@kedge/cli 0.9.0 → 0.10.0

package/src/main.ts

@@ -2,19 +2,28 @@
 // commands (`staff invite-owner`, `staff recover`, `keys create`); doctor,
 // check, preview and deploy arrive with P0.8 (docs/11).
 import { spawnSync } from "node:child_process";
-import { cpSync, existsSync, mkdtempSync, readdirSync, readFileSync, rmSync, writeFileSync } from "node:fs";
-import { tmpdir } from "node:os";
+import { cpSync, existsSync, readdirSync, readFileSync, writeFileSync } from "node:fs";
 import { dirname, join, relative, resolve } from "node:path";
 import { fileURLToPath, pathToFileURL } from "node:url";
 import type { KedgeConfig } from "@kedge/core";
-import { type CliBatch, ownerInviteSql, publishableKeySql, recoverSql } from "@kedge/db";
-import { type Cloudflare, restCloudflare } from "./cf";
+import { ownerInviteSql, publishableKeySql, recoverSql } from "@kedge/db";
+import {
+  type Cloudflare,
+  cloudflareBase,
+  cloudflareFor,
+  NeedsPerson,
+  resolveCloudflare,
+  restCloudflare,
+  sameAccount,
+  wranglerBin,
+} from "./cf";
 import { check as runCheck } from "./check";
 import {
   type CommandDeps,
   deployCommand,
   devCommand,
   ejectCommand,
+  failureOf,
   flag,
   generateSupersede,
   keysOverHttp,
@@ -23,12 +32,15 @@ import {
   restoreCommand,
   secretCommand,
   seedCommand,
+  smokeCommand,
   upgradeCommand,
 } from "./commands";
 import { ComposeError, compose, type Lock } from "./compose";
-import { doctor, doctorRemote, formatReport } from "./doctor";
+import { type Executor, wranglerExecute } from "./d1-batch";
+import { credentialsChecks, doctor, doctorRemote, formatReport } from "./doctor";
 import { invariantsMarkdown, invariantsOf } from "./invariants";
 import { installedPackages } from "./manifest";
+import { emit, withJsonOutput } from "./output";
 import { composedTexts, schemaOf } from "./schema";
 import { storeNames } from "./store";
 import { compileStoreZone } from "./tz";
@@ -51,9 +63,10 @@ const USAGE = `usage: kedge generate [--check] [--supersede <op-id>]
        kedge doctor --core-diff [--upstream <manifest>] [--strict]
        kedge secret put <NAME> | kedge secret delete <NAME>
        kedge restore --list
-       kedge seed --sample apparel --url <url> (--key <sk_…> | --session <token>) [--live]
+       kedge seed --sample apparel --url <url> [--key <sk_…> | --session <token>] [--live]
+       kedge smoke --url <url> [--run <name>] [--live]
        kedge keys create (--publishable [--origin <url>]... | --secret --grant <permission>...)
-                         --url <url> (--session <token> | --sign-in <email>) [--name <name>]
+                         --url <url> (--session <token> | --sign-in <email> [--answers-stdin] | --save) [--name <name>]
        kedge staff invite-owner <email> [--database DB] [--remote] [--url <url>] [--config wrangler.jsonc]
        kedge staff recover <email> [--database DB] [--remote] [--config wrangler.jsonc]
        kedge keys create --publishable --name <name> [--origin <origin>]... [--pepper-version N]
@@ -71,6 +84,8 @@ const USAGE = `usage: kedge generate [--check] [--supersede <op-id>]
   upgrade             every @kedge package to a release one supported step on, its codemods,
                       UPGRADE-TODO.md, then generate and check; nothing is committed
   restore --list      the restore points; restoring waits for P1.18
+  smoke               a test order on one of this store's own URLs: a cart, completion and
+                      placement, resumed by its --run name until it has its number
   check               typecheck, generate --check, doctor, then the store's tests;
                       --fast stops before the tests (the Stop hook's)
   doctor              the store's offline checks: lock, installed core, error map,
@@ -81,40 +96,13 @@ const USAGE = `usage: kedge generate [--check] [--supersede <op-id>]
                       KEDGE_KEY_PEPPER_V<N> in the environment (N defaults to 1)
 
   The staff and keys commands run one audited batch through wrangler d1 execute
-  (--local unless --remote) and print the secret once.`;
-
-/** Runs one CLI batch against the store's D1; tests replace it. */
-export type Executor = (
-  b: CliBatch,
-  opts: { database: string; remote: boolean; cwd: string; config?: string },
-) => number;
+  (--local unless --remote) and print the secret once.
 
-const wranglerExecute: Executor = (b, opts) => {
-  const dir = mkdtempSync(join(tmpdir(), "kedge-"));
-  const file = join(dir, "batch.sql");
-  try {
-    writeFileSync(file, b.sql, { mode: 0o600 });
-    const r = spawnSync(
-      "npx",
-      [
-        "wrangler",
-        "d1",
-        "execute",
-        opts.database,
-        "--file",
-        file,
-        opts.remote ? "--remote" : "--local",
-        "--yes",
-        ...(opts.config ? ["-c", opts.config] : []),
-      ],
-      { cwd: opts.cwd, stdio: "inherit" },
-    );
-    return r.status ?? 1;
-  } finally {
-    // The file holds no secret (only digests), but it needn't outlive the run.
-    rmSync(dir, { recursive: true, force: true });
-  }
-};
+  deploy, preview, seed, staff and keys take --json: one object on stdout when they
+  end ({"ok": true, ...}, or {"ok": false, "error"} / {"ok": false, "handoff"}),
+  everything else on stderr. Exit 3 means a person must act: the last line of stderr
+  starts "for you:". --sign-in asks only a terminal; --answers-stdin reads one line
+  per question from a pipe, waiting 30 seconds for each.`;
 
 /**
  * The store's origin for the invite link (p0.9 §3.5): `--url`, or with
@@ -133,7 +121,7 @@ async function inviteOrigin(
   if (!remote) return null;
   try {
     const worker = storeNames(cwd).names.worker;
-    return `https://${worker}.${await (cf ?? restCloudflare(env)).workersSubdomain()}.workers.dev`;
+    return `https://${worker}.${await (cf ?? (await cloudflareFor(env, cwd))).workersSubdomain()}.workers.dev`;
   } catch {
     return null;
   }
@@ -145,50 +133,87 @@ async function bootstrap(
   cwd: string,
   execute: Executor,
   env: NodeJS.ProcessEnv,
-  cf?: Cloudflare,
+  o: { json: boolean; emit?: (result: Record<string, unknown>) => void; cf?: Cloudflare },
 ): Promise<number> {
+  const cf = o.cf;
+  const result = (r: Record<string, unknown>) => {
+    if (o.json) (o.emit ?? emit)(r);
+  };
+  // A usage error is an end too: under --json it's an object, never an empty stdout (codex code r8).
+  const usage = (message: string) => {
+    console.error(message);
+    result({ ok: false, error: message.split("\n")[0] });
+    return 2;
+  };
+  // Wrangler's own words are on stderr already; the object says only that the batch didn't finish.
+  const failed = (status: number) => {
+    result({ ok: false, error: `wrangler d1 execute exited ${status}` });
+    return status;
+  };
   const config = flag(args, "--config");
+  const remote = args.includes("--remote");
+  // Resolved before any write, as every remote command does (p0.10 §4): no credentials is the
+  // handoff, exit 3, never Wrangler's own failure; and the batch goes where the resolver says,
+  // salve's broker included (codex code r2).
+  const auth = remote ? await resolveCloudflare(env, cwd) : null;
+  // A --config of another file is what Wrangler reads, so its account_id must agree too.
+  if (auth && config) sameAccount(auth.account, resolve(cwd, config));
+  const base = cloudflareBase(env);
   const opts = {
     database: flag(args, "--database") ?? "DB",
-    remote: args.includes("--remote"),
+    remote,
     cwd,
     ...(config ? { config } : {}),
+    ...(auth
+      ? {
+          env: {
+            CLOUDFLARE_API_TOKEN: auth.token(),
+            CLOUDFLARE_ACCOUNT_ID: auth.account,
+            // Always, the default included: Wrangler would otherwise take one from the store's
+            // dotenv files and send this token there (codex code r4).
+            CLOUDFLARE_API_BASE_URL: base,
+          },
+        }
+      : {}),
   };
   const now = Date.now();
   const [sub, target] = args;
   if (command === "staff" && (sub === "invite-owner" || sub === "recover") && target && !target.startsWith("--")) {
     const b = sub === "invite-owner" ? await ownerInviteSql(target, now) : await recoverSql(target, now);
     const status = execute(b, opts);
-    if (status !== 0) return status;
-    console.log(`invite ${b.inviteId} for ${target}, valid until ${new Date(b.expiresAt).toISOString()}`);
+    if (status !== 0) return failed(status);
+    const expires = new Date(b.expiresAt).toISOString();
+    console.log(`invite ${b.inviteId} for ${target}, valid until ${expires}`);
     console.log(`accept with POST /auth/admin/invites/accept and this token (shown once):\n${b.token}`);
     const origin = await inviteOrigin(args, opts.remote, cwd, env, cf);
     // The token rides in the fragment, which no server log or Referer carries (p0.9 §3.5).
-    if (origin) console.log(`or open the admin's invite page:\n${origin}/app/invite#${b.token}`);
+    const link = origin ? `${origin}/app/invite#${b.token}` : null;
+    if (link) console.log(`or open the admin's invite page:\n${link}`);
+    result({ ok: true, invite: b.inviteId, email: target, expires_at: expires, token: b.token, link });
     return 0;
   }
   if (command === "keys" && sub === "create" && args.includes("--publishable")) {
     const name = flag(args, "--name");
-    if (!name) {
-      console.error("keys create needs --name");
-      return 2;
-    }
+    if (!name) return usage("keys create needs --name");
     const origins = args.flatMap((a, i) => (a === "--origin" && args[i + 1] ? [args[i + 1] as string] : []));
     const pepperVersion = Number(flag(args, "--pepper-version") ?? "1");
     const pepper = env[`KEDGE_KEY_PEPPER_V${pepperVersion}`];
-    if (!Number.isSafeInteger(pepperVersion) || pepperVersion < 1 || !pepper) {
-      console.error(`set KEDGE_KEY_PEPPER_V${pepperVersion} to the Worker's pepper secret first`);
-      return 2;
-    }
+    if (!Number.isSafeInteger(pepperVersion) || pepperVersion < 1)
+      return usage("--pepper-version takes a whole number from 1");
+    // The pepper lives in the merchant's own vault, or only in the Worker: theirs to hand over (p0.10 §5).
+    if (!pepper)
+      throw new NeedsPerson(
+        `set KEDGE_KEY_PEPPER_V${pepperVersion} to the Worker's pepper secret, or create the key with --url and --sign-in, which keeps the pepper in the Worker`,
+      );
     const b = await publishableKeySql({ name, origins, pepperVersion, pepper }, now);
     const status = execute(b, opts);
-    if (status !== 0) return status;
+    if (status !== 0) return failed(status);
     console.log(`storefront ${b.storefrontId}, key ${b.keyId}`);
     console.log(`publishable key (send as x-kedge-key; shown once):\n${b.key}`);
+    result({ ok: true, storefront: b.storefrontId, key_id: b.keyId, key: b.key });
     return 0;
   }
-  console.error(USAGE);
-  return 2;
+  return usage(USAGE);
 }
 
 const INDEX_START = "<!-- kedge:docs-index:start -->";
@@ -218,13 +243,18 @@ function agentsIndex(cwd: string): { path: string; text: string } | null {
   return { path, text: `${current.slice(0, a + INDEX_START.length)}\n${lines.join("\n")}\n${current.slice(b)}` };
 }
 
-/** Skills ship in @kedge/docs and are copied, gitignored, so they always match what's installed (§9.3). */
+/**
+ * Skills ship in @kedge/docs and are copied, gitignored, so they always match
+ * what's installed (§9.3): into `.claude/skills` for Claude Code, and into
+ * `.agents/skills`, where salve and other agents read them (p0.10 §2, §6.4).
+ */
 function copySkills(cwd: string): string[] {
   const docs = installedPackages(cwd).get("@kedge/docs");
   if (!docs || !existsSync(join(docs, "skills")) || !existsSync(join(cwd, ".claude"))) return [];
   const out: string[] = [];
   for (const s of readdirSync(join(docs, "skills"))) {
-    cpSync(join(docs, "skills", s), join(cwd, ".claude", "skills", s), { recursive: true });
+    for (const home of [".claude", ".agents"])
+      cpSync(join(docs, "skills", s), join(cwd, home, "skills", s), { recursive: true });
     out.push(s);
   }
   return out;
@@ -251,29 +281,46 @@ function coreMigrationsDir(): string {
   return join(dirname(entry), "..", "migrations");
 }
 
-export async function main(
-  argv: string[],
-  cwd: string,
-  deps: { execute?: Executor; env?: NodeJS.ProcessEnv; cf?: Cloudflare } = {},
-): Promise<number> {
+interface RunDeps {
+  execute?: Executor;
+  env?: NodeJS.ProcessEnv;
+  cf?: Cloudflare;
+  /** Where `--json`'s object goes; tests read it. */
+  emit?: (result: Record<string, unknown>) => void;
+}
+
+/** The commands an agent reads the result of (p0.10 §5); doctor has its own `--json`. */
+const JSON_COMMANDS = new Set(["deploy", "preview", "staff", "keys", "seed", "smoke"]);
+
+async function run(argv: string[], cwd: string, deps: RunDeps & { json: boolean }): Promise<number> {
   const [command, ...flags] = argv;
+  const out = {
+    json: deps.json,
+    ...(deps.emit ? { emit: deps.emit } : {}),
+    ...(deps.execute ? { execute: deps.execute } : {}),
+  };
   if (command === "keys" && flag(flags, "--url")) {
-    const d0: CommandDeps = { cwd, env: deps.env ?? process.env, coreDir: coreMigrationsDir() };
+    const d0: CommandDeps = { cwd, env: deps.env ?? process.env, coreDir: coreMigrationsDir(), ...out };
     return keysOverHttp(flags, d0);
   }
   if (command === "staff" || command === "keys")
-    return bootstrap(command, flags, cwd, deps.execute ?? wranglerExecute, deps.env ?? process.env, deps.cf);
+    return bootstrap(command, flags, cwd, deps.execute ?? wranglerExecute, deps.env ?? process.env, {
+      ...out,
+      ...(deps.cf ? { cf: deps.cf } : {}),
+    });
   const d: CommandDeps = {
     cwd,
     env: deps.env ?? process.env,
     coreDir: coreMigrationsDir(),
     checkFast: () => main(["check", "--fast"], cwd),
+    ...out,
   };
   if (command === "deploy") return deployCommand(flags, d);
   if (command === "migrate") return migrateCommand(flags, d);
   if (command === "restore") return restoreCommand(flags, d);
   if (command === "secret") return secretCommand(flags, d);
   if (command === "seed") return seedCommand(flags, d);
+  if (command === "smoke") return smokeCommand(flags, d);
   if (command === "preview") return previewCommand(flags, d);
   if (command === "eject") return ejectCommand(flags, d);
   if (command === "upgrade")
@@ -302,11 +349,35 @@ export async function main(
   if (command === "doctor") {
     const results = await doctor({ cwd, coreDir: coreMigrationsDir() });
     if (flags.includes("--remote")) {
-      const cf = restCloudflare(d.env);
-      const lock = JSON.parse(readFileSync(join(cwd, "kedge.lock.json"), "utf8")) as Lock;
-      results.push(...(await doctorRemote({ cwd, cf, lock, logpushJobs: () => cf.logpushJobs() })));
+      let auth: Awaited<ReturnType<typeof resolveCloudflare>> | null = null;
+      try {
+        auth = await resolveCloudflare(d.env, cwd);
+      } catch (e) {
+        // No credentials is a check that failed and a handoff, with the offline report still printed (codex code r8).
+        if (!(e instanceof NeedsPerson)) throw e;
+        results.push({ name: "credentials", status: "fail", message: e.handoff, handoff: e.handoff });
+      }
+      if (auth) {
+        const cf = restCloudflare(d.env, fetch, wranglerBin(), auth);
+        const lock = JSON.parse(readFileSync(join(cwd, "kedge.lock.json"), "utf8")) as Lock;
+        const creds = await credentialsChecks({ cf, source: auth.source, base: cloudflareBase(d.env) });
+        results.push(...creds);
+        // Credentials that can't read the account would make every later check throw, not report (codex code r7).
+        if (creds.some((c) => c.status === "fail"))
+          results.push({
+            name: "remote",
+            status: "skip",
+            message: "the store's resources weren't read: fix the credentials first",
+          });
+        else results.push(...(await doctorRemote({ cwd, cf, lock, logpushJobs: () => cf.logpushJobs() })));
+      }
     }
     console.log(flags.includes("--json") ? JSON.stringify({ checks: results }, null, 2) : formatReport(results));
+    const handoff = results.find((r) => r.handoff)?.handoff;
+    if (handoff) {
+      console.error(`for you: ${handoff}`);
+      return 3;
+    }
     return results.some((r) => r.status === "fail") ? 1 : 0;
   }
   if (command === "check")
@@ -376,3 +447,24 @@ export async function main(
     throw e;
   }
 }
+
+/**
+ * The CLI. A handoff from any command ends it with exit 3 and one sentence for
+ * whoever runs it to pass on (p0.10 §5).
+ */
+export async function main(argv: string[], cwd: string, deps: RunDeps = {}): Promise<number> {
+  const [command, ...flags] = argv;
+  const json = flags.includes("--json") && JSON_COMMANDS.has(command ?? "");
+  return withJsonOutput(json, async () => {
+    try {
+      return await run(argv, cwd, { ...deps, json });
+    } catch (e) {
+      // What escapes a command's own handling (bootstrap, doctor) ends the same way (p0.10 §5).
+      const f = failureOf(e);
+      if (!f) throw e;
+      console.error(f.line);
+      if (json) (deps.emit ?? emit)(f.result);
+      return f.code;
+    }
+  });
+}

package/src/ops.ts

@@ -18,6 +18,8 @@ export type Query = (sql: string, params?: readonly unknown[]) => Promise<Row[]>
 
 export const OPS_SCHEMA = [
   `CREATE TABLE IF NOT EXISTS kedge_ops_meta (id INTEGER PRIMARY KEY CHECK (id = 1), store TEXT NOT NULL, created_at INTEGER NOT NULL)`,
+  // The store's choices made once (p0.10 §7: its jurisdiction), each written once and never changed.
+  `CREATE TABLE IF NOT EXISTS ops_setting (name TEXT PRIMARY KEY, value TEXT NOT NULL, created_at INTEGER NOT NULL)`,
   `CREATE TABLE IF NOT EXISTS operation (
     scope TEXT PRIMARY KEY, op_id TEXT NOT NULL UNIQUE, kind TEXT NOT NULL, plan TEXT NOT NULL, step TEXT NOT NULL,
     progress TEXT NOT NULL DEFAULT '{}',
@@ -136,6 +138,22 @@ export class OpsStore {
       throw new Error(`this operations database belongs to ${String(meta?.store)}, not ${store}`);
   }
 
+  /** A setting written once; the value already recorded wins, and is what this answers. */
+  async settle(name: string, value: string): Promise<string> {
+    await this.q("INSERT INTO ops_setting (name, value, created_at) VALUES (?, ?, ?) ON CONFLICT (name) DO NOTHING", [
+      name,
+      value,
+      this.now(),
+    ]);
+    const [r] = await this.q("SELECT value FROM ops_setting WHERE name = ?", [name]);
+    return String(r?.value);
+  }
+
+  async setting(name: string): Promise<string | null> {
+    const [r] = await this.q("SELECT value FROM ops_setting WHERE name = ?", [name]);
+    return r ? String(r.value) : null;
+  }
+
   // ---- operations --------------------------------------------------------------------------------------
   async current(scope: string): Promise<OperationRow | null> {
     return ((await this.q("SELECT * FROM operation WHERE scope = ?", [scope]))[0] as OperationRow | undefined) ?? null;

package/src/output.ts

@@ -0,0 +1,35 @@
+// `--json` (p0.10 §5): stdout carries one object when the command ends, and
+// nothing else, so an agent parses it whole. Progress still reaches a person,
+// on stderr: console.log is pointed there for the command's run, and every
+// child the CLI starts (Wrangler, the store's checks and scenarios) writes its
+// stdout there too, since a child's line on stdout would break the object.
+import type { StdioOptions } from "node:child_process";
+
+let reserved = false;
+
+/** Runs `work` with stdout reserved for `emit` when `on`; nested runs keep the outer setting. */
+export async function withJsonOutput<T>(on: boolean, work: () => Promise<T>): Promise<T> {
+  if (!on || reserved) return work();
+  const log = console.log;
+  const info = console.info;
+  reserved = true;
+  console.log = console.error;
+  console.info = console.error;
+  try {
+    return await work();
+  } finally {
+    reserved = false;
+    console.log = log;
+    console.info = info;
+  }
+}
+
+/** The command's one result object. */
+export function emit(result: Record<string, unknown>): void {
+  process.stdout.write(`${JSON.stringify(result)}\n`);
+}
+
+/** A child's stdio: inherited, except that its stdout goes to stderr while stdout is reserved. */
+export function childStdio(): StdioOptions {
+  return reserved ? ["inherit", 2, "inherit"] : "inherit";
+}

package/src/preview.ts

@@ -27,12 +27,13 @@ import { tmpdir } from "node:os";
 import { join } from "node:path";
 import { ownerInviteSql } from "@kedge/db";
 import { enrolOwner, type StoreCredentials } from "@kedge/testing/http";
-import { type Cloudflare, UnknownOutcome } from "./cf";
+import { type Cloudflare, type JurisdictionChoice, UnknownOutcome } from "./cf";
 import { seed } from "./commands";
 import type { Lock } from "./compose";
 import { CORE_SECRETS, DeployRefused, openOps, stageAssets } from "./deploy";
 import { assetsShape, declaredClasses, readWrangler } from "./doctor";
 import { LostOwnership, OperationHeld, type OpsStore } from "./ops";
+import { childStdio } from "./output";
 import { hashTree, type StoreNames, sha256, type WranglerJson } from "./store";
 import { readTar, type TarEntry, TarRefused, writeTar } from "./tar";
 
@@ -430,6 +431,8 @@ export interface ApplyInput {
   name?: string;
   /** Secrets the caller grants from its own environment (--secret-env). */
   secretEnv?: readonly string[];
+  /** The person's choice, when this preview is the store's first resource (p0.10 §7). */
+  jurisdiction?: JurisdictionChoice;
   env: NodeJS.ProcessEnv;
   fresh?: boolean;
   takeOver?: string;
@@ -466,7 +469,8 @@ export async function applyPlan(input: ApplyInput): Promise<Applied> {
   const { dir: staging, plan } = stagePlan(input.stream);
   const store = input.store ?? plan.store;
   const name = input.name ?? plan.name;
-  const { ops } = await openOps(input.cf, opsNames(store), input.now);
+  // A preview before the first deploy makes <store>-ops, so it fixes the store's jurisdiction; it takes its store's.
+  const { ops, jurisdiction } = await openOps(input.cf, opsNames(store), input.now, input.jurisdiction ?? "ask");
   const scope = `preview:${store}/${name}`;
   const key = input.env.KEDGE_PREVIEW_KEY;
   if (!key) throw new DeployRefused("set KEDGE_PREVIEW_KEY: a preview's credentials are sealed under it");
@@ -478,7 +482,19 @@ export async function applyPlan(input: ApplyInput): Promise<Applied> {
   } else opId = await ops.start(scope, "preview", { modules: plan.modules, migrations: plan.migrations }, "start");
   const release = (outcome: string) => ops.finish(scope, opId, outcome, [{ modules: plan.modules }]);
   try {
-    const p = new PreviewRun(input, ops, scope, opId, staging, plan, `${store}/${name}`, store, name, key, log);
+    const p = new PreviewRun(
+      { ...input, jurisdiction },
+      ops,
+      scope,
+      opId,
+      staging,
+      plan,
+      `${store}/${name}`,
+      store,
+      name,
+      key,
+      log,
+    );
     const out = await p.run();
     return { ...out, release };
   } catch (e) {
@@ -604,7 +620,10 @@ class PreviewRun {
       if (found) return found;
       const id = await this.ops.openIntent(this.scope, this.opId, "create", kind, row.worker, { name: nameOf });
       try {
-        const out = await (kind === "d1" ? this.cf.createD1(nameOf) : this.cf.createQueue(nameOf));
+        const j = this.input.jurisdiction ?? "none";
+        const out = await (kind === "d1"
+          ? this.cf.createD1(nameOf, j === "none" ? null : j)
+          : this.cf.createQueue(nameOf));
         await this.ops.closeIntent(id, "done", "answer");
         return out;
       } catch (e) {
@@ -620,6 +639,13 @@ class PreviewRun {
       }
     };
     const databaseId = await create("d1", row.database_name, row.database_id);
+    // Recorded, found or made, the preview's database is accepted only where its store's data lives (p0.10 §7):
+    // one replaced outside Kedge would take the preview's writes elsewhere (codex code r13).
+    const where = await this.cf.d1Jurisdiction(databaseId);
+    if (where !== (this.input.jurisdiction ?? "none"))
+      throw new DeployRefused(
+        `${row.database_name} is in jurisdiction ${where}, and this store's is ${this.input.jurisdiction ?? "none"}`,
+      );
     await this.write("database_id = ?", [databaseId]);
     const queueId = await create("queue", row.queue_name, row.queue_id);
     await this.write("queue_id = ?", [queueId]);
@@ -632,7 +658,8 @@ class PreviewRun {
       databaseId,
       migrationsDir: join(this.staging, "migrations"),
       queue: row.queue_name,
-      vars: this.plan.vars,
+      // The store's jurisdiction, never the plan's: a preview's objects live where its store's do (p0.10 §7).
+      vars: { ...this.plan.vars, KEDGE_JURISDICTION: this.input.jurisdiction ?? "none" },
       ...(this.plan.assets ? { assetsDir: join(this.staging, "assets") } : {}),
     });
     const configFile = join(this.staging, "..", `${row.worker}.wrangler.json`);
@@ -989,7 +1016,7 @@ export function runScenarios(cwd: string, credentials: StoreCredentials, env: No
     );
     const r = spawnSync(join(cwd, "node_modules", ".bin", "vitest"), ["run", "--config", config], {
       cwd,
-      stdio: "inherit",
+      stdio: childStdio(),
       env: { ...env, KEDGE_PREVIEW_CREDENTIALS: JSON.stringify(credentials) },
     });
     return r.status ?? 1;