@wtfalch/foundry 0.65.0 → 0.66.0

package/dist/plan/release-host.d.ts

@@ -1,5 +1,7 @@
 import { type ReleaseDeps, type StageCopyJob, type StageCopyOutcome } from '../release/run.js';
+import { type ReleaseSeriesQuery } from '../release/series.js';
 import { type ReleaseStore } from '../release/state.js';
+import type { ReleaseSeries } from '../release/types.js';
 import { type BlueGreenSubject, type PinHeldKeys } from './blue-green.js';
 import { type DeployHealthRuntime } from './deploy-health.js';
 import type { CoolifyPort } from './executor.js';
@@ -18,6 +20,11 @@ export interface ReleaseHost {
     refreshStage(): Promise<void>;
     /** Writes the recorded weights to the balancer on every server that has one. */
     writeWeights(): Promise<void>;
+    /**
+     * Reporting's release series for `entry` (C2), read through the balancer like the health read. Null when
+     * `entry` is not this host's, the entry has no reporting, or the read failed.
+     */
+    readSeries?(entry: string, query: ReleaseSeriesQuery): Promise<ReleaseSeries | null>;
 }
 export interface ReleaseHostInput {
     subject: BlueGreenSubject;
@@ -47,6 +54,27 @@ export interface ReleaseHostInput {
 /** A stage deploy waits at most this many polls of this long (10 minutes) for Coolify's deployment to finish. */
 export declare const STAGE_DEPLOY_ATTEMPTS = 60;
 export declare const STAGE_DEPLOY_INTERVAL_MS = 10000;
+/** What the balancer read of a subject needs: its address, its pin key and its health token. */
+interface SubjectRead {
+    subject: BlueGreenSubject;
+    healthToken: ReleaseHostInput['healthToken'];
+    secret: ReleaseHostInput['secret'];
+    pinRef: string;
+    heldKeys?: PinHeldKeys;
+    fetch?: typeof fetch;
+    renew?: () => Promise<void>;
+    label: string;
+}
+type Recorded = () => Readonly<Record<string, string>>;
+/**
+ * Reporting's release series of one subject (C2), read through the balancer like the health read. Null when the
+ * subject has no reporting, the token is not held, or the read failed. Used by a release run and, outside a run,
+ * by {@link readEntryReleaseSeries}.
+ */
+export declare function readSubjectSeries(read: SubjectRead & {
+    recorded: Recorded;
+    query: ReleaseSeriesQuery;
+}): Promise<ReleaseSeries | null>;
 export declare function createReleaseHost(input: ReleaseHostInput): ReleaseHost;
 /**
  * One release run for one subject, writing into `context` (the live recorded ids of the run that holds
@@ -56,7 +84,7 @@ export declare function createReleaseHost(input: ReleaseHostInput): ReleaseHost;
  * (like the next apply, through its `bluegreen-lb` step) writes it again.
  */
 export declare function runSubjectRelease(input: {
-    store: Pick<ReleaseStore, 'openRequests' | 'consumeRequests'>;
+    store: Pick<ReleaseStore, 'openRequests' | 'consumeRequests'> & Partial<Pick<ReleaseStore, 'appendEvents'>>;
     scopeOwnerId: string;
     subject: BlueGreenSubject;
     host: ReleaseHost;
@@ -90,3 +118,4 @@ export declare function finishStageCopy(input: {
     outcome: StageCopyOutcome;
     refused: string[];
 }>;
+export {};

package/dist/plan/release-host.js

@@ -1,6 +1,7 @@
 import { randomBytes } from 'node:crypto';
 import { checkColorAddress, readReleaseHealth } from '../release/health.js';
 import { runRelease, runStageCopy, settleStageCopy, } from '../release/run.js';
+import { fetchReleaseSeries } from '../release/series.js';
 import { releaseKeys } from '../release/state.js';
 import { applyBlueGreenWeights, copiedEnv } from './blue-green-apply.js';
 import { ACTIONS_KEY_ENV, DEFAULT_WEIGHTS, LB_COLOR_HEADER, LB_PIN_HEADER, bgKey, formatWeights, mintPinKey, parseWeights, readPinKey, reportingEnv, } from './blue-green.js';
@@ -20,6 +21,68 @@ function statusOf(status) {
     return 'other';
 }
 const defaultSleep = (ms) => new Promise((resolve) => setTimeout(resolve, ms));
+const pinInputOf = (read, recorded) => ({
+    id: read.subject.id,
+    ref: read.pinRef,
+    recorded,
+    secret: read.secret,
+    heldKeys: read.heldKeys ?? { resolve: async () => null },
+});
+/**
+ * Where the runner reaches a color: the entry's first public hostname, pinned to the color by the balancer's
+ * header router. The balancer routes the pinned request to that color whatever its weight.
+ */
+async function colorAddress(read, recorded, color) {
+    const hostname = read.subject.hostnames.find((name) => !name.startsWith('*'));
+    if (!hostname)
+        throw new Error(`${read.label}: the app has no public hostname to check through`);
+    const pinKey = await readPinKey(pinInputOf(read, recorded));
+    if (!pinKey)
+        throw new Error(`${read.label}: the balancer's pin key is not held`);
+    return {
+        address: `https://${hostname}`,
+        headers: { [LB_COLOR_HEADER]: color, [LB_PIN_HEADER]: pinKey },
+    };
+}
+/** The color a health read goes to: the one being released, else the live one. */
+function healthColorOf(ids, id) {
+    try {
+        const window = JSON.parse(ids[bgKey.window(id)] ?? '{}');
+        if (window.release?.to === 'blue' || window.release?.to === 'green')
+            return window.release.to;
+    }
+    catch {
+        // A damaged window reads as no release; the runner rewrites it.
+    }
+    return ids[bgKey.live(id)] === 'green' ? 'green' : 'blue';
+}
+/**
+ * Reporting's release series of one subject (C2), read through the balancer like the health read. Null when the
+ * subject has no reporting, the token is not held, or the read failed. Used by a release run and, outside a run,
+ * by {@link readEntryReleaseSeries}.
+ */
+export async function readSubjectSeries(read) {
+    if (!read.subject.reporting)
+        return null;
+    try {
+        await read.renew?.();
+        const token = await read.healthToken();
+        if (!token)
+            return null;
+        read.secret(token);
+        return await fetchReleaseSeries({
+            ...(await colorAddress(read, read.recorded, healthColorOf(read.recorded(), read.subject.id))),
+            token,
+            query: read.query,
+            ...(read.fetch ? { fetchImpl: read.fetch } : {}),
+        });
+    }
+    catch {
+        // No hostname or pin key yet: the page shows no chart. The cause can name a hostname, so it is not logged.
+        console.error(`${read.label}: reading the release series failed`);
+        return null;
+    }
+}
 export function createReleaseHost(input) {
     const { subject, context, coolify } = input;
     const id = subject.id;
@@ -43,41 +106,9 @@ export function createReleaseHost(input) {
     };
     const colorApps = (color) => colorAppsOnServers(color).map((a) => a.appId);
     const primaryColorApp = (color) => color === 'blue' ? input.primaryBlueAppId : recorded()[bgKey.app(id, input.primaryUuid, color)];
-    /**
-     * Where the runner reaches a color: the entry's first public hostname, pinned to the color by the balancer's
-     * header router. The balancer routes the pinned request to that color whatever its weight.
-     */
-    const pinInput = () => ({
-        id,
-        ref: input.pinRef,
-        recorded,
-        secret: input.secret,
-        heldKeys: input.heldKeys ?? { resolve: async () => null },
-    });
-    const addressOf = async (color) => {
-        const hostname = subject.hostnames.find((name) => !name.startsWith('*'));
-        if (!hostname)
-            throw new Error(`${input.label}: the app has no public hostname to check through`);
-        const pinKey = await readPinKey(pinInput());
-        if (!pinKey)
-            throw new Error(`${input.label}: the balancer's pin key is not held`);
-        return {
-            address: `https://${hostname}`,
-            headers: { [LB_COLOR_HEADER]: color, [LB_PIN_HEADER]: pinKey },
-        };
-    };
-    /** The color a health read goes to: the one being released, else the live one. */
-    const healthColor = () => {
-        try {
-            const window = JSON.parse(recorded()[bgKey.window(id)] ?? '{}');
-            if (window.release?.to === 'blue' || window.release?.to === 'green')
-                return window.release.to;
-        }
-        catch {
-            // A damaged window reads as no release; the runner rewrites it.
-        }
-        return recorded()[bgKey.live(id)] === 'green' ? 'green' : 'blue';
-    };
+    const pinInput = () => pinInputOf(input, recorded);
+    const addressOf = (color) => colorAddress(input, recorded, color);
+    const healthColor = () => healthColorOf(recorded(), id);
     const deployTo = async (color, digest) => {
         if (!COMMIT.test(digest))
             throw new Error(`${input.label}: the release is not a built commit`);
@@ -250,6 +281,11 @@ export function createReleaseHost(input) {
     };
     return {
         deps,
+        async readSeries(entry, query) {
+            if (entry !== id)
+                return null;
+            return readSubjectSeries({ ...input, recorded, query });
+        },
         async refreshStage() {
             const stageId = recorded()[bgKey.app(id, input.primaryUuid, 'stage')];
             if (!stageId || !coolify.listApplicationDeployments)
@@ -324,13 +360,7 @@ export async function runSubjectRelease(input) {
     const result = await runRelease({
         store: {
             getScopeIds: async () => ({ ...ids() }),
-            addRequest: async () => {
-                throw new Error('the release runner takes requests; it does not add them');
-            },
             openRequests: (query) => input.store.openRequests(query),
-            consumeRequests: async () => {
-                throw new Error('the release runner consumes requests after it persists');
-            },
         },
         orgId: input.scopeOwnerId,
         entryKey: id,
@@ -347,6 +377,19 @@ export async function runSubjectRelease(input) {
             context.recordScopeId(key, value);
     }
     await context.persist();
+    if (input.store.appendEvents && result.events.length > 0) {
+        try {
+            await input.store.appendEvents({
+                orgId: input.scopeOwnerId,
+                entryKey: id,
+                events: result.events,
+            });
+        }
+        catch {
+            // The history is a record, not a gate: losing a line must not leave the run's requests open to replay.
+            console.error(`release ${id}: recording ${result.events.length} history lines failed`);
+        }
+    }
     await input.store.consumeRequests(result.requestIds);
     const after = parseWeights(ids()[bgKey.weights(id)]);
     // Also when a balancer lags the weights (an earlier write failed), so the next tick retries it.

package/dist/plan/release-series-reader.d.ts

@@ -0,0 +1,26 @@
+import type { ReleaseSeriesQuery } from '../release/series.js';
+import type { ReleaseStore } from '../release/state.js';
+import type { ReleaseSeries } from '../release/types.js';
+import type { DeclaredOrgStore } from '../store.js';
+import { type PinHeldKeys } from './blue-green.js';
+/** What a request needs to read a series outside a release run: what Archon already holds. */
+export interface EntrySeriesDeps {
+    orgs: Pick<DeclaredOrgStore, 'get'>;
+    /** The recorded ids of the org, as the release tick persists them (`createPostgresReleaseStore`). */
+    store: Pick<ReleaseStore, 'getScopeIds'>;
+    /** The held store: reads the entry's health token and the balancer's pin key. */
+    heldKeys: Pick<PinHeldKeys, 'resolve'>;
+    /** Registers a value for redaction before it is used. */
+    secret?: (value: string) => void;
+    fetch?: typeof fetch;
+}
+/**
+ * C2 for a request: the series of one blue/green entry, read the way a release run reads it (the entry's
+ * first public hostname, the colour pin headers, the health token, a 15 s timeout, a 1 MiB cap). Null for an
+ * org or entry that is not declared blue/green, an app without reporting, a token or pin key not held, and any
+ * failed read; a failure logs fixed text only. Never mints and never writes.
+ */
+export declare function readEntryReleaseSeries(deps: EntrySeriesDeps, input: {
+    orgId: string;
+    entryKey: string;
+} & ReleaseSeriesQuery): Promise<ReleaseSeries | null>;

package/dist/plan/release-series-reader.js

@@ -0,0 +1,40 @@
+import { sharedSecretRef } from '../org.js';
+import { blueGreenSubjects, healthTokenName, pinKeyName } from './blue-green.js';
+import { readSubjectSeries } from './release-host.js';
+/**
+ * C2 for a request: the series of one blue/green entry, read the way a release run reads it (the entry's
+ * first public hostname, the colour pin headers, the health token, a 15 s timeout, a 1 MiB cap). Null for an
+ * org or entry that is not declared blue/green, an app without reporting, a token or pin key not held, and any
+ * failed read; a failure logs fixed text only. Never mints and never writes.
+ */
+export async function readEntryReleaseSeries(deps, input) {
+    const label = `coolify:release:${input.entryKey}`;
+    try {
+        const org = await deps.orgs.get(input.orgId);
+        if (!org)
+            return null;
+        const ids = await deps.store.getScopeIds(input.orgId);
+        const subject = blueGreenSubjects(org, ids).find((s) => s.id === input.entryKey);
+        if (!subject)
+            return null;
+        return await readSubjectSeries({
+            subject,
+            recorded: () => ids,
+            healthToken: async () => (await deps.heldKeys.resolve(sharedSecretRef(org.id, healthTokenName(subject.id)))) ?? null,
+            secret: deps.secret ?? (() => undefined),
+            pinRef: sharedSecretRef(org.id, pinKeyName(subject.id)),
+            heldKeys: deps.heldKeys,
+            ...(deps.fetch ? { fetch: deps.fetch } : {}),
+            label,
+            query: {
+                from: input.from,
+                to: input.to,
+                ...(input.bucket !== undefined ? { bucket: input.bucket } : {}),
+            },
+        });
+    }
+    catch {
+        console.error(`${label}: reading the release series failed`);
+        return null;
+    }
+}

package/dist/plan/sign-in-archon.d.ts

@@ -9,7 +9,7 @@ export declare const PLATFORM_ARCHON_IN_APP_SCOPE_KEY = "platform_archon_in_app"
 /** The host a recorded {@link PLATFORM_ARCHON_IN_APP_SCOPE_KEY} names; `''` when none. */
 export declare function archonInAppHost(recorded: Readonly<Record<string, string>>): string;
 /** The ZITADEL calls Archon's in-app sign-in makes, on the owner company's own instance. */
-export type ArchonInAppZitadel = Pick<ZitadelPort, 'ensureTrustedDomain' | 'deleteTrustedDomain' | 'updateOidcAppLoginBaseUri'> & Partial<Pick<ZitadelPort, 'allowPerAppLoginBaseUri'>>;
+export type ArchonInAppZitadel = Pick<ZitadelPort, 'ensureTrustedDomain' | 'deleteTrustedDomain' | 'updateOidcAppLoginBaseUri' | 'listApps'> & Partial<Pick<ZitadelPort, 'allowPerAppLoginBaseUri' | 'listOrgs' | 'listProjects'>>;
 interface ArchonInAppInput {
     zitadel: ArchonInAppZitadel;
     coolify: Pick<CoolifyPort, 'listEnvs' | 'bulkUpsertEnvs' | 'deploy'>;

package/dist/plan/sign-in-archon.js

@@ -1,4 +1,4 @@
-import { isNotFoundError, setOidcAppLoginBaseUri } from './executor.js';
+import { allowPerAppLoginBaseUris, isNotFoundError, setOidcAppLoginBaseUri } from './executor.js';
 import { editSignInBindings } from './sign-in-bindings.js';
 import { SIGN_IN_BASE_PATH } from './sign-in.js';
 /**
@@ -41,7 +41,7 @@ export async function archonInAppPoint(input) {
     if (!zitadel.allowPerAppLoginBaseUri) {
         throw new Error("platform:archon: the owner company's ZITADEL port cannot allow a per-app login base URI, so Archon cannot sign in on its own address");
     }
-    await zitadel.allowPerAppLoginBaseUri(`https://${input.loginHost}/`);
+    await allowPerAppLoginBaseUris(zitadel, `https://${input.loginHost}/`);
     await setOidcAppLoginBaseUri(zitadel, input.organisationId, input.projectId, input.appId, `https://${host}${SIGN_IN_BASE_PATH}/`);
 }
 /** First half of giving the address up: the client goes back to the company's login host. */

package/dist/plan/worker-app-database.d.ts

@@ -18,7 +18,7 @@ export { type DatabaseMigration, MIGRATIONS_ASSET_NAME, WORKER_APP_MIGRATION_TIM
  * database it cannot use:
  * Access app and service token -> tunnel rule and DNS -> `<db>_rt` password -> release
  * `migrations.json` (its sha256 checked against `database.migrationsSha256`) applied with the owner credentials -> runtime role (UPDATE, DELETE and
- * TRUNCATE revoked on `appendOnly`) -> Hyperdrive config with the runtime credentials.
+ * TRUNCATE revoked on `appendOnly`, DELETE and TRUNCATE on `noDelete`) -> Hyperdrive config with the runtime credentials.
  * A failed migration throws, so the Worker is not uploaded.
  */
 /** Everything needed to open a connection to the org's database over the tunnel. */
@@ -75,6 +75,16 @@ export interface WorkerAppDatabasePort extends WorkerAppMigrationRunner<Hyperdri
     }): Promise<void>;
     /** The text of a release asset of a wtfalch repo, or `null` when the release has no such asset. */
     fetchReleaseAsset(url: string): Promise<string | null>;
+    /**
+     * After the runtime role work: the names among `tables` that `user` can still delete from or
+     * truncate (itself, through PUBLIC or through a role it belongs to), or that do not exist.
+     * Optional: without it a `noDelete` list is blocked at plan time.
+     */
+    deletableTables?(input: {
+        owner: HyperdriveOrigin;
+        user: string;
+        tables: string[];
+    }): Promise<string[]>;
 }
 /** The Hyperdrive config, `{name, id}` as JSON. No secret. */
 export declare const workerAppHyperdriveScopeKey: (entryKey: string) => string;
@@ -130,6 +140,7 @@ export declare function applyWorkerAppDatabase(deps: WorkerAppDatabaseDeps, org:
     artifactUrl: string;
     database: {
         appendOnly: string[];
+        noDelete?: string[];
         grants?: string[];
         migrationsSha256?: string;
     };

package/dist/plan/worker-app-database.js

@@ -145,6 +145,19 @@ export async function applyWorkerAppDatabase(deps, org, entry, scriptName, want,
             await context.persistScopeIds();
         },
     });
+    // 5a. `noDelete`: read the role's rights back, so a port that dropped the list cannot pass.
+    const noDelete = want.database.noDelete ?? [];
+    if (noDelete.length > 0) {
+        const read = port.deletableTables;
+        if (!read) {
+            throw new Error(`${at}: the host's database port cannot read the role's rights back (no deletableTables)`);
+        }
+        const open = await call("check the runtime role's rights", () => read.call(port, { owner: ownerOrigin, user: runtimeUser, tables: [...noDelete] }));
+        const named = noDelete.filter((table) => open.includes(table));
+        if (named.length > 0) {
+            throw new Error(`${at}: the runtime role can still delete from ${named.join(', ')} (or the table is missing); the Worker was not deployed`);
+        }
+    }
     // 5b. `uses.audit`: the sealing role, apart from the runtime role, after the audit tables exist.
     if (entry.uses?.audit === true && port.ensureSealerRole) {
         await ensureAuditSealer(deps, org, entry, owner.database, ownerOrigin, at, call, context, put);

package/dist/plan/worker-app.d.ts

@@ -67,6 +67,10 @@ export declare const WORKER_APP_AUTH_KEY_SECRET = "AUTH_APP_KEY";
  * and name are hashed: a held ref is at most 128 characters.
  */
 export declare const workerAppSecretRef: (orgId: string, entryKey: string, name: string) => string;
+/** The version recorded for a `heldSecret` value: a short hash, so a changed value is delivered again. Never the value. */
+export declare const heldSecretVersion: (value: string) => string;
+/** `<entry key>/<NAME>` of a `heldSecret`: how the plan's readiness names it. */
+export declare const heldSecretId: (entryKey: string, name: string) => string;
 /**
  * The Cloudflare calls a Worker app needs. Edge 0.13.0 has none of the Durable
  * Object, migration or container calls, so no adapter ships with this port yet
@@ -97,6 +101,11 @@ export interface WorkerAppPort {
         value: string;
         version: string;
     }[]): Promise<void>;
+    /**
+     * Sets the script's cron triggers to exactly `crons`; an empty list clears them. Safe to repeat.
+     * Edge's `client.platform.workers.setSchedules(name, { crons })`.
+     */
+    setSchedules(name: string, crons: readonly string[]): Promise<void>;
     /** A no-op when the secret is gone. */
     deleteSecret(name: string, secretName: string): Promise<void>;
     /** Creates or updates the container application of `className` on the script; returns its id. */
@@ -155,14 +164,21 @@ export interface WorkerAppWant {
     /** `workerApp.database`: the Hyperdrive binding and the tables the runtime role may only append to, sorted. */
     database?: {
         appendOnly: string[];
+        noDelete?: string[];
         grants?: string[];
         migrationsSha256?: string;
     };
-    /** Secret names and where each comes from, sorted. */
+    /** `workerApp.triggers.crons`, sorted. Absent when none, so a Worker without cron keeps the marker it already has. */
+    crons?: string[];
+    /**
+     * Secret names and where each comes from, sorted. A `heldSecret` is listed only while a value is held,
+     * with the version of that value (a hash, never the value); one with no value is not here.
+     */
     secrets: {
         name: string;
-        source: 'generated' | 'keysCustody';
+        source: 'generated' | 'keysCustody' | 'heldSecret';
         hostId?: string;
+        version?: string;
     }[];
 }
 /** The zone apex the entry's route lives in. */
@@ -174,8 +190,11 @@ export declare const workerAppApex: (org: DeclaredOrg, entry?: HostingEntry) =>
 export declare function wantedWorkerApp(org: DeclaredOrg, entry: HostingEntry, recorded: Readonly<Record<string, string>>, input: {
     issuer: string | null;
     keysUrl?: string;
+    /** `<entry key>/<NAME>` -> version of the value held now, for each `heldSecret` that has one. */
+    heldSecrets?: Readonly<Record<string, string>>;
 }): {
     want: WorkerAppWant;
+    unset: string[];
 } | {
     missing: string[];
 };
@@ -201,6 +220,8 @@ export interface WorkerAppPlanInput {
     canHoldSecrets: boolean;
     /** The sign-in issuer for `authEnv`. */
     issuer: string | null;
+    /** `<entry key>/<NAME>` -> version of the value held now, for each `heldSecret` that has one (names only, never a value). */
+    heldSecrets?: Readonly<Record<string, string>>;
     /** The platform's Cloudflare account id: a container image must live in its registry. */
     registryAccountId?: string;
     /**
@@ -214,6 +235,8 @@ export interface WorkerAppPlanInput {
         tunnelReady: boolean;
         /** The executor has Access, tunnel, DNS and zone ports. */
         accessReady: boolean;
+        /** The port has `deletableTables`, so a `noDelete` list can be proven after the role work. */
+        noDeleteCheck?: boolean;
     };
 }
 /** Every entry key with a deployed or half-deployed Worker app recorded. */
@@ -245,6 +268,8 @@ export interface WorkerAppDeps {
     };
     /** `workerApp.database`: the Hyperdrive port and the route's Cloudflare ports. */
     database?: WorkerAppDatabaseDeps;
+    /** Registers a value for redaction before anything else can see it. */
+    secret?: (value: string) => void;
     /** Test hook: the timeout, in ms. */
     timeoutMs?: number;
 }

package/dist/plan/worker-app.js

@@ -1,5 +1,5 @@
 import { createHash, randomBytes } from 'node:crypto';
-import { APPS_DOMAIN } from '../org.js';
+import { APPS_DOMAIN, heldEnvRef } from '../org.js';
 import { WORKER_APP_KEYS_SECRET, WORKER_APP_KEYS_URL_VAR, workerAppHasBuild, workerAppHostId, } from '../worker-app-config.js';
 import { WORKER_APP_DNS_RECORD, pendingWorkerAppMigrations, strayContainerImage, withCallTimeout, workerAppRegistryPrefix, workerAppShape, workerAppUpload, } from '../worker-app-upload.js';
 import { entryAuthEnv } from './broker-entries.js';
@@ -92,6 +92,10 @@ export const WORKER_APP_AUTH_KEY_SECRET = 'AUTH_APP_KEY';
  */
 export const workerAppSecretRef = (orgId, entryKey, name) => `foundry:worker-app:${orgId}:${createHash('sha256').update(`${entryKey}:${name}`).digest('hex').slice(0, 32)}`;
 const secretVersion = (value) => `g1-${createHash('sha256').update(value).digest('hex').slice(0, 16)}`;
+/** The version recorded for a `heldSecret` value: a short hash, so a changed value is delivered again. Never the value. */
+export const heldSecretVersion = (value) => `h1-${createHash('sha256').update(value).digest('hex').slice(0, 16)}`;
+/** `<entry key>/<NAME>` of a `heldSecret`: how the plan's readiness names it. */
+export const heldSecretId = (entryKey, name) => `${entryKey}/${name}`;
 /** Foundry mints a new credential this long before the held one expires. */
 export const WORKER_APP_CREDENTIAL_RENEW_BEFORE_MS = 30 * 24 * 60 * 60 * 1000;
 /**
@@ -112,8 +116,8 @@ export const workerAppApex = (org, entry) => entry && workspaceWorkerParent(entr
     : org.hosting.usesDomain && org.domain
         ? org.domain
         : WORKER_APP_OIKOS_ZONE;
-/** True when the want has a secret that must be held (a generated one, the broker key, a custody credential). */
-const holdsGenerated = (want) => want.secrets.length > 0;
+/** True when the want has a secret foundry must hold (a generated one, the broker key, a custody credential). A `heldSecret` is the company's: it is only read. */
+const holdsGenerated = (want) => want.secrets.some((s) => s.source !== 'heldSecret');
 /**
  * What the Worker must look like, or the inputs still missing (names only).
  * `issuer` is the sign-in issuer the plan read; `keysUrl` the custody Worker.
@@ -123,8 +127,16 @@ export function wantedWorkerApp(org, entry, recorded, input) {
     const missing = [];
     const vars = { ...app.vars };
     const secrets = [];
+    const unset = [];
     for (const [name, source] of Object.entries(app.secrets ?? {})) {
-        if (source.from === 'keysCustody') {
+        if (source.from === 'heldSecret') {
+            const version = input.heldSecrets?.[heldSecretId(entry.key, name)];
+            if (version)
+                secrets.push({ name, source: 'heldSecret', version });
+            else
+                unset.push(name);
+        }
+        else if (source.from === 'keysCustody') {
             const hostId = workerAppHostId(org.id, entry.key);
             if (input.keysUrl === undefined)
                 missing.push('the keys custody port');
@@ -165,7 +177,9 @@ export function wantedWorkerApp(org, entry, recorded, input) {
     if (missing.length > 0)
         return { missing };
     const shape = workerAppShape(app);
+    const crons = [...(app.triggers?.crons ?? [])].sort();
     return {
+        unset: unset.sort(),
         want: {
             name: workerAppName(org, entry),
             artifactUrl: shape.artifactUrl,
@@ -182,6 +196,9 @@ export function wantedWorkerApp(org, entry, recorded, input) {
                 ? {
                     database: {
                         appendOnly: [...(app.database.appendOnly ?? [])].sort(),
+                        ...(app.database.noDelete?.length
+                            ? { noDelete: [...app.database.noDelete].sort() }
+                            : {}),
                         ...(app.database.grants?.length ? { grants: [...app.database.grants].sort() } : {}),
                         ...(app.database.migrationsSha256
                             ? { migrationsSha256: app.database.migrationsSha256 }
@@ -189,6 +206,7 @@ export function wantedWorkerApp(org, entry, recorded, input) {
                     },
                 }
                 : {}),
+            ...(crons.length > 0 ? { crons } : {}),
             secrets: secrets.sort((a, b) => a.name.localeCompare(b.name)),
         },
     };
@@ -321,7 +339,7 @@ export function planWorkerApps(org, recordedIds, input) {
             block(`${wanted.missing.join(', ')} not recorded yet`);
             continue;
         }
-        const { want } = wanted;
+        const { want, unset } = wanted;
         const stray = strayContainerImage(app, input.registryAccountId);
         if (stray) {
             block(input.registryAccountId === undefined
@@ -345,7 +363,9 @@ export function planWorkerApps(org, recordedIds, input) {
                                     ? `its Access service token ${recordedIds[remoteDatabaseKeys(entry.key).undelivered]} was minted and its secret never held; delete the token in Cloudflare and clear the recorded id before minting again`
                                     : !input.canHoldSecrets
                                         ? 'its database credentials need a held-key store that can put, and the host has none'
-                                        : null;
+                                        : want.database.noDelete?.length && !db.noDeleteCheck
+                                            ? "its noDelete tables need a database port that reads the role's rights back (deletableTables), and the host's has none"
+                                            : null;
             if (why) {
                 block(why);
                 continue;
@@ -381,7 +401,7 @@ export function planWorkerApps(org, recordedIds, input) {
                 desired: { mode: 'apply', ...want },
             },
             step: {
-                description: `${first ? 'deploy' : 'update'} ${at} at ${want.host}${risk}${renew ? ' (renews its keys custody credential, which expires within 30 days)' : ''}`,
+                description: `${first ? 'deploy' : 'update'} ${at} at ${want.host}${risk}${renew ? ' (renews its keys custody credential, which expires within 30 days)' : ''}${unset.length > 0 ? ` (no value is held yet for secret ${unset.join(', ')}: the Worker runs without ${unset.length === 1 ? 'it' : 'them'} until the company adds ${unset.length === 1 ? 'it' : 'them'}, then the next apply sets ${unset.length === 1 ? 'it' : 'them'})` : ''}`,
                 destroys: deletes.length > 0,
                 migrates: renames.length > 0,
             },
@@ -465,6 +485,15 @@ export async function applyWorkerApp(deps, org, action, context) {
     }
     // 2. Secrets: before the route, so the Worker never serves without them.
     await deliverSecrets(deps, org, entryKey, want, context, at, call);
+    // 2b. Cron triggers, once the script and its secrets are there. An empty list clears the ones a
+    // previous apply set; a Worker that never had any makes no call. Idempotent, so a crash here is
+    // repaired by the next apply (the applied marker is not written yet).
+    const crons = want.crons ?? [];
+    const hadCrons = (parseJson(recorded0[workerAppAppliedScopeKey(entryKey)], {}).crons ?? [])
+        .length > 0;
+    if (crons.length > 0 || hadCrons) {
+        await call('set the cron triggers', () => workers.setSchedules(want.name, crons));
+    }
     // 3. Containers.
     await syncContainers(deps, entryKey, want, context, at, call);
     // 4. The record on the org's own zone, 5. the route.
@@ -532,6 +561,22 @@ async function deliverSecrets(deps, org, entryKey, want, context, at, call) {
         if (delivered[secret.name] !== version)
             generated.push({ name: secret.name, value, version });
     }
+    // Held secrets: the company's value, read from the held-key store. The plan found each one held; a
+    // value gone since stops the step, and the error names the ref, never a value.
+    for (const secret of want.secrets) {
+        if (secret.source !== 'heldSecret')
+            continue;
+        const ref = heldEnvRef(org.id, entryKey, secret.name);
+        const value = await call('read a held secret', async () => heldKeys?.resolve(ref));
+        if (!value) {
+            throw new Error(`${at}: held secret ${secret.name} is no longer held (ref ${ref}); the next plan leaves it off the Worker`);
+        }
+        deps.secret?.(value);
+        const version = heldSecretVersion(value);
+        if (delivered[secret.name] !== version) {
+            generated.push({ name: secret.name, value, version });
+        }
+    }
     if (generated.length > 0) {
         await call('deliver secrets', () => workers.setSecrets(want.name, generated));
         for (const { name, version } of generated)

package/dist/plan/workspace.d.ts

@@ -37,8 +37,8 @@ export declare const peopleHash: (emails: readonly string[]) => string;
 export declare function withoutDarkEntries(org: DeclaredOrg): DeclaredOrg;
 /**
  * The org with a second Worker app per Worker-app workspace, keyed `<key>-work`, so the Worker app planner and
- * executor deploy it like any other. The copy has no database and no sign-in env (the workspace gate is its
- * sign-in; a database would be the live one) and is served at the workspace host. `declared` names the org the
+ * executor deploy it like any other. The copy has no database, no sign-in env and no cron triggers (the workspace gate is its
+ * sign-in; a database would be the live one, and a schedule would run its jobs with nothing to run them on) and is served at the workspace host. `declared` names the org the
  * workspaces are read from when `org` has had dark entries removed.
  */
 export declare function withWorkspaceWorkers(org: DeclaredOrg, declared?: DeclaredOrg): DeclaredOrg;

package/dist/plan/workspace.js

@@ -67,8 +67,8 @@ export function withoutDarkEntries(org) {
 }
 /**
  * The org with a second Worker app per Worker-app workspace, keyed `<key>-work`, so the Worker app planner and
- * executor deploy it like any other. The copy has no database and no sign-in env (the workspace gate is its
- * sign-in; a database would be the live one) and is served at the workspace host. `declared` names the org the
+ * executor deploy it like any other. The copy has no database, no sign-in env and no cron triggers (the workspace gate is its
+ * sign-in; a database would be the live one, and a schedule would run its jobs with nothing to run them on) and is served at the workspace host. `declared` names the org the
  * workspaces are read from when `org` has had dark entries removed.
  */
 export function withWorkspaceWorkers(org, declared = org) {
@@ -79,7 +79,7 @@ export function withWorkspaceWorkers(org, declared = org) {
         if (!entry.workspace || !entry.workerApp)
             continue;
         const { workspace: _w, live: _l, hostedName: _h, uses: _u, workerApp, ...rest } = entry;
-        const { database: _d, authEnv: _a, ...app } = workerApp;
+        const { database: _d, authEnv: _a, triggers: _t, ...app } = workerApp;
         const copy = {
             ...rest,
             key: `${entry.key}-work`,

package/dist/release/decide.d.ts

@@ -106,6 +106,8 @@ export interface Decision {
     refused: string[];
     /** The reason a `copy_prod_to_stage` request was refused here, for `bg.<id>.stagecopy`; else null. */
     stageRefusal: string | null;
+    /** The requested actions that took effect, in order (the same objects as `input.actions`). */
+    applied: ReleaseAction[];
 }
 export declare function normalizeSteps(steps: readonly number[] | undefined): number[];
 /** The time a health read should cover: from the step or window start to now. */