@runeditrun/rer 0.1.0 → 0.2.0

package/modules/erasure/order.mjs

@@ -1,6 +1,24 @@
 import { all, canonicalJson, insist, quote } from './sql.mjs';
 import { matching } from './plan.mjs';
 
+/** Every foreign key between two deleted tables, grouped per constraint. Schema
+ * only: it never reads a row, so a later step can use it without a plan. */
+export async function foreignKeyLinks(db, d) {
+  const links = [];
+  for (const table of d.deleted) {
+    const groups = new Map();
+    for (const fk of await all(db, `PRAGMA foreign_key_list(${quote(table)})`)) {
+      if (!groups.has(fk.id)) groups.set(fk.id, []);
+      groups.get(fk.id).push(fk);
+    }
+    for (const group of groups.values()) {
+      const parentTable = d.deleted.find(name => name.toLowerCase() === group[0].table.toLowerCase());
+      if (parentTable) links.push({ table, parentTable, group });
+    }
+  }
+  return links;
+}
+
 /** Topological row order across every path, not the depth of the first visit.
  * Actual FK links also constrain order, even if a row was reached by another edge. */
 export async function deletionOrder(db, d, plan) {
@@ -18,28 +36,17 @@ export async function deletionOrder(db, d, plan) {
       if (child) link(parent, child);
     }
   }
-  plan.foreignKeys = [];
-  for (const table of d.deleted) {
-    const groups = new Map();
-    for (const fk of await all(db, `PRAGMA foreign_key_list(${quote(table)})`)) {
-      if (!groups.has(fk.id)) groups.set(fk.id, []);
-      groups.get(fk.id).push(fk);
-    }
-    for (const group of groups.values()) {
-      const parentTable = d.deleted.find(name => name.toLowerCase() === group[0].table.toLowerCase());
-      const parents = parentTable && plan.rows.get(parentTable);
-      if (parentTable) plan.foreignKeys.push({ table, parentTable, group });
-      if (!parents) continue;
-      for (const parent of parents.values()) {
-        const parentKeys = plan.keys.get(parent.table).pk;
-        // Read the actual join: FK columns need not be part of a declared edge's projection.
-        const cols = plan.keys.get(table).pk;
-        const found = await all(db, `SELECT ${cols.map(c => c === 'rowid' ? 'rowid AS rowid' : quote(c)).join(',')} FROM ${quote(table)} WHERE ${group.map(f => `${quote(f.from)}=(SELECT ${quote(f.to || parentKeys[f.seq])} FROM ${quote(parent.table)} WHERE ${parentKeys.map(c => `${quote(c)}=?`).join(' AND ')})`).join(' AND ')}`, ...group.flatMap(() => parentKeys.map(c => parent.key[c])));
-        for (const row of found) {
-          const child = entries.get(table + '\0' + canonicalJson(Object.fromEntries(cols.map(c => [c, row[c]]))));
-          insist(child, `unreached_dependent:${table}:${parent.table}`, 409);
-          link(parent, child);
-        }
+  plan.foreignKeys = await foreignKeyLinks(db, d);
+  for (const { table, parentTable, group } of plan.foreignKeys) {
+    for (const parent of plan.rows.get(parentTable).values()) {
+      const parentKeys = plan.keys.get(parent.table).pk;
+      // Read the actual join: FK columns need not be part of a declared edge's projection.
+      const cols = plan.keys.get(table).pk;
+      const found = await all(db, `SELECT ${cols.map(c => c === 'rowid' ? 'rowid AS rowid' : quote(c)).join(',')} FROM ${quote(table)} WHERE ${group.map(f => `${quote(f.from)}=(SELECT ${quote(f.to || parentKeys[f.seq])} FROM ${quote(parent.table)} WHERE ${parentKeys.map(c => `${quote(c)}=?`).join(' AND ')})`).join(' AND ')}`, ...group.flatMap(() => parentKeys.map(c => parent.key[c])));
+      for (const row of found) {
+        const child = entries.get(table + '\0' + canonicalJson(Object.fromEntries(cols.map(c => [c, row[c]]))));
+        insist(child, `unreached_dependent:${table}:${parent.table}`, 409);
+        link(parent, child);
       }
     }
   }

package/modules/erasure/plan.mjs

@@ -40,7 +40,9 @@ export function matchSql(item, parents) {
   if (!item.on) return parents.map(p => ({ where: `(${item.where})`, values: (item.params ?? []).map(c => p[c]) }));
   const pairs = Object.entries(item.on);
   const tuples = parents.map(p => pairs.map(([, parent]) => p[parent])).filter(t => t.every(v => v !== null && v !== undefined));
-  const where = `EXISTS(SELECT 1 FROM json_each(?) j WHERE ${pairs.map(([child], i) => `${quote(item.table)}.${quote(child)}=json_extract(j.value,'$[${i}]')`).join(' AND ')})`;
+  // A set lookup, so an index on the child columns serves it; json_each's own
+  // columns (id, key, value...) are never in scope beside the child's.
+  const where = `(${pairs.map(([child]) => `${quote(item.table)}.${quote(child)}`).join(',')}) IN (SELECT ${pairs.map((_, i) => `json_extract(j.value,'$[${i}]')`).join(',')} FROM json_each(?) j)`;
   return chunks(tuples, 200).map(part => ({ where, values: [JSON.stringify(part)] }));
 }
 
@@ -71,7 +73,7 @@ export async function collect(db, d, subject, remembered = []) {
   for (const [table, old] of known) {
     const pk = keys.get(table).pk;
     for (const part of chunks([...old.values()], 200)) {
-      const found = await all(db, `SELECT ${projection(columns.get(table))} FROM ${quote(table)} WHERE EXISTS(SELECT 1 FROM json_each(?) j WHERE ${pk.map((c, i) => `${quote(c)} IS json_extract(j.value,'$[${i}]')`).join(' AND ')})`, JSON.stringify(part.map(row => pk.map(c => row[c]))));
+      const found = await all(db, `SELECT ${projection(columns.get(table))} FROM ${quote(table)} WHERE EXISTS(SELECT 1 FROM json_each(?) j WHERE ${pk.map((c, i) => `${quote(table)}.${c === 'rowid' ? 'rowid' : quote(c)} IS json_extract(j.value,'$[${i}]')`).join(' AND ')})`, JSON.stringify(part.map(row => pk.map(c => row[c]))));
       for (const row of found) { remember(table, row); const key = keyOf(table, row); rows.get(table).set(canonicalJson(key), { table, key, row, depth: 1 }); }
     }
   }

package/modules/erasure/queue.mjs

@@ -0,0 +1,41 @@
+import { all, statement, canonicalJson } from './sql.mjs';
+import { tableKeys } from './plan.mjs';
+import { foreignKeyLinks } from './order.mjs';
+
+/** What is left of a plan after its first step, in deletion order, held in the
+ * private scope table (no schema of its own). Each later step reads only its
+ * slice, so no step re-reads or re-checks the rows still waiting: the cost of
+ * the whole erasure stays linear in its rows. The slice is verified inside the
+ * step's batch; anything the queue does not know about (rows written after it
+ * was built) is found by the full collection that runs once the queue is empty. */
+const seq = n => String(n).padStart(10, '0');
+
+export const clearQueue = (db, id) => statement(db, "DELETE FROM rer_erasure_scope WHERE operation=? AND kind='queue'", id);
+
+/** Replaces the operation's queue with `entries`; chunks stay small enough for one bound value. */
+export function queueStatements(db, id, entries) {
+  const out = [clearQueue(db, id)], texts = entries.map((e, i) => canonicalJson({ i, t: e.table, k: e.key, r: e.row }));
+  for (let from = 0, to = 0; from < texts.length; from = to) {
+    for (let size = 0; to < texts.length && size + texts[to].length < 60000 && to - from < 200; to++) size += texts[to].length;
+    if (to === from) to++;
+    out.push(statement(db, "INSERT INTO rer_erasure_scope SELECT ?,'queue',printf('%010d',json_extract(j.value,'$.i')),'{}',j.value FROM json_each(?) j", id, `[${texts.slice(from, to).join(',')}]`));
+  }
+  return out;
+}
+
+export async function readQueue(db, id, limit) {
+  const rows = await all(db, "SELECT table_name AS seq,row_json FROM rer_erasure_scope WHERE operation=? AND kind='queue' ORDER BY table_name LIMIT ?", id, limit);
+  return rows.map(r => { const e = JSON.parse(r.row_json); return { seq: r.seq, table: e.t, key: e.k, row: e.r, depth: 1 }; });
+}
+export const consumeStatement = (db, id, last) => statement(db, "DELETE FROM rer_erasure_scope WHERE operation=? AND kind='queue' AND table_name<=?", id, last);
+
+/** The part of a plan one step needs: only the rows it deletes are tracked, so
+ * every check in its batch is bounded by the slice, not by the rows waiting. */
+export async function slicePlan(db, d, subject, entries) {
+  const keys = new Map();
+  for (const t of new Set([...d.tracked, ...d.redact.map(r => r.table)])) keys.set(t, await tableKeys(db, t));
+  const rows = new Map(d.tracked.map(t => [t, new Map()])), known = new Map(d.tracked.map(t => [t, new Map()]));
+  for (const e of entries) { rows.get(e.table).set(canonicalJson(e.key), e); known.get(e.table).set(canonicalJson(e.row), e.row); }
+  return { subject, root: null, keys, rows, entries, known, order: entries, foreignKeys: await foreignKeyLinks(db, d) };
+}
+export const rootScopeExists = async (db, id, d) => (await all(db, "SELECT 1 FROM rer_erasure_scope WHERE operation=? AND kind='graph' AND table_name=? LIMIT 1", id, d.root.table)).length > 0;

package/modules/erasure/scope.mjs

@@ -6,17 +6,17 @@ import { tableKeys } from './plan.mjs';
 export async function readScope(db, id) {
   return (await all(db, "SELECT table_name,key_json,row_json FROM rer_erasure_scope WHERE operation=? AND kind='graph'", id)).map(r => ({ table: r.table_name, key: JSON.parse(r.key_json), row: JSON.parse(r.row_json) }));
 }
-export async function scopeStatements(db, d, plan, id, entries = plan.entries) {
+export async function scopeStatements(db, d, plan, id, entries = plan.entries, { whole = true } = {}) {
   const out = [];
   for (const { table, row, key } of entries) {
     out.push(statement(db, "INSERT OR IGNORE INTO rer_erasure_scope VALUES(?,'graph',?,?,?)", id, table, canonicalJson(key), canonicalJson(row)));
   }
-  for (const { table } of d.retain) {
+  for (const { table } of whole ? d.retain : []) {
     const { pk } = await tableKeys(db, table);
     const key = `json_object(${pk.flatMap(c => ["'" + c.replaceAll("'", "''") + "'", quote(c)]).join(',')})`;
     out.push(statement(db, `INSERT OR IGNORE INTO rer_erasure_scope SELECT ?,'retain',?,${key},${key} FROM ${quote(table)}`, id, table));
   }
-  if (d.root.redact && plan.root) {
+  if (whole && d.root.redact && plan.root) {
     const identity = Object.fromEntries((d.root.redact.identityColumns ?? []).map(c => [c, plan.root.row[c]]));
     out.push(statement(db, "INSERT INTO rer_erasure_scope SELECT ?,'identity',?,?,? WHERE NOT EXISTS(SELECT 1 FROM rer_erasure_scope WHERE operation=? AND kind='identity')", id, d.root.table, canonicalJson(plan.subject), canonicalJson(identity), id));
   }

package/modules/erasure/verification.mjs

@@ -19,9 +19,11 @@ export async function verificationStatements(db, d, plan, id, label, { final = f
       const pk = plan.keys.get(table).pk, parentPk = plan.keys.get(parentTable).pk;
       const parents = [...plan.rows.get(parentTable).values()].map(e => parentPk.map(c => e.key[c]));
       const children = [...plan.rows.get(table).values()].map(e => pk.map(c => e.key[c]));
-      const keyMatch = (alias, columns) => columns.map((c, i) => `${alias}.${quote(c)} IS json_extract(j.value,'$[${i}]')`).join(' AND ');
+      if (!parents.length) continue;
+      const keyMatch = (alias, columns, json = 'j') => columns.map((c, i) => `${alias}.${quote(c)} IS json_extract(${json}.value,'$[${i}]')`).join(' AND ');
       const joined = group.map(f => `c.${quote(f.from)}=p.${quote(f.to || parentPk[f.seq])}`).join(' AND ');
-      out.push(verify(db, 'scope', `NOT EXISTS(SELECT 1 FROM ${quote(table)} c JOIN ${quote(parentTable)} p ON ${joined} WHERE EXISTS(SELECT 1 FROM json_each(?) j WHERE ${keyMatch('p', parentPk)}) AND NOT EXISTS(SELECT 1 FROM json_each(?) j WHERE ${keyMatch('c', pk)}))`, JSON.stringify(parents), JSON.stringify(children)));
+      // Parents first, then their children through the key: cost follows the parents, not the child table.
+      out.push(verify(db, 'scope', `NOT EXISTS(SELECT 1 FROM json_each(?) j CROSS JOIN ${quote(parentTable)} p CROSS JOIN ${quote(table)} c WHERE ${keyMatch('p', parentPk)} AND ${joined} AND NOT EXISTS(SELECT 1 FROM json_each(?) k WHERE ${keyMatch('c', pk, 'k')}))`, JSON.stringify(parents), JSON.stringify(children)));
     }
     for (const edge of d.edges) for (const m of matchSql(edge, [...plan.known.get(edge.from).values()])) {
       const pk = plan.keys.get(edge.table).pk, keys = [...plan.rows.get(edge.table).values()].map(e => pk.map(c => e.key[c]));

package/modules/mail/README.md

@@ -149,7 +149,7 @@ Network loss, redirects, HTTP 408 and 5xx are conservatively `uncertain`; 429 is
 
 ## Development and unsubscribe
 
-Development requires all three: `provider:'development'`, `mode:'development'`, and explicit `dependencies.outbox.put`. It captures the prepared message with its raw attachment bytes and returns `development`, never remote acceptance. Configure storage only in your development host; no route is mounted automatically and no network replay is provided. Treat captured messages and sign-in links as sensitive local data.
+Development requires all three: `provider:'development'`, `mode:'development'`, and explicit `dependencies.outbox.put`. It captures the prepared message with its raw attachment bytes and returns `development`, never remote acceptance. A storage failure throws `DevelopmentOutboxError` (`code: 'development_outbox_failed'`, `retryable: true`): the message is valid, so a queue consumer retries it. Invalid input throws `MailValidationError`, which is permanent and is dropped. Configure storage only in your development host; no route is mounted automatically and no network replay is provided. Treat captured messages and sign-in links as sensitive local data.
 
 ### Adopting the local outbox
 

package/modules/mail/index.mjs

@@ -1,6 +1,6 @@
 export { createMailSender } from './src/sender.mjs';
 
-export { MailValidationError } from './src/core/errors.mjs';
+export { MailValidationError, DevelopmentOutboxError } from './src/core/errors.mjs';
 export { serializeSendGridMessage } from './src/adapters/sendgrid/index.mjs';
 export { verifyWebhook, MAX_WEBHOOK_BYTES, createDeliveryEventIntake, createD1EventStore } from './src/events/index.mjs';
 export { normalizeInbound, createResendAttachmentFetcher } from './src/inbound/index.mjs';

package/modules/mail/src/core/errors.mjs

@@ -7,3 +7,12 @@ export class MailValidationError extends Error {
   }
 }
 export function fail(code) { throw new MailValidationError(code); }
+/** The development outbox could not store the message. The message is fine: send it again. */
+export class DevelopmentOutboxError extends Error {
+  constructor() {
+    super('Development outbox storage failed; the same message may succeed when sent again.');
+    this.name = 'DevelopmentOutboxError';
+    this.code = 'development_outbox_failed';
+    this.retryable = true;
+  }
+}

package/modules/mail/src/development/index.d.mts

@@ -27,6 +27,12 @@ export interface DevelopmentD1Database {
   prepare(sql: string): DevelopmentD1Statement;
   batch(statements: DevelopmentD1Statement[]): Promise<Array<{ success: boolean; results: unknown[] }>>;
 }
+/** Storage failure: the message is valid, so a queue consumer retries instead of dropping it. Invalid input throws `MailValidationError`, which is permanent. */
+export class DevelopmentOutboxError extends Error {
+  readonly name: 'DevelopmentOutboxError';
+  readonly code: 'development_outbox_failed';
+  readonly retryable: true;
+}
 export function createD1DevelopmentOutbox(options: { db: DevelopmentD1Database; maxMessages?: number; maxAgeMs?: number; clock?: () => number }): DevelopmentOutbox;
 export function createDevelopmentOutboxHandler(options: {
   local: boolean; origin: string; outbox: Pick<DevelopmentOutbox, 'list' | 'get'>; path?: string;

package/modules/mail/src/development/index.mjs

@@ -1,9 +1,10 @@
-import { MailValidationError, fail } from '../core/errors.mjs';
+import { MailValidationError, DevelopmentOutboxError, fail } from '../core/errors.mjs';
 import { validateConfig, validateMessage } from '../core/validation.mjs';
 import { sendResult } from '../core/transport.mjs';
 
 export { createD1DevelopmentOutbox } from './outbox.mjs';
 export { createDevelopmentOutboxHandler } from './viewer.mjs';
+export { DevelopmentOutboxError } from '../core/errors.mjs';
 
 function validate(operation, errorCode) {
   try {
@@ -27,8 +28,10 @@ export async function sendDevelopment(config, message, dependencies = {}) {
 
   try {
     await dependencies.outbox.put(snapshot);
-  } catch {
-    fail('development_outbox_failed');
+  } catch (error) {
+    // Input the outbox itself refuses stays permanent; a storage failure is worth a retry.
+    if (error instanceof MailValidationError) throw error;
+    throw new DevelopmentOutboxError();
   }
 
   return sendResult('development', 'development', null);

package/modules/mail/src/development/viewer-html.mjs

@@ -1,4 +1,4 @@
-export const style = `*{box-sizing:border-box}body{margin:0;background:#f5f7fa;color:#17212e;font:16px/1.6 system-ui,sans-serif}main{max-width:52rem;margin:0 auto;padding:24px 16px}h1{font-size:1.75rem;line-height:1.2}article{margin:20px 0;padding:20px;background:white;border:1px solid #cad2dc;border-radius:12px}h2{font-size:1.2rem}h1,h2,p,a,pre{overflow-wrap:anywhere;word-break:normal}pre{white-space:pre-wrap;font:inherit}a{color:#174fb5}a.open{display:block;padding:16px;margin:20px 0;border-radius:8px;background:#174fb5;color:white;font-weight:700;text-align:center;text-decoration:none;min-height:56px}small{color:#465569}`;
+export const style = `*{box-sizing:border-box}body{margin:0;background:#f5f7fa;color:#17212e;font:16px/1.6 system-ui,sans-serif}main{max-width:52rem;margin:0 auto;padding:24px 16px}h1{font-size:1.75rem;line-height:1.2}article{margin:20px 0;padding:20px;background:white;border:1px solid #cad2dc;border-radius:12px}h2{font-size:1.2rem}h1,h2,p,a,pre{overflow-wrap:anywhere;word-break:normal}pre{white-space:pre-wrap;font:inherit}a{color:#174fb5}a.open{display:block;padding:16px;margin:20px 0;border-radius:8px;background:#174fb5;color:white;font-weight:700;text-align:center;text-decoration:none;min-height:56px}a.nav{display:inline-block;padding:4px 0}small{color:#465569}`;
 
 // Added only when the seed declares a theme: its linked rer-theme.css supplies the
 // --rer-* tokens. Each falls back to the plain sheet's value, and the focus ring is
@@ -33,10 +33,10 @@ export function document(body, theme) {
 }
 
 export function listing(rows, path) {
-  return rows.length ? rows.map(row => `<article>${metadata(row)}<p><a href="${escape(`${path}?message=${encodeURIComponent(row.id)}`)}">Read message</a></p></article>`).join('') : '<p>No messages yet.</p>';
+  return rows.length ? rows.map(row => `<article>${metadata(row)}<p><a href="${escape(`${path}?message=${encodeURIComponent(row.id)}`)}" class="nav">Read message</a></p></article>`).join('') : '<p>No messages yet.</p>';
 }
 
 export function detail(row, path) {
   const link = firstLink(row.message);
-  return `<p><a href="${escape(path)}">All messages</a></p><article>${metadata(row)}${link ? `<a class="open" href="${escape(link)}" rel="noreferrer noopener">Open this link</a>` : ''}<h2>Message text</h2><pre>${escape(row.message.text || row.message.html || '')}</pre>${row.message.attachments?.length ? `<p>${row.message.attachments.length} attachment(s) stored with this message.</p>` : ''}</article>`;
+  return `<p><a href="${escape(path)}" class="nav">All messages</a></p><article>${metadata(row)}${link ? `<a class="open" href="${escape(link)}" rel="noreferrer noopener">Open this link</a>` : ''}<h2>Message text</h2><pre>${escape(row.message.text || row.message.html || '')}</pre>${row.message.attachments?.length ? `<p>${row.message.attachments.length} attachment(s) stored with this message.</p>` : ''}</article>`;
 }

package/modules/mail/src/development/viewer.mjs

@@ -1,11 +1,18 @@
 import { detail, document, listing, style, themedStyle } from './viewer-html.mjs';
 
+// The mail module runs as its own module root (in workerd too), so it cannot
+// import operator-auth's shared predicate (modules/operator-auth/loopback.mjs);
+// this is the same rule: the loopback hosts, 127/8, or a name under .localhost
+// (the front door's http://NAME.localhost:PORT).
+const localhostName = /^(?:[a-z0-9](?:[a-z0-9-]{0,61}[a-z0-9])?\.)+localhost$/;
+const isLoopbackHost = hostname => hostname === 'localhost' || hostname === '127.0.0.1' || hostname === '[::1]' || (hostname.length <= 253 && localhostName.test(hostname));
+
 function localOrigin(origin) {
   if (typeof origin !== 'string') return null;
   try {
     const url = new URL(origin);
     const ipv4 = url.hostname.split('.');
-    const loopback = url.hostname === 'localhost' || url.hostname === '[::1]' ||
+    const loopback = isLoopbackHost(url.hostname) ||
       (ipv4.length === 4 && ipv4[0] === '127' && ipv4.every(part => /^(0|[1-9]\d{0,2})$/.test(part) && Number(part) <= 255));
     return loopback && ['http:', 'https:'].includes(url.protocol) && url.origin === origin ? url : null;
   } catch { return null; }

package/modules/operator-auth/dev/index.mjs

@@ -50,7 +50,7 @@ export function withDevIdentity(worker, { bindings = env => env, config: authCon
         if (!gate || env.RER_DEV_IDENTITY === 'off' || !await gate.admits(request)) return devNotFound();
         const context = identity(env, authConfig, declared);
         try {
-          return path === '/__dev/personas' ? Response.json(context.list(), { headers }) : await enter(request, gate, context);
+          return path === '/__dev/personas' ? Response.json(await context.list(), { headers }) : await enter(request, gate, context);
         } catch (error) {
           if (error instanceof AuthError) return Response.json({ error: error.code }, { status: error.status, headers });
           throw error;
@@ -68,7 +68,16 @@ export function withDevIdentity(worker, { bindings = env => env, config: authCon
 function identity(env, authConfig, declared) {
   const config = configure(authConfig(env)), store = new AuthStore(env.DB);
   const hash = token => hashToken(config.SESSION_SECRET, 'session', token);
-  const everyone = () => [{ as: 'owner', email: config.OWNER_EMAIL }, ...declared];
+  // The `owner` persona is the owner rer setup claimed while that owner is
+  // active; after that owner has left, the earliest-created active owner; with
+  // no active owner left, nobody (email null), so rer names who it signs in as.
+  const owner = async () => {
+    const setup = await store.byEmail(config.OWNER_EMAIL);
+    if (setup?.role === 'owner' && isActiveOperator(setup, config.allowList)) return setup.email;
+    const rows = (await store.statement(`SELECT email FROM oa_operators WHERE role='owner' AND status='active' ORDER BY created_at, id`).all()).results;
+    return rows.find(row => isActiveOperator({ ...row, status: 'active' }, config.allowList))?.email ?? (setup ? null : config.OWNER_EMAIL);
+  };
+  const everyone = async () => [{ as: 'owner', email: await owner() }, ...declared];
   async function current(request) {
     const token = readCookie(request, config);
     if (!token) return null;
@@ -85,8 +94,8 @@ function identity(env, authConfig, declared) {
       if (!defaultRolePolicy({ actor: actor.operator, action: 'operators:invite', role: 'owner' })) throw new AuthError('forbidden', 403);
       return { ...actor, hash: await hash(readCookie(request, config)) };
     },
-    list: () => [...everyone().map(({ as, email, role }) => ({ as, email, ...(role ? { role } : {}) })), { as: 'signed-out' }],
-    async badge(request) { return { session: await current(request), choices: everyone() }; },
+    list: async () => [...(await everyone()).map(({ as, email, role }) => ({ as, email, ...(role ? { role } : {}) })), { as: 'signed-out' }],
+    async badge(request) { return { session: await current(request), choices: (await everyone()).filter(persona => persona.email) }; },
   };
 }
 
@@ -104,8 +113,9 @@ async function enter(request, gate, { config, store, hash, current, everyone, ow
     reply.set('location', '/');
     return new Response(null, { status: 303, headers: reply });
   }
-  const persona = everyone().find(p => p.as === as);
+  const persona = (await everyone()).find(p => p.as === as);
   if (!persona) return devNotFound();
+  if (!persona.email) return text(409, 'No active owner remains in this app. Sign in another way, or run rer reset --yes and rer setup for a new owner.');
   let operator = await store.byEmail(persona.email);
   // Personas are real operators, created only here, in local dev.
   if (!operator && persona.role) {

package/modules/operator-auth/http.mjs

@@ -1,8 +1,7 @@
 import { deny } from './errors.mjs';
 import { validToken } from './crypto.mjs';
-export function isLoopbackHost(hostname) {
-  return hostname === 'localhost' || hostname === '127.0.0.1' || hostname === '[::1]';
-}
+import { isLoopbackHost } from './loopback.mjs';
+export { isLoopbackHost };
 // Browsers keep cookies per host, not per port, so checkouts side by side on
 // one loopback host would overwrite each other's cookies. A local cookie name
 // therefore carries its origin's port; hosted names never change. Seeds on

package/modules/operator-auth/loopback.mjs

@@ -0,0 +1,17 @@
+// The one loopback predicate every local-only check shares. A local origin's
+// host is one of the three loopback hosts or a name under `.localhost`, which
+// RFC 6761 reserves for loopback and browsers resolve to it themselves: the
+// front door serves each checkout at `http://<name>.localhost:<port>`. Hosted
+// origins never pass through this predicate; they must be https.
+const label = '[a-z0-9](?:[a-z0-9-]{0,61}[a-z0-9])?';
+const localhostName = new RegExp(`^(?:${label}\\.)+localhost$`);
+
+/** A name under `.localhost` (lowercase, no trailing dot), such as `cradle.localhost`. */
+export function isLocalhostName(hostname) {
+  return typeof hostname === 'string' && hostname.length <= 253 && localhostName.test(hostname);
+}
+
+/** `localhost`, `127.0.0.1`, `[::1]` (as URL.hostname spells it) or a `*.localhost` name. */
+export function isLoopbackHost(hostname) {
+  return hostname === 'localhost' || hostname === '127.0.0.1' || hostname === '[::1]' || isLocalhostName(hostname);
+}

package/modules/owner-claim/verify.mjs

@@ -1,4 +1,5 @@
 // Portable Web Crypto verifier. This file has no application or database imports.
+import { isLoopbackHost } from '../operator-auth/loopback.mjs';
 export class OwnerClaimError extends Error {
   constructor(code = 'invalid_claim', status = 403) { super(code); this.name = 'OwnerClaimError'; this.code = code; this.status = status; }
 }
@@ -10,7 +11,7 @@ function coordinate(value) {
   return btoa(atob(value.replaceAll('-', '+').replaceAll('_', '/'))).replaceAll('+', '-').replaceAll('/', '_').replace(/=+$/, '') === value;
 }
 function origin(value) {
-  try { const u = new URL(value); return u.origin === value && !u.username && !u.password && (u.protocol === 'https:' || (u.protocol === 'http:' && ['localhost', '127.0.0.1', '[::1]'].includes(u.hostname))); } catch { return false; }
+  try { const u = new URL(value); return u.origin === value && !u.username && !u.password && (u.protocol === 'https:' || (u.protocol === 'http:' && isLoopbackHost(u.hostname))); } catch { return false; }
 }
 export function configureClaim(input) {
   if (!input || !origin(input.issuer) || !origin(input.appOrigin)

package/modules/portability/README.md

@@ -217,6 +217,14 @@ and refuses rows matching its tombstones or any destination erasure fence.
 Product validation, foreign keys and normal restore safeguards still apply.
 Any mismatch refuses recovery; this mode does not repair damaged archives.
 
+Recovery needs a new installation. SQLite, migration and transfer bookkeeping, the
+storage tables of FTS5 indexes (`<index>_data|idx|content|docsize|config`; the index
+itself is still checked through its own SELECT) and the rows the destination's own
+migrations seed may exist; the seed rows are compared with a scratch replay of the
+applied migrations (Node runners) and must be unchanged. Any other row refuses with
+`legacy_target_not_empty`, before staging and again inside the restore batch. A table
+the policy lists in `replaceableTables` is replaced by the restore as usual.
+
 V1 cannot authenticate the complete manifest: source identity, export time,
 erasure epoch/journal, rowids and other metadata lack the v2 archive binding.
 Checksums are consistency checks, not proof of authorship. A missing or altered

package/modules/portability/hash.mjs

@@ -17,9 +17,13 @@ export function base64(bytes) {
   for (let i = 0; i < bytes.length; i += 8192) result += String.fromCharCode(...bytes.subarray(i, i + 8192));
   return btoa(result);
 }
+// Canonical base64 only: a plain character-class scan (no group repetition, so no regex stack) and
+// the padding rule by arithmetic, in time linear in the input however large an original is.
 export function unbase64(value) {
-  if (typeof value !== 'string' || !/^(?:[A-Za-z0-9+/]{4})*(?:[A-Za-z0-9+/]{2}==|[A-Za-z0-9+/]{3}=)?$/.test(value)) throw new Error('invalid_base64');
-  return Uint8Array.from(atob(value), c => c.charCodeAt(0));
+  if (typeof value !== 'string' || value.length % 4 !== 0 || !/^[A-Za-z0-9+/]*={0,2}$/.test(value)) throw new Error('invalid_base64');
+  const text = atob(value), bytes = new Uint8Array(text.length);
+  for (let i = 0; i < text.length; i++) bytes[i] = text.charCodeAt(i);
+  return bytes;
 }
 
 // Incremental SHA-256 for semantic JSON and objects. SubtleCrypto has no streaming

package/modules/portability/import.mjs

@@ -134,7 +134,7 @@ export async function finalizeImport(context,id,{contentHash,archiveHash,laterJo
   const digest=verifier.digest();if(contentHash!==undefined)insist(contentHash===digest,'content_checksum');
   insist(archiveHash===archive.digest(),'archive_checksum',409);
   const checked=await fence(db,manifest,row.metadata.copies,laterJournal);
-  if(row.metadata.legacyRecovery)await requireLegacyEmpty(context,row.metadata.legacyRecovery.emptyTables);
+  if(row.metadata.legacyRecovery)await requireLegacyEmpty(context,row.metadata.legacyRecovery);
   for(const table of row.metadata.targets) if(!config.replaceableTables.includes(table.name))insist(!(await statement(db,`SELECT 1 FROM ${quote(table.name)} LIMIT 1`).first()),'target_not_empty:'+table.name,409);
   const dependentGuards=await excludedDependentGuards(db,row.metadata.targets,config.replaceableTables);
   await bucketsEmpty(context,row);

package/modules/portability/legacy-files.mjs

@@ -4,7 +4,7 @@ import { createPortability } from './index.mjs';
 import { createImport, uploadPart, finalizeImport, abortImport } from './import.mjs';
 import { readLegacyArchive, ArchiveVerifier } from './format.mjs';
 import { fileRecords, exportArchive } from './files.mjs';
-import { ensureLegacyAudit, legacyEmptyTables, requireLegacyEmpty } from './legacy-safety.mjs';
+import { ensureLegacyAudit, legacyTargetState, requireLegacyEmpty } from './legacy-safety.mjs';
 import { insist, PortabilityError } from './storage.mjs';
 
 export async function recoverLegacyArchive({db,buckets,policy:input,migrations},path,output,transient,acknowledged) {
@@ -13,8 +13,8 @@ export async function recoverLegacyArchive({db,buckets,policy:input,migrations},
  insist(!(await lstat(output).catch(error=>{if(error.code==='ENOENT')return null;throw error;})),'legacy_output_exists',409);
  // Whole-file verification precedes even staging/audit schema writes.
  for await(const record of fileRecords(path,readLegacyArchive)){}
- const context={db,buckets,config:policy(input),migrations},emptyTables=await legacyEmptyTables(db);
- await requireLegacyEmpty(context,emptyTables);
+ const context={db,buckets,config:policy(input),migrations},target=await legacyTargetState(db,migrations);
+ await requireLegacyEmpty(context,target);
  let id,manifest,closing,integrity,status,complete=false;
  try {
   for await(const record of fileRecords(path,readLegacyArchive)) {
@@ -25,7 +25,7 @@ export async function recoverLegacyArchive({db,buckets,policy:input,migrations},
     id=await createImport(context,manifest,'legacy-v1',{
      event:'legacy_v1_unverified_restore',acknowledgedUnverifiedMetadata:true,
      sourceIdentity:record.sourceIdentity,exportedAt:record.exportedAt,
-     recoveryOutput:output,emptyTables,
+     recoveryOutput:output,...target,
     });
     // A refused schema writes nothing, not even the audit table.
     await ensureLegacyAudit(db);

package/modules/portability/legacy-safety.mjs

@@ -2,18 +2,59 @@ import { all, statement, guard, quote, insist } from './storage.mjs';
 import { canonicalJson } from './hash.mjs';
 
 // Recovery requires a new installation, including excluded identity tables and
-// normally replaceable product rows. Only SQLite/migration/transfer bookkeeping
-// may already exist. Do not use the product's export exclusions for this check.
-export async function legacyEmptyTables(db) {
- const tables=await all(db,"SELECT name FROM sqlite_master WHERE type='table' AND sql IS NOT NULL ORDER BY name");
- return tables.map(t=>t.name).filter(name=>!(/^(sqlite_|_cf_|rer_portability_)/i.test(name) || ['d1_migrations','_rer_deploy_migrations','_rer_portability_migrations'].includes(name.toLowerCase())));
+// normally replaceable product rows. Only SQLite/migration/transfer bookkeeping,
+// the storage of FTS5 indexes and rows the destination's own migrations seed may
+// already exist. Do not use the product's export exclusions for this check.
+const bookkeeping=name=>/^(sqlite_|_cf_|rer_portability_)/i.test(name) || ['d1_migrations','_rer_deploy_migrations','_rer_portability_migrations'].includes(name.toLowerCase());
+const fts5=/^\s*CREATE\s+VIRTUAL\s+TABLE\s+(?:IF\s+NOT\s+EXISTS\s+)?(?:"((?:[^"]|"")+)"|`([^`]+)`|\[([^\]]+)\]|'((?:[^']|'')+)'|([A-Za-z0-9_$]+))\s+USING\s+fts5\b/i;
+const unquoted=m=>m[1]!==undefined?m[1].replaceAll('""','"'):m[4]!==undefined?m[4].replaceAll("''","'"):m[2]??m[3]??m[5];
+// An FTS5 index keeps its data in <name>_data|idx|content|docsize|config. The index itself stays
+// listed and is checked through its own SELECT, so a real indexed row still refuses.
+function shadowTables(tables) {
+ const shadows=new Set();
+ for(const table of tables) {
+  const match=fts5.exec(table.sql);
+  if(match)for(const suffix of ['data','idx','content','docsize','config'])shadows.add(unquoted(match).toLowerCase()+'_'+suffix);
+ }
+ return shadows;
 }
-export async function requireLegacyEmpty({db,buckets},tables) {
- for(const table of tables)insist(!(await statement(db,`SELECT 1 FROM ${quote(table)} LIMIT 1`).first()),'legacy_target_not_empty:'+table,409);
+const imageSql=(table,columns)=>`SELECT json_array(${columns.map(c=>`quote(${quote(c)})`).join(',')}) AS image FROM ${quote(table)}`;
+const MAX_SEED_ROWS=10000;
+
+/** What the destination must still hold when the restore commits: `emptyTables` stay empty and
+ * each of `seededTables` keeps exactly the rows its migrations put there. A table with rows the
+ * replay of the destination's applied migrations (migrations(), a node runner's scratch database)
+ * does not produce is listed as to-be-empty, so the preflight refuses it. */
+export async function legacyTargetState(db,migrations) {
+ const tables=await all(db,"SELECT name,sql FROM sqlite_master WHERE type='table' AND sql IS NOT NULL ORDER BY name"),shadows=shadowTables(tables);
+ const names=tables.map(t=>t.name).filter(name=>!bookkeeping(name) && !shadows.has(name.toLowerCase()));
+ const filled=[];
+ for(const name of names)if(await statement(db,`SELECT 1 FROM ${quote(name)} LIMIT 1`).first())filled.push(name);
+ const seeded=[];
+ if(filled.length && migrations) {
+  const requests=[];
+  for(const name of filled)requests.push({name,columns:(await all(db,`SELECT name FROM pragma_table_info(?)`,name)).map(c=>c.name)});
+  // Without a usable replay no seed is vouched for, so those rows count as the installation's own.
+  const expected=await migrations().then(replay=>replay.rowImages(requests,MAX_SEED_ROWS),()=>new Map());
+  for(const {name,columns} of requests) {
+   const want=expected.get(name);
+   if(!want || (await statement(db,`SELECT count(*) AS n FROM ${quote(name)}`).first()).n!==want.length)continue;
+   const found=(await all(db,imageSql(name,columns))).map(r=>r.image).sort();
+   if(canonicalJson(found)===canonicalJson(want))seeded.push({name,columns,images:found});
+  }
+ }
+ return {emptyTables:names.filter(name=>!seeded.some(s=>s.name===name)),seededTables:seeded};
+}
+const seededCondition=(db,table)=>[`(SELECT count(*) FROM ${quote(table.name)})=? AND NOT EXISTS(SELECT 1 FROM (${imageSql(table.name,table.columns)}) WHERE image NOT IN (SELECT value FROM json_each(?)))`,table.images.length,JSON.stringify(table.images)];
+export async function requireLegacyEmpty({db,buckets},{emptyTables,seededTables=[]}) {
+ for(const table of emptyTables)insist(!(await statement(db,`SELECT 1 FROM ${quote(table)} LIMIT 1`).first()),'legacy_target_not_empty:'+table,409);
+ for(const table of seededTables){const [condition,...values]=seededCondition(db,table);insist((await statement(db,`SELECT CASE WHEN (${condition}) THEN 1 ELSE 0 END AS ok`,...values).first()).ok===1,'legacy_target_not_empty:'+table.name,409);}
  for(const [name,bucket] of Object.entries(buckets))insist(!(await bucket.list({limit:1})).objects.length,'legacy_bucket_not_empty:'+name,409);
 }
 export function legacyEmptyGuards(db,row) {
- return (row.metadata.legacyRecovery?.emptyTables??[]).map(table=>guard(db,`NOT EXISTS(SELECT 1 FROM ${quote(table)})`));
+ const recovery=row.metadata.legacyRecovery;
+ return [...(recovery?.emptyTables??[]).map(table=>guard(db,`NOT EXISTS(SELECT 1 FROM ${quote(table)})`)),
+  ...(recovery?.seededTables??[]).map(table=>{const [condition,...values]=seededCondition(db,table);return guard(db,condition,...values);})];
 }
 export async function ensureLegacyAudit(db) {
  // Additive sidecar, installed only by recovery; existing product migrations
@@ -22,6 +63,6 @@ export async function ensureLegacyAudit(db) {
 }
 export function legacyAuditStatements(db,row) {
  if(!row.metadata.legacyRecovery)return [];
- const {emptyTables,...details}=row.metadata.legacyRecovery;
- return [statement(db,'INSERT INTO rer_portability_recovery_audit VALUES(?,?,?)',row.id,new Date().toISOString(),canonicalJson({...details,contentHash:row.metadata.contentHash,...(row.metadata.bridge?{bridged:row.metadata.bridge}:{})}))];
+ const {emptyTables,seededTables=[],...details}=row.metadata.legacyRecovery;
+ return [statement(db,'INSERT INTO rer_portability_recovery_audit VALUES(?,?,?)',row.id,new Date().toISOString(),canonicalJson({...details,...(seededTables.length?{seededTables:seededTables.map(t=>t.name)}:{}),contentHash:row.metadata.contentHash,...(row.metadata.bridge?{bridged:row.metadata.bridge}:{})}))];
 }

package/modules/portability/migration-history.mjs

@@ -14,5 +14,20 @@ export function migrationReplay(plan,input) {
       for(const migration of plan.filter(m=>names.includes(m.name)))for(const sql of migration.statements)scratch.exec(sql);
       return await schemaIdentity(db,config);
     }finally{scratch.close();}
+  },
+  // The rows the whole replay leaves in each requested table, as sorted images (legacy-safety.mjs).
+  // A table the replay lacks, or one holding more than `limit` rows, has no entry.
+  async rowImages(requests,limit) {
+    const scratch=new DatabaseSync(':memory:'),found=new Map();
+    try {
+      for(const migration of plan)for(const sql of migration.statements)scratch.exec(sql);
+      for(const {name,columns} of requests) {
+        try {
+          const rows=scratch.prepare(`SELECT json_array(${columns.map(c=>`quote("${c.replaceAll('"','""')}")`).join(',')}) AS image FROM "${name.replaceAll('"','""')}" LIMIT ?`).all(limit+1).map(r=>r.image);
+          if(rows.length<=limit)found.set(name,rows.sort());
+        }catch{}
+      }
+      return found;
+    }finally{scratch.close();}
   }};
 }

package/modules/release/README.md

@@ -55,9 +55,11 @@ default verification succeeds. Keep capacity, maximum-size memory and load cases
 in that release-only script. Both dry runs and releases require it to pass;
 `gates.verify.release` records its result. Routine CI and default verification
 do not invoke it.
-Child logs are suppressed to avoid credential disclosure; the receipt retains
-exit status and numeric final summaries from Node's spec/TAP reporters and
-Playwright's text reporters. Counts add across suites: `tests`, `passed`,
+A passing step's receipt retains exit status and numeric final summaries from
+Node's spec/TAP reporters and Playwright's text reporters. A failing install,
+`verify` or `verify:release` step also keeps `output`: the last 40 lines (at most
+8 KB) of that child's output, after the command store's credential redaction.
+The output stays in the receipt and is left out of the site preview. Counts add across suites: `tests`, `passed`,
 `failed`, `skipped` and `flaky`; nonzero `cancelled`, `todo`, `interrupted` and
 `notRun` counts are retained when reported. Playwright's total includes each
 outcome once, with flaky tests counted separately from passed tests. Node's

package/modules/release/produce.mjs

@@ -8,6 +8,9 @@ import { publicationScan, validatePublicationDestination } from './publication-s
 import { publicDestination, requirePublicDestination, remotePublicHead, publicChild, assertPublicTree } from './public-child.mjs';
 import { writePublishHandoff } from './publish-handoff.mjs';
 
+// Failure output belongs to the private receipt, not the site preview.
+const withoutOutput = gates => JSON.parse(JSON.stringify(gates, (key, value) => key === 'output' ? undefined : value));
+
 export async function release({ repo, ref = 'HEAD', output, project, repository, dryRun = false, tag = false, cleanHistory: clean = false, envFile, onto }) {
   if (!/^[\w.-]+\/[\w.-]+$/.test(project ?? '')) throw Error('--project must be publisher/name');
   if (!/^https:\/\/github\.com\/[\w.-]+\/[\w.-]+(?:\.git)?$/i.test(repository ?? '')) throw Error('--repository must be a credential-free GitHub repository URL');
@@ -37,7 +40,7 @@ export async function release({ repo, ref = 'HEAD', output, project, repository,
     // Honour the seed's committed install policy. Base's native-build settings
     // are not interchangeable with pnpm 8's locked onlyBuiltDependencies.
     const install = await command('pnpm', ['install', '--frozen-lockfile'], checkout);
-    const verify = install.status === 'PASS' ? await command('pnpm', ['run', 'verify'], checkout) : { status: 'FAIL', reason: 'frozen-install-failed', tests: 0, passed: 0, failed: 0 };
+    const verify = install.status === 'PASS' ? await command('pnpm', ['run', 'verify'], checkout) : { status: 'FAIL', reason: 'frozen-install-failed', tests: 0, passed: 0, failed: 0, output: install.output };
     // Release-only scale and capacity cases stay outside routine CI. The
     // committed seed script is an additional gate in previews and releases.
     if (verify.status === 'PASS' && JSON.parse(source.bytes('package.json')).scripts['verify:release']) {
@@ -101,7 +104,7 @@ export async function release({ repo, ref = 'HEAD', output, project, repository,
     // A blocked preview may prepare the site metadata/docs for local review.
     // Its provenance explicitly records blocked gates; it is never a release.
     const publicSource = exported ? { ...source, commit: exported.commit, publicTagStaged: Boolean(destination && tag) } : source;
-    if (passed || preview) receipt.siteRelease = writeCatalogue(publicSource, output, catalogue(publicSource, project, repository, gates, preview));
+    if (passed || preview) receipt.siteRelease = writeCatalogue(publicSource, output, catalogue(publicSource, project, repository, withoutOutput(gates), preview));
     if (passed) {
       if (tag) {
         receipt.publicExport = publicExport(source, temporary, output);