@runeditrun/rer 0.0.0-stage → 0.1.1

package/modules/deploy-kit/prepare.mjs

@@ -0,0 +1,62 @@
+import { execFileSync } from 'node:child_process';
+import { mkdir, writeFile, readdir, rm } from 'node:fs/promises';
+import { resolve, join, relative } from 'node:path';
+import { pathToFileURL } from 'node:url';
+import { assert, hash, localPath } from './validation.mjs';
+import { collectFiles, regularBytes, validateArtifact, MAX_ARTIFACT } from './artifact.mjs';
+import { collectBuildModules } from './build-modules.mjs';
+import { refuseLocalModels } from './local-only.mjs';
+
+export function assertCredentialFree(env) {
+  for (const [key,value] of Object.entries(env)) if (value && /(?:TOKEN|SECRET|PASSWORD|API_KEY|PRIVATE_KEY|AUTHORIZATION|COOKIE|CREDENTIAL)/i.test(key)) throw new Error('prepare-credential-environment-forbidden');
+  assert(!env.NODE_OPTIONS && !env.NODE_PATH,'prepare-node-injection-forbidden');
+}
+function run(argv, cwd, env) {
+  try { return execFileSync(argv[0],argv.slice(1),{cwd,env,encoding:'utf8',stdio:['ignore','pipe','pipe'],timeout:15*60*1000,maxBuffer:1024*1024}); }
+  catch { throw new Error('prepare-command-failed'); }
+}
+export async function packageBuild({root,source,runIdentity,productDirectory = 'default-seed'}) {
+  assert(productDirectory === '' || localPath(productDirectory), 'invalid-product-directory');
+  const product = join(root,productDirectory);
+  await refuseLocalModels(root);
+  if (product !== root) await refuseLocalModels(product);
+  const build = join(product,'dist/server');
+  const config = JSON.parse(await regularBytes(join(build,'wrangler.json'),1024*1024));
+  const main = localPath(relative(build,resolve(build,config.main)));
+  const modules = await collectBuildModules(build,config,main);
+  const assets = await collectFiles(join(product,'dist/client'));
+  const migrations = [];
+  for (const name of (await readdir(join(product,'migrations/core'))).sort()) {
+    assert(/^[0-9]+_[a-zA-Z0-9_-]+\.sql$/.test(name),'unexpected-migration-file');
+    const sql = (await regularBytes(join(product,'migrations/core',name),512000)).toString('utf8'); migrations.push({binding:'DB',name,sql,sha256:hash(sql)});
+  }
+  const artifact = {version:1,source,run:runIdentity,main,modules,assets,migrations}; validateArtifact(artifact);
+  return artifact;
+}
+export async function prepare(env = process.env) {
+  assertCredentialFree(env);
+  assert(process.platform === 'linux' && env.RER_PREPARE_ISOLATION === 'ephemeral-credential-free-job','prepare-requires-isolated-linux-job');
+  assert(/^[a-f0-9]{40}$/.test(env.RER_DEPLOY_SOURCE_SHA ?? '') && /^\d+$/.test(env.RER_DEPLOY_RUN_ID ?? '') && /^\d+$/.test(env.RER_DEPLOY_RUN_ATTEMPT ?? ''),'missing-prepare-identity');
+  const root = process.cwd();
+  assert(env.RER_DEPLOY_ARTIFACT && resolve(env.RER_DEPLOY_ARTIFACT) !== root && !resolve(env.RER_DEPLOY_ARTIFACT).startsWith(root+'/'),'artifact-must-be-outside-checkout');
+  const home = resolve(env.RER_PREPARE_HOME ?? ''); assert(home !== root && !home.startsWith(root+'/') && env.RER_PREPARE_HOME,'missing-isolated-home');
+  await mkdir(home,{recursive:false,mode:0o700});
+  try {
+  const cleanEnv = {PATH:env.PATH,HOME:home,CI:'true',WRANGLER_SEND_METRICS:'false',CLOUDFLARE_LOAD_DEV_VARS_FROM_DOT_ENV:'false'};
+  const git = (...args) => run(['git',...args],root,cleanEnv).trim();
+  const source = {sha:git('rev-parse','HEAD'),tree:git('rev-parse','HEAD^{tree}')};
+  assert(source.sha === env.RER_DEPLOY_SOURCE_SHA && !git('status','--porcelain','--untracked-files=no'),'prepare-source-mismatch');
+  run(['pnpm','install','--frozen-lockfile'],root,cleanEnv);
+  run(['pnpm','--dir','default-seed','build'],root,cleanEnv);
+  assert(git('rev-parse','HEAD') === source.sha && !git('status','--porcelain','--untracked-files=no'),'source-changed-during-build');
+  const artifact = await packageBuild({root,source,runIdentity:{id:env.RER_DEPLOY_RUN_ID,attempt:env.RER_DEPLOY_RUN_ATTEMPT}});
+  const bytes = JSON.stringify(artifact); assert(Buffer.byteLength(bytes) <= MAX_ARTIFACT,'artifact-too-large');
+  await writeFile(env.RER_DEPLOY_ARTIFACT,bytes,{flag:'wx',mode:0o600});
+  // Public digest only. The trusted artifact service binds it to the run/source; stdout alone is not custody.
+  return {sha256:hash(bytes),source,run:artifact.run};
+  } finally { await rm(home,{recursive:true,force:true}); }
+}
+if (process.argv[1] && import.meta.url === pathToFileURL(resolve(process.argv[1])).href) {
+  try { assert(process.argv.length === 2,'prepare-no-arguments'); console.log(JSON.stringify(await prepare())); }
+  catch { console.error('deploy-kit-prepare-failed'); process.exitCode=1; }
+}

package/modules/deploy-kit/provider.mjs

@@ -0,0 +1,99 @@
+import { assert, hexId } from './validation.mjs';
+
+export async function boundedJSON(response, limit = 4 * 1024 * 1024) {
+  assert(response.body, 'empty-response');
+  const reader = response.body.getReader(); const chunks = []; let length = 0;
+  try { while (true) { const { done, value } = await reader.read(); if (done) break; length += value.length; assert(length <= limit, 'response-too-large'); chunks.push(value); } }
+  finally { await reader.cancel().catch(() => {}); }
+  try { return JSON.parse(Buffer.concat(chunks).toString('utf8')); } catch { throw new Error('malformed-response'); }
+}
+/** Only this fixed origin and the explicitly selected account ever receive the token. */
+export function cloudflare({ accountId, token, fetch: request = globalThis.fetch, timeoutMs = 30000, maxRequests = 500 }) {
+  assert(hexId(accountId), 'invalid-cloudflare-account-id');
+  assert(typeof token === 'string' && token.trim() && !/[\r\n]/.test(token), 'invalid-cloudflare-api-token');
+  let requests = 0;
+  async function envelope(path, { method = 'GET', body, assetToken } = {}) {
+    assert(typeof path === 'string' && /^\/[a-z0-9/_?=&.,%-]+$/i.test(path) && !path.includes('..') && !path.split('?')[0].includes('%'), 'invalid-provider-path');
+    assert(++requests <= maxRequests, 'provider-request-budget');
+    assert(!assetToken || path === '/workers/assets/upload?base64=true', 'invalid-asset-auth-target');
+    const signal = AbortSignal.timeout(timeoutMs);
+    let response;
+    try { response = await request(`https://api.cloudflare.com/client/v4/accounts/${accountId}${path}`, {
+      method, redirect: 'error', signal, headers: { Authorization: `Bearer ${assetToken ?? token}`, ...(body && !(body instanceof FormData) ? { 'Content-Type':'application/json' } : {}) },
+      ...(body === undefined ? {} : { body: body instanceof FormData ? body : JSON.stringify(body) }),
+    }); } catch { throw new Error('provider-transport-failed'); }
+    if (!response.ok) { const error = new Error(`provider-http-${response.status}`); error.status = response.status; await response.body?.cancel(); throw error; }
+    const payload = await boundedJSON(response);
+    assert(payload?.success === true && Object.hasOwn(payload,'result') && (!payload.errors || Array.isArray(payload.errors) && !payload.errors.length), 'provider-unsuccessful-or-malformed');
+    return payload;
+  }
+  async function list(path, { field, pagination = 'page' } = {}) {
+    if (pagination === 'single') {
+      assert(path === '/workers/scripts' || /^\/queues\/[a-f0-9]{32}\/consumers$/.test(path),'invalid-single-list');
+      const data = await envelope(path);
+      assert(Array.isArray(data.result) && data.result.length <= 10000,'provider-invalid-list');
+      const info = data.result_info;
+      if (info != null) {
+        assert(typeof info === 'object' && !Array.isArray(info),'provider-incomplete-pagination');
+        for (const key of ['count','total_count']) if (Object.hasOwn(info,key)) assert(info[key] === data.result.length,'provider-partial-list');
+        assert([undefined,null,''].includes(info.cursor) &&
+          (info.total_pages === undefined || info.total_pages === 1 || info.total_pages === 0 && data.result.length === 0) &&
+          (info.page === undefined || info.page === 1),'provider-incomplete-pagination');
+      }
+      return data.result;
+    }
+    assert(['page','cursor','r2-bounded'].includes(pagination),'invalid-list-pagination');
+    const r2Bounded = pagination === 'r2-bounded';
+    assert(!r2Bounded || path === '/r2/buckets' && field === 'buckets', 'invalid-r2-bounded-list');
+    const result = []; const seen = new Set(); let cursor; let total;
+    for (let page = 1; page <= 100; page++) {
+      const suffix = r2Bounded || pagination === 'cursor' ? (path === '/r2/buckets' ? `?per_page=1000${cursor ? `&cursor=${encodeURIComponent(cursor)}` : ''}` : (cursor ? `?cursor=${encodeURIComponent(cursor)}` : '')) : `?page=${page}&per_page=100`;
+      const data = await envelope(path + suffix); const rows = field ? data.result?.[field] : data.result;
+      assert(Array.isArray(rows), 'provider-invalid-list');
+      result.push(...rows); assert(result.length <= 10000, 'provider-list-too-large');
+      if (r2Bounded) {
+        const info = data.result_info;
+        assert(rows.length <= 1000, 'provider-partial-list');
+        // Only this endpoint's explicit bounded strategy uses the requested
+        // limit when metadata is absent. Never invent metadata for other modes.
+        if (info === undefined || info === null) {
+          assert(rows.length < 1000, 'provider-incomplete-pagination');
+          assert(total === undefined || result.length === total, 'provider-partial-list');
+          return result;
+        }
+        assert(typeof info === 'object' && !Array.isArray(info) && Number.isSafeInteger(info.per_page) && info.per_page > 0 && info.per_page <= 1000, 'provider-incomplete-pagination');
+        assert(rows.length <= info.per_page, 'provider-partial-list');
+        if (Object.hasOwn(info, 'count')) assert(info.count === rows.length, 'provider-partial-list');
+        if (Object.hasOwn(info, 'total_count')) {
+          assert(Number.isSafeInteger(info.total_count) && info.total_count >= 0, 'provider-incomplete-pagination');
+          total ??= info.total_count; assert(total === info.total_count, 'provider-pagination-changed');
+        }
+        assert(total === undefined || result.length <= total, 'provider-partial-list');
+        assert(info.cursor === undefined || typeof info.cursor === 'string', 'provider-invalid-cursor');
+        if (!info.cursor) {
+          assert(rows.length < info.per_page && (total === undefined || result.length === total), 'provider-partial-list');
+          return result;
+        }
+        assert(total === undefined || result.length < total, 'provider-partial-list');
+        cursor = info.cursor; assert(/^[a-zA-Z0-9_+\/=-]+$/.test(cursor) && !seen.has(cursor), 'provider-invalid-cursor'); seen.add(cursor);
+      } else if (pagination === 'cursor') {
+        const info = data.result_info;
+        // R2's terminal short page may explicitly report null pagination. The
+        // requested documented limit supplies the bound; a full page is ambiguous.
+        if (path === '/r2/buckets' && info === null) { assert(rows.length < 1000, 'provider-incomplete-pagination'); return result; }
+        assert(info && Number.isSafeInteger(info.per_page) && info.per_page > 0, 'provider-incomplete-pagination');
+        if (!info.cursor) { assert(rows.length < info.per_page, 'provider-partial-list'); return result; }
+        cursor = info.cursor; assert(typeof cursor === 'string' && /^[a-zA-Z0-9_+\/=-]+$/.test(cursor) && !seen.has(cursor), 'provider-invalid-cursor'); seen.add(cursor);
+      } else {
+        const info = data.result_info;
+        assert(info && info.page === page && Number.isSafeInteger(info.total_count) && info.total_count >= 0, 'provider-incomplete-pagination');
+        total ??= info.total_count; assert(total === info.total_count, 'provider-pagination-changed');
+        assert(result.length <= total, 'provider-partial-list');
+        if (result.length === total) return result;
+        assert(rows.length > 0 && (info.total_pages === undefined || page < info.total_pages), 'provider-partial-list');
+      }
+    }
+    throw new Error('provider-pagination-limit');
+  }
+  return { accountId, envelope, list, async request(path, options) { return (await envelope(path, options)).result; } };
+}

package/modules/deploy-kit/queue-consumer.mjs

@@ -0,0 +1,10 @@
+import { resourceName } from './validation.mjs';
+
+/** Decode the documented and observed Worker consumer identity wire variants. */
+export function workerConsumerScript(consumer) {
+  if (!consumer || typeof consumer !== 'object' || Array.isArray(consumer) || consumer.type !== 'worker') return null;
+  const fields = ['script_name','script'].filter(key => Object.hasOwn(consumer,key));
+  if (!fields.length || fields.some(key => !resourceName(consumer[key]) || consumer[key] !== consumer[key].trim())) return null;
+  const script = consumer[fields[0]];
+  return fields.every(key => consumer[key] === script) ? script : null;
+}

package/modules/deploy-kit/receipt.mjs

@@ -0,0 +1,16 @@
+import { writeFile, rename, rm } from 'node:fs/promises';
+import { randomUUID } from 'node:crypto';
+import { regularBytes } from './artifact.mjs';
+import { assert, stable } from './validation.mjs';
+
+/** Preserve the identity written before health; replace only health evidence. */
+export async function writeHealthReceipt(path, receipt) {
+  const previous = JSON.parse(await regularBytes(path,1024*1024));
+  const identity = ({health,...value}) => value;
+  assert(stable(identity(previous)) === stable(identity(receipt)),'health-receipt-identity-mismatch');
+  const temporary = `${path}.health-${randomUUID()}`;
+  try {
+    await writeFile(temporary,JSON.stringify(receipt,null,2)+'\n',{flag:'wx',mode:0o600});
+    await rename(temporary,path);
+  } finally { await rm(temporary,{force:true}); }
+}

package/modules/deploy-kit/render.mjs

@@ -0,0 +1,47 @@
+import { assert, stable } from './validation.mjs';
+/** Every request reaches the Worker first, so its routing, origin admission and private-path
+ * refusals decide what is served; the Worker serves built files from env.ASSETS itself.
+ * `rer verify` serves the local build with this same setting (cli/hosted-output.mjs). */
+export const RUN_WORKER_FIRST = true;
+export function renderConfig(plan, resources, accountId, sourceSha, fingerprint, main, hasAssets = false) {
+  return { name:plan.worker, account_id:accountId, main, compatibility_date:plan.compatibilityDate, compatibility_flags:plan.compatibilityFlags ?? [], workers_dev:plan.workersDev !== false,
+    ...(hasAssets ? {assets:{directory:'__static',binding:'ASSETS',run_worker_first:RUN_WORKER_FIRST}} : {}),
+    vars:{...plan.vars,RER_DEPLOY_SOURCE:sourceSha,RER_DEPLOY_FINGERPRINT:fingerprint}, version_metadata:{binding:'RER_VERSION'},
+    d1_databases:resources.d1.map(x => ({binding:x.binding,database_name:x.name,database_id:x.id})), r2_buckets:resources.r2.map(x => ({binding:x.binding,bucket_name:x.name})),
+    queues:{producers:resources.queues.map(x => ({binding:x.binding,queue:x.name})), consumers:plan.queues.filter(x => x.consumer).map(x => ({queue:x.name,...(x.deadLetterQueue ? {dead_letter_queue:x.deadLetterQueue} : {}),max_batch_size:x.consumer.batch_size,max_retries:x.consumer.max_retries,...(x.consumer.max_wait_time_ms === undefined ? {} : {max_batch_timeout:x.consumer.max_wait_time_ms/1000}),...(x.consumer.max_concurrency === undefined ? {} : {max_concurrency:x.consumer.max_concurrency}),...(x.consumer.retry_delay === undefined ? {} : {retry_delay:x.consumer.retry_delay})}))},
+    durable_objects:{bindings:plan.durableObjects.map(x => ({name:x.binding,class_name:x.className}))}, triggers:{crons:plan.crons},
+    // Only plans that declare KV add the key, so earlier fingerprints are unchanged.
+    ...(resources.kv ? {kv_namespaces:resources.kv.map(x => ({binding:x.binding,id:x.id}))} : {}),
+    ...(plan.services ? {services:plan.services.map(serviceEntry)} : {}) };
+}
+const serviceEntry = x => ({binding:x.binding,service:x.service,...(x.entrypoint ? {entrypoint:x.entrypoint} : {}),...(x.props ? {props:x.props} : {})});
+function serviceBinding(x) {
+  const {binding,...rest} = serviceEntry(x);
+  return {type:'service',name:binding,...rest};
+}
+export function bindingsFor(config, resources, plan) {
+  return [ ...(config.assets ? [{type:'assets',name:'ASSETS'}] : []), ...Object.entries(config.vars).map(([name,text]) => ({type:'plain_text',name,text})), {type:'version_metadata',name:'RER_VERSION'},
+    ...resources.d1.map(x => ({type:'d1',name:x.binding,id:x.id})), ...resources.r2.map(x => ({type:'r2_bucket',name:x.binding,bucket_name:x.name})),
+    ...(resources.kv ?? []).map(x => ({type:'kv_namespace',name:x.binding,namespace_id:x.id})),
+    ...resources.queues.map(x => ({type:'queue',name:x.binding,queue_name:x.name})), ...plan.durableObjects.map(x => ({type:'durable_object_namespace',name:x.binding,class_name:x.className})),
+    ...(plan.services ?? []).map(serviceBinding) ];
+}
+export function verifyBindings(actual, expected) {
+  assert(Array.isArray(actual),'invalid-provider-bindings');
+  const names = new Set();
+  const services = new Set(expected.filter(x => x.type === 'service').map(x => x.name));
+  for (const binding of actual) {
+    assert(binding && typeof binding.name === 'string' && binding.name.length && !names.has(binding.name), 'binding-readback-mismatch');
+    names.add(binding.name);
+    // Provider-added secrets and ordinary bindings can be legitimate, but every service
+    // binding grants authority and must be explicitly declared by the caller.
+    assert(binding.type !== 'service' || services.has(binding.name), 'binding-readback-mismatch');
+  }
+  for (const desired of expected) {
+    const rows = actual.filter(x => x.name === desired.name); assert(rows.length === 1,'binding-readback-mismatch');
+    if (desired.type === 'service') {
+      assert(Object.keys(rows[0]).every(key => Object.hasOwn(desired, key) || key === 'environment' && rows[0][key] === 'production'), 'binding-readback-mismatch');
+    }
+    for (const [key,value] of Object.entries(desired)) assert(stable(rows[0][key]) === stable(value),'binding-readback-mismatch');
+  }
+}

package/modules/deploy-kit/resources.mjs

@@ -0,0 +1,106 @@
+import { assert, uuid, hexId, kvOf } from './validation.mjs';
+import { workerConsumerScript } from './queue-consumer.mjs';
+function unique(rows, key, name) { const found = rows.filter(x => x?.[key] === name); assert(found.length <= 1,'ambiguous-resource-name'); return found[0]; }
+/** Account-level resources found or created by name. Durable Object namespaces
+ * belong to their Worker and are created by its upload migration instead. */
+export const resourceKinds = Object.freeze({
+  d1: {items:plan => plan.d1, key:'name',
+    list:api => api.list('/d1/database'),
+    create:(api,item) => api.request('/d1/database',{method:'POST',body:{name:item.name}})},
+  r2: {items:plan => plan.r2, key:'name',
+    list:api => api.list('/r2/buckets',{field:'buckets',pagination:'r2-bounded'}),
+    create:(api,item) => api.request('/r2/buckets',{method:'POST',body:{name:item.name,...(item.locationHint ? {locationHint:item.locationHint}: {})}})},
+  kv: {items:kvOf, key:'title',
+    list:api => api.list('/storage/kv/namespaces'),
+    create:(api,item) => api.request('/storage/kv/namespaces',{method:'POST',body:{title:item.name}})},
+  queues: {items:plan => plan.queues, key:'queue_name',
+    list:api => api.list('/queues'),
+    create:(api,item) => api.request('/queues',{method:'POST',body:{queue_name:item.name}})},
+});
+export function findResource(rows, kind, name) { return unique(rows,resourceKinds[kind].key,name); }
+export async function reconcileResources(api, plan, { create = true } = {}) {
+  const resources = { d1:[], r2:[], queues:[] };
+  if (plan.d1.length) {
+    const rows = await resourceKinds.d1.list(api);
+    for (const item of plan.d1) {
+      let row = unique(rows,'name',item.name);
+      if (!row) { assert(create,'missing-d1'); row = await resourceKinds.d1.create(api,item); }
+      assert(row.name === item.name && uuid(row.uuid), 'invalid-d1-identity');
+      const read = await api.request(`/d1/database/${row.uuid}`);
+      assert(read.uuid === row.uuid && read.name === item.name && (!item.readReplication || read.read_replication?.mode === item.readReplication), 'incompatible-d1');
+      resources.d1.push({binding:item.binding,name:item.name,id:row.uuid});
+    }
+  }
+  if (plan.r2.length) {
+    const rows = await resourceKinds.r2.list(api);
+    for (const item of plan.r2) {
+      let row = unique(rows,'name',item.name);
+      if (!row) { assert(create,'missing-r2'); row = await resourceKinds.r2.create(api,item); }
+      const read = await api.request(`/r2/buckets/${item.name}`);
+      assert(row.name === item.name && read.name === item.name && (!item.jurisdiction || read.jurisdiction === item.jurisdiction) && (!item.storageClass || read.storage_class === item.storageClass), 'incompatible-r2');
+      resources.r2.push({binding:item.binding,name:item.name});
+    }
+  }
+  // Only plans that declare KV carry the key, so earlier receipts compare unchanged.
+  if (kvOf(plan).length) {
+    resources.kv = [];
+    const rows = await resourceKinds.kv.list(api);
+    for (const item of kvOf(plan)) {
+      let row = unique(rows,'title',item.name);
+      if (!row) { assert(create,'missing-kv'); row = await resourceKinds.kv.create(api,item); }
+      assert(row.title === item.name && hexId(row.id), 'invalid-kv-identity');
+      const read = await api.request(`/storage/kv/namespaces/${row.id}`);
+      assert(read.id === row.id && read.title === item.name, 'incompatible-kv');
+      resources.kv.push({binding:item.binding,name:item.name,id:row.id});
+    }
+  }
+  if (plan.queues.length) {
+    const rows = await resourceKinds.queues.list(api);
+    for (const item of plan.queues) {
+      let row = unique(rows,'queue_name',item.name);
+      if (!row) { assert(create,'missing-queue'); row = await resourceKinds.queues.create(api,item); }
+      assert(row.queue_name === item.name && hexId(row.queue_id), 'invalid-queue-identity');
+      const read = await api.request(`/queues/${row.queue_id}`);
+      assert(read.queue_name === item.name && read.queue_id === row.queue_id && read.settings?.delivery_paused !== true, 'incompatible-or-paused-queue');
+      resources.queues.push({binding:item.binding,name:item.name,id:row.queue_id});
+    }
+  }
+  return resources;
+}
+export async function reconcileTriggers(api, plan, resources, { mutate = true, reapplyCrons = false } = {}) {
+  // PUT replaces the entire schedule set. Inspect it before any trigger write,
+  // and never remove a schedule that the requested plan does not own.
+  const crons = await checkCronOwnership(api, plan);
+  const updates = [];
+  for (const item of plan.queues.filter(x => x.consumer)) {
+    const id = resources.queues.find(x => x.binding === item.binding).id;
+    const consumers = await api.request(`/queues/${id}/consumers`);
+    assert(Array.isArray(consumers), 'invalid-queue-consumers');
+    const wanted = {type:'worker',script_name:plan.worker,settings:item.consumer,...(item.deadLetterQueue ? {dead_letter_queue:item.deadLetterQueue} : {})};
+    const matches = consumers.filter(x => workerConsumerScript(x) === plan.worker);
+    assert(consumers.length === matches.length && matches.length <= 1, 'queue-consumer-conflict');
+    const row = matches[0];
+    if (!row || (row.dead_letter_queue || '') !== (item.deadLetterQueue || '') || Object.entries(item.consumer).some(([k,v]) => row.settings?.[k] !== v)) {
+      assert(mutate,'queue-consumer-drift');
+      if (row) assert(hexId(row.consumer_id),'invalid-consumer-id');
+      updates.push({path:`/queues/${id}/consumers${row ? `/${row.consumer_id}`:''}`,options:{method:row ? 'PUT':'POST',body:wanted}});
+    }
+  }
+  // Validate every consumer's ownership before applying any trigger update.
+  for (const {path,options} of updates) await api.request(path,options);
+  const desired = JSON.stringify([...plan.crons].sort());
+  if (JSON.stringify(crons) !== desired || reapplyCrons && plan.crons.length > 0) {
+    assert(mutate,'cron-drift');
+    await api.request(`/workers/scripts/${plan.worker}/schedules`,{method:'PUT',body:plan.crons.map(cron => ({cron}))});
+    assert(JSON.stringify(await checkCronOwnership(api,plan)) === desired,'cron-drift');
+  }
+}
+
+export async function checkCronOwnership(api, plan) {
+  const result = await api.request(`/workers/scripts/${plan.worker}/schedules`);
+  assert(result && !Array.isArray(result) && Array.isArray(result.schedules) && result.schedules.every(x => typeof x?.cron === 'string' && x.cron.trim()), 'invalid-cron-list');
+  const crons = result.schedules.map(x => x.cron).sort();
+  assert(new Set(crons).size === crons.length, 'invalid-cron-list');
+  assert(crons.every(cron => plan.crons.includes(cron)), 'cron-drift');
+  return crons;
+}

package/modules/deploy-kit/service-grants.mjs

@@ -0,0 +1,25 @@
+import { assert, stable } from './validation.mjs';
+import { activeWorker } from './worker.mjs';
+
+/** A named service entrypoint's authority is stored by the service owner. Cloudflare
+ * settings and immutable deployment identity are both checked; no omitted props waiver. */
+export async function verifyServiceGrants(api, plan) {
+  for (const binding of plan.services ?? []) {
+    if (!binding.grant) continue;
+    const current = await activeWorker(api, binding.service), expected = binding.grant;
+    assert(current && ['versionId','deploymentId','etag'].every(key => current[key] === expected.provider[key]), 'service-grant-deployment-drift');
+    const values = {};
+    for (const name of ['EGRESS_GRANTS','RER_DEPLOY_SOURCE','RER_DEPLOY_FINGERPRINT']) {
+      const rows = current.settings.bindings.filter(b => b.name === name);
+      assert(rows.length === 1 && rows[0].type === 'plain_text' && typeof rows[0].text === 'string', 'service-grant-readback-mismatch');
+      values[name] = rows[0].text;
+    }
+    assert(values.RER_DEPLOY_SOURCE === expected.sourceSha && values.RER_DEPLOY_FINGERPRINT === expected.fingerprint, 'service-grant-deployment-drift');
+    let grants; try { grants = JSON.parse(values.EGRESS_GRANTS); } catch { throw new Error('service-grant-readback-mismatch'); }
+    assert(Array.isArray(grants) && grants.length && grants.every(row => row && Object.keys(row).sort().join() === 'allowedHosts,entrypoint'
+      && typeof row.entrypoint === 'string' && (row.allowedHosts === null || Array.isArray(row.allowedHosts)))
+      && new Set(grants.map(row => row.entrypoint)).size === grants.length, 'service-grant-readback-mismatch');
+    const rows = grants.filter(row => row.entrypoint === binding.entrypoint);
+    assert(rows.length === 1 && stable(rows[0].allowedHosts) === stable(expected.allowedHosts), 'service-grant-readback-mismatch');
+  }
+}

package/modules/deploy-kit/sql-safety.mjs

@@ -0,0 +1,94 @@
+import { assert } from './validation.mjs';
+import { sqlTokens } from './sql-tokens.mjs';
+
+const reserved = new Set(['_rer_deploy_migrations', 'd1_migrations']);
+const controls = new Set(['BEGIN', 'COMMIT', 'END', 'ROLLBACK', 'SAVEPOINT', 'RELEASE', 'ATTACH', 'DETACH', 'VACUUM']);
+const needsOperand = new Set(['CASE', 'WHEN', 'THEN', 'ELSE', 'AND', 'OR', 'IS', 'NOT', 'IN', 'LIKE', 'GLOB', 'MATCH', 'REGEXP', 'BETWEEN', 'ESCAPE', 'COLLATE', 'AS', 'DISTINCT', 'FROM']);
+const keyword = token => token?.kind === 'word' ? token.value.toUpperCase() : '';
+const symbol = (token, value) => token?.kind === 'symbol' && token.value === value;
+
+function createsTrigger(statement) {
+  let index = 0;
+  if (keyword(statement[index++]) !== 'CREATE') return false;
+  if (['TEMP', 'TEMPORARY'].includes(keyword(statement[index]))) index++;
+  return keyword(statement[index]) === 'TRIGGER';
+}
+
+function endsExpression(tokens, index) {
+  const token = tokens[index];
+  // After a function call or FILTER clause, OVER still needs its window.
+  // Elsewhere SQLite permits OVER as an ordinary column or window name.
+  if (keyword(token) === 'OVER' && symbol(tokens[index - 1], ')')) return false;
+  return token && (['string', 'identifier', 'number'].includes(token.kind) ||
+    (token.kind === 'word' && !needsOperand.has(keyword(token))) || symbol(token, ')'));
+}
+
+function triggerBegin(tokens) {
+  let index = keyword(tokens[1]) === 'TRIGGER' ? 2 : 3;
+  if (keyword(tokens[index]) === 'IF') {
+    assert(keyword(tokens[index + 1]) === 'NOT' && keyword(tokens[index + 2]) === 'EXISTS', 'unsafe-migration-control');
+    index += 3;
+  }
+  const afterName = start => symbol(tokens[start + 1], '.') ? start + 3 : start + 1;
+  index = afterName(index);
+  while (index < tokens.length && keyword(tokens[index]) !== 'ON') index++;
+  index = afterName(index + 1);
+  for (; index < tokens.length; index++) {
+    if (keyword(tokens[index]) === 'BEGIN' && endsExpression(tokens, index - 1) && !symbol(tokens[index + 1], '.')) return index;
+  }
+  return -1;
+}
+
+function assertClosedExpressions(tokens) {
+  const scopes = [];
+  for (let index = 0; index < tokens.length; index++) {
+    const token = tokens[index];
+    if (symbol(token, '(')) scopes.push('(');
+    else if (keyword(token) === 'CASE') scopes.push('CASE');
+    else if (symbol(token, ')')) assert(scopes.pop() === '(', 'unsafe-migration-control');
+    // END may instead be an operand (THEN end) or a qualified identifier
+    // (NEW.end). Only an END following a complete expression closes CASE.
+    else if (keyword(token) === 'END' && scopes.at(-1) === 'CASE' &&
+      endsExpression(tokens, index - 1) && !symbol(tokens[index + 1], '.')) scopes.pop();
+  }
+  assert(scopes.length === 0, 'unsafe-migration-control');
+}
+
+export function assertMigrationSqlSafe(sql) {
+  const tokens = sqlTokens(sql);
+  // SQLite also treats single-quoted text as identifiers and virtual-table
+  // options as table names. Reserve exact controller names in every token.
+  assert(tokens.every(token => !reserved.has(token.value.toLowerCase())), 'unsafe-migration-control');
+  // ROLLBACK also controls transactions in ON CONFLICT / OR clauses and
+  // RAISE(ROLLBACK, ...), without beginning a standalone SQL statement.
+  assert(tokens.every(token => keyword(token) !== 'ROLLBACK'), 'unsafe-migration-control');
+  let inTrigger = false;
+  let statement = [];
+  const finishStatement = () => {
+    if (!statement.length) return;
+    const first = keyword(statement[0]);
+    if (inTrigger && first === 'END' && statement.length === 1) {
+      inTrigger = false;
+    } else {
+      assert(!controls.has(first), 'unsafe-migration-control');
+      if (createsTrigger(statement)) {
+        const begin = triggerBegin(statement);
+        assert(!inTrigger && begin >= 0, 'unsafe-migration-control');
+        // Header CASE expressions must close before BEGIN; body expressions
+        // must close before each semicolon, never at the trigger's final END.
+        assertClosedExpressions(statement.slice(0, begin));
+        const body = statement.slice(begin + 1);
+        assert(body.length > 0 && !controls.has(keyword(body[0])), 'unsafe-migration-control');
+        assertClosedExpressions(body);
+        inTrigger = true;
+      } else assertClosedExpressions(statement);
+    }
+    statement = [];
+  };
+  for (const token of tokens) {
+    if (symbol(token, ';')) finishStatement();
+    else statement.push(token);
+  }
+  finishStatement();
+  assert(!inTrigger, 'unsafe-migration-control');
+}

package/modules/deploy-kit/sql-tokens.mjs

@@ -0,0 +1,49 @@
+import { assert } from './validation.mjs';
+
+// SQLite quotes escape themselves by doubling, except brackets, which end at ].
+// Keep quoted tokens intact: their punctuation and keywords are never syntax.
+export function sqlTokens(sql) {
+  assert(!sql.includes('\0'), 'unsafe-migration-control');
+  const tokens = [];
+  let offset = 0;
+  while (offset < sql.length) {
+    const start = offset;
+    const char = sql[offset++];
+    if (/[\t\n\v\f\r \uFEFF]/.test(char)) continue;
+    if (char === '-' && sql[offset] === '-') {
+      const end = sql.indexOf('\n', offset + 1);
+      offset = end < 0 ? sql.length : end + 1;
+      continue;
+    }
+    if (char === '/' && sql[offset] === '*') {
+      const end = sql.indexOf('*/', offset + 1);
+      // An open comment could swallow the controller's appended completion SQL.
+      assert(end >= 0, 'unsafe-migration-control');
+      offset = end + 2;
+      continue;
+    }
+    if (`'\"\`[`.includes(char)) {
+      const closing = char === '[' ? ']' : char;
+      let value = '', closed = false;
+      while (offset < sql.length) {
+        const next = sql[offset++];
+        if (next !== closing) { value += next; continue; }
+        if (char !== '[' && sql[offset] === closing) { value += closing; offset++; continue; }
+        closed = true;
+        break;
+      }
+      assert(closed, 'unsafe-migration-control');
+      tokens.push({ kind: char === "'" ? 'string' : 'identifier', value });
+    } else if (/[0-9]/.test(char) || (char === '.' && /[0-9]/.test(sql[offset] ?? ''))) {
+      const number = /^(?:0[xX][0-9a-fA-F_]+|(?:[0-9][0-9_]*(?:\.[0-9_]*)?|\.[0-9][0-9_]*)(?:[eE][+-]?[0-9][0-9_]*)?)/.exec(sql.slice(start))[0];
+      offset = start + number.length;
+      tokens.push({ kind: 'number', value: number });
+    } else if (/[A-Za-z_\u0080-\uFFFF]/.test(char)) {
+      while (offset < sql.length && /[A-Za-z0-9_$\u0080-\uFFFF]/.test(sql[offset])) offset++;
+      tokens.push({ kind: 'word', value: sql.slice(start, offset) });
+    } else {
+      tokens.push({ kind: 'symbol', value: char });
+    }
+  }
+  return tokens;
+}

package/modules/deploy-kit/teardown.mjs

@@ -0,0 +1,100 @@
+import { assert, hexId, uuid } from './validation.mjs';
+import { workerConsumerScript } from './queue-consumer.mjs';
+
+function checked(rows, key, valid) {
+  assert(Array.isArray(rows) && rows.every(row => row && valid(row[key])),'teardown-invalid-list-identity');
+  assert(new Set(rows.map(row => row[key])).size === rows.length,'teardown-duplicate-list-identity');
+  return rows;
+}
+const listedName = value => typeof value === 'string' && value.length > 0;
+const name = value => typeof value === 'string' && /^[a-z0-9][a-z0-9-]{0,62}$/.test(value);
+
+/** Read every account list. Post-delete callers restart this entire snapshot. */
+async function inventory(api) {
+  const reads = await Promise.allSettled([
+    api.list('/workers/scripts',{pagination:'single'}), api.list('/d1/database'),
+    api.list('/r2/buckets',{field:'buckets',pagination:'r2-bounded'}), api.list('/queues'),
+    api.list('/workers/durable_objects/namespaces'),
+  ]);
+  const failure = reads.find(result => result.status === 'rejected');
+  if (failure) throw failure.reason;
+  const [workers,d1,r2,queues,durableObjects] = reads.map(result => result.value);
+  checked(workers,'id',listedName); checked(d1,'uuid',uuid); checked(r2,'name',listedName); checked(queues,'queue_id',hexId); checked(durableObjects,'id',hexId);
+  assert(d1.every(row=>listedName(row.name)) && queues.every(row=>listedName(row.queue_name)) && durableObjects.every(row=>listedName(row.script)),'teardown-invalid-list-name');
+  const consumers = [];
+  // The provider's global request budget bounds consumer reads as well.
+  for (const queue of queues) {
+    const rows = checked(await api.list(`/queues/${queue.queue_id}/consumers`,{pagination:'single'}),'consumer_id',hexId);
+    assert(rows.every(row=>row.type !== 'worker' || workerConsumerScript(row)),'teardown-invalid-worker-consumer');
+    consumers.push(...rows.map(row=>({...row,queueId:queue.queue_id,queueName:queue.queue_name})));
+  }
+  return {workers,d1,r2,queues,consumers,durableObjects};
+}
+
+/** Read-only verification. It never deletes, repairs or authorizes deletion. */
+export async function verifyTeardown({api,plan,receipt,prefix=plan?.worker,maxAttempts=4,clock=()=>performance.now(),sleep=ms=>new Promise(resolve=>setTimeout(resolve,ms)),onAttempt=()=>{}}) {
+  assert(receipt?.version === 1 && receipt.accountId === api.accountId && receipt.worker === plan?.worker,'teardown-receipt-target-mismatch');
+  assert(name(prefix) && (prefix.startsWith('rer-seedproof-') || /^rer-base-stage-[0-9]{1,20}$/.test(prefix)) && plan.worker === prefix,'teardown-disposable-prefix-required');
+  assert(Number.isSafeInteger(maxAttempts) && maxAttempts >= 1 && maxAttempts <= 8,'teardown-invalid-attempt-bound');
+  assert(Array.isArray(receipt.resources?.d1) && Array.isArray(receipt.resources.r2) && Array.isArray(receipt.resources.queues) && Array.isArray(receipt.durableObjects),'teardown-invalid-receipt');
+  assert(receipt.resources.d1.every(row=>uuid(row.id) && listedName(row.name)) && receipt.resources.r2.every(row=>listedName(row.name)) && receipt.resources.queues.every(row=>hexId(row.id) && listedName(row.name)) && receipt.durableObjects.every(row=>hexId(row.id)),'teardown-invalid-receipt-identity');
+  const attempts = []; const start = clock();
+  const prefixed = value => typeof value === 'string' && value.startsWith(prefix);
+  for (let number=1; number<=maxAttempts; number++) {
+    const attempt = {number,offsetMs:Math.round(clock()-start),errorClass:null}; attempts.push(attempt);
+    try {
+      const listing = await inventory(api);
+      const remaining = {
+        workers:listing.workers.filter(row=>row.id === receipt.worker || prefixed(row.id)),
+        d1:listing.d1.filter(row=>receipt.resources.d1.some(owned=>owned.id === row.uuid) || prefixed(row.name)),
+        r2:listing.r2.filter(row=>receipt.resources.r2.some(owned=>owned.name === row.name) || prefixed(row.name)),
+        queues:listing.queues.filter(row=>receipt.resources.queues.some(owned=>owned.id === row.queue_id) || prefixed(row.queue_name)),
+        consumers:listing.consumers.filter(row=>receipt.resources.queues.some(owned=>owned.id === row.queueId) || prefixed(row.queueName) || workerConsumerScript(row) === receipt.worker || prefixed(workerConsumerScript(row))),
+        durableObjects:listing.durableObjects.filter(row=>receipt.durableObjects.some(owned=>owned.id === row.id) || prefixed(row.script) || prefixed(row.name) || prefixed(row.class)),
+      };
+      attempt.counts = Object.fromEntries(Object.entries(listing).map(([type,rows])=>[type,rows.length]));
+      const survivors = Object.entries(remaining).flatMap(([type,rows])=>rows.map(row=>({type,name:row.name ?? row.queue_name ?? row.script ?? row.id,id:row.uuid ?? row.queue_id ?? row.consumer_id ?? row.id})));
+      if (survivors.length) {
+        const error = new Error('teardown-resources-remain'); error.remaining = survivors; error.listing = remaining; throw error;
+      }
+      await onAttempt(attempt);
+      // The scoped view is the empty listing that was seen; foreign rows stay out of the evidence.
+      return {ok:true,scope:'authenticated-scoped-teardown-verification',prefix,accountId:api.accountId,attempts,listing:remaining};
+    } catch (error) {
+      attempt.errorClass = error.message;
+      await onAttempt(attempt);
+      // Partial snapshots can accompany concurrent removal as well. They may
+      // be retried here, but never accepted, inferred empty, or relaxed.
+      if (number === maxAttempts || !['provider-pagination-changed','provider-partial-list'].includes(error.message)) {
+        error.attempts = attempts;
+        throw error;
+      }
+      await sleep(Math.min(250 * 2 ** (number-1),2000));
+    }
+  }
+}
+
+/**
+ * Delete a Worker the caller has already proven it owns. The provider keeps dispatching a
+ * deleted Worker's Cron (as failing invocations) until its next scheduler refresh, so clear the
+ * schedule set first, wait until the provider reports none, and only then delete. A set that does
+ * not settle within `maxWaitMs` leaves the Worker in place.
+ */
+export async function deleteWorker({api,worker,maxWaitMs=60000,clock=()=>performance.now(),sleep=ms=>new Promise(resolve=>setTimeout(resolve,ms))}) {
+  assert(name(worker),'teardown-invalid-worker-name');
+  const schedules = `/workers/scripts/${worker}/schedules`;
+  await api.request(schedules,{method:'PUT',body:[]});
+  const start = clock();
+  for (let delay=250;; delay=Math.min(delay*2,4000)) {
+    const result = await api.request(schedules);
+    assert(result && !Array.isArray(result) && Array.isArray(result.schedules),'invalid-cron-list');
+    if (!result.schedules.length) break;
+    if (clock()-start+delay > maxWaitMs) {
+      const error = new Error(`The provider still lists ${result.schedules.length} Cron schedule(s) on ${worker} ${Math.round(maxWaitMs/1000)} seconds after they were cleared, so the Worker was not deleted. Run the teardown again once the provider reports none.`);
+      error.code = 'teardown-schedules-not-cleared';
+      throw error;
+    }
+    await sleep(delay);
+  }
+  await api.request(`/workers/scripts/${worker}?force=true`,{method:'DELETE'});
+}