@wtfalch/foundry 0.65.0 → 0.67.0

package/dist/release/state.d.ts

@@ -1,6 +1,6 @@
 import { z } from 'zod';
 import { type Recorded, resolveReleaseConfig } from './decide.js';
-import type { Color, ReleaseAction, ReleaseSignal, ReleaseState, StageCopyState, WindowState } from './types.js';
+import type { Color, ReleaseAction, ReleaseEvent, ReleaseSignal, ReleaseState, StageCopyState, WindowState } from './types.js';
 /**
  * The persistence the release runner and Archon share. `getScopeIds` is the
  * recorded `bg.*` keys of an org's applied state (or of the platform, for the
@@ -26,6 +26,19 @@ export interface ReleaseStore {
     }[]>;
     /** Marks requests consumed. The runner calls it only after its decision is persisted. */
     consumeRequests(ids: readonly number[]): Promise<void>;
+    /** Appends history lines (`foundry_release_events`), oldest first. Nothing is ever updated or deleted. */
+    appendEvents(input: {
+        orgId: string;
+        entryKey: string;
+        events: readonly ReleaseEvent[];
+    }): Promise<void>;
+    /** The history of one entry, newest first. `since` is inclusive. Rows that no longer parse are skipped. */
+    readEvents(input: {
+        orgId: string;
+        entryKey: string;
+        since?: string;
+        limit: number;
+    }): Promise<ReleaseEvent[]>;
 }
 /** Scope keys (C3). `entry` is a hosting entry key: never `.` or `:`. */
 export declare function releaseKeys(entry: string): {
@@ -53,6 +66,41 @@ export declare function releaseKeys(entry: string): {
 };
 export declare function formatWeights(w: Record<Color, number>): string;
 export declare function parseWeights(value: string | undefined): Record<Color, number> | null;
+export declare const RELEASE_EVENT_KINDS: readonly ["promote", "step", "check", "pause", "resume", "step_now", "approve", "open", "rollback", "passed", "hard_fail"];
+/** What `foundry_release_events.payload` holds: a line's fields besides `at` and `kind`. */
+export declare const releaseEventPayload: z.ZodObject<{
+    percent: z.ZodOptional<z.ZodNumber>;
+    actor: z.ZodOptional<z.ZodString>;
+    reason: z.ZodOptional<z.ZodString>;
+    release: z.ZodOptional<z.ZodObject<{
+        from: z.ZodString;
+        to: z.ZodString;
+    }, z.core.$strip>>;
+    signal: z.ZodOptional<z.ZodObject<{
+        requests: z.ZodNumber;
+        errors: z.ZodNumber;
+        baselineRate: z.ZodNullable<z.ZodNumber>;
+        verdict: z.ZodEnum<{
+            inconclusive: "inconclusive";
+            pass: "pass";
+            fail: "fail";
+            hard_fail: "hard_fail";
+        }>;
+    }, z.core.$strip>>;
+}, z.core.$strip>;
+export declare const releaseEventKind: z.ZodEnum<{
+    step: "step";
+    open: "open";
+    check: "check";
+    passed: "passed";
+    hard_fail: "hard_fail";
+    promote: "promote";
+    rollback: "rollback";
+    pause: "pause";
+    resume: "resume";
+    step_now: "step_now";
+    approve: "approve";
+}>;
 /** The window JSON is the C2 state plus the active release's `release` field. */
 export declare function parseWindow(value: string | undefined): {
     window: WindowState;
@@ -86,3 +134,12 @@ export declare function requestReleaseAction(store: ReleaseStore, input: {
     actor: string;
 }): Promise<void>;
 export { actionSchema as releaseActionSchema };
+export declare const RELEASE_HISTORY_DEFAULT_LIMIT = 200;
+export declare const RELEASE_HISTORY_MAX_LIMIT = 1000;
+/** C1: the history of one entry (a release's steps, checks, actions and outcome), newest first. */
+export declare function readReleaseHistory(store: Pick<ReleaseStore, 'readEvents'>, q: {
+    orgId: string;
+    entryKey: string;
+    since?: string;
+    limit?: number;
+}): Promise<ReleaseEvent[]>;

package/dist/release/state.js

@@ -48,6 +48,7 @@ const storedWindow = z.discriminatedUnion('kind', [
     z.object({ kind: z.literal('rolled_back'), at: z.string(), reason: z.string() }),
     z.object({ kind: z.literal('cap'), since: z.string() }),
     z.object({ kind: z.literal('staff'), since: z.string() }),
+    z.object({ kind: z.literal('paused'), percent: z.number(), since: z.string() }),
 ]);
 const releaseField = z
     .object({
@@ -65,6 +66,28 @@ const signalSchema = z.object({
     baselineRate: z.number().nullable(),
     verdict: z.enum(['pass', 'fail', 'hard_fail', 'inconclusive']),
 });
+export const RELEASE_EVENT_KINDS = [
+    'promote',
+    'step',
+    'check',
+    'pause',
+    'resume',
+    'step_now',
+    'approve',
+    'open',
+    'rollback',
+    'passed',
+    'hard_fail',
+];
+/** What `foundry_release_events.payload` holds: a line's fields besides `at` and `kind`. */
+export const releaseEventPayload = z.object({
+    percent: z.number().optional(),
+    actor: z.string().optional(),
+    reason: z.string().optional(),
+    release: z.object({ from: z.string(), to: z.string() }).optional(),
+    signal: signalSchema.optional(),
+});
+export const releaseEventKind = z.enum(RELEASE_EVENT_KINDS);
 function parseJson(value) {
     if (!value)
         return undefined;
@@ -187,6 +210,9 @@ const actionSchema = z.discriminatedUnion('kind', [
     z.object({ kind: z.literal('decide_at_cap'), decision: z.enum(['pass', 'rollback']) }),
     z.object({ kind: z.literal('approve_step') }),
     z.object({ kind: z.literal('open') }),
+    z.object({ kind: z.literal('pause') }),
+    z.object({ kind: z.literal('resume') }),
+    z.object({ kind: z.literal('step_now') }),
     z.object({ kind: z.literal('deploy_stage'), ref: z.string().regex(STAGE_REF_PATTERN) }),
     z.object({ kind: z.literal('copy_prod_to_stage') }),
     z.object({ kind: z.literal('undo_stage_copy') }),
@@ -197,3 +223,22 @@ export async function requestReleaseAction(store, input) {
     await store.addRequest({ ...input, action: actionSchema.parse(input.action) });
 }
 export { actionSchema as releaseActionSchema };
+export const RELEASE_HISTORY_DEFAULT_LIMIT = 200;
+export const RELEASE_HISTORY_MAX_LIMIT = 1000;
+/** C1: the history of one entry (a release's steps, checks, actions and outcome), newest first. */
+export async function readReleaseHistory(store, q) {
+    releaseKeys(q.entryKey);
+    if (q.since !== undefined && Number.isNaN(Date.parse(q.since))) {
+        throw new Error('invalid release history start time');
+    }
+    const wanted = q.limit !== undefined && Number.isFinite(q.limit)
+        ? Math.floor(q.limit)
+        : RELEASE_HISTORY_DEFAULT_LIMIT;
+    const limit = Math.min(Math.max(wanted, 1), RELEASE_HISTORY_MAX_LIMIT);
+    return store.readEvents({
+        orgId: q.orgId,
+        entryKey: q.entryKey,
+        ...(q.since !== undefined ? { since: q.since } : {}),
+        limit,
+    });
+}

package/dist/release/types.d.ts

@@ -27,6 +27,12 @@ export type WindowState = {
  | {
     kind: 'staff';
     since: string;
+}
+/** A person held the step with `pause`. `since` is when the step began; `resume` returns to `step` with it. */
+ | {
+    kind: 'paused';
+    percent: number;
+    since: string;
 };
 export interface ReleaseSignal {
     requests: number;
@@ -88,6 +94,12 @@ export type ReleaseAction = {
     kind: 'approve_step';
 } | {
     kind: 'open';
+} | {
+    kind: 'pause';
+} | {
+    kind: 'resume';
+} | {
+    kind: 'step_now';
 } | {
     kind: 'deploy_stage';
     ref: string;
@@ -96,6 +108,38 @@ export type ReleaseAction = {
 } | {
     kind: 'undo_stage_copy';
 };
+export type ReleaseEventKind = 'promote' | 'step' | 'check' | 'pause' | 'resume' | 'step_now' | 'approve' | 'open' | 'rollback' | 'passed' | 'hard_fail';
+/** C1: one line of a release's history, written by the release run (`foundry_release_events`). */
+export interface ReleaseEvent {
+    at: string;
+    kind: ReleaseEventKind;
+    percent?: number;
+    /** Who asked, when a person did. */
+    actor?: string;
+    reason?: string;
+    release?: {
+        from: string;
+        to: string;
+    };
+    signal?: ReleaseSignal;
+}
+/** C2: what reporting counts for one color in one bucket. */
+export interface ReleaseSeriesColor {
+    requests: number;
+    errors: number;
+    slow: number;
+    durationMsSum: number;
+    signIns: number;
+    signInFailures: number;
+}
+/** C2: reporting's `GET /api/reporting/release-series` body. */
+export interface ReleaseSeries {
+    bucketMinutes: number;
+    buckets: Array<{
+        start: string;
+        colors: Record<Color, ReleaseSeriesColor>;
+    }>;
+}
 /** The requests that run a stage copy. They are handled by the tick's second phase, never by an apply. */
 export declare const isStageCopyAction: (action: ReleaseAction) => boolean;
 export declare const COLORS: readonly Color[];

package/dist/slug.d.ts

@@ -2,7 +2,7 @@
 export declare const RESERVED_SLUGS: ReadonlySet<string>;
 /** Every platform app, tunnel, project and database name starts `platform-`, so no company slug may. */
 export declare const RESERVED_SLUG_PREFIX = "platform-";
-/** Whether `label` ends in a suffix reserved for another org's own hostname (`-stage`, `-pr-<n>`, `-calls`, `-agora`, `-boule`, `-kosmos`, `-auth`, `-mail`, `-files`, `-sfu`, `-cms`). */
+/** Whether `label` ends in a suffix reserved for another org's own hostname (`-stage`, `-pr-<n>`, `-calls`, `-agora`, `-boule`, `-kosmos`, `-analytics`, `-auth`, `-mail`, `-files`, `-sfu`, `-cms`). */
 export declare function hasBarredSlugSuffix(label: string): boolean;
 /**
  * Why {@link validateSlug} refused a candidate slug, by name so a caller —

package/dist/slug.js

@@ -146,6 +146,8 @@ const BOULE_SUFFIX = /-boule$/;
  * hostname once kosmos is on, not because every org gets one.
  */
 const KOSMOS_SUFFIX = /-kosmos$/;
+/** `<something>-analytics` — a level-1 org's own analytics backend hostname (`<slug>-analytics.oikos.host`, foundry#724). Reserved always, so a company that turns analytics on later never finds the name taken. */
+const ANALYTICS_SUFFIX = /-analytics$/;
 /** `<something>-auth|-mail|-files|-sfu|-cms` — an own company's service hostnames on oikos.host (`plan/own-hostnames.ts`). */
 const OWN_SERVICE_SUFFIX = /-(auth|mail|files|sfu|cms)$/;
 /**
@@ -159,7 +161,7 @@ const OWN_SERVICE_SUFFIX = /-(auth|mail|files|sfu|cms)$/;
  * `names-`.
  */
 const NAMES_PREFIX = /^names(-|$)/;
-/** Whether `label` ends in a suffix reserved for another org's own hostname (`-stage`, `-pr-<n>`, `-calls`, `-agora`, `-boule`, `-kosmos`, `-auth`, `-mail`, `-files`, `-sfu`, `-cms`). */
+/** Whether `label` ends in a suffix reserved for another org's own hostname (`-stage`, `-pr-<n>`, `-calls`, `-agora`, `-boule`, `-kosmos`, `-analytics`, `-auth`, `-mail`, `-files`, `-sfu`, `-cms`). */
 export function hasBarredSlugSuffix(label) {
     return (STAGE_SUFFIX.test(label) ||
         PR_SUFFIX.test(label) ||
@@ -167,6 +169,7 @@ export function hasBarredSlugSuffix(label) {
         AGORA_SUFFIX.test(label) ||
         BOULE_SUFFIX.test(label) ||
         KOSMOS_SUFFIX.test(label) ||
+        ANALYTICS_SUFFIX.test(label) ||
         OWN_SERVICE_SUFFIX.test(label));
 }
 /**
@@ -198,7 +201,7 @@ export function validateSlug(slug) {
     if (hasBarredSlugSuffix(slug)) {
         return {
             reason: 'environment-suffix',
-            message: `slug '${slug}' ends with an environment suffix ('-stage', '-pr-<digits>', '-calls', '-agora', '-boule', '-kosmos', '-auth', '-mail', '-files', '-sfu' or '-cms') reserved for another org's own hostname (#28, #145, #164, #161, #949) — 'acme-calls' is only legal as acme's calls hostname, 'acme-agora' only as acme's Agora hostname, 'acme-boule' only as acme's Boule hostname, 'acme-kosmos' only as acme's kosmos hostname, never as an org slug in its own right`,
+            message: `slug '${slug}' ends with an environment suffix ('-stage', '-pr-<digits>', '-calls', '-agora', '-boule', '-kosmos', '-analytics', '-auth', '-mail', '-files', '-sfu' or '-cms') reserved for another org's own hostname (#28, #145, #164, #161, #949) — 'acme-calls' is only legal as acme's calls hostname, 'acme-agora' only as acme's Agora hostname, 'acme-boule' only as acme's Boule hostname, 'acme-kosmos' only as acme's kosmos hostname, never as an org slug in its own right`,
         };
     }
     return null;

package/dist/store/postgres.js

@@ -1,13 +1,13 @@
-import { and, asc, desc, eq, inArray, isNull, ne, sql } from 'drizzle-orm';
+import { and, asc, desc, eq, gte, inArray, isNull, ne, sql } from 'drizzle-orm';
 import { APP_ENTRY_KEY, DEFAULT_MAIL_APPS, DEFAULT_NO_REPLY_LOCAL_PART, normalizeHostingRepos, refuseBuiltinBlueGreen, refuseCustomers, refuseHosting, validateBlueGreen, validateBuyerIdentity, validateCalls, validateDomain, validateDomainClaim, validateMail, validateOwners, validateServices, validateSignIn, validateSite, validateVersionPin, } from '../org.js';
 import { hostingNames } from '../plan/locked-hostnames.js';
 import { findNameClashes, nameClashMessage } from '../plan/org-names.js';
 import { validatePlatform } from '../platform.js';
-import { releaseActionSchema } from '../release/state.js';
+import { releaseActionSchema, releaseEventKind, releaseEventPayload, } from '../release/state.js';
 import { RequestedChangeError, classifyChange } from '../requested-changes.js';
 import { validateSlug } from '../slug.js';
 import { StaleLeaseError, } from '../store.js';
-import { declaredOrgs, foundryAppliedState, foundryAppliedVersions, foundryDeclaredPlatform, foundryMutationLeases, foundryReleaseRequests, foundryRequestedChanges, } from './schema.js';
+import { declaredOrgs, foundryAppliedState, foundryAppliedVersions, foundryDeclaredPlatform, foundryMutationLeases, foundryReleaseEvents, foundryReleaseRequests, foundryRequestedChanges, } from './schema.js';
 const UNIQUE_VIOLATION = '23505';
 /**
  * #441: runs `write`, and with a `fence` only if its token is still the
@@ -1100,5 +1100,31 @@ export function createPostgresReleaseStore(db) {
                 .set({ consumedAt: sql `now()` })
                 .where(and(inArray(foundryReleaseRequests.id, [...ids]), isNull(foundryReleaseRequests.consumedAt)));
         },
+        async appendEvents({ orgId, entryKey, events }) {
+            if (events.length === 0)
+                return;
+            await db.insert(foundryReleaseEvents).values(events.map(({ at, kind, ...payload }) => ({
+                orgId,
+                entryKey,
+                at: new Date(at),
+                kind,
+                payload,
+            })));
+        },
+        async readEvents({ orgId, entryKey, since, limit }) {
+            const rows = await db
+                .select()
+                .from(foundryReleaseEvents)
+                .where(and(eq(foundryReleaseEvents.orgId, orgId), eq(foundryReleaseEvents.entryKey, entryKey), ...(since ? [gte(foundryReleaseEvents.at, new Date(since))] : [])))
+                .orderBy(desc(foundryReleaseEvents.at), desc(foundryReleaseEvents.id))
+                .limit(limit);
+            return rows.flatMap((row) => {
+                const kind = releaseEventKind.safeParse(row.kind);
+                const payload = releaseEventPayload.safeParse(row.payload);
+                return kind.success && payload.success
+                    ? [{ at: row.at.toISOString(), kind: kind.data, ...payload.data }]
+                    : [];
+            });
+        },
     };
 }

package/dist/store/schema.d.ts

@@ -2854,6 +2854,118 @@ export declare const foundryReleaseRequests: import("drizzle-orm/pg-core").PgTab
     };
     dialect: "pg";
 }>;
+/** Mirrors `migrations/0069_release_events.sql`: a release's history, appended by the release run and never changed. */
+export declare const foundryReleaseEvents: import("drizzle-orm/pg-core").PgTableWithColumns<{
+    name: "foundry_release_events";
+    schema: undefined;
+    columns: {
+        id: import("drizzle-orm/pg-core").PgColumn<{
+            name: "id";
+            tableName: "foundry_release_events";
+            dataType: "number";
+            columnType: "PgBigSerial53";
+            data: number;
+            driverParam: number;
+            notNull: true;
+            hasDefault: true;
+            isPrimaryKey: true;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: undefined;
+            baseColumn: never;
+            identity: undefined;
+            generated: undefined;
+        }, {}, {}>;
+        orgId: import("drizzle-orm/pg-core").PgColumn<{
+            name: "org_id";
+            tableName: "foundry_release_events";
+            dataType: "string";
+            columnType: "PgText";
+            data: string;
+            driverParam: string;
+            notNull: true;
+            hasDefault: false;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: [string, ...string[]];
+            baseColumn: never;
+            identity: undefined;
+            generated: undefined;
+        }, {}, {}>;
+        entryKey: import("drizzle-orm/pg-core").PgColumn<{
+            name: "entry_key";
+            tableName: "foundry_release_events";
+            dataType: "string";
+            columnType: "PgText";
+            data: string;
+            driverParam: string;
+            notNull: true;
+            hasDefault: false;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: [string, ...string[]];
+            baseColumn: never;
+            identity: undefined;
+            generated: undefined;
+        }, {}, {}>;
+        at: import("drizzle-orm/pg-core").PgColumn<{
+            name: "at";
+            tableName: "foundry_release_events";
+            dataType: "date";
+            columnType: "PgTimestamp";
+            data: Date;
+            driverParam: string;
+            notNull: true;
+            hasDefault: false;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: undefined;
+            baseColumn: never;
+            identity: undefined;
+            generated: undefined;
+        }, {}, {}>;
+        kind: import("drizzle-orm/pg-core").PgColumn<{
+            name: "kind";
+            tableName: "foundry_release_events";
+            dataType: "string";
+            columnType: "PgText";
+            data: string;
+            driverParam: string;
+            notNull: true;
+            hasDefault: false;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: [string, ...string[]];
+            baseColumn: never;
+            identity: undefined;
+            generated: undefined;
+        }, {}, {}>;
+        payload: import("drizzle-orm/pg-core").PgColumn<{
+            name: "payload";
+            tableName: "foundry_release_events";
+            dataType: "json";
+            columnType: "PgJsonb";
+            data: Record<string, unknown>;
+            driverParam: unknown;
+            notNull: true;
+            hasDefault: true;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: undefined;
+            baseColumn: never;
+            identity: undefined;
+            generated: undefined;
+        }, {}, {
+            $type: Record<string, unknown>;
+        }>;
+    };
+    dialect: "pg";
+}>;
 export type DeclaredOrgRow = typeof declaredOrgs.$inferSelect;
 export type NewDeclaredOrgRow = typeof declaredOrgs.$inferInsert;
 export type AppliedStateRow = typeof foundryAppliedState.$inferSelect;

package/dist/store/schema.js

@@ -268,3 +268,12 @@ export const foundryReleaseRequests = pgTable('foundry_release_requests', {
     createdAt: timestamp('created_at', { withTimezone: true }).notNull().defaultNow(),
     consumedAt: timestamp('consumed_at', { withTimezone: true }),
 });
+/** Mirrors `migrations/0069_release_events.sql`: a release's history, appended by the release run and never changed. */
+export const foundryReleaseEvents = pgTable('foundry_release_events', {
+    id: bigserial('id', { mode: 'number' }).primaryKey(),
+    orgId: text('org_id').notNull(),
+    entryKey: text('entry_key').notNull(),
+    at: timestamp('at', { withTimezone: true }).notNull(),
+    kind: text('kind').notNull(),
+    payload: jsonb('payload').notNull().$type().default({}),
+});

package/dist/worker-app-config.d.ts

@@ -43,12 +43,28 @@ export interface WorkerAppConfig {
      * `KEYS_CREDENTIAL`, at most one) delivers a keys custody Worker credential
      * for the app's own host id (`workerAppHostId`), with `KEYS_URL` as a var.
      * `keys` (an issued API key) is refused: custody does not accept one.
+     * `heldSecret` is a value the company supplies (a webhook address, a vendor
+     * key): it is read from the held-key store at `heldEnvRef(orgId, entryKey, name)`,
+     * the ref a `heldSecret` env of a Coolify entry uses, and set on the Worker
+     * only while a value is held. With no value the Worker deploys without the
+     * secret and the plan says so.
      */
     secrets?: Record<string, {
         from: 'generated';
     } | {
         from: 'keysCustody';
+    } | {
+        from: 'heldSecret';
     }>;
+    /**
+     * Cloudflare cron triggers: at most three standard five-field cron
+     * expressions (minute hour day-of-month month day-of-week, UTC), each
+     * once. The Worker's `scheduled` handler receives them. Empty or absent
+     * clears the triggers.
+     */
+    triggers?: {
+        crons?: string[];
+    };
     /** True delivers the entry's sign-in env as Worker vars. Needs `uses.auth`. */
     authEnv?: boolean;
     /**
@@ -64,9 +80,14 @@ export interface WorkerAppConfig {
      * functions the runtime role may execute, as `name(type, ...)` or
      * `schema.name(type, ...)`: the security definer functions a migration
      * revoked from public, such as `@wtfalch/audit`'s ledger functions.
+     * `noDelete` names tables the runtime role may select, insert into and
+     * update but never delete from or truncate (a looser `appendOnly`: a table
+     * in both lists is refused). The app removes rows from them through a
+     * `grants` function, as a retention job does.
      */
     database?: {
         appendOnly?: string[];
+        noDelete?: string[];
         grants?: string[];
         migrationsSha256?: string;
     };
@@ -80,7 +101,7 @@ export declare const WORKER_APP_COMPATIBILITY_FLAGS: ReadonlySet<string>;
 export declare const WORKER_APP_INSTANCE_TYPES: ReadonlySet<string>;
 /** The most instances one container class may scale to. */
 export declare const WORKER_APP_MAX_INSTANCES = 100;
-export { WORKER_APP_APPEND_ONLY_MAX, WORKER_APP_GRANTS_MAX, WORKER_APP_KEYS_SECRET, WORKER_APP_RESERVED_NAMES, } from './entry-rules.js';
+export { WORKER_APP_APPEND_ONLY_MAX, WORKER_APP_CRONS_MAX, WORKER_APP_GRANTS_MAX, WORKER_APP_KEYS_SECRET, WORKER_APP_NO_DELETE_MAX, WORKER_APP_RESERVED_NAMES, } from './entry-rules.js';
 export declare const WORKER_APP_KEYS_URL_VAR = "KEYS_URL";
 /** True when the entry needs the org's Postgres database: a Coolify app with `database`, or a Worker app with `workerApp.database`. */
 export declare const entryHasDatabase: (entry: {

package/dist/worker-app-config.js

@@ -1,5 +1,5 @@
 import { createHash } from 'node:crypto';
-import { WORKER_APP_ENV_NAME as ENV_NAME, WORKER_APP_FUNCTION_SIGNATURE as FUNCTION_SIGNATURE, SECRET_LIKE_NAME as SECRET_NAME, WORKER_APP_TABLE_NAME as TABLE_NAME, WORKER_APP_APPEND_ONLY_MAX, WORKER_APP_GRANTS_MAX, WORKER_APP_KEYS_SECRET, WORKER_APP_RESERVED_NAMES, } from './entry-rules.js';
+import { WORKER_APP_ENV_NAME as ENV_NAME, WORKER_APP_FUNCTION_SIGNATURE as FUNCTION_SIGNATURE, SECRET_LIKE_NAME as SECRET_NAME, WORKER_APP_TABLE_NAME as TABLE_NAME, WORKER_APP_APPEND_ONLY_MAX, WORKER_APP_CRONS_MAX, WORKER_APP_GRANTS_MAX, WORKER_APP_KEYS_SECRET, WORKER_APP_NO_DELETE_MAX, WORKER_APP_RESERVED_NAMES, workerAppCronProblem, } from './entry-rules.js';
 import { validateSlug } from './slug.js';
 /** The compatibility flags a Worker app may ask for. */
 export const WORKER_APP_COMPATIBILITY_FLAGS = new Set(['nodejs_compat']);
@@ -13,7 +13,7 @@ export const WORKER_APP_INSTANCE_TYPES = new Set([
 ]);
 /** The most instances one container class may scale to. */
 export const WORKER_APP_MAX_INSTANCES = 100;
-export { WORKER_APP_APPEND_ONLY_MAX, WORKER_APP_GRANTS_MAX, WORKER_APP_KEYS_SECRET, WORKER_APP_RESERVED_NAMES, } from './entry-rules.js';
+export { WORKER_APP_APPEND_ONLY_MAX, WORKER_APP_CRONS_MAX, WORKER_APP_GRANTS_MAX, WORKER_APP_KEYS_SECRET, WORKER_APP_NO_DELETE_MAX, WORKER_APP_RESERVED_NAMES, } from './entry-rules.js';
 export const WORKER_APP_KEYS_URL_VAR = 'KEYS_URL';
 /** True when the entry needs the org's Postgres database: a Coolify app with `database`, or a Worker app with `workerApp.database`. */
 export const entryHasDatabase = (entry) => entry.database || Boolean(entry.workerApp?.database);
@@ -52,6 +52,9 @@ const MIGRATION_TAG = /^[A-Za-z0-9][A-Za-z0-9._-]{0,63}$/;
 const IMAGE_REPOSITORY = /^[a-z0-9]+([._-][a-z0-9]+)*(:[0-9]+)?(\/[a-z0-9]+([._-][a-z0-9]+)*)+$/;
 const COMPAT_DATE = /^\d{4}-\d{2}-\d{2}$/;
 const VAR_MAX_LENGTH = 1000;
+/** `heldEnvRef` in `org.ts`: the ref is at most 128 characters and 52 of them are fixed. */
+const HELD_REF_MAX = 128;
+const HELD_REF_FIXED = 52;
 /**
  * Checks an artifact reference: an https URL with no userinfo, query or
  * fragment (those end up verbatim in recorded scope ids) and a lowercase hex
@@ -193,9 +196,9 @@ export function validateEntryWorkerApp(entry, hosting, names) {
     if (Object.keys(entry.env).length > 0) {
         return `${at} has no Coolify app, so env does not apply: use workerApp.vars or workerApp.secrets`;
     }
-    const unsupported = Object.keys(entry.uses ?? {}).find((use) => use !== 'auth' && use !== 'audit');
+    const unsupported = Object.keys(entry.uses ?? {}).find((use) => use !== 'auth' && use !== 'audit' && use !== 'analytics');
     if (unsupported)
-        return `${at} supports uses.auth and uses.audit only, not uses.${unsupported}`;
+        return `${at} supports uses.auth, uses.audit and uses.analytics only, not uses.${unsupported}`;
     if (entry.key.length > WORKER_NAME_MAX_LENGTH - WORKER_NAME_FIXED_LENGTH) {
         return `${at} entry key is too long: the deployed Worker's name (an 8-character org hash, the key, and "${WORKER_APP_NAME_SUFFIX}") must fit Cloudflare's ${WORKER_NAME_MAX_LENGTH}-character limit`;
     }
@@ -278,6 +281,16 @@ export function validateEntryWorkerApp(entry, hosting, names) {
             return invalid;
         if (source?.from === 'generated')
             continue;
+        if (source?.from === 'heldSecret') {
+            if (name === WORKER_APP_KEYS_SECRET) {
+                return `${at} secret '${name}' is the custody credential: declare it as keysCustody, not heldSecret`;
+            }
+            // `heldEnvRef`'s own limit (org.ts restates the ref: this file cannot import it).
+            if (HELD_REF_FIXED + entry.key.length + name.length > HELD_REF_MAX) {
+                return `${at} secret '${name}' heldSecret: the name and the entry key are too long to hold a value under (at most ${HELD_REF_MAX - HELD_REF_FIXED} characters together)`;
+            }
+            continue;
+        }
         if (source?.from !== 'keysCustody')
             return `${at} secret '${name}' has an unknown source`;
         keysSecrets++;
@@ -312,6 +325,9 @@ export function validateEntryWorkerApp(entry, hosting, names) {
             // Not a URL: nothing to check.
         }
     }
+    const invalidTriggers = validateWorkerAppTriggers(at, app);
+    if (invalidTriggers)
+        return invalidTriggers;
     const invalidDatabase = validateWorkerAppDatabase(at, app);
     if (invalidDatabase)
         return invalidDatabase;
@@ -332,11 +348,11 @@ function validateWorkerAppDatabase(at, app) {
     if (database === undefined)
         return null;
     if (typeof database !== 'object' || database === null || Array.isArray(database)) {
-        return `${at} database must be an object: { appendOnly?: string[]; grants?: string[]; migrationsSha256?: string }`;
+        return `${at} database must be an object: { appendOnly?: string[]; noDelete?: string[]; grants?: string[]; migrationsSha256?: string }`;
     }
-    const unknown = Object.keys(database).find((key) => key !== 'appendOnly' && key !== 'grants' && key !== 'migrationsSha256');
+    const unknown = Object.keys(database).find((key) => key !== 'appendOnly' && key !== 'noDelete' && key !== 'grants' && key !== 'migrationsSha256');
     if (unknown) {
-        return `${at} database.${unknown} is not a setting: only appendOnly, grants and migrationsSha256`;
+        return `${at} database.${unknown} is not a setting: only appendOnly, noDelete, grants and migrationsSha256`;
     }
     const grants = database.grants;
     if (grants !== undefined) {
@@ -357,21 +373,63 @@ function validateWorkerAppDatabase(at, app) {
     if (sha !== undefined && (typeof sha !== 'string' || !SHA256_HEX.test(sha))) {
         return `${at} database.migrationsSha256 must be 64 lowercase hex characters`;
     }
-    const appendOnly = database.appendOnly;
-    if (appendOnly === undefined)
-        return null;
-    if (!Array.isArray(appendOnly) || appendOnly.length > WORKER_APP_APPEND_ONLY_MAX) {
-        return `${at} database.appendOnly must be a list of at most ${WORKER_APP_APPEND_ONLY_MAX} table names`;
+    const appendOnly = tableList(at, 'appendOnly', WORKER_APP_APPEND_ONLY_MAX, database);
+    if (typeof appendOnly === 'string')
+        return appendOnly;
+    const noDelete = tableList(at, 'noDelete', WORKER_APP_NO_DELETE_MAX, database);
+    if (typeof noDelete === 'string')
+        return noDelete;
+    const both = noDelete.find((table) => appendOnly.includes(table));
+    if (both) {
+        return `${at} database.noDelete names '${both}', which database.appendOnly already covers (append-only is stricter): name it in one list`;
+    }
+    return null;
+}
+/** A table list (`appendOnly` or `noDelete`) of `database`: its names, or the refusal. */
+function tableList(at, key, max, database) {
+    const list = database[key];
+    if (list === undefined)
+        return [];
+    if (!Array.isArray(list) || list.length > max) {
+        return `${at} database.${key} must be a list of at most ${max} table names`;
     }
     const seen = new Set();
-    for (const table of appendOnly) {
+    for (const table of list) {
         if (typeof table !== 'string' || !TABLE_NAME.test(table)) {
-            return `${at} database.appendOnly names '${String(table).slice(0, 80)}', which is not a table name (letters, digits and '_', optionally schema.table)`;
+            return `${at} database.${key} names '${String(table).slice(0, 80)}', which is not a table name (letters, digits and '_', optionally schema.table)`;
         }
         if (seen.has(table))
-            return `${at} database.appendOnly names '${table}' twice`;
+            return `${at} database.${key} names '${table}' twice`;
         seen.add(table);
     }
+    return [...seen];
+}
+/** `triggers`: only `crons`, at most {@link WORKER_APP_CRONS_MAX}, each a standard five-field cron, each once. */
+function validateWorkerAppTriggers(at, app) {
+    const triggers = app.triggers;
+    if (triggers === undefined)
+        return null;
+    if (typeof triggers !== 'object' || triggers === null || Array.isArray(triggers)) {
+        return `${at} triggers must be an object: { crons?: string[] }`;
+    }
+    const unknown = Object.keys(triggers).find((key) => key !== 'crons');
+    if (unknown)
+        return `${at} triggers.${unknown} is not a trigger: only crons`;
+    const crons = triggers.crons;
+    if (crons === undefined)
+        return null;
+    if (!Array.isArray(crons) || crons.length > WORKER_APP_CRONS_MAX) {
+        return `${at} triggers.crons must be a list of at most ${WORKER_APP_CRONS_MAX} cron expressions (Cloudflare's limit for one Worker)`;
+    }
+    const seen = new Set();
+    for (const cron of crons) {
+        const problem = workerAppCronProblem(cron);
+        if (problem)
+            return `${at} triggers.crons: ${problem}`;
+        if (seen.has(cron))
+            return `${at} triggers.crons names '${cron}' twice`;
+        seen.add(cron);
+    }
     return null;
 }
 function validateDurableObjects(at, app, claim) {