@wtfalch/foundry 0.65.0 → 0.67.0

package/dist/plan/release-host.d.ts

@@ -1,5 +1,7 @@
 import { type ReleaseDeps, type StageCopyJob, type StageCopyOutcome } from '../release/run.js';
+import { type ReleaseSeriesQuery } from '../release/series.js';
 import { type ReleaseStore } from '../release/state.js';
+import type { ReleaseSeries } from '../release/types.js';
 import { type BlueGreenSubject, type PinHeldKeys } from './blue-green.js';
 import { type DeployHealthRuntime } from './deploy-health.js';
 import type { CoolifyPort } from './executor.js';
@@ -18,6 +20,11 @@ export interface ReleaseHost {
     refreshStage(): Promise<void>;
     /** Writes the recorded weights to the balancer on every server that has one. */
     writeWeights(): Promise<void>;
+    /**
+     * Reporting's release series for `entry` (C2), read through the balancer like the health read. Null when
+     * `entry` is not this host's, the entry has no reporting, or the read failed.
+     */
+    readSeries?(entry: string, query: ReleaseSeriesQuery): Promise<ReleaseSeries | null>;
 }
 export interface ReleaseHostInput {
     subject: BlueGreenSubject;
@@ -47,6 +54,27 @@ export interface ReleaseHostInput {
 /** A stage deploy waits at most this many polls of this long (10 minutes) for Coolify's deployment to finish. */
 export declare const STAGE_DEPLOY_ATTEMPTS = 60;
 export declare const STAGE_DEPLOY_INTERVAL_MS = 10000;
+/** What the balancer read of a subject needs: its address, its pin key and its health token. */
+interface SubjectRead {
+    subject: BlueGreenSubject;
+    healthToken: ReleaseHostInput['healthToken'];
+    secret: ReleaseHostInput['secret'];
+    pinRef: string;
+    heldKeys?: PinHeldKeys;
+    fetch?: typeof fetch;
+    renew?: () => Promise<void>;
+    label: string;
+}
+type Recorded = () => Readonly<Record<string, string>>;
+/**
+ * Reporting's release series of one subject (C2), read through the balancer like the health read. Null when the
+ * subject has no reporting, the token is not held, or the read failed. Used by a release run and, outside a run,
+ * by {@link readEntryReleaseSeries}.
+ */
+export declare function readSubjectSeries(read: SubjectRead & {
+    recorded: Recorded;
+    query: ReleaseSeriesQuery;
+}): Promise<ReleaseSeries | null>;
 export declare function createReleaseHost(input: ReleaseHostInput): ReleaseHost;
 /**
  * One release run for one subject, writing into `context` (the live recorded ids of the run that holds
@@ -56,7 +84,7 @@ export declare function createReleaseHost(input: ReleaseHostInput): ReleaseHost;
  * (like the next apply, through its `bluegreen-lb` step) writes it again.
  */
 export declare function runSubjectRelease(input: {
-    store: Pick<ReleaseStore, 'openRequests' | 'consumeRequests'>;
+    store: Pick<ReleaseStore, 'openRequests' | 'consumeRequests'> & Partial<Pick<ReleaseStore, 'appendEvents'>>;
     scopeOwnerId: string;
     subject: BlueGreenSubject;
     host: ReleaseHost;
@@ -90,3 +118,4 @@ export declare function finishStageCopy(input: {
     outcome: StageCopyOutcome;
     refused: string[];
 }>;
+export {};

package/dist/plan/release-host.js

@@ -1,6 +1,7 @@
 import { randomBytes } from 'node:crypto';
 import { checkColorAddress, readReleaseHealth } from '../release/health.js';
 import { runRelease, runStageCopy, settleStageCopy, } from '../release/run.js';
+import { fetchReleaseSeries } from '../release/series.js';
 import { releaseKeys } from '../release/state.js';
 import { applyBlueGreenWeights, copiedEnv } from './blue-green-apply.js';
 import { ACTIONS_KEY_ENV, DEFAULT_WEIGHTS, LB_COLOR_HEADER, LB_PIN_HEADER, bgKey, formatWeights, mintPinKey, parseWeights, readPinKey, reportingEnv, } from './blue-green.js';
@@ -20,6 +21,68 @@ function statusOf(status) {
     return 'other';
 }
 const defaultSleep = (ms) => new Promise((resolve) => setTimeout(resolve, ms));
+const pinInputOf = (read, recorded) => ({
+    id: read.subject.id,
+    ref: read.pinRef,
+    recorded,
+    secret: read.secret,
+    heldKeys: read.heldKeys ?? { resolve: async () => null },
+});
+/**
+ * Where the runner reaches a color: the entry's first public hostname, pinned to the color by the balancer's
+ * header router. The balancer routes the pinned request to that color whatever its weight.
+ */
+async function colorAddress(read, recorded, color) {
+    const hostname = read.subject.hostnames.find((name) => !name.startsWith('*'));
+    if (!hostname)
+        throw new Error(`${read.label}: the app has no public hostname to check through`);
+    const pinKey = await readPinKey(pinInputOf(read, recorded));
+    if (!pinKey)
+        throw new Error(`${read.label}: the balancer's pin key is not held`);
+    return {
+        address: `https://${hostname}`,
+        headers: { [LB_COLOR_HEADER]: color, [LB_PIN_HEADER]: pinKey },
+    };
+}
+/** The color a health read goes to: the one being released, else the live one. */
+function healthColorOf(ids, id) {
+    try {
+        const window = JSON.parse(ids[bgKey.window(id)] ?? '{}');
+        if (window.release?.to === 'blue' || window.release?.to === 'green')
+            return window.release.to;
+    }
+    catch {
+        // A damaged window reads as no release; the runner rewrites it.
+    }
+    return ids[bgKey.live(id)] === 'green' ? 'green' : 'blue';
+}
+/**
+ * Reporting's release series of one subject (C2), read through the balancer like the health read. Null when the
+ * subject has no reporting, the token is not held, or the read failed. Used by a release run and, outside a run,
+ * by {@link readEntryReleaseSeries}.
+ */
+export async function readSubjectSeries(read) {
+    if (!read.subject.reporting)
+        return null;
+    try {
+        await read.renew?.();
+        const token = await read.healthToken();
+        if (!token)
+            return null;
+        read.secret(token);
+        return await fetchReleaseSeries({
+            ...(await colorAddress(read, read.recorded, healthColorOf(read.recorded(), read.subject.id))),
+            token,
+            query: read.query,
+            ...(read.fetch ? { fetchImpl: read.fetch } : {}),
+        });
+    }
+    catch {
+        // No hostname or pin key yet: the page shows no chart. The cause can name a hostname, so it is not logged.
+        console.error(`${read.label}: reading the release series failed`);
+        return null;
+    }
+}
 export function createReleaseHost(input) {
     const { subject, context, coolify } = input;
     const id = subject.id;
@@ -43,41 +106,9 @@ export function createReleaseHost(input) {
     };
     const colorApps = (color) => colorAppsOnServers(color).map((a) => a.appId);
     const primaryColorApp = (color) => color === 'blue' ? input.primaryBlueAppId : recorded()[bgKey.app(id, input.primaryUuid, color)];
-    /**
-     * Where the runner reaches a color: the entry's first public hostname, pinned to the color by the balancer's
-     * header router. The balancer routes the pinned request to that color whatever its weight.
-     */
-    const pinInput = () => ({
-        id,
-        ref: input.pinRef,
-        recorded,
-        secret: input.secret,
-        heldKeys: input.heldKeys ?? { resolve: async () => null },
-    });
-    const addressOf = async (color) => {
-        const hostname = subject.hostnames.find((name) => !name.startsWith('*'));
-        if (!hostname)
-            throw new Error(`${input.label}: the app has no public hostname to check through`);
-        const pinKey = await readPinKey(pinInput());
-        if (!pinKey)
-            throw new Error(`${input.label}: the balancer's pin key is not held`);
-        return {
-            address: `https://${hostname}`,
-            headers: { [LB_COLOR_HEADER]: color, [LB_PIN_HEADER]: pinKey },
-        };
-    };
-    /** The color a health read goes to: the one being released, else the live one. */
-    const healthColor = () => {
-        try {
-            const window = JSON.parse(recorded()[bgKey.window(id)] ?? '{}');
-            if (window.release?.to === 'blue' || window.release?.to === 'green')
-                return window.release.to;
-        }
-        catch {
-            // A damaged window reads as no release; the runner rewrites it.
-        }
-        return recorded()[bgKey.live(id)] === 'green' ? 'green' : 'blue';
-    };
+    const pinInput = () => pinInputOf(input, recorded);
+    const addressOf = (color) => colorAddress(input, recorded, color);
+    const healthColor = () => healthColorOf(recorded(), id);
     const deployTo = async (color, digest) => {
         if (!COMMIT.test(digest))
             throw new Error(`${input.label}: the release is not a built commit`);
@@ -250,6 +281,11 @@ export function createReleaseHost(input) {
     };
     return {
         deps,
+        async readSeries(entry, query) {
+            if (entry !== id)
+                return null;
+            return readSubjectSeries({ ...input, recorded, query });
+        },
         async refreshStage() {
             const stageId = recorded()[bgKey.app(id, input.primaryUuid, 'stage')];
             if (!stageId || !coolify.listApplicationDeployments)
@@ -324,13 +360,7 @@ export async function runSubjectRelease(input) {
     const result = await runRelease({
         store: {
             getScopeIds: async () => ({ ...ids() }),
-            addRequest: async () => {
-                throw new Error('the release runner takes requests; it does not add them');
-            },
             openRequests: (query) => input.store.openRequests(query),
-            consumeRequests: async () => {
-                throw new Error('the release runner consumes requests after it persists');
-            },
         },
         orgId: input.scopeOwnerId,
         entryKey: id,
@@ -347,6 +377,19 @@ export async function runSubjectRelease(input) {
             context.recordScopeId(key, value);
     }
     await context.persist();
+    if (input.store.appendEvents && result.events.length > 0) {
+        try {
+            await input.store.appendEvents({
+                orgId: input.scopeOwnerId,
+                entryKey: id,
+                events: result.events,
+            });
+        }
+        catch {
+            // The history is a record, not a gate: losing a line must not leave the run's requests open to replay.
+            console.error(`release ${id}: recording ${result.events.length} history lines failed`);
+        }
+    }
     await input.store.consumeRequests(result.requestIds);
     const after = parseWeights(ids()[bgKey.weights(id)]);
     // Also when a balancer lags the weights (an earlier write failed), so the next tick retries it.

package/dist/plan/release-series-reader.d.ts

@@ -0,0 +1,26 @@
+import type { ReleaseSeriesQuery } from '../release/series.js';
+import type { ReleaseStore } from '../release/state.js';
+import type { ReleaseSeries } from '../release/types.js';
+import type { DeclaredOrgStore } from '../store.js';
+import { type PinHeldKeys } from './blue-green.js';
+/** What a request needs to read a series outside a release run: what Archon already holds. */
+export interface EntrySeriesDeps {
+    orgs: Pick<DeclaredOrgStore, 'get'>;
+    /** The recorded ids of the org, as the release tick persists them (`createPostgresReleaseStore`). */
+    store: Pick<ReleaseStore, 'getScopeIds'>;
+    /** The held store: reads the entry's health token and the balancer's pin key. */
+    heldKeys: Pick<PinHeldKeys, 'resolve'>;
+    /** Registers a value for redaction before it is used. */
+    secret?: (value: string) => void;
+    fetch?: typeof fetch;
+}
+/**
+ * C2 for a request: the series of one blue/green entry, read the way a release run reads it (the entry's
+ * first public hostname, the colour pin headers, the health token, a 15 s timeout, a 1 MiB cap). Null for an
+ * org or entry that is not declared blue/green, an app without reporting, a token or pin key not held, and any
+ * failed read; a failure logs fixed text only. Never mints and never writes.
+ */
+export declare function readEntryReleaseSeries(deps: EntrySeriesDeps, input: {
+    orgId: string;
+    entryKey: string;
+} & ReleaseSeriesQuery): Promise<ReleaseSeries | null>;

package/dist/plan/release-series-reader.js

@@ -0,0 +1,40 @@
+import { sharedSecretRef } from '../org.js';
+import { blueGreenSubjects, healthTokenName, pinKeyName } from './blue-green.js';
+import { readSubjectSeries } from './release-host.js';
+/**
+ * C2 for a request: the series of one blue/green entry, read the way a release run reads it (the entry's
+ * first public hostname, the colour pin headers, the health token, a 15 s timeout, a 1 MiB cap). Null for an
+ * org or entry that is not declared blue/green, an app without reporting, a token or pin key not held, and any
+ * failed read; a failure logs fixed text only. Never mints and never writes.
+ */
+export async function readEntryReleaseSeries(deps, input) {
+    const label = `coolify:release:${input.entryKey}`;
+    try {
+        const org = await deps.orgs.get(input.orgId);
+        if (!org)
+            return null;
+        const ids = await deps.store.getScopeIds(input.orgId);
+        const subject = blueGreenSubjects(org, ids).find((s) => s.id === input.entryKey);
+        if (!subject)
+            return null;
+        return await readSubjectSeries({
+            subject,
+            recorded: () => ids,
+            healthToken: async () => (await deps.heldKeys.resolve(sharedSecretRef(org.id, healthTokenName(subject.id)))) ?? null,
+            secret: deps.secret ?? (() => undefined),
+            pinRef: sharedSecretRef(org.id, pinKeyName(subject.id)),
+            heldKeys: deps.heldKeys,
+            ...(deps.fetch ? { fetch: deps.fetch } : {}),
+            label,
+            query: {
+                from: input.from,
+                to: input.to,
+                ...(input.bucket !== undefined ? { bucket: input.bucket } : {}),
+            },
+        });
+    }
+    catch {
+        console.error(`${label}: reading the release series failed`);
+        return null;
+    }
+}

package/dist/plan/sign-in-archon.d.ts

@@ -9,7 +9,7 @@ export declare const PLATFORM_ARCHON_IN_APP_SCOPE_KEY = "platform_archon_in_app"
 /** The host a recorded {@link PLATFORM_ARCHON_IN_APP_SCOPE_KEY} names; `''` when none. */
 export declare function archonInAppHost(recorded: Readonly<Record<string, string>>): string;
 /** The ZITADEL calls Archon's in-app sign-in makes, on the owner company's own instance. */
-export type ArchonInAppZitadel = Pick<ZitadelPort, 'ensureTrustedDomain' | 'deleteTrustedDomain' | 'updateOidcAppLoginBaseUri'> & Partial<Pick<ZitadelPort, 'allowPerAppLoginBaseUri'>>;
+export type ArchonInAppZitadel = Pick<ZitadelPort, 'ensureTrustedDomain' | 'deleteTrustedDomain' | 'updateOidcAppLoginBaseUri' | 'listApps'> & Partial<Pick<ZitadelPort, 'allowPerAppLoginBaseUri' | 'listOrgs' | 'listProjects'>>;
 interface ArchonInAppInput {
     zitadel: ArchonInAppZitadel;
     coolify: Pick<CoolifyPort, 'listEnvs' | 'bulkUpsertEnvs' | 'deploy'>;

package/dist/plan/sign-in-archon.js

@@ -1,4 +1,4 @@
-import { isNotFoundError, setOidcAppLoginBaseUri } from './executor.js';
+import { allowPerAppLoginBaseUris, isNotFoundError, setOidcAppLoginBaseUri } from './executor.js';
 import { editSignInBindings } from './sign-in-bindings.js';
 import { SIGN_IN_BASE_PATH } from './sign-in.js';
 /**
@@ -41,7 +41,7 @@ export async function archonInAppPoint(input) {
     if (!zitadel.allowPerAppLoginBaseUri) {
         throw new Error("platform:archon: the owner company's ZITADEL port cannot allow a per-app login base URI, so Archon cannot sign in on its own address");
     }
-    await zitadel.allowPerAppLoginBaseUri(`https://${input.loginHost}/`);
+    await allowPerAppLoginBaseUris(zitadel, `https://${input.loginHost}/`);
     await setOidcAppLoginBaseUri(zitadel, input.organisationId, input.projectId, input.appId, `https://${host}${SIGN_IN_BASE_PATH}/`);
 }
 /** First half of giving the address up: the client goes back to the company's login host. */

package/dist/plan/stage-services.d.ts

@@ -5,7 +5,7 @@ import { type StageKind } from './stage-isolation.js';
  * minted for it only. A stage key is worthless on production, and production's key never reaches stage. Nothing
  * here returns, logs or throws a secret: errors carry fixed text, ids and refs (CLAUDE.md, Platform steps).
  */
-export type StageService = 'files' | 'ai' | 'jobs';
+export type StageService = 'files' | 'ai' | 'jobs' | 'analytics';
 export declare const STAGE_SERVICES: readonly StageService[];
 /** One credential a service shows once: the env name stage holds it under, and its value. */
 export interface StageSecret {
@@ -44,6 +44,8 @@ export interface StageServicesPort {
     files?: StageServicePort;
     ai?: StageServicePort;
     jobs?: StageServicePort;
+    /** The company's analytics backend: stage's own site key (environment `stage`), shown once with the mint. */
+    analytics?: StageServicePort;
     /** The id of production's jobs project, so stage's jobs key can be tried against it. */
     prodJobsProjectId?: string;
 }

package/dist/plan/stage-services.js

@@ -1,7 +1,7 @@
 import { createHash } from 'node:crypto';
 import { bgKey } from './blue-green.js';
 import { isAllowed } from './stage-isolation.js';
-export const STAGE_SERVICES = ['files', 'ai', 'jobs'];
+export const STAGE_SERVICES = ['files', 'ai', 'jobs', 'analytics'];
 /** Fixed text and ids only: safe to log, record and return. */
 export class StageServiceError extends Error {
     name = 'StageServiceError';
@@ -14,6 +14,7 @@ const SERVICE_ENV = {
         evidence: ['JOBS_SCHEDULER_URL', 'JOBS_SYNC_KEY', 'JOBS_SIGNING_SECRET'],
         url: 'JOBS_SCHEDULER_URL',
     },
+    analytics: { evidence: ['ANALYTICS_URL', 'ANALYTICS_SITE_KEY'], url: 'ANALYTICS_URL' },
 };
 /** The fixed reasons a used service is recorded absent. */
 export const STAGE_SERVICE_ABSENT = {

package/dist/plan/uptime-worker.js

@@ -1,9 +1,19 @@
 import { randomBytes, randomUUID } from 'node:crypto';
 import { EdgeApiError } from '@wtfalch/edge';
 import { uptimeArtifactUrl } from '../platform.js';
-import { PLATFORM_EDGE_INTERNAL_URL_SCOPE_KEY, PLATFORM_UPTIME_ACCESS_CLIENT_ID_REF, PLATFORM_UPTIME_ACCESS_CLIENT_SECRET_REF, PLATFORM_UPTIME_ACCESS_TOKEN_ID_SCOPE_KEY, PLATFORM_UPTIME_ACCESS_TOKEN_NAME, PLATFORM_UPTIME_ACCESS_UNDELIVERED_SCOPE_KEY, PLATFORM_UPTIME_APPLIED_HOSTNAME_SCOPE_KEY, PLATFORM_UPTIME_APPLIED_SECRETS_SCOPE_KEY, PLATFORM_UPTIME_APPLIED_SHA256_SCOPE_KEY, PLATFORM_UPTIME_APPLIED_TAG_SCOPE_KEY, PLATFORM_UPTIME_APPLIED_VARS_SCOPE_KEY, PLATFORM_UPTIME_CHAT_ROOM_ID_SCOPE_KEY, PLATFORM_UPTIME_CHAT_TOKEN_REF, PLATFORM_UPTIME_CHAT_UNDELIVERED_SCOPE_KEY, PLATFORM_UPTIME_HEARTBEAT_URL_REF, PLATFORM_UPTIME_KEY, PLATFORM_UPTIME_KV_TITLE, PLATFORM_UPTIME_OPTIONAL_SECRETS, PLATFORM_UPTIME_REMOVED_SCOPE_KEY, PLATFORM_UPTIME_SCRIPT_NAME, PLATFORM_UPTIME_TOKEN_ID_SCOPE_KEY, PLATFORM_UPTIME_TOKEN_REF, PLATFORM_UPTIME_TOKEN_UNDELIVERED_SCOPE_KEY, uptimeAccessTokenConflict, uptimeEffectiveVars, uptimeSecretNames, uptimeVarsDigest, } from './platform-diff.js';
-/** The Worker's cron trigger, from Archon's `workers/uptime/manifest.json`. */
-const UPTIME_CRONS = ['* * * * *'];
+import { PLATFORM_EDGE_INTERNAL_URL_SCOPE_KEY, PLATFORM_UPTIME_ACCESS_CLIENT_ID_REF, PLATFORM_UPTIME_ACCESS_CLIENT_SECRET_REF, PLATFORM_UPTIME_ACCESS_TOKEN_ID_SCOPE_KEY, PLATFORM_UPTIME_ACCESS_TOKEN_NAME, PLATFORM_UPTIME_ACCESS_UNDELIVERED_SCOPE_KEY, PLATFORM_UPTIME_APPLIED_HOSTNAME_SCOPE_KEY, PLATFORM_UPTIME_APPLIED_SECRETS_SCOPE_KEY, PLATFORM_UPTIME_APPLIED_SHA256_SCOPE_KEY, PLATFORM_UPTIME_APPLIED_TAG_SCOPE_KEY, PLATFORM_UPTIME_APPLIED_VARS_SCOPE_KEY, PLATFORM_UPTIME_AUDIT_SEAL_TICK_ID_SCOPE_KEY, PLATFORM_UPTIME_AUDIT_SEAL_TICK_TOKEN_REF, PLATFORM_UPTIME_AUDIT_SEAL_TICK_UNDELIVERED_SCOPE_KEY, PLATFORM_UPTIME_CHAT_ROOM_ID_SCOPE_KEY, PLATFORM_UPTIME_CHAT_TOKEN_REF, PLATFORM_UPTIME_CHAT_UNDELIVERED_SCOPE_KEY, PLATFORM_UPTIME_HEARTBEAT_URL_REF, PLATFORM_UPTIME_KEY, PLATFORM_UPTIME_KV_TITLE, PLATFORM_UPTIME_OPTIONAL_SECRETS, PLATFORM_UPTIME_RELEASE_TICK_ID_SCOPE_KEY, PLATFORM_UPTIME_RELEASE_TICK_TOKEN_REF, PLATFORM_UPTIME_RELEASE_TICK_UNDELIVERED_SCOPE_KEY, PLATFORM_UPTIME_REMOVED_SCOPE_KEY, PLATFORM_UPTIME_SCRIPT_NAME, PLATFORM_UPTIME_TOKEN_ID_SCOPE_KEY, PLATFORM_UPTIME_TOKEN_REF, PLATFORM_UPTIME_TOKEN_UNDELIVERED_SCOPE_KEY, uptimeAccessTokenConflict, uptimeEffectiveVars, uptimeSecretNames, uptimeVarsDigest, } from './platform-diff.js';
+/**
+ * The Worker's cron triggers, in the order of Archon's `workers/uptime/manifest.json`: the probe, the
+ * usage tick, the charge tick, the release tick and the audit seal tick. The usage and charge ticks
+ * stay off because the step gives the Worker no `USAGE_TOKEN` or `CHARGE_TOKEN`.
+ */
+const UPTIME_CRONS = [
+    '* * * * *',
+    '0 * * * *',
+    '15 3 * * *',
+    '*/10 * * * *',
+    '*/15 * * * *',
+];
 /** The date Archon's own Worker config used. */
 const UPTIME_COMPATIBILITY_DATE = '2026-09-27';
 /** How many times a delivery or a secrets write is tried before the step fails. */
@@ -124,6 +134,27 @@ async function attempt(what, task) {
     }
     throw new Error(`platform:uptime: ${what} failed after ${UPTIME_ATTEMPTS} attempts`);
 }
+/**
+ * Holds a minted tick token under `ref`, the Worker token's pattern: the undelivered id is persisted
+ * before the value is held, the guard once it is. A guard with nothing held, or a marker without a
+ * guard, means the value is gone: a new one is minted and the old id dropped. Returns the held value
+ * and its id (the Worker secret's version label); the value goes nowhere else.
+ */
+async function holdTickToken(context, deps, recorded, keys) {
+    const guard = recorded[keys.idKey];
+    const heldValue = guard ? await deps.heldKeys.resolve(keys.ref) : null;
+    if (guard && heldValue)
+        return { id: guard, value: heldValue };
+    const id = randomUUID();
+    const value = randomBytes(32).toString('hex');
+    context.recordScopeId(keys.undeliveredKey, id);
+    await context.persist?.();
+    await attempt(`holding token ${id}`, () => deps.deliverSecret(keys.ref, value));
+    context.recordScopeId(keys.idKey, id);
+    context.recordScopeId(keys.undeliveredKey, '');
+    await context.persist?.();
+    return { id, value };
+}
 /** Removes an Access token edge made; one already gone is success. */
 async function removeAccessToken(access, id, what) {
     try {
@@ -165,6 +196,8 @@ export async function provisionPlatformUptime(context, deps) {
         }
         for (const ref of [
             PLATFORM_UPTIME_TOKEN_REF,
+            PLATFORM_UPTIME_RELEASE_TICK_TOKEN_REF,
+            PLATFORM_UPTIME_AUDIT_SEAL_TICK_TOKEN_REF,
             PLATFORM_UPTIME_ACCESS_CLIENT_ID_REF,
             PLATFORM_UPTIME_ACCESS_CLIENT_SECRET_REF,
         ]) {
@@ -175,6 +208,10 @@ export async function provisionPlatformUptime(context, deps) {
             PLATFORM_UPTIME_ACCESS_UNDELIVERED_SCOPE_KEY,
             PLATFORM_UPTIME_TOKEN_ID_SCOPE_KEY,
             PLATFORM_UPTIME_TOKEN_UNDELIVERED_SCOPE_KEY,
+            PLATFORM_UPTIME_RELEASE_TICK_ID_SCOPE_KEY,
+            PLATFORM_UPTIME_RELEASE_TICK_UNDELIVERED_SCOPE_KEY,
+            PLATFORM_UPTIME_AUDIT_SEAL_TICK_ID_SCOPE_KEY,
+            PLATFORM_UPTIME_AUDIT_SEAL_TICK_UNDELIVERED_SCOPE_KEY,
         ]) {
             context.recordScopeId(key, '');
         }
@@ -280,6 +317,17 @@ export async function provisionPlatformUptime(context, deps) {
         tokenId = newId;
         token = minted;
     }
+    // The two tick tokens, minted and held the same way, each its own value.
+    const releaseTick = await holdTickToken(context, deps, recorded, {
+        ref: PLATFORM_UPTIME_RELEASE_TICK_TOKEN_REF,
+        idKey: PLATFORM_UPTIME_RELEASE_TICK_ID_SCOPE_KEY,
+        undeliveredKey: PLATFORM_UPTIME_RELEASE_TICK_UNDELIVERED_SCOPE_KEY,
+    });
+    const auditSealTick = await holdTickToken(context, deps, recorded, {
+        ref: PLATFORM_UPTIME_AUDIT_SEAL_TICK_TOKEN_REF,
+        idKey: PLATFORM_UPTIME_AUDIT_SEAL_TICK_ID_SCOPE_KEY,
+        undeliveredKey: PLATFORM_UPTIME_AUDIT_SEAL_TICK_UNDELIVERED_SCOPE_KEY,
+    });
     // The Access service token pair, minted through edge. The id is recorded
     // and persisted before the pair is held, the guard once both are held. A
     // pair that may be lost (marker without guard, or guard with nothing held)
@@ -341,6 +389,8 @@ export async function provisionPlatformUptime(context, deps) {
     const version = `pin-${uptime.sha256.slice(0, 12)}`;
     const secrets = [
         { name: 'UPTIME_TOKEN', value: token, version: tokenId },
+        { name: 'RELEASE_TICK_TOKEN', value: releaseTick.value, version: releaseTick.id },
+        { name: 'AUDIT_SEAL_TICK_TOKEN', value: auditSealTick.value, version: auditSealTick.id },
         { name: 'CF_ACCESS_CLIENT_ID', value: clientId, version: accessId },
         { name: 'CF_ACCESS_CLIENT_SECRET', value: clientSecret, version: accessId },
         // A ping URL works as a capability: a secret, not a plain text binding.

package/dist/plan/worker-app-database.d.ts

@@ -18,7 +18,7 @@ export { type DatabaseMigration, MIGRATIONS_ASSET_NAME, WORKER_APP_MIGRATION_TIM
  * database it cannot use:
  * Access app and service token -> tunnel rule and DNS -> `<db>_rt` password -> release
  * `migrations.json` (its sha256 checked against `database.migrationsSha256`) applied with the owner credentials -> runtime role (UPDATE, DELETE and
- * TRUNCATE revoked on `appendOnly`) -> Hyperdrive config with the runtime credentials.
+ * TRUNCATE revoked on `appendOnly`, DELETE and TRUNCATE on `noDelete`) -> Hyperdrive config with the runtime credentials.
  * A failed migration throws, so the Worker is not uploaded.
  */
 /** Everything needed to open a connection to the org's database over the tunnel. */
@@ -75,6 +75,16 @@ export interface WorkerAppDatabasePort extends WorkerAppMigrationRunner<Hyperdri
     }): Promise<void>;
     /** The text of a release asset of a wtfalch repo, or `null` when the release has no such asset. */
     fetchReleaseAsset(url: string): Promise<string | null>;
+    /**
+     * After the runtime role work: the names among `tables` that `user` can still delete from or
+     * truncate (itself, through PUBLIC or through a role it belongs to), or that do not exist.
+     * Optional: without it a `noDelete` list is blocked at plan time.
+     */
+    deletableTables?(input: {
+        owner: HyperdriveOrigin;
+        user: string;
+        tables: string[];
+    }): Promise<string[]>;
 }
 /** The Hyperdrive config, `{name, id}` as JSON. No secret. */
 export declare const workerAppHyperdriveScopeKey: (entryKey: string) => string;
@@ -130,6 +140,7 @@ export declare function applyWorkerAppDatabase(deps: WorkerAppDatabaseDeps, org:
     artifactUrl: string;
     database: {
         appendOnly: string[];
+        noDelete?: string[];
         grants?: string[];
         migrationsSha256?: string;
     };

package/dist/plan/worker-app-database.js

@@ -145,6 +145,19 @@ export async function applyWorkerAppDatabase(deps, org, entry, scriptName, want,
             await context.persistScopeIds();
         },
     });
+    // 5a. `noDelete`: read the role's rights back, so a port that dropped the list cannot pass.
+    const noDelete = want.database.noDelete ?? [];
+    if (noDelete.length > 0) {
+        const read = port.deletableTables;
+        if (!read) {
+            throw new Error(`${at}: the host's database port cannot read the role's rights back (no deletableTables)`);
+        }
+        const open = await call("check the runtime role's rights", () => read.call(port, { owner: ownerOrigin, user: runtimeUser, tables: [...noDelete] }));
+        const named = noDelete.filter((table) => open.includes(table));
+        if (named.length > 0) {
+            throw new Error(`${at}: the runtime role can still delete from ${named.join(', ')} (or the table is missing); the Worker was not deployed`);
+        }
+    }
     // 5b. `uses.audit`: the sealing role, apart from the runtime role, after the audit tables exist.
     if (entry.uses?.audit === true && port.ensureSealerRole) {
         await ensureAuditSealer(deps, org, entry, owner.database, ownerOrigin, at, call, context, put);

package/dist/plan/worker-app.d.ts

@@ -67,6 +67,10 @@ export declare const WORKER_APP_AUTH_KEY_SECRET = "AUTH_APP_KEY";
  * and name are hashed: a held ref is at most 128 characters.
  */
 export declare const workerAppSecretRef: (orgId: string, entryKey: string, name: string) => string;
+/** The version recorded for a `heldSecret` value: a short hash, so a changed value is delivered again. Never the value. */
+export declare const heldSecretVersion: (value: string) => string;
+/** `<entry key>/<NAME>` of a `heldSecret`: how the plan's readiness names it. */
+export declare const heldSecretId: (entryKey: string, name: string) => string;
 /**
  * The Cloudflare calls a Worker app needs. Edge 0.13.0 has none of the Durable
  * Object, migration or container calls, so no adapter ships with this port yet
@@ -97,6 +101,11 @@ export interface WorkerAppPort {
         value: string;
         version: string;
     }[]): Promise<void>;
+    /**
+     * Sets the script's cron triggers to exactly `crons`; an empty list clears them. Safe to repeat.
+     * Edge's `client.platform.workers.setSchedules(name, { crons })`.
+     */
+    setSchedules(name: string, crons: readonly string[]): Promise<void>;
     /** A no-op when the secret is gone. */
     deleteSecret(name: string, secretName: string): Promise<void>;
     /** Creates or updates the container application of `className` on the script; returns its id. */
@@ -155,14 +164,21 @@ export interface WorkerAppWant {
     /** `workerApp.database`: the Hyperdrive binding and the tables the runtime role may only append to, sorted. */
     database?: {
         appendOnly: string[];
+        noDelete?: string[];
         grants?: string[];
         migrationsSha256?: string;
     };
-    /** Secret names and where each comes from, sorted. */
+    /** `workerApp.triggers.crons`, sorted. Absent when none, so a Worker without cron keeps the marker it already has. */
+    crons?: string[];
+    /**
+     * Secret names and where each comes from, sorted. A `heldSecret` is listed only while a value is held,
+     * with the version of that value (a hash, never the value); one with no value is not here.
+     */
     secrets: {
         name: string;
-        source: 'generated' | 'keysCustody';
+        source: 'generated' | 'keysCustody' | 'heldSecret';
         hostId?: string;
+        version?: string;
     }[];
 }
 /** The zone apex the entry's route lives in. */
@@ -174,8 +190,11 @@ export declare const workerAppApex: (org: DeclaredOrg, entry?: HostingEntry) =>
 export declare function wantedWorkerApp(org: DeclaredOrg, entry: HostingEntry, recorded: Readonly<Record<string, string>>, input: {
     issuer: string | null;
     keysUrl?: string;
+    /** `<entry key>/<NAME>` -> version of the value held now, for each `heldSecret` that has one. */
+    heldSecrets?: Readonly<Record<string, string>>;
 }): {
     want: WorkerAppWant;
+    unset: string[];
 } | {
     missing: string[];
 };
@@ -201,6 +220,8 @@ export interface WorkerAppPlanInput {
     canHoldSecrets: boolean;
     /** The sign-in issuer for `authEnv`. */
     issuer: string | null;
+    /** `<entry key>/<NAME>` -> version of the value held now, for each `heldSecret` that has one (names only, never a value). */
+    heldSecrets?: Readonly<Record<string, string>>;
     /** The platform's Cloudflare account id: a container image must live in its registry. */
     registryAccountId?: string;
     /**
@@ -214,6 +235,8 @@ export interface WorkerAppPlanInput {
         tunnelReady: boolean;
         /** The executor has Access, tunnel, DNS and zone ports. */
         accessReady: boolean;
+        /** The port has `deletableTables`, so a `noDelete` list can be proven after the role work. */
+        noDeleteCheck?: boolean;
     };
 }
 /** Every entry key with a deployed or half-deployed Worker app recorded. */
@@ -245,6 +268,8 @@ export interface WorkerAppDeps {
     };
     /** `workerApp.database`: the Hyperdrive port and the route's Cloudflare ports. */
     database?: WorkerAppDatabaseDeps;
+    /** Registers a value for redaction before anything else can see it. */
+    secret?: (value: string) => void;
     /** Test hook: the timeout, in ms. */
     timeoutMs?: number;
 }