the keepalive and the inventory of which ones survived.
+ *
+ * SCOPE — READ ONLY
+ * -----------------
+ * The only request this module ever makes is
+ *   GET https://api.mercury.com/api/v1/accounts?limit=1
+ * (docs.mercury.com/reference/getaccounts). It never calls a write endpoint.
+ * `limit=1` keeps the response minimal, and the 2xx body is DISCARDED UNREAD —
+ * /accounts returns account and routing numbers, and this module has no reason
+ * to hold them.
+ *
+ * CREDENTIAL HANDLING
+ * -------------------
+ * Tokens are referenced by Secrets Store BINDING NAME only. `.get()` happens at
+ * the call site, the value goes straight into the Authorization header, and it is
+ * never logged, returned, persisted, or put in an error message. Only the binding
+ * name, the HTTP status, Mercury's `errorCode`, and a timestamp are recorded.
+ *
+ * THREE STATES, NOT TWO
+ * ---------------------
+ * A 401 is a SUCCESSFUL probe with a negative result. Conflating "the token is
+ * dead" with "we could not reach Mercury" would make the whole probe useless, so
+ * classification is explicit:
+ *   alive         — 2xx
+ *   dead          — 401 / 403 (expired, deleted, or revoked)
+ *   indeterminate — timeout, network error, 429, 5xx, unexpected status, or a
+ *                   binding that is not present on this Worker
+ */
+
+/**
+ * The seven Secrets Store bindings, one per entity. Binding name == secret name,
+ * matching CHITTYOS/chittysecrets/wrangler.json, which binds the same secrets from
+ * the same account-level store (e914522471964c3c8cf1e601770edcc3). Secrets Store is
+ * account-level, so chittyfinance declares these directly — it does not need the
+ * ChittySecrets broker in the path.
+ */
+export const MERCURY_TOKEN_BINDINGS = [
+  'MERCURY_TOKEN_ARIBIA_LLC',
+  'MERCURY_TOKEN_ARIBIA_LLC_CITY_STUDIO',
+  'MERCURY_TOKEN_ARIBIA_LLC_APT_ARLENE',
+  'MERCURY_TOKEN_CHICAGO_FURNISHED_CONDOS',
+  'MERCURY_TOKEN_IT_CAN_BE_LLC',
+  'MERCURY_TOKEN_CHITTY_SERVICES',
+  'MERCURY_TOKEN_JEAN_ARLENE_VENTURING',
+] as const;
+
+export type MercuryTokenBinding = (typeof MERCURY_TOKEN_BINDINGS)[number];
+
+/** Read-only. Do not point this at a write endpoint. */
+export const MERCURY_PROBE_URL = 'https://api.mercury.com/api/v1/accounts?limit=1';
+
+export const MERCURY_PROBE_TIMEOUT_MS = 10_000;
+
+export type Liveness = 'alive' | 'dead' | 'indeterminate';
+
+/** Raw observation handed to the pure classifier. Carries no credential material. */
+export interface ProbeObservation {
+  /** HTTP status, when a response was received at all. */
+  status?: number;
+  /** Mercury's `errors.errorCode`, when the non-2xx body carried one. */
+  errorCode?: string | null;
+  /** Transport-level failure (timeout, DNS, TLS). Never a credential value. */
+  transportError?: string | null;
+  /** The Secrets Store binding is absent, or `.get()` threw. */
+  bindingMissing?: boolean;
+}
+
+export interface Classification {
+  liveness: Liveness;
+  reason: string;
+}
+
+export interface ProbeResult extends Classification {
+  /** Secrets Store binding name — never the token value. */
+  token: MercuryTokenBinding | string;
+  status: number | null;
+  errorCode: string | null;
+  checkedAt: string;
+}
+
+export interface KeepaliveReport {
+  ranAt: string;
+  probeUrl: string;
+  counts: Record<Liveness, number>;
+  results: ProbeResult[];
+}
+
+/**
+ * Pure three-state classifier. Separated from fetch so it can be tested against
+ * real `Response` statuses rather than a mocked client.
+ *
+ * `dead` is deliberately narrow: only 401/403, where Mercury has told us the token
+ * itself is not acceptable. Everything we cannot interpret is `indeterminate`.
+ */
+export function classifyProbe(obs: ProbeObservation): Classification {
+  if (obs.bindingMissing) {
+    return {
+      liveness: 'indeterminate',
+      reason: 'binding_missing: secrets_store binding is not present on this Worker',
+    };
+  }
+
+  if (typeof obs.status !== 'number') {
+    return {
+      liveness: 'indeterminate',
+      reason: `transport_error: ${obs.transportError || 'no response received'}`,
+    };
+  }
+
+  const { status } = obs;
+
+  if (status >= 200 && status < 300) {
+    return { liveness: 'alive', reason: `ok: HTTP ${status}` };
+  }
+
+  // 401 — Mercury rejected the token (deleted after 45 days idle, or revoked).
+  // 403 — authenticated but refused; on a read+write token this is also the shape
+  // an IP-allowlist rejection would take, which is why the errorCode is kept.
+  if (status === 401 || status === 403) {
+    const code = obs.errorCode ? ` (${obs.errorCode})` : '';
+    return {
+      liveness: 'dead',
+      reason: `rejected: HTTP ${status}${code}`,
+    };
+  }
+
+  if (status === 429) {
+    return { liveness: 'indeterminate', reason: 'rate_limited: HTTP 429' };
+  }
+
+  if (status >= 500) {
+    return { liveness: 'indeterminate', reason: `upstream_error: HTTP ${status}` };
+  }
+
+  return { liveness: 'indeterminate', reason: `unexpected_status: HTTP ${status}` };
+}
+
+/**
+ * Pull `errors.errorCode` out of a non-2xx body. Deliberately narrow: only the
+ * machine-readable code is taken, never Mercury's `message`, so nothing a remote
+ * service put in prose can end up in our logs. Sanitized and length-capped.
+ */
+export function extractErrorCode(body: unknown): string | null {
+  if (!body || typeof body !== 'object') return null;
+  const errors = (body as { errors?: unknown }).errors;
+  const candidate = Array.isArray(errors) ? errors[0] : errors;
+  if (!candidate || typeof candidate !== 'object') return null;
+  const code = (candidate as { errorCode?: unknown }).errorCode;
+  if (typeof code !== 'string') return null;
+  const safe = code.replace(/[^A-Za-z0-9_.:-]/g, '');
+  return safe.slice(0, 64) || null;
+}
+
+/** Only the two members of Env this module needs, so tests need not build a whole Env. */
+export type MercuryKeepaliveEnv = Partial<Record<MercuryTokenBinding, { get(): Promise<string> }>> & {
+  FINANCE_KV?: KVNamespace;
+};
+
+/**
+ * Probe one token. Resolves — never rejects — so one entity's failure cannot sink
+ * the others or the scheduled run.
+ */
+export async function probeToken(
+  binding: MercuryTokenBinding,
+  env: MercuryKeepaliveEnv,
+  fetchImpl: typeof fetch = fetch,
+): Promise<ProbeResult> {
+  const checkedAt = new Date().toISOString();
+  const secret = env[binding];
+
+  let token: string;
+  try {
+    if (!secret || typeof secret.get !== 'function') throw new Error('binding absent');
+    token = await secret.get();
+    if (!token) throw new Error('empty secret');
+  } catch {
+    // Deliberately swallow the thrown error rather than surface its message: a
+    // Secrets Store failure must never carry secret material into a log line.
+    return {
+      token: binding,
+      status: null,
+      errorCode: null,
+      ...classifyProbe({ bindingMissing: true }),
+      checkedAt,
+    };
+  }
+
+  let status: number | undefined;
+  let errorCode: string | null = null;
+  let transportError: string | null = null;
+
+  try {
+    const res = await fetchImpl(MERCURY_PROBE_URL, {
+      method: 'GET',
+      headers: {
+        // The token value lives only in this header, for the life of this call.
+        Authorization: `Bearer ${token}`,
+        Accept: 'application/json',
+      },
+      signal: AbortSignal.timeout(MERCURY_PROBE_TIMEOUT_MS),
+    });
+    status = res.status;
+
+    if (res.ok) {
+      // Discard the 2xx body UNREAD — it holds account and routing numbers.
+      // `res.ok` alone is the whole signal we want.
+      await res.body?.cancel().catch(() => undefined);
+    } else {
+      try {
+        errorCode = extractErrorCode(await res.json());
+      } catch {
+        errorCode = null;
+      }
+    }
+  } catch (err) {
+    transportError = err instanceof Error ? err.name : 'unknown';
+  }
+
+  return {
+    token: binding,
+    status: status ?? null,
+    errorCode,
+    ...classifyProbe({ status, errorCode, transportError }),
+    checkedAt,
+  };
+}
+
+/**
+ * Probe all seven concurrently and build the report.
+ *
+ * `allSettled` is belt-and-braces: `probeToken` already resolves on every path, so
+ * a rejection here would be a bug in this module rather than a dead token — but a
+ * single throw must not cost us the other six results.
+ */
+export async function runMercuryTokenKeepalive(
+  env: MercuryKeepaliveEnv,
+  fetchImpl: typeof fetch = fetch,
+): Promise<KeepaliveReport> {
+  const ranAt = new Date().toISOString();
+
+  const settled = await Promise.allSettled(
+    MERCURY_TOKEN_BINDINGS.map((b) => probeToken(b, env, fetchImpl)),
+  );
+
+  const results: ProbeResult[] = settled.map((s, i) => {
+    if (s.status === 'fulfilled') return s.value;
+    return {
+      token: MERCURY_TOKEN_BINDINGS[i],
+      status: null,
+      errorCode: null,
+      ...classifyProbe({ transportError: 'probe threw' }),
+      checkedAt: ranAt,
+    };
+  });
+
+  const counts: Record<Liveness, number> = { alive: 0, dead: 0, indeterminate: 0 };
+  for (const r of results) counts[r.liveness] += 1;
+
+  return { ranAt, probeUrl: MERCURY_PROBE_URL, counts, results };
+}
+
+export const KV_RUN_LATEST = 'mercury:token-probe:run:latest';
+export const kvTokenKey = (binding: string) => `mercury:token-probe:${binding}`;
+export const kvRunKey = (ranAt: string) => `mercury:token-probe:run:${ranAt}`;
+
+/** History retention for dated run snapshots. Per-token latest and the latest run never expire. */
+export const KV_RUN_HISTORY_TTL_SECONDS = 180 * 86400;
+
+/**
+ * Persist the report.
+ *
+ * KV rather than a Neon table, deliberately:
+ *   - `integrations` is the only existing table that is remotely about external
+ *     services, and it is tenant-FK'd (`tenant_id uuid NOT NULL REFERENCES tenants`).
+ *     These seven tokens are keyed by Secrets Store binding name with no tenant
+ *     mapping, so rows would need an invented tenant.
+ *   - A new table means `drizzle-kit push`, which CLAUDE.md records as destructive
+ *     and cutover-coordinated — a disproportionate price for seven rows a day, and
+ *     against the standing startup-mode posture of not entrenching Postgres.
+ *   - FINANCE_KV is already this repo's store for operational state (sessions,
+ *     the inbound-email index, Wave webhook secrets).
+ *   - The operator policy allows KV for "short-lived cache or rotation state".
+ *     Token liveness is rotation state.
+ * Per-token and latest-run keys carry no TTL, so the record is durable.
+ */
+export async function persistKeepaliveReport(
+  report: KeepaliveReport,
+  kv: KVNamespace,
+): Promise<void> {
+  const writes: Promise<unknown>[] = [
+    kv.put(KV_RUN_LATEST, JSON.stringify(report)),
+    kv.put(kvRunKey(report.ranAt), JSON.stringify(report), {
+      expirationTtl: KV_RUN_HISTORY_TTL_SECONDS,
+    }),
+  ];
+
+  for (const r of report.results) {
+    writes.push(kv.put(kvTokenKey(r.token), JSON.stringify(r)));
+  }
+
+  // One failed KV write must not lose the rest of the record.
+  await Promise.allSettled(writes);
+}
+
+/** Read back the last run. `null` means the probe has not run yet on this deployment. */
+export async function readLatestKeepaliveReport(
+  kv: KVNamespace,
+): Promise<KeepaliveReport | null> {
+  const raw = await kv.get(KV_RUN_LATEST);
+  if (!raw) return null;
+  try {
+    return JSON.parse(raw) as KeepaliveReport;
+  } catch {
+    return null;
+  }
+}
+
+/**
+ * Run the probe, persist it, and log a credential-free summary. Used by the
+ * scheduled handler and by the on-demand endpoint.
+ */
+export async function keepaliveAndRecord(
+  env: MercuryKeepaliveEnv,
+  fetchImpl: typeof fetch = fetch,
+): Promise<KeepaliveReport> {
+  const report = await runMercuryTokenKeepalive(env, fetchImpl);
+
+  if (env.FINANCE_KV) {
+    await persistKeepaliveReport(report, env.FINANCE_KV);
+  } else {
+    console.warn('[mercury-keepalive] FINANCE_KV not bound — result not recorded');
+  }
+
+  // Binding names, statuses and error codes only. No token values.
+  console.log(
+    '[mercury-keepalive] complete:',
+    JSON.stringify({ ranAt: report.ranAt, counts: report.counts }),
+  );
+  for (const r of report.results) {
+    console.log(`[mercury-keepalive] ${r.token} ${r.liveness} ${r.reason}`);
+  }
+
+  return report;
+}
diff --git a/server/routes/mercury-tokens.ts b/server/routes/mercury-tokens.ts
new file mode 100644
index 0000000..ba7f9c7
--- /dev/null
+++ b/server/routes/mercury-tokens.ts
@@ -0,0 +1,56 @@
+import { Hono } from 'hono';
+import type { HonoEnv } from '../env';
+import {
+  MERCURY_TOKEN_BINDINGS,
+  keepaliveAndRecord,
+  readLatestKeepaliveReport,
+} from '../lib/mercury-token-keepalive';
+
+/**
+ * Operational/meta routes for the Mercury token keepalive, so liveness is readable
+ * without waiting for the 09:00 UTC cron.
+ *
+ * AUTH — these are gated by `serviceAuth` in server/app.ts, NOT left public.
+ * The /api/v1/* neighbours (`/api/v1/status`, `/api/v1/metrics`,
+ * `/api/v1/documentation`) are all unauthenticated, so "gated the way its
+ * neighbours are" cannot be followed here: an open endpoint enumerating which
+ * banking tokens are alive is an information leak. These carry the same bearer
+ * gate as /api/admin, and deliberately no tenant middleware — the seven bindings
+ * are account-level and have no tenant scope.
+ *
+ * The response carries binding NAMES, statuses, error codes and timestamps. It
+ * never carries a token value.
+ */
+export const mercuryTokenRoutes = new Hono<HonoEnv>();
+
+// GET /api/v1/mercury-tokens — last recorded probe result per entity.
+mercuryTokenRoutes.get('/api/v1/mercury-tokens', async (c) => {
+  const kv = c.env.FINANCE_KV;
+  if (!kv) {
+    return c.json({ error: 'kv_not_configured' }, 500);
+  }
+
+  const report = await readLatestKeepaliveReport(kv);
+  if (!report) {
+    return c.json(
+      {
+        status: 'no_run_recorded',
+        message:
+          'The keepalive has not run on this deployment yet. POST /api/v1/mercury-tokens/probe to run it now, or wait for the 09:00 UTC cron.',
+        tokens: MERCURY_TOKEN_BINDINGS,
+      },
+      200,
+    );
+  }
+
+  return c.json({ status: 'ok', ...report });
+});
+
+// POST /api/v1/mercury-tokens/probe — run the probe now.
+//
+// Read-only against Mercury: one GET /api/v1/accounts?limit=1 per token. The POST
+// verb describes the local side effect (it records a new run), not a Mercury write.
+mercuryTokenRoutes.post('/api/v1/mercury-tokens/probe', async (c) => {
+  const report = await keepaliveAndRecord(c.env);
+  return c.json({ status: 'ok', ...report });
+});
diff --git a/server/worker.ts b/server/worker.ts
index 4105e9e..4079ac2 100644
--- a/server/worker.ts
+++ b/server/worker.ts
@@ -2,6 +2,7 @@ import { createApp } from './app';
 import type { Env } from './env';
 import { processLeaseExpirations } from './lib/lease-expiration';
 import { sendHeartbeat, registerWithDiscovery } from './lib/discovery-client';
+import { keepaliveAndRecord } from './lib/mercury-token-keepalive';
 // Bundled as text by the `Text` rule in wrangler.jsonc / deploy/system-wrangler.jsonc.
 // This import lives here, in the Worker-only entry, and nowhere deeper: server/app.ts is
 // also loaded by `tsx server/dev.ts` and by the esbuild step of `npm run build`, neither
@@ -14,11 +15,31 @@ export default {
   fetch: app.fetch,
 
   async scheduled(controller: ScheduledController, env: Env, ctx: ExecutionContext) {
+    // The two jobs on this cron are isolated from each other: processLeaseExpirations
+    // throws outright when DATABASE_URL is unbound, and the Mercury keepalive must not
+    // be skipped because of it (nor the reverse). allSettled, then report.
+    const [lease, mercury] = await Promise.allSettled([
+      processLeaseExpirations(env),
+      // Mercury API tokens are deleted after 45 days with no call. One read-only
+      // GET /api/v1/accounts per entity keeps them alive and inventories which survived.
+      keepaliveAndRecord(env),
+    ]);
+
     // Lease expiration processing
-    const stats = await processLeaseExpirations(env);
-    console.log('[cron:lease-expiration] complete:', JSON.stringify(stats));
-    if (stats.errors.length > 0) {
-      console.error(`[cron:lease-expiration] ${stats.errors.length} failures during processing`);
+    if (lease.status === 'fulfilled') {
+      const stats = lease.value;
+      console.log('[cron:lease-expiration] complete:', JSON.stringify(stats));
+      if (stats.errors.length > 0) {
+        console.error(`[cron:lease-expiration] ${stats.errors.length} failures during processing`);
+      }
+    } else {
+      console.error('[cron:lease-expiration] failed:', lease.reason instanceof Error ? lease.reason.message : String(lease.reason));
+    }
+
+    // Mercury token keepalive. keepaliveAndRecord already logs per-token outcomes and
+    // resolves on every path, so a rejection here is a bug in that module, not a dead token.
+    if (mercury.status === 'rejected') {
+      console.error('[cron:mercury-keepalive] failed:', mercury.reason instanceof Error ? mercury.reason.message : String(mercury.reason));
     }
 
     // Discovery heartbeat (keeps service marked active)
diff --git a/wrangler.jsonc b/wrangler.jsonc
index 10ac36d..c87406b 100644
--- a/wrangler.jsonc
+++ b/wrangler.jsonc
@@ -40,6 +40,22 @@
     { "name": "EMAIL", "allowed_sender_addresses": ["finance@chitty.cc", "noreply@chitty.cc"] }
   ],
 
+  // Mercury API tokens — one per entity — from the ACCOUNT-LEVEL Cloudflare Secrets
+  // Store. Same store and same binding names as CHITTYOS/chittysecrets/wrangler.json;
+  // because the store is account-level, chittyfinance binds them directly and does not
+  // need the ChittySecrets broker in the path. Consumed by the daily keepalive probe in
+  // server/lib/mercury-token-keepalive.ts — Mercury deletes a token after 45 days with
+  // no API call. Bindings do NOT inherit into env blocks, so each env repeats them.
+  "secrets_store_secrets": [
+    { "binding": "MERCURY_TOKEN_ARIBIA_LLC", "store_id": "e914522471964c3c8cf1e601770edcc3", "secret_name": "MERCURY_TOKEN_ARIBIA_LLC" },
+    { "binding": "MERCURY_TOKEN_ARIBIA_LLC_CITY_STUDIO", "store_id": "e914522471964c3c8cf1e601770edcc3", "secret_name": "MERCURY_TOKEN_ARIBIA_LLC_CITY_STUDIO" },
+    { "binding": "MERCURY_TOKEN_ARIBIA_LLC_APT_ARLENE", "store_id": "e914522471964c3c8cf1e601770edcc3", "secret_name": "MERCURY_TOKEN_ARIBIA_LLC_APT_ARLENE" },
+    { "binding": "MERCURY_TOKEN_CHICAGO_FURNISHED_CONDOS", "store_id": "e914522471964c3c8cf1e601770edcc3", "secret_name": "MERCURY_TOKEN_CHICAGO_FURNISHED_CONDOS" },
+    { "binding": "MERCURY_TOKEN_IT_CAN_BE_LLC", "store_id": "e914522471964c3c8cf1e601770edcc3", "secret_name": "MERCURY_TOKEN_IT_CAN_BE_LLC" },
+    { "binding": "MERCURY_TOKEN_CHITTY_SERVICES", "store_id": "e914522471964c3c8cf1e601770edcc3", "secret_name": "MERCURY_TOKEN_CHITTY_SERVICES" },
+    { "binding": "MERCURY_TOKEN_JEAN_ARLENE_VENTURING", "store_id": "e914522471964c3c8cf1e601770edcc3", "secret_name": "MERCURY_TOKEN_JEAN_ARLENE_VENTURING" }
+  ],
+
   "vars": {
     "MODE": "system",
     "NODE_ENV": "production",
@@ -105,6 +121,16 @@
       "name": "chittyfinance-dev",
       "workers_dev": true,
       "send_email": [{ "name": "EMAIL" }],
+      "secrets_store_secrets": [
+        { "binding": "MERCURY_TOKEN_ARIBIA_LLC", "store_id": "e914522471964c3c8cf1e601770edcc3", "secret_name": "MERCURY_TOKEN_ARIBIA_LLC" },
+        { "binding": "MERCURY_TOKEN_ARIBIA_LLC_CITY_STUDIO", "store_id": "e914522471964c3c8cf1e601770edcc3", "secret_name": "MERCURY_TOKEN_ARIBIA_LLC_CITY_STUDIO" },
+        { "binding": "MERCURY_TOKEN_ARIBIA_LLC_APT_ARLENE", "store_id": "e914522471964c3c8cf1e601770edcc3", "secret_name": "MERCURY_TOKEN_ARIBIA_LLC_APT_ARLENE" },
+        { "binding": "MERCURY_TOKEN_CHICAGO_FURNISHED_CONDOS", "store_id": "e914522471964c3c8cf1e601770edcc3", "secret_name": "MERCURY_TOKEN_CHICAGO_FURNISHED_CONDOS" },
+        { "binding": "MERCURY_TOKEN_IT_CAN_BE_LLC", "store_id": "e914522471964c3c8cf1e601770edcc3", "secret_name": "MERCURY_TOKEN_IT_CAN_BE_LLC" },
+        { "binding": "MERCURY_TOKEN_CHITTY_SERVICES", "store_id": "e914522471964c3c8cf1e601770edcc3", "secret_name": "MERCURY_TOKEN_CHITTY_SERVICES" },
+        { "binding": "MERCURY_TOKEN_JEAN_ARLENE_VENTURING", "store_id": "e914522471964c3c8cf1e601770edcc3", "secret_name": "MERCURY_TOKEN_JEAN_ARLENE_VENTURING" }
+      ],
+
       "vars": {
         "MODE": "system",
         "NODE_ENV": "development",
@@ -127,6 +153,16 @@
     "staging": {
       "name": "chittyfinance-staging",
       "workers_dev": true,
+      "secrets_store_secrets": [
+        { "binding": "MERCURY_TOKEN_ARIBIA_LLC", "store_id": "e914522471964c3c8cf1e601770edcc3", "secret_name": "MERCURY_TOKEN_ARIBIA_LLC" },
+        { "binding": "MERCURY_TOKEN_ARIBIA_LLC_CITY_STUDIO", "store_id": "e914522471964c3c8cf1e601770edcc3", "secret_name": "MERCURY_TOKEN_ARIBIA_LLC_CITY_STUDIO" },
+        { "binding": "MERCURY_TOKEN_ARIBIA_LLC_APT_ARLENE", "store_id": "e914522471964c3c8cf1e601770edcc3", "secret_name": "MERCURY_TOKEN_ARIBIA_LLC_APT_ARLENE" },
+        { "binding": "MERCURY_TOKEN_CHICAGO_FURNISHED_CONDOS", "store_id": "e914522471964c3c8cf1e601770edcc3", "secret_name": "MERCURY_TOKEN_CHICAGO_FURNISHED_CONDOS" },
+        { "binding": "MERCURY_TOKEN_IT_CAN_BE_LLC", "store_id": "e914522471964c3c8cf1e601770edcc3", "secret_name": "MERCURY_TOKEN_IT_CAN_BE_LLC" },
+        { "binding": "MERCURY_TOKEN_CHITTY_SERVICES", "store_id": "e914522471964c3c8cf1e601770edcc3", "secret_name": "MERCURY_TOKEN_CHITTY_SERVICES" },
+        { "binding": "MERCURY_TOKEN_JEAN_ARLENE_VENTURING", "store_id": "e914522471964c3c8cf1e601770edcc3", "secret_name": "MERCURY_TOKEN_JEAN_ARLENE_VENTURING" }
+      ],
+
       "vars": {
         "MODE": "system",
         "NODE_ENV": "staging",
@@ -155,6 +191,16 @@
       "send_email": [
         { "name": "EMAIL", "allowed_sender_addresses": ["finance@chitty.cc", "noreply@chitty.cc"] }
       ],
+      "secrets_store_secrets": [
+        { "binding": "MERCURY_TOKEN_ARIBIA_LLC", "store_id": "e914522471964c3c8cf1e601770edcc3", "secret_name": "MERCURY_TOKEN_ARIBIA_LLC" },
+        { "binding": "MERCURY_TOKEN_ARIBIA_LLC_CITY_STUDIO", "store_id": "e914522471964c3c8cf1e601770edcc3", "secret_name": "MERCURY_TOKEN_ARIBIA_LLC_CITY_STUDIO" },
+        { "binding": "MERCURY_TOKEN_ARIBIA_LLC_APT_ARLENE", "store_id": "e914522471964c3c8cf1e601770edcc3", "secret_name": "MERCURY_TOKEN_ARIBIA_LLC_APT_ARLENE" },
+        { "binding": "MERCURY_TOKEN_CHICAGO_FURNISHED_CONDOS", "store_id": "e914522471964c3c8cf1e601770edcc3", "secret_name": "MERCURY_TOKEN_CHICAGO_FURNISHED_CONDOS" },
+        { "binding": "MERCURY_TOKEN_IT_CAN_BE_LLC", "store_id": "e914522471964c3c8cf1e601770edcc3", "secret_name": "MERCURY_TOKEN_IT_CAN_BE_LLC" },
+        { "binding": "MERCURY_TOKEN_CHITTY_SERVICES", "store_id": "e914522471964c3c8cf1e601770edcc3", "secret_name": "MERCURY_TOKEN_CHITTY_SERVICES" },
+        { "binding": "MERCURY_TOKEN_JEAN_ARLENE_VENTURING", "store_id": "e914522471964c3c8cf1e601770edcc3", "secret_name": "MERCURY_TOKEN_JEAN_ARLENE_VENTURING" }
+      ],
+
       "vars": {
         "MODE": "system",
         "NODE_ENV": "production",