@wtfalch/foundry 0.64.0 → 0.66.0

package/dist/apps/cloudflare.d.ts

@@ -51,6 +51,11 @@ export interface AppsCloudflare {
     }[]>;
     putWorkerSecret(name: string, secretName: string, text: string): Promise<void>;
     deleteWorkerSecret(name: string, secretName: string): Promise<void>;
+    /**
+     * Sets the script's cron triggers to exactly `crons`; an empty list clears them. Optional until
+     * providers' client has the call: a deploy that declares crons stops, in words, without it.
+     */
+    setWorkerSchedules?(name: string, crons: string[]): Promise<void>;
     /** The account's `<name>.workers.dev` name, or `undefined` when it has none. */
     getWorkersSubdomain(): Promise<string | undefined>;
     setWorkerScriptSubdomain(name: string, enabled: boolean): Promise<void>;

package/dist/apps/deploy.js

@@ -401,6 +401,21 @@ async function pruneSecrets(ctx, script, secrets) {
         ctx.steps.push(`Removed the old secret ${name}`);
     }
 }
+/**
+ * A live copy's cron triggers are made to match the declaration: set to the list, or cleared when it
+ * is empty. A workspace copy runs no scheduled jobs. A client without the call was refused earlier
+ * when there was a list to set.
+ */
+async function syncSchedules(ctx, script, crons, copy) {
+    if (copy !== 'live')
+        return;
+    const set = ctx.cf.setWorkerSchedules;
+    if (!set)
+        return;
+    await ctx.call('upload', 'set the app’s scheduled jobs', () => set.call(ctx.cf, script, [...crons]));
+    if (crons.length > 0)
+        ctx.steps.push(`Set ${crons.length} scheduled ${crons.length === 1 ? 'job' : 'jobs'}`);
+}
 const containerAppName = (script, className) => `${script}-${className}`.toLowerCase();
 async function waitForRollout(ctx, appId, rolloutId, className) {
     const deadline = Date.now() + (ctx.deps.rolloutTimeoutMs ?? ROLLOUT_TIMEOUT_MS);
@@ -538,7 +553,14 @@ function prepare(input) {
     if (clash)
         throw new Stop('check', `${clash} is both a setting and a secret. Keep only one.`);
     const missing = [];
+    const unset = [];
     for (const [name, source] of Object.entries(app.secrets ?? {})) {
+        if (source.from === 'heldSecret') {
+            // The company's own value: without it the app runs without the secret, it is not a stop.
+            if (!input.secrets[name])
+                unset.push(name);
+            continue;
+        }
         if (!input.secrets[name])
             missing.push(name);
         if (source.from === 'keysCustody' &&
@@ -573,7 +595,10 @@ function prepare(input) {
         script: appScriptName(input.app.key, input.app.copy),
         shape: workerAppShape(app),
         vars: Object.entries(vars).sort(([a], [b]) => a.localeCompare(b)),
-        secrets: { ...input.secrets },
+        // An unset held secret (no value, or an empty one) is never set as an empty secret.
+        secrets: Object.fromEntries(Object.entries(input.secrets).filter(([name]) => !unset.includes(name))),
+        unset: unset.sort(),
+        crons: input.app.copy === 'live' ? [...(app.triggers?.crons ?? [])].sort() : [],
         database,
         migrationsNote: Boolean(app.database?.migrationsSha256),
     };
@@ -649,6 +674,9 @@ export async function deployWorkerApp(input, deps) {
             const parsed = prepared.database;
             hidden.push(parsed.password);
         }
+        if (prepared.crons.length > 0 && !c.cf.setWorkerSchedules) {
+            throw new Stop('check', 'This app runs scheduled jobs, and the connection to your Cloudflare account cannot set them yet. Update Boule, then try again.');
+        }
         const address = await findAddress(c, input.app, script);
         await checkAddressFree(c, address, script);
         const module = await fetchBuild(c, prepared, input.github ?? null);
@@ -691,6 +719,10 @@ export async function deployWorkerApp(input, deps) {
         if (!existing)
             await putSecrets(c, script, prepared.secrets);
         await pruneSecrets(c, script, prepared.secrets);
+        if (prepared.unset.length > 0) {
+            c.steps.push(`No value was given for ${prepared.unset.join(', ')}, so the app runs without ${prepared.unset.length === 1 ? 'it' : 'them'}. Add ${prepared.unset.length === 1 ? 'it' : 'them'} under the app’s settings in Boule and deploy again.`);
+        }
+        await syncSchedules(c, script, prepared.crons, input.app.copy);
         if (!prepared.database)
             await deleteHyperdrive(c, 'database', script);
         await syncContainers(c, script, shape.containers);

package/dist/apps/migrations.d.ts

@@ -36,6 +36,8 @@ export interface ApplyWorkerAppMigrationsInput {
     migrationsSha256?: string | undefined;
     /** build.json's `database.appendOnly`. */
     appendOnly?: string[] | undefined;
+    /** The entry's `database.noDelete`: tables the app's user may not delete from. */
+    noDelete?: string[] | undefined;
     /** build.json's `database.grants`. */
     grants?: string[] | undefined;
 }
@@ -70,6 +72,7 @@ export interface WorkerAppDatabaseRunner extends WorkerAppMigrationRunner<Databa
     runtimeRolePrivileges(owner: DatabaseOwnerAddress, input: {
         user: string;
         appendOnly: string[];
+        noDelete: string[];
         grants: string[];
     }): Promise<RuntimeRolePrivileges>;
     /** Closes every connection the runner has open now, without waiting for the work on it. */

package/dist/apps/migrations.js

@@ -84,11 +84,19 @@ function check(input) {
     if (!Array.isArray(appendOnly) || appendOnly.length > LIST_MAX) {
         throw new Stop('check', `At most ${LIST_MAX} append-only tables.`);
     }
-    for (const table of appendOnly) {
+    const noDelete = input.noDelete ?? [];
+    if (!Array.isArray(noDelete) || noDelete.length > LIST_MAX) {
+        throw new Stop('check', `At most ${LIST_MAX} tables the app may not delete from.`);
+    }
+    for (const table of [...appendOnly, ...noDelete]) {
         if (typeof table !== 'string' || !WORKER_APP_TABLE_NAME.test(table)) {
             throw new Stop('check', `${String(table).slice(0, 80)} is not a table name (letters, digits and _, optionally schema.table).`);
         }
     }
+    const both = noDelete.find((table) => appendOnly.includes(table));
+    if (both) {
+        throw new Stop('check', `${both} is listed as append-only and as no-delete. Append-only already stops deleting; list it once.`);
+    }
     if (!Array.isArray(grants) || grants.length > LIST_MAX) {
         throw new Stop('check', `At most ${LIST_MAX} granted functions.`);
     }
@@ -155,6 +163,7 @@ export async function applyWorkerAppMigrations(input, deps = {}) {
         const ms = deps.timeoutMs ?? CALL_TIMEOUT_MS;
         const ownerAddress = { url: input.ownerUrl };
         const appendOnly = input.appendOnly ?? [];
+        const noDelete = input.noDelete ?? [];
         const grants = input.grants ?? [];
         const call = async (label, task, over) => {
             const step = label.startsWith('apply migration')
@@ -207,6 +216,7 @@ export async function applyWorkerAppMigrations(input, deps = {}) {
         }
         const result = await runWorkerAppMigrations(sql, ownerAddress, input.migrationsJson, {
             appendOnly,
+            noDelete,
             grants,
             ...(input.migrationsSha256 ? { migrationsSha256: input.migrationsSha256 } : {}),
         }, { user: runtime.user, password: runtime.password }, {
@@ -226,8 +236,13 @@ export async function applyWorkerAppMigrations(input, deps = {}) {
             // The only check left after `check`: an applied migration moved or left the file.
             throw new Stop('migrations', 'A database change that already ran is no longer in the same place in migrations.json. Changes are only ever added at the end; restore the file’s earlier order in a new release.');
         });
-        const held = await call('ensure: check the app’s database user', () => sql.runtimeRolePrivileges(ownerAddress, { user: runtime.user, appendOnly, grants }));
-        proveRole(held, appendOnly, grants);
+        const held = await call('ensure: check the app’s database user', () => sql.runtimeRolePrivileges(ownerAddress, {
+            user: runtime.user,
+            appendOnly,
+            noDelete,
+            grants,
+        }));
+        proveRole(held, appendOnly, noDelete, grants);
         if (result.ran.length === 0)
             steps.push('The database already had every change of this build');
         steps.push(`Set up the app’s database user ${runtime.user}`);
@@ -254,7 +269,7 @@ export async function applyWorkerAppMigrations(input, deps = {}) {
 const named = (id) => (id && MIGRATION_ID.test(id) ? ` ${id}` : '');
 const editedMessage = (id) => `The database change${named(id)} was edited after it ran. A change that ran is never edited: add a new one in a new release.`;
 /** The role as read back must be what build.json asks for; else the `role` step fails, naming what. */
-function proveRole(held, appendOnly, grants) {
+function proveRole(held, appendOnly, noDelete, grants) {
     for (const name of appendOnly) {
         const table = held.tables.find((t) => t.name === name);
         if (!table?.exists) {
@@ -264,6 +279,15 @@ function proveRole(held, appendOnly, grants) {
             throw new Stop('role', `The app’s database user can still change or delete rows of ${name}, which build.json says only grows. Write the name in build.json as the table is named, and remove any grant on it to PUBLIC or to a role that user belongs to; then try again.`);
         }
     }
+    for (const name of noDelete) {
+        const table = held.tables.find((t) => t.name === name);
+        if (!table?.exists) {
+            throw new Stop('role', `The table ${name} that may not be deleted from is not in the database after its changes ran. Write it in the app's database settings as the table is named, then try again.`);
+        }
+        if (table.delete || table.truncate) {
+            throw new Stop('role', `The app’s database user can still delete rows of ${name}, which is set to keep its rows. Write the name as the table is named, and remove any grant on it to PUBLIC or to a role that user belongs to; then try again.`);
+        }
+    }
     for (const signature of grants) {
         const fn = held.functions.find((f) => f.signature === signature);
         if (!fn?.exists) {
@@ -375,13 +399,14 @@ export function postgresMigrationRunner() {
                 return row.comment === runtimeRoleMarker(database) ? 'ours' : 'other';
             });
         },
-        async ensureRuntimeRole({ owner, runtime, appendOnly, grants }) {
+        async ensureRuntimeRole({ owner, runtime, appendOnly, noDelete, grants }) {
             const { ensureRuntimeRole } = await import('@wtfalch/db/runtime-role');
             // Not abortable: `@wtfalch/db` opens its own connection. Every statement of it is idempotent.
             await ensureRuntimeRole({
                 ownerUrl: owner.url,
                 runtimeUrl: runtimeUrlFor(owner.url, runtime.user, runtime.password),
                 appendOnly,
+                noDelete,
                 grants,
                 log: () => { },
             });
@@ -393,7 +418,7 @@ export function postgresMigrationRunner() {
                 await db.database.query(`comment on role ${quoted.role} is ${quoted.note}`);
             });
         },
-        async runtimeRolePrivileges({ url }, { user, appendOnly, grants }) {
+        async runtimeRolePrivileges({ url }, { user, appendOnly, noDelete, grants }) {
             return withOwner(url, async (owner) => {
                 // A right the role holds itself, through PUBLIC, or through a role it belongs to (a
                 // NOINHERIT member can still SET ROLE to it).
@@ -403,7 +428,7 @@ export function postgresMigrationRunner() {
             where r.rolname <> $1::name and pg_has_role($1::name, r.oid, 'MEMBER')
               and has_table_privilege(r.oid, c.oid, '${privilege}')))`;
                 const tables = [];
-                for (const name of appendOnly) {
+                for (const name of [...appendOnly, ...noDelete]) {
                     const [row] = await owner.database.query(`select c.oid is not null as exists,
                     coalesce(${holds('UPDATE')}, false) as update,
                     coalesce(${holds('DELETE')}, false) as delete,

package/dist/entry-rules.d.ts

@@ -48,6 +48,17 @@ export declare const WORKER_APP_ENV_NAME: RegExp;
 /** The most tables `database.appendOnly` may name, and the shape of one name (`table` or `schema.table`). */
 export declare const WORKER_APP_APPEND_ONLY_MAX = 100;
 export declare const WORKER_APP_TABLE_NAME: RegExp;
+/** The most tables `database.noDelete` may name; the names follow {@link WORKER_APP_TABLE_NAME}. */
+export declare const WORKER_APP_NO_DELETE_MAX = 100;
 /** The most functions `database.grants` may name, and the shape of one signature. It is spliced into SQL, so nothing else passes. */
 export declare const WORKER_APP_GRANTS_MAX = 100;
 export declare const WORKER_APP_FUNCTION_SIGNATURE: RegExp;
+/** Cloudflare allows at most three cron triggers on one Worker. */
+export declare const WORKER_APP_CRONS_MAX = 3;
+/**
+ * `null` when `expression` is a standard five-field cron (minute hour day-of-month month
+ * day-of-week) built from `*`, numbers, `a-b` ranges, `/step` and comma lists, with month and
+ * weekday names allowed; else a plain sentence that names the field and repeats no more than the
+ * first 40 characters of the input. Cloudflare's extensions (`L`, `W`, `#`) are refused.
+ */
+export declare function workerAppCronProblem(expression: unknown): string | null;

package/dist/entry-rules.js

@@ -66,6 +66,76 @@ export const WORKER_APP_ENV_NAME = /^[A-Z][A-Z0-9_]{0,63}$/;
 /** The most tables `database.appendOnly` may name, and the shape of one name (`table` or `schema.table`). */
 export const WORKER_APP_APPEND_ONLY_MAX = 100;
 export const WORKER_APP_TABLE_NAME = /^[A-Za-z_][A-Za-z0-9_]{0,62}(\.[A-Za-z_][A-Za-z0-9_]{0,62})?$/;
+/** The most tables `database.noDelete` may name; the names follow {@link WORKER_APP_TABLE_NAME}. */
+export const WORKER_APP_NO_DELETE_MAX = 100;
 /** The most functions `database.grants` may name, and the shape of one signature. It is spliced into SQL, so nothing else passes. */
 export const WORKER_APP_GRANTS_MAX = 100;
 export const WORKER_APP_FUNCTION_SIGNATURE = /^[A-Za-z_][A-Za-z0-9_]{0,62}(\.[A-Za-z_][A-Za-z0-9_]{0,62})?\(([a-z][a-z0-9_]*( [a-z][a-z0-9_]*)?(, [a-z][a-z0-9_]*( [a-z][a-z0-9_]*)?)*)?\)$/;
+/** Cloudflare allows at most three cron triggers on one Worker. */
+export const WORKER_APP_CRONS_MAX = 3;
+const MONTH_NAMES = [
+    'JAN',
+    'FEB',
+    'MAR',
+    'APR',
+    'MAY',
+    'JUN',
+    'JUL',
+    'AUG',
+    'SEP',
+    'OCT',
+    'NOV',
+    'DEC',
+];
+const WEEKDAY_NAMES = ['SUN', 'MON', 'TUE', 'WED', 'THU', 'FRI', 'SAT'];
+const CRON_FIELDS = [
+    { name: 'minute', min: 0, max: 59 },
+    { name: 'hour', min: 0, max: 23 },
+    { name: 'day of the month', min: 1, max: 31 },
+    { name: 'month', min: 1, max: 12, names: MONTH_NAMES, first: 1 },
+    { name: 'day of the week', min: 0, max: 7, names: WEEKDAY_NAMES, first: 0 },
+];
+/**
+ * `null` when `expression` is a standard five-field cron (minute hour day-of-month month
+ * day-of-week) built from `*`, numbers, `a-b` ranges, `/step` and comma lists, with month and
+ * weekday names allowed; else a plain sentence that names the field and repeats no more than the
+ * first 40 characters of the input. Cloudflare's extensions (`L`, `W`, `#`) are refused.
+ */
+export function workerAppCronProblem(expression) {
+    if (typeof expression !== 'string')
+        return 'it is not text';
+    const shown = JSON.stringify(expression.slice(0, 40));
+    const fields = expression.split(' ');
+    if (fields.length !== 5 || fields.some((field) => field === '')) {
+        return `${shown} must be five fields separated by single spaces: minute hour day-of-month month day-of-week`;
+    }
+    for (const [index, field] of fields.entries()) {
+        const spec = CRON_FIELDS[index];
+        const value = (token) => {
+            if (/^[0-9]{1,2}$/.test(token)) {
+                const n = Number(token);
+                return n >= spec.min && n <= spec.max ? n : null;
+            }
+            const at = spec.names?.indexOf(token.toUpperCase()) ?? -1;
+            return at >= 0 ? at + (spec.first ?? 0) : null;
+        };
+        for (const item of field.split(',')) {
+            const [base = '', step, extra] = item.split('/');
+            if (extra !== undefined || (step !== undefined && !/^[0-9]{1,2}$/.test(step))) {
+                return `${shown} has a step in the ${spec.name} field that is not a whole number`;
+            }
+            if (step !== undefined && Number(step) < 1) {
+                return `${shown} has a step of 0 in the ${spec.name} field`;
+            }
+            if (base === '*')
+                continue;
+            const [from, to, more] = base.split('-');
+            const a = from === undefined ? null : value(from);
+            const b = to === undefined ? a : value(to);
+            if (more !== undefined || a === null || b === null || a > b) {
+                return `${shown} has a ${spec.name} that is not ${spec.min} to ${spec.max}${spec.names ? ' or a name' : ''}`;
+            }
+        }
+    }
+    return null;
+}

package/dist/index.d.ts

@@ -22,14 +22,18 @@ export { StaleLeaseError } from './store.js';
 export type { PlanApply, DestroyProgress } from './apply.js';
 export { createPostgresAppliedVersionsStore, createPostgresDeclaredOrgStore, createPostgresPlatformStore, createPostgresRequestedChangeStore, DeclaredOrgError, PlatformError, } from './store/postgres.js';
 export { createPostgresAuditLog } from './store/audit.js';
-export type { Color, ReleaseAction, ReleaseSignal, ReleaseState, WindowState, } from './release/types.js';
+export type { Color, ReleaseAction, ReleaseEvent, ReleaseEventKind, ReleaseSeries, ReleaseSeriesColor, ReleaseSignal, ReleaseState, WindowState, } from './release/types.js';
 export type { ReleaseStore } from './release/state.js';
-export { readReleaseState, requestReleaseAction } from './release/state.js';
+export { readReleaseHistory, readReleaseState, requestReleaseAction } from './release/state.js';
+export type { ReleaseSeriesHost, ReleaseSeriesQuery } from './release/series.js';
+export { readReleaseSeries } from './release/series.js';
+export type { EntrySeriesDeps } from './plan/release-series-reader.js';
+export { readEntryReleaseSeries } from './plan/release-series-reader.js';
 export type { DeclaredClassRemoval, MigrationCompatibilityInput, MigrationCompatibilityProblem, MigrationCompatibilityResult, } from './release/migration-compatibility.js';
 export { checkMigrationCompatibility } from './release/migration-compatibility.js';
 export { createPostgresReleaseStore } from './store/postgres.js';
 export type { FoundryStoreDb } from './store/postgres.js';
-export { declaredOrgs, foundryAppliedState, foundryAppliedVersions, foundryAuditEvents, foundryDeclaredPlatform, foundryReleaseRequests, foundryRequestedChanges, type AuditEventRow, type DeclaredOrgRow, type NewDeclaredOrgRow, type AppliedStateRow, type NewAppliedStateRow, type AppliedVersionRow, type NewAppliedVersionRow, type DeclaredPlatformRow, type NewDeclaredPlatformRow, type RequestedChangeRow, type NewRequestedChangeRow, } from './store/schema.js';
+export { declaredOrgs, foundryAppliedState, foundryAppliedVersions, foundryAuditEvents, foundryDeclaredPlatform, foundryReleaseEvents, foundryReleaseRequests, foundryRequestedChanges, type AuditEventRow, type DeclaredOrgRow, type NewDeclaredOrgRow, type AppliedStateRow, type NewAppliedStateRow, type AppliedVersionRow, type NewAppliedVersionRow, type DeclaredPlatformRow, type NewDeclaredPlatformRow, type RequestedChangeRow, type NewRequestedChangeRow, } from './store/schema.js';
 export type { LiveResource, ZitadelReader, CoolifyReader, CloudflareReader, FilesReader, AiReader, CmsReader, LiveReaders, PlatformCloudflareReader, PlatformCoolifyReader, PlatformLiveReaders, StepAction, PlannedStep, StepSystem, PlanDetail, OrgPostgresPlan, PlatformPlanDetail, MailRoute, AdoptCandidate, AdoptInput, AdoptPlan, AdoptSnapshot, AuditActor, AuditLog, AuthzGate, StepExecutor, StepDestroyer, DestroyTarget, StepExecutionContext, PlatformStepExecutor, PlatformStepExecutionContext, FoundryPlanApplyOptions, FoundryApplyOptions, UnconfirmedUpgrade, } from './plan/index.js';
 export { COMPANY_DESTINATION_NAME_PREFIX, COMPANY_NETWORKS, DEFAULT_MAX_DESTINATIONS, DestinationCapacityError, PLATFORM_NETWORK, companyNetworkName, ensureDestination, findDestination, placed, placedOnPlatform, validateNetworkName, } from './plan/index.js';
 export { AdoptRefusedError } from './plan/index.js';

package/dist/index.js

@@ -14,10 +14,12 @@ export { NATIVE_BUILD_REPO, NATIVE_BUILD_WORKFLOW_FILE, NATIVE_BUILD_WORKFLOW_RE
 export { StaleLeaseError } from './store.js';
 export { createPostgresAppliedVersionsStore, createPostgresDeclaredOrgStore, createPostgresPlatformStore, createPostgresRequestedChangeStore, DeclaredOrgError, PlatformError, } from './store/postgres.js';
 export { createPostgresAuditLog } from './store/audit.js';
-export { readReleaseState, requestReleaseAction } from './release/state.js';
+export { readReleaseHistory, readReleaseState, requestReleaseAction } from './release/state.js';
+export { readReleaseSeries } from './release/series.js';
+export { readEntryReleaseSeries } from './plan/release-series-reader.js';
 export { checkMigrationCompatibility } from './release/migration-compatibility.js';
 export { createPostgresReleaseStore } from './store/postgres.js';
-export { declaredOrgs, foundryAppliedState, foundryAppliedVersions, foundryAuditEvents, foundryDeclaredPlatform, foundryReleaseRequests, foundryRequestedChanges, } from './store/schema.js';
+export { declaredOrgs, foundryAppliedState, foundryAppliedVersions, foundryAuditEvents, foundryDeclaredPlatform, foundryReleaseEvents, foundryReleaseRequests, foundryRequestedChanges, } from './store/schema.js';
 export { COMPANY_DESTINATION_NAME_PREFIX, COMPANY_NETWORKS, DEFAULT_MAX_DESTINATIONS, DestinationCapacityError, PLATFORM_NETWORK, companyNetworkName, ensureDestination, findDestination, placed, placedOnPlatform, validateNetworkName, } from './plan/index.js';
 export { AdoptRefusedError } from './plan/index.js';
 export { DumpError, dumpNow } from './plan/index.js';

package/dist/migrations/0069_release_events.sql

@@ -0,0 +1,16 @@
+-- @wtfalch/foundry: a release's history, one line per step, check, action and outcome, written by the
+-- release run. Append-only: nothing in the package updates or deletes a row. Additive: a new table, no
+-- existing row touched. Copies 0055_release_requests.sql (no foreign key, because `org_id` may be
+-- `platform`). Mirrors src/store/schema.ts's `foundryReleaseEvents`.
+
+create table if not exists foundry_release_events (
+  id        bigserial primary key,
+  org_id    text not null,
+  entry_key text not null,
+  at        timestamptz not null,
+  kind      text not null,
+  payload   jsonb not null default '{}'::jsonb
+);
+
+create index if not exists foundry_release_events_entry_idx
+  on foundry_release_events (org_id, entry_key, at desc, id desc);

package/dist/modules/database.js

@@ -1,4 +1,4 @@
-import { WORKER_APP_APPEND_ONLY_MAX, WORKER_APP_FUNCTION_SIGNATURE, WORKER_APP_GRANTS_MAX, WORKER_APP_TABLE_NAME, } from '../entry-rules.js';
+import { WORKER_APP_APPEND_ONLY_MAX, WORKER_APP_FUNCTION_SIGNATURE, WORKER_APP_GRANTS_MAX, WORKER_APP_NO_DELETE_MAX, WORKER_APP_TABLE_NAME, } from '../entry-rules.js';
 import { clone, list, omit, problem, withWorkerApp } from './entry-parts.js';
 const ADDRESS_HELP = 'From your Postgres provider. The owner can change tables; the app address is a separate user with less access. Use a different database for the workspace than for live.';
 const ADDRESS_MAX = 2000;
@@ -112,6 +112,15 @@ export const database = {
                 pattern: WORKER_APP_TABLE_NAME.source,
                 max: WORKER_APP_APPEND_ONLY_MAX,
             },
+            {
+                key: 'noDelete',
+                label: 'Tables the app cannot delete from',
+                help: 'We stop the app from deleting rows in these tables. It can still add, read and change them, and it clears old rows through a database function you allow below. Only for apps that run as a Worker app.',
+                kind: 'list',
+                advanced: true,
+                pattern: WORKER_APP_TABLE_NAME.source,
+                max: WORKER_APP_NO_DELETE_MAX,
+            },
             {
                 key: 'grants',
                 label: 'Database functions the app may run',
@@ -132,13 +141,18 @@ export const database = {
     },
     check(values, _modules, ctx) {
         if (ctx.runtime === 'server') {
-            for (const key of ['appendOnly', 'grants']) {
+            for (const key of ['appendOnly', 'noDelete', 'grants']) {
                 if (list(values, key) !== undefined) {
-                    return problem(key, 'Tables that keep every row and database functions can only be set for an app that runs as a Worker app.');
+                    return problem(key, 'Table protections and database functions can only be set for an app that runs as a Worker app.');
                 }
             }
             return null;
         }
+        const kept = list(values, 'appendOnly') ?? [];
+        const both = (list(values, 'noDelete') ?? []).find((table) => kept.includes(table));
+        if (both) {
+            return problem('noDelete', `${both} is already in the tables that keep every row, which also stops deleting. Keep it in one list.`);
+        }
         const workspace = readCopy(values, 'workspace');
         if (workspace && 'message' in workspace)
             return workspace;
@@ -161,9 +175,12 @@ export const database = {
                 return omit(app, 'database');
             const next = {};
             const appendOnly = list(values, 'appendOnly');
+            const noDelete = list(values, 'noDelete');
             const grants = list(values, 'grants');
             if (appendOnly)
                 next.appendOnly = appendOnly;
+            if (noDelete)
+                next.noDelete = noDelete;
             if (grants)
                 next.grants = grants;
             const pinned = app.database?.migrationsSha256;
@@ -180,6 +197,8 @@ export const database = {
             const values = {};
             if (db.appendOnly?.length)
                 values.appendOnly = [...db.appendOnly];
+            if (db.noDelete?.length)
+                values.noDelete = [...db.noDelete];
             if (db.grants?.length)
                 values.grants = [...db.grants];
             return values;

package/dist/native-build.d.ts

@@ -3,18 +3,18 @@
  * builds and signs a company's native app shell (estate
  * `.plans/2026-10-22-app-shells.md`). Boule now owns the `NativeAppConfig`,
  * the build runs and the company's store keys (estate#262, foundry#951);
- * foundry keeps only two things, both in this file: dispatching the
- * workflow, and the key Boule presents when it asks the host (Archon) to
- * dispatch it.
+ * foundry keeps only the dispatch, in this file.
  *
- * `dispatchNativeBuild` runs inside Archon's own `/api/native/builds`
- * route, not foundry's apply loop. The key itself is minted by
- * `plan/executor.ts`'s `coolifyBoule` (`ensureNativeBuildKey`), reusing the
- * same `mintIfAbsent` path every other per-company Boule secret goes
- * through (foundry#970) -- this file keeps only the env name and the byte
- * length, not a second mint function (foundry#957 review note 2 and
- * thermo note 1: the earlier `mintNativeBuildKey` was a third, buggy copy
- * of that same check).
+ * `dispatchNativeBuild` runs inside Archon's own `/api/orgs/{orgId}/native/builds`
+ * route, not foundry's apply loop.
+ *
+ * `NATIVE_BUILD_KEY_ENV` and `NATIVE_BUILD_KEY_BYTES` are deprecated
+ * (foundry#987): Archon's route now checks the company's own org credential
+ * instead (archon#706, boule#432), so nothing mints, delivers or reads
+ * `NATIVE_BUILD_KEY` any more -- `plan/executor.ts`'s `coolifyBoule` takes
+ * the env row away from any Boule that still has one from #970/#971. Both
+ * constants are kept one release for the two-release removal rule and go in
+ * the next.
  */
 export declare const NATIVE_BUILD_REPO = "wtfalch/shell";
 export declare const NATIVE_BUILD_WORKFLOW_FILE = "build-app.yml";
@@ -45,6 +45,10 @@ export declare function dispatchNativeBuild(deps: NativeBuildDispatchDeps, run:
     runId: string;
     origin: string;
 }): Promise<void>;
-/** The env name Boule presents this key under, to Archon's native-build route. */
+/**
+ * @deprecated foundry#987: Archon's native-build route checks the company's own org credential
+ * now, not this key. Nothing mints, delivers or reads it any more. Removed in the next release.
+ */
 export declare const NATIVE_BUILD_KEY_ENV = "NATIVE_BUILD_KEY";
+/** @deprecated foundry#987: goes with {@link NATIVE_BUILD_KEY_ENV}. */
 export declare const NATIVE_BUILD_KEY_BYTES = 32;

package/dist/native-build.js

@@ -3,18 +3,18 @@
  * builds and signs a company's native app shell (estate
  * `.plans/2026-10-22-app-shells.md`). Boule now owns the `NativeAppConfig`,
  * the build runs and the company's store keys (estate#262, foundry#951);
- * foundry keeps only two things, both in this file: dispatching the
- * workflow, and the key Boule presents when it asks the host (Archon) to
- * dispatch it.
+ * foundry keeps only the dispatch, in this file.
  *
- * `dispatchNativeBuild` runs inside Archon's own `/api/native/builds`
- * route, not foundry's apply loop. The key itself is minted by
- * `plan/executor.ts`'s `coolifyBoule` (`ensureNativeBuildKey`), reusing the
- * same `mintIfAbsent` path every other per-company Boule secret goes
- * through (foundry#970) -- this file keeps only the env name and the byte
- * length, not a second mint function (foundry#957 review note 2 and
- * thermo note 1: the earlier `mintNativeBuildKey` was a third, buggy copy
- * of that same check).
+ * `dispatchNativeBuild` runs inside Archon's own `/api/orgs/{orgId}/native/builds`
+ * route, not foundry's apply loop.
+ *
+ * `NATIVE_BUILD_KEY_ENV` and `NATIVE_BUILD_KEY_BYTES` are deprecated
+ * (foundry#987): Archon's route now checks the company's own org credential
+ * instead (archon#706, boule#432), so nothing mints, delivers or reads
+ * `NATIVE_BUILD_KEY` any more -- `plan/executor.ts`'s `coolifyBoule` takes
+ * the env row away from any Boule that still has one from #970/#971. Both
+ * constants are kept one release for the two-release removal rule and go in
+ * the next.
  */
 export const NATIVE_BUILD_REPO = 'wtfalch/shell';
 export const NATIVE_BUILD_WORKFLOW_FILE = 'build-app.yml';
@@ -67,6 +67,10 @@ export async function dispatchNativeBuild(deps, run) {
     if (!response.ok)
         throw new NativeBuildDispatchError(response.status);
 }
-/** The env name Boule presents this key under, to Archon's native-build route. */
+/**
+ * @deprecated foundry#987: Archon's native-build route checks the company's own org credential
+ * now, not this key. Nothing mints, delivers or reads it any more. Removed in the next release.
+ */
 export const NATIVE_BUILD_KEY_ENV = 'NATIVE_BUILD_KEY';
+/** @deprecated foundry#987: goes with {@link NATIVE_BUILD_KEY_ENV}. */
 export const NATIVE_BUILD_KEY_BYTES = 32;

package/dist/plan/boule.js

@@ -177,6 +177,8 @@ export const BOULE_MANAGED_ENV_KEYS = [
     BOULE_PEER_PASSWORD_ENV,
     BOULE_BRIDGE_SECRET_ENV,
     BOULE_OWNER_SEED_SECRET_ENV,
+    // Deprecated (foundry#987): kept in the list so the live reader still sees it, which is how
+    // `planBoule` finds a stale one to take away. Goes with `NATIVE_BUILD_KEY_ENV` next release.
     NATIVE_BUILD_KEY_ENV,
     BOULE_ARCHON_ORG_ID_ENV,
     BOULE_ARCHON_CREDENTIAL_ENV,

package/dist/plan/diff.d.ts

@@ -85,6 +85,8 @@ export interface PlanOrgOptions {
     keysRegistrarUrl?: string;
     /** C2: true when the executor was built with a `WorkerAppDatabasePort`; a `workerApp.database` is blocked without it. */
     workerAppDatabase?: boolean;
+    /** True when that port has `deletableTables`; a `workerApp.database.noDelete` is blocked without it. */
+    workerAppNoDeleteCheck?: boolean;
     /** ADR 0002: the platform's Cloudflare account id; a container image must live in its registry. */
     workerAppRegistryAccountId?: string;
     /** The executor was built with an `ownerInviteMail` port; without it each owner's invite is blocked. */

package/dist/plan/diff.js

@@ -30,7 +30,7 @@ import { planKeysRegistrar } from './keys-registrar.js';
 import { desiredKosmosEnv, kosmosEnvDrift } from './kosmos.js';
 import { APP_GONE_KIND } from './live.js';
 import { lockedHostnames } from './locked-hostnames.js';
-import { LOGIN_BINDING_SCOPE_KEY, LOGIN_CLIENT_ORGS_SCOPE_KEY, OWN_CUSTOMERS_BASE_URI_SCOPE_KEY, agoraIssuerHostFor, clientOrganizationsState, companyLoginTunnelHost, customersClientOrganizations, inAppApps, loginBindingState, loginHostClientIds, loginHostServesAgora, loginHostnameFor, ownAuthApplied, ownCustomersAppState, pendingRemovalHosts, } from './login-host.js';
+import { LOGIN_BASE_URI_SWEEP_SCOPE_KEY, LOGIN_BASE_URI_SWEEP_VERSION, LOGIN_BINDING_SCOPE_KEY, LOGIN_CLIENT_ORGS_SCOPE_KEY, OWN_CUSTOMERS_BASE_URI_SCOPE_KEY, agoraIssuerHostFor, clientOrganizationsState, companyLoginTunnelHost, customersClientOrganizations, inAppApps, loginBindingState, loginHostClientIds, loginHostServesAgora, loginHostnameFor, ownAuthApplied, ownCustomersAppState, pendingRemovalHosts, } from './login-host.js';
 import { planMachineBypasses } from './machine-paths.js';
 import { MAIL_COPY_COMPLETED_SCOPE_KEY, MAIL_COPY_DONE_SCOPE_KEY, parseMailCopyCompleted, } from './mail-copy.js';
 import { mailStoreSwitchChange } from './mail-store.js';
@@ -835,6 +835,9 @@ export function computePlanDetail(declaredOrg, live, recordedIds = {}, agoraHost
             : {}),
         canHoldSecrets: platformReadiness.canHoldSecrets === true,
         issuer: authIssuer,
+        ...(platformReadiness.workerAppSecrets
+            ? { heldSecrets: platformReadiness.workerAppSecrets }
+            : {}),
         ...(options.workerAppDatabase
             ? {
                 database: {
@@ -844,6 +847,7 @@ export function computePlanDetail(declaredOrg, live, recordedIds = {}, agoraHost
                     tunnelReady: Boolean(recordedIds[`cloudflare:tunnel:${org.id}`]) ||
                         plannedSteps.some((s) => s.action.system === 'cloudflare' && s.action.kind === 'tunnel'),
                     accessReady: edgeNeeded(platformReadiness, ['access', 'tunnels', 'dns', 'zones']) === null,
+                    noDeleteCheck: options.workerAppNoDeleteCheck === true,
                 },
             }
             : {}),
@@ -1627,7 +1631,14 @@ function planOwnLoginHost(org, recordedIds, gates) {
     const customersOwed = Boolean(recordedIds[SIGN_IN_LOGIN_APP_SCOPE_KEY]) &&
         ownCustomersAppState(org, recordedIds) !==
             (recordedIds[OWN_CUSTOMERS_BASE_URI_SCOPE_KEY] ?? '');
-    if (!inAppSignIn(org) && !recordedIds[SIGN_IN_IN_APP_SCOPE_KEY] && !mapOwed && !customersOwed) {
+    // With in-app sign-in applied `loginV2.required` is off: every app of the instance owes a base URI until swept.
+    const sweepOwed = Boolean(recordedIds[SIGN_IN_IN_APP_SCOPE_KEY]) &&
+        recordedIds[LOGIN_BASE_URI_SWEEP_SCOPE_KEY] !== LOGIN_BASE_URI_SWEEP_VERSION;
+    if (!inAppSignIn(org) &&
+        !recordedIds[SIGN_IN_IN_APP_SCOPE_KEY] &&
+        !mapOwed &&
+        !customersOwed &&
+        !sweepOwed) {
         return none;
     }
     // The company's own sign-in is reported on its own line (`coolify:own-auth`).
@@ -1646,6 +1657,7 @@ function planOwnLoginHost(org, recordedIds, gates) {
         (recordedIds[SIGN_IN_IN_APP_SCOPE_KEY] ?? '') === targets.active &&
         !mapOwed &&
         !customersOwed &&
+        !sweepOwed &&
         pendingRemovalHosts(recordedIds).length === 0) {
         return { step: null, blocked: waiting };
     }
@@ -3388,7 +3400,9 @@ function planBoule(org, byKey, claimed, recordedIds, issuer, otherSlugs, archonU
         drift.push(BOULE_BRIDGE_SECRET_ENV);
     if (!liveEnv[BOULE_OWNER_SEED_SECRET_ENV])
         drift.push(BOULE_OWNER_SEED_SECRET_ENV);
-    if (!liveEnv[NATIVE_BUILD_KEY_ENV])
+    // foundry#987: nothing reads this any more (Boule calls Archon's org build route with its
+    // own org credential instead). A live one is drift, so the step removes it rather than minting it.
+    if (liveEnv[NATIVE_BUILD_KEY_ENV])
         drift.push(NATIVE_BUILD_KEY_ENV);
     // Secrets written but Boule not restarted since: plan the step so it restarts, minting nothing.
     if (platformOwner && !recordedIds[BOULE_SECRETS_RESTARTED_SCOPE_KEY]) {