@runeditrun/rer 0.1.0 → 0.2.0

package/modules/release/source.mjs

@@ -4,6 +4,7 @@ import { shared } from '../../cli/shared.mjs';
 import { execFileSync, spawn } from 'node:child_process';
 import { realpathSync, existsSync, lstatSync, mkdirSync } from 'node:fs';
 import { resolve, dirname, relative, isAbsolute } from 'node:path';
+import { stripVTControlCharacters } from 'node:util';
 import { testSummary } from './test-summary.mjs';
 
 export function git(repo, ...args) {
@@ -56,16 +57,26 @@ export function newOutput(repo, output) {
   return output;
 }
 
-// Keep child diagnostics private: arbitrary verify scripts can print credential
-// values. Only exit status and numeric test summaries leave this boundary.
+// Child output is redacted by the command store before it is kept. A failing
+// step's receipt carries the last 40 lines of it, at most 8 KB; a passing step
+// carries only its exit status and numeric test summaries.
+const TAIL_LINES = 40, TAIL_BYTES = 8192;
+function failureTail(logs) {
+  const lines = stripVTControlCharacters(logs.join('\n')).split('\n');
+  while (lines.length && lines.at(-1).trim() === '') lines.pop();
+  const bytes = Buffer.from(lines.slice(-TAIL_LINES).join('\n'));
+  return bytes.subarray(Math.max(0, bytes.length - TAIL_BYTES)).toString('utf8').replace(/^\uFFFD+/, '');
+}
+
 export async function command(command, args, cwd) {
  const {createCommands}=await shared('commands.mjs');
  const directory=await mkdtemp(resolve(tmpdir(),'rer-release-'));
- const store=await createCommands(directory,{logs:[]},{terminal:()=>{},queue:{verb:'release'}});
+ const state={logs:[]};
+ const store=await createCommands(directory,state,{terminal:()=>{},queue:{verb:'release'}});
  const summary=testSummary(),env={...process.env,FORCE_COLOR:'0'};delete env.NODE_TEST_CONTEXT;
  try {
   await store.run('Release verification',command,args,{cwd,env,onChild:child=>child.stdout.on('data',bytes=>summary.write(bytes))});
   return {status:'PASS',exitCode:0,...summary.finish()};
- }catch(error){return {status:'FAIL',exitCode:error.childExitCode??null,...summary.finish()};}
+ }catch(error){return {status:'FAIL',exitCode:error.childExitCode??null,...summary.finish(),output:failureTail(state.logs)};}
  finally{await store.closeCommands();await rm(directory,{recursive:true,force:true});}
 }

package/onboarding/adapter-auth.mjs

@@ -1,4 +1,5 @@
 import { approveSetupDependencies } from './dependency-approval.mjs';
+import { appFetch } from './app-fetch.mjs';
 import { createHmac } from 'node:crypto';
 import {commandFailure,installationFailure} from './failures.mjs';
 import { labels } from './adapter-labels.mjs';
@@ -10,10 +11,10 @@ const outboxPath = '/__dev/outbox'; // modules/mail/src/development default path
 // that is not in local mode ignores the header. The proof comes from the
 // setting the seed's adapter declares as its session secret (sessionSecretKey,
 // default SESSION_SECRET).
-const localCliProof = secret => createHmac('sha256', secret).update('local-cli\0sign-in').digest('hex');
+export const localCliProof = secret => createHmac('sha256', secret).update('local-cli\0sign-in').digest('hex');
 const post = (context, path, body) => {
  const secret = context.vars[context.sessionSecretKey ?? 'SESSION_SECRET'];
- return fetch(new URL(path, context.origin), {
+ return appFetch(new URL(path, context.origin), {
   method: 'POST', redirect: 'manual', signal: context.signal,
   headers: { Origin: context.origin, 'Content-Type': 'application/json', ...(typeof secret === 'string' && secret ? { 'x-rer-local-cli': localCliProof(secret) } : {}) }, body: JSON.stringify(body),
  });
@@ -75,7 +76,7 @@ export async function signIn(context, hook) {
 async function outboxMessages(context, path, address, required = false) {
  let response;
  // A dev-identity seed gates its outbox with the checkout's key; present it.
- try { response = await fetch(new URL(path, context.origin), { signal: context.signal, headers: context.devKey ? { 'x-rer-dev-key': context.devKey } : {} }); } catch (error) {
+ try { response = await appFetch(new URL(path, context.origin), { signal: context.signal, headers: context.devKey ? { 'x-rer-dev-key': context.devKey } : {} }); } catch (error) {
   if (context.signal?.aborted) throw error;
   if(required){context.store.report?.('Local development outbox is unavailable. Run rer setup before requesting sign-in.');throw context.fail('setup');}
   return [];

package/onboarding/adapter-settings.mjs

@@ -1,6 +1,7 @@
 import { randomBytes } from 'node:crypto';
 import { createServer } from 'node:net';
-import { isAbsolute, relative, resolve, sep } from 'node:path';
+import { basename, dirname, isAbsolute, relative, resolve, sep } from 'node:path';
+import { fileURLToPath } from 'node:url';
 import { labels } from './adapter-labels.mjs';
 import { credentialValues } from './redaction.mjs';
 import { privateDirectory, readPrivateFile, writePrivateFile } from './private-files.mjs';
@@ -8,6 +9,9 @@ import { localVariables } from './local/environment.mjs';
 import { assertRegular, inspect } from './local/files.mjs';
 import { localOperation } from './local/operation.mjs';
 import { recoverInterrupted } from './local/recovery.mjs';
+// The shared loopback predicate, beside this copy in Base or in a seed's scripts/.
+const portable = basename(dirname(fileURLToPath(import.meta.url))) === 'base-onboarding';
+const { isLocalhostName } = await import(new URL(portable ? '../base-cli/modules/operator-auth/loopback.mjs' : '../modules/operator-auth/loopback.mjs', import.meta.url));
 
 async function freePort() {
  const socket = createServer();
@@ -17,15 +21,16 @@ async function freePort() {
  return port;
 }
 
-// A rerun keeps the loopback origin already saved in the seed's settings, so
-// sessions, links and the owner's bookmarks stay valid.
+// A rerun keeps the loopback origin already saved in the seed's settings (a
+// 127.0.0.1 port or a front-door `NAME.localhost` origin), so sessions, links
+// and the owner's bookmarks stay valid.
 async function chooseOrigin(context, hooks) {
  if (context.selectedOrigin) return context.selectedOrigin;
  if (typeof hooks.origin === 'function') return hooks.origin(context);
  const key = hooks.secrets?.originKey;
  if (key) {
   const saved = (await readSettings(context.root, hooks.secrets)).values[key];
-  try { const url = new URL(saved); if (url.protocol === 'http:' && url.hostname === '127.0.0.1' && url.port && url.origin === saved) return saved; } catch {}
+  try { const url = new URL(saved); if (url.protocol === 'http:' && (url.hostname === '127.0.0.1' || isLocalhostName(url.hostname)) && url.port && url.origin === saved) return saved; } catch {}
  }
  return `http://127.0.0.1:${await freePort()}`;
 }
@@ -110,7 +115,18 @@ async function writeSecrets(context, options) {
 async function moveSavedOrigin(context, options, values) {
  const key = options.originKey ?? 'AUTH_ORIGIN', origin = context.selectedOrigin;
  if (!origin || values[key] === undefined || values[key] === origin) return values;
- const current = await readSettings(context.root, options), format = options.format ?? 'dotenv', merged = { ...values, [key]: origin };
+ return rewriteOrigin(context.root, options, values, origin);
+}
+
+// Rewrite only the saved origin (rer dev --door and --direct). The caller holds
+// the local operation lock.
+export async function replaceSavedOrigin(root, options, origin) {
+ return rewriteOrigin(root, options, (await readSettings(root, options)).values, origin);
+}
+
+async function rewriteOrigin(root, options, values, origin) {
+ const key = options.originKey ?? 'AUTH_ORIGIN';
+ const current = await readSettings(root, options), format = options.format ?? 'dotenv', merged = { ...values, [key]: origin };
  const text = format === 'json' ? JSON.stringify(merged, null, 1) + '\n' : current.text.replace(new RegExp(`^${key}=.*$`, 'm'), `${key}=${dotenvValue(origin)}`);
  if (format !== 'json' && localVariables(text)[key] !== origin) throw new Error(`Could not move ${key} in ${options.file ?? '.dev.vars'}; put ${key}=${origin} on its own line.`);
  await writePrivateFile(current.path, text);

package/onboarding/adapter.mjs

@@ -10,6 +10,7 @@ import { credentialValues } from './redaction.mjs';
 import { labels } from './adapter-labels.mjs';
 import { chooseOrigin, prepareSettings, readSettings } from './adapter-settings.mjs';
 import {listenerPorts} from './process-diagnostics.mjs';
+import { appFetch } from './app-fetch.mjs';
 import { owner, signIn } from './adapter-auth.mjs';
 import { installerDevKey } from './dev-identity.mjs';
 import { assertArchiveFree } from './archive-output.mjs';
@@ -180,7 +181,7 @@ async function build(context, hooks) {
 // Health is the application's own /health: HTTP 200 with JSON status "ok"
 // unless the seed supplies another check. Each probe honours its signal.
 export async function defaultHealth(url, signal) {
- const response = await fetch(url, { signal });
+ const response = await appFetch(url, { signal });
  if (!response.ok) {
   await response.body?.cancel();
   return { ready: false, message: `HTTP ${response.status}` };

package/onboarding/app-fetch.mjs

@@ -0,0 +1,79 @@
+// Requests rer itself makes to a local app's own origin (health, sign-in,
+// outbox, dev identity). A directly served origin uses fetch. A front-door
+// origin (http://NAME.localhost:PORT) is never resolved and never goes through
+// the door: rer connects with node:http to that checkout's own proxy on
+// 127.0.0.1, which keeps the Host header (fetch drops a Host override, and musl
+// and some Linux resolvers do not resolve *.localhost), and adds the proxy's
+// per-start secret. Redirects within the routed origin are followed the way
+// fetch follows them. A `*.localhost` origin with no route (its server is not
+// running in this process's knowledge) is refused before anything is sent:
+// whatever answers that name (the door, or a process that took its port) never
+// receives rer's own requests, which can carry the checkout's dev key.
+import http from 'node:http';
+import { basename, dirname } from 'node:path';
+import { fileURLToPath } from 'node:url';
+// The shared loopback predicate, beside this copy in Base or in a seed's scripts/.
+const portable = basename(dirname(fileURLToPath(import.meta.url))) === 'base-onboarding';
+const { isLocalhostName } = await import(new URL(portable ? '../base-cli/modules/operator-auth/loopback.mjs' : '../modules/operator-auth/loopback.mjs', import.meta.url));
+
+const routes = new Map();
+
+/** Send this process's requests for `origin` to 127.0.0.1:`port` with `headers` added. */
+export function routeOrigin(origin, { port, headers = {} }) {
+ routes.set(new URL(origin).origin, { port, headers });
+}
+
+/** One HTTP/1.1 exchange with a loopback listener, Host as given. */
+export function loopbackRequest({ host = '127.0.0.1', port, path = '/', method = 'GET', headers = {}, body, signal, timeoutMs = 30000 }) {
+ return new Promise((resolve, reject) => {
+  const request = http.request({ host, port, path, method, headers, agent: false, signal }, response => {
+   const chunks = [];
+   response.on('data', chunk => chunks.push(chunk));
+   response.on('end', () => resolve({ status: response.statusCode, statusText: response.statusMessage ?? '', rawHeaders: response.rawHeaders, body: Buffer.concat(chunks) }));
+   response.on('error', reject);
+  });
+  request.setTimeout(timeoutMs, () => request.destroy(Object.assign(Error(`No answer from ${host}:${port} within ${timeoutMs / 1000} s.`), { code: 'ETIMEDOUT' })));
+  request.on('error', reject);
+  request.end(body);
+ });
+}
+
+async function bodyBytes(body) {
+ if (body === undefined || body === null) return undefined;
+ if (typeof body === 'string' || Buffer.isBuffer(body) || body instanceof Uint8Array) return Buffer.from(body);
+ return Buffer.from(await new Response(body).arrayBuffer());
+}
+
+const nullBody = status => [101, 103, 204, 205, 304].includes(status);
+
+function unrouted(url) {
+ return Object.assign(new TypeError(`fetch failed: rer sends nothing to ${url.origin} except through that checkout's own server, which is not running here.`), { code: 'ERR_RER_UNROUTED' });
+}
+
+export async function appFetch(input, init = {}) {
+ let url = new URL(input instanceof Request ? input.url : String(input));
+ if (!routes.has(url.origin) && isLocalhostName(url.hostname)) throw unrouted(url);
+ if (!routes.has(url.origin)) return fetch(input, init);
+ let method = (init.method ?? 'GET').toUpperCase(), body = await bodyBytes(init.body);
+ const sent = Object.fromEntries(new Headers(init.headers ?? {}));
+ if (body !== undefined && init.body instanceof URLSearchParams && !sent['content-type']) sent['content-type'] = 'application/x-www-form-urlencoded;charset=UTF-8';
+ for (let hops = 0; ; hops++) {
+  const route = routes.get(url.origin);
+  if (!route && isLocalhostName(url.hostname)) throw unrouted(url);
+  if (!route) return fetch(url, { ...init, method, body });
+  const reply = await loopbackRequest({ port: route.port, path: url.pathname + url.search, method, headers: { ...sent, ...route.headers, host: url.host, ...(body ? { 'content-length': String(body.length) } : {}) }, body, signal: init.signal });
+  const headers = new Headers();
+  for (let i = 0; i < reply.rawHeaders.length; i += 2) headers.append(reply.rawHeaders[i], reply.rawHeaders[i + 1]);
+  const location = headers.get('location');
+  if (location && [301, 302, 303, 307, 308].includes(reply.status) && (init.redirect ?? 'follow') !== 'manual') {
+   if (init.redirect === 'error') throw new TypeError('fetch failed: redirect');
+   if (hops >= 20) throw new TypeError('fetch failed: too many redirects');
+   if (reply.status === 303 || ([301, 302].includes(reply.status) && method === 'POST')) { method = 'GET'; body = undefined; delete sent['content-type']; }
+   url = new URL(location, url);
+   continue;
+  }
+  const response = new Response(nullBody(reply.status) || method === 'HEAD' ? null : reply.body, { status: reply.status, statusText: reply.statusText, headers });
+  Object.defineProperty(response, 'url', { value: url.href });
+  return response;
+ }
+}

package/onboarding/archive-output.d.mts

@@ -1,3 +1,5 @@
 import type { Plugin } from 'vite';
-export function assertArchiveFree(directory: string): Promise<void>;
-export function archiveOutputGuard(): Plugin;
+/** `formats`: the seed's own archive formats, matched against a leading JSON object's `payload.format`. */
+export interface ArchiveFormats { formats?: string[] }
+export function assertArchiveFree(directory: string, options?: ArchiveFormats): Promise<void>;
+export function archiveOutputGuard(options?: ArchiveFormats): Plugin;

package/onboarding/archive-output.mjs

@@ -4,9 +4,13 @@ import { join, resolve } from 'node:path';
 
 // Stream output, including copied public assets: a renamed archive is still
 // private. Never include its contents in an error or read it into one buffer.
-async function hasManifest(file) {
+// A seed whose own export writes another format declares that format's
+// `payload.format` strings; a file whose leading JSON object carries one of them
+// is an archive too.
+async function hasManifest(file, formats) {
  let tail = '', kind = false, format = false, header = '', depth = 0, quoted = false, escaped = false, reading = true, started = false;
- const manifest = text => { try { const value = JSON.parse(text); return value?.kind === 'manifest' && value.format === 'runeditrun-portability'; } catch { return false; } };
+ const manifest = text => { try { const value = JSON.parse(text); return value?.kind === 'manifest' && value.format === 'runeditrun-portability' || formats.includes(value?.payload?.format); } catch { return false; } };
+ const declared = formats.map(name => new RegExp(`"format"\\s*:\\s*${JSON.stringify(name).replace(/[.*+?^${}()|[\]\\]/g, '\\$&')}`));
  for await (const chunk of createReadStream(file, { encoding: 'utf8' })) {
   // Parse the leading JSON object too, so escaped property names and pretty
   // printing cannot hide an otherwise valid portability manifest. The format
@@ -14,7 +18,8 @@ async function hasManifest(file) {
   if (reading) for (const character of chunk) {
    if (!started) { if (/\s/.test(character)) continue; if (character !== '{') { reading = false; break; } started = true; }
    header += character;
-   if (header.length > 24 * 1024 * 1024) { reading = false; header = ''; break; }
+   // A leading object past the limit is an archive when it names a declared format.
+   if (header.length > 24 * 1024 * 1024) { if (declared.some(pattern => pattern.test(header))) return true; reading = false; header = ''; break; }
    if (quoted) { if (escaped) escaped = false; else if (character === '\\') escaped = true; else if (character === '"') quoted = false; }
    else if (character === '"') quoted = true;
    else if (character === '{') depth++;
@@ -28,27 +33,34 @@ async function hasManifest(file) {
  }
  return false;
 }
-export async function assertArchiveFree(directory) {
+export async function assertArchiveFree(directory, { formats = [] } = {}) {
+ assert(formats);
  const status = await lstat(directory).catch(error => { if (error.code === 'ENOENT') return null; throw error; });
  if (!status) return;
  if (status.isSymbolicLink()) throw new Error('Build output must not contain symbolic links.');
  if (status.isDirectory()) {
-  for (const name of await readdir(directory)) await assertArchiveFree(join(directory, name));
- } else if (status.isFile() && (/\.rer(?:\.[\w-]+\.partial)?$/i.test(directory) || await hasManifest(directory))) {
+  for (const name of await readdir(directory)) await assertArchiveFree(join(directory, name), { formats });
+ } else if (status.isFile() && (/\.rer(?:\.[\w-]+\.partial)?$/i.test(directory) || await hasManifest(directory, formats))) {
   throw new Error('Build output contains an installation archive. Move archives to exports/ and build again.');
  }
 }
 
+function assert(formats) {
+ if (!Array.isArray(formats) || formats.some(name => typeof name !== 'string' || !name.trim())) throw new Error('Archive formats must be a list of non-empty payload.format strings.');
+}
+
 // Runs after Vite copies publicDir and writes each client/Worker bundle, also
-// for direct vite build and custom output directories.
-export function archiveOutputGuard() {
+// for direct vite build and custom output directories. `formats` lists the
+// seed's own archive formats (`archiveOutputGuard({ formats: ['acme/local-data.v1'] })`).
+export function archiveOutputGuard({ formats = [] } = {}) {
+ assert(formats);
  let root;
  return {
   name: 'rer:private-archives', apply: 'build', enforce: 'post',
   configResolved(config) { root = config.root; },
   writeBundle: { order: 'post', async handler(options) {
-   if (options.dir) await assertArchiveFree(resolve(root, options.dir));
-   else if (options.file) await assertArchiveFree(resolve(root, options.file));
+   if (options.dir) await assertArchiveFree(resolve(root, options.dir), { formats });
+   else if (options.file) await assertArchiveFree(resolve(root, options.file), { formats });
   } },
  };
 }

package/onboarding/dependency-approval.mjs

@@ -1,3 +1,4 @@
+import { appFetch } from './app-fetch.mjs';
 // Setup opens app-local approvals before native bootstrap. Existing owners must
 // prove their email afresh through the local outbox, just like owner controls.
 export async function approveSetupDependencies(context, post, messages) {
@@ -5,7 +6,7 @@ export async function approveSetupDependencies(context, post, messages) {
  if(!selected.length)return;
  const failure=()=>Error('Application dependency approval failed. Complete fresh app-owner approval before linking.');
  let cookie;
- const current=await fetch(new URL('/auth/dependencies/status',context.origin),{signal:context.signal}).then(response=>response.ok?response.json():null);
+ const current=await appFetch(new URL('/auth/dependencies/status',context.origin),{signal:context.signal}).then(response=>response.ok?response.json():null);
  const files=process.env.RER_LINK_TOKEN_FILES?JSON.parse(process.env.RER_LINK_TOKEN_FILES):{};
  for(const dependency of selected) {
   const body={interface:dependency.interface,issuer:context.input[dependency.address]};
@@ -21,7 +22,7 @@ export async function approveSetupDependencies(context, post, messages) {
    let id;
    for(let attempt=0;attempt<50 && !id;attempt++) {id=(await messages(context,path,email)).find(value=>!before.has(value));if(!id)await new Promise(resolve=>setTimeout(resolve,200));}
    if(!id)throw failure();
-   const response=await fetch(new URL(path+'?message='+encodeURIComponent(id),context.origin),{signal:context.signal,headers:context.devKey?{'x-rer-dev-key':context.devKey}:{}});
+   const response=await appFetch(new URL(path+'?message='+encodeURIComponent(id),context.origin),{signal:context.signal,headers:context.devKey?{'x-rer-dev-key':context.devKey}:{}});
    if(!response.ok)throw failure();
    const html=await response.text(),href=/<a\b[^>]*class="open"[^>]*href="([^"]+)"/.exec(html)?.[1];
    if(!href)throw failure();
@@ -30,7 +31,7 @@ export async function approveSetupDependencies(context, post, messages) {
    if(confirmed.status!==303)throw failure();cookie=confirmed.headers.get('set-cookie')?.split(';')[0];await confirmed.body?.cancel();
    if(!cookie)throw failure();context.store.addSecrets?.([cookie]);
   }
-  const approved=await fetch(new URL('/auth/dependencies/relink',context.origin),{method:'POST',redirect:'manual',signal:context.signal,headers:{Origin:context.origin,'Content-Type':'application/json',Cookie:cookie},body:JSON.stringify(body)});
+  const approved=await appFetch(new URL('/auth/dependencies/relink',context.origin),{method:'POST',redirect:'manual',signal:context.signal,headers:{Origin:context.origin,'Content-Type':'application/json',Cookie:cookie},body:JSON.stringify(body)});
   if(!approved.ok)throw failure();await approved.body?.cancel();
  }
 }

package/onboarding/local/environment.mjs

@@ -1,4 +1,9 @@
 import { parseEnv } from 'node:util'
+import { basename, dirname } from 'node:path'
+import { fileURLToPath } from 'node:url'
+// The shared loopback predicate, beside this copy in Base or in a seed's scripts/.
+const portable = basename(dirname(dirname(fileURLToPath(import.meta.url)))) === 'base-onboarding'
+const { isLocalhostName } = await import(new URL(portable ? '../../base-cli/modules/operator-auth/loopback.mjs' : '../../modules/operator-auth/loopback.mjs', import.meta.url))
 
 export function localVariables(text) {
   // Node's dotenv parser can consume the next assignment after an unquoted
@@ -23,8 +28,8 @@ export const secretValues = (vars) => Object.entries(vars).filter(([key]) => /SE
 export function localOrigin(vars) {
   let url
   try { url = new URL(vars.AUTH_ORIGIN) } catch { /* Use a fixed, non-secret diagnostic. */ }
-  if (vars.AUTH_LOCAL !== 'true' || !url || url.protocol !== 'http:' || url.hostname !== '127.0.0.1' || url.origin !== vars.AUTH_ORIGIN || url.username || url.password) {
-    throw new Error('Invalid local origin in .dev.vars: AUTH_ORIGIN must be http://127.0.0.1:PORT with AUTH_LOCAL=true. Run rer setup to save a valid one. If you changed AUTH_ORIGIN yourself, put back the http://127.0.0.1:PORT origin setup saved, or pick a port with rer setup --port PORT.')
+  if (vars.AUTH_LOCAL !== 'true' || !url || url.protocol !== 'http:' || (url.hostname !== '127.0.0.1' && !isLocalhostName(url.hostname)) || url.origin !== vars.AUTH_ORIGIN || url.username || url.password) {
+    throw new Error('Invalid local origin in .dev.vars: AUTH_ORIGIN must be http://127.0.0.1:PORT (or a front-door http://NAME.localhost:PORT) with AUTH_LOCAL=true. Run rer setup to save a valid one. If you changed AUTH_ORIGIN yourself, put back the http://127.0.0.1:PORT origin setup saved, or pick a port with rer setup --port PORT.')
   }
   return url
 }

package/onboarding/operator-install.mjs

@@ -1,11 +1,17 @@
 import { randomUUID } from 'node:crypto';
+import { existsSync } from 'node:fs';
 import { readFile, unlink } from 'node:fs/promises';
 import { join, relative } from 'node:path';
+import { fileURLToPath } from 'node:url';
 import { chooseOrigin } from './adapter-settings.mjs';
 import { privateDirectory, writePrivateFile } from './private-files.mjs';
 import { installationFailure, installationFailureMessage } from './failures.mjs';
 import { labels } from './adapter-labels.mjs';
 
+// The rer that nested commands run: a vendored checkout's own scripts/rer.mjs,
+// else this copy's own (a checkout that pins the @runeditrun/rer package).
+const rerEntry=root=>existsSync(join(root,'scripts/rer.mjs'))?'scripts/rer.mjs':fileURLToPath(new URL('../bin/rer.mjs',import.meta.url));
+
 // The browser and terminal use the same bounded setup journey. Its temporary
 // runtime is gone before that lease releases. The foreground preview belongs
 // to the installer process, outside the bounded job's descendant tree.
@@ -20,14 +26,14 @@ export async function installOperator(root,input,store,onApp,signal,hooks){
   // The browser owns no local operation. A verifier may have launched it while
   // holding a different checkout's token; each public command takes its own.
   const env={...process.env};delete env.RER_LOCAL_OPERATION;
-  const run=(label,args)=>store.run(label,process.execPath,['scripts/rer.mjs',...args,'--non-interactive','--json'],{cwd:root,signal,env,heavy:false});
+  const run=(label,args)=>store.run(label,process.execPath,[rerEntry(root),...args,'--non-interactive','--json'],{cwd:root,signal,env,heavy:false});
   step='dependencies';await store.step(labels.dependencies);await run(labels.dependencies,['install']);
   step='setup';await store.step(labels.build);await run(labels.build,['setup','--answers',relative(root,answer),'--host',address.hostname.replace(/^\[|\]$/g,''),'--port',address.port]);
   await unlink(answer);answer=undefined;
   // Preview's ready event carries RER_OPEN; keep the checkout's dev key out of this log.
   const devKey=/^RER_DEV_KEY=(\S+)$/m.exec(await readFile(join(root,'.rer/local/dev-key.env'),'utf8').catch(()=>''))?.[1];if(devKey)store.addSecrets?.([devKey]);
   step='start';await store.step(labels.start);
-  app=store.spawn(labels.start,process.execPath,['scripts/rer.mjs','preview','--non-interactive','--json'],{cwd:root,signal,env});onApp(app);
+  app=store.spawn(labels.start,process.execPath,[rerEntry(root),'preview','--non-interactive','--json'],{cwd:root,signal,env});onApp(app);
   let buffer='',ready=false,openUrl;
   app.stdout.on('data',chunk=>{buffer+=chunk;let end;while((end=buffer.indexOf('\n'))>=0){const line=buffer.slice(0,end);buffer=buffer.slice(end+1);try{const event=JSON.parse(line);if(event.version===1&&event.verb==='preview'&&event.event==='ready'&&event.url===origin){ready=true;openUrl=event.openUrl;}}catch{}}});
   await store.waitForReady(labels.start,app,async probeSignal=>{

package/onboarding/operator-prerequisites.mjs

@@ -18,8 +18,11 @@ export async function operatorPrerequisites(root,email){
    db=new DatabaseSync(join(directory,file.name),{readOnly:true});
    const applied=new Set(db.prepare('SELECT name FROM d1_migrations').all().map(row=>row.name));
    const claimed=db.prepare('SELECT COUNT(*) AS count FROM oa_bootstrap').get().count;
-   const owner=db.prepare("SELECT COUNT(*) AS count FROM oa_operators WHERE email=? AND role='owner' AND status='active'").get(email).count;
-   if(claimed===1&&owner===1&&migrations.every(name=>applied.has(name)))return true;
+   // Setup claimed this saved owner, and an active owner remains: after that
+   // owner has left, dev signs in as the remaining owner (dev identity's owner persona).
+   const saved=db.prepare('SELECT COUNT(*) AS count FROM oa_operators WHERE email=?').get(email).count;
+   const owners=db.prepare("SELECT COUNT(*) AS count FROM oa_operators WHERE role='owner' AND status='active'").get().count;
+   if(claimed===1&&saved===1&&owners>0&&migrations.every(name=>applied.has(name)))return true;
   }catch{/* A missing/corrupt/unrelated database cannot prove prior setup. */}
   finally{db?.close();}
  }

package/onboarding/queued-entry.mjs

@@ -23,12 +23,16 @@ export async function queuedEntrypoint(url,verb='verify') {
  }finally{await store?.closeCommands();await rm(directory,{recursive:true,force:true});}
 }
 
-if(process.argv[1] && pathToFileURL(resolve(process.argv[1])).href===import.meta.url){
- const [verb,separator,command,...args]=process.argv.slice(2);
- if(separator!=='--'||!command)throw Error('Usage: queued-entry VERB -- COMMAND ARGS');
+// `node queued-entry.mjs VERB -- COMMAND ARGS` (a vendored copy) and
+// `rer queue VERB -- COMMAND ARGS` (a pinned package): run COMMAND once the
+// machine job queue admits it, and return its exit status.
+export async function queuedCommandLine([verb,separator,command,...args]){
+ if(!verb||separator!=='--'||!command)throw Error('Usage: queued-entry VERB -- COMMAND ARGS');
  const directory=await mkdtemp(join(tmpdir(),'rer-heavy-'));
  const store=await createCommands(directory,{logs:[]},{terminal:text=>process.stdout.write(text),queue:{verb}});
- try{await store.run(verb,command,args,{cwd:process.cwd()});}
- catch(error){process.exitCode=error.childExitCode??1;}
+ try{await store.run(verb,command,args,{cwd:process.cwd()});return 0;}
+ catch(error){return error.childExitCode??1;}
  finally{await store.closeCommands();await rm(directory,{recursive:true,force:true});}
 }
+
+if(process.argv[1] && pathToFileURL(resolve(process.argv[1])).href===import.meta.url)process.exitCode=await queuedCommandLine(process.argv.slice(2));

package/operations/operations.mjs

@@ -1,5 +1,5 @@
 import { readFile, access } from 'node:fs/promises';
-import { existsSync } from 'node:fs';
+import { existsSync, readFileSync } from 'node:fs';
 import { relative, resolve } from 'node:path';
 import { pathToFileURL } from 'node:url';
 import { spawnSync } from 'node:child_process';
@@ -136,8 +136,17 @@ async function checkSummary(result, descriptor, root) {
   return lines.join('\n');
 }
 
+// A first-party checkout's rer: its vendored scripts/rer.mjs, or the
+// @runeditrun/rer package it pins.
+function checkoutRer(root) {
+  const vendored = resolve(root, 'scripts/rer.mjs'), pinned = resolve(root, 'node_modules/@runeditrun/rer/bin/rer.mjs');
+  if (existsSync(vendored)) return vendored;
+  try { const pkg = JSON.parse(readFileSync(resolve(root, 'package.json'), 'utf8')); if ((pkg.devDependencies?.['@runeditrun/rer'] ?? pkg.dependencies?.['@runeditrun/rer']) && existsSync(pinned)) return pinned; } catch {}
+  return vendored;
+}
+
 export async function main(args = process.argv.slice(2), root = process.cwd()) {
-  const rer = resolve(root, 'scripts/rer.mjs');
+  const rer = checkoutRer(root);
   if (!['describe', 'check'].includes(args[0]) || (args.length !== 1 && !existsSync(rer))) throw new Error('Unsupported operations command.');
   // First-party projects describe and check through their RER command.
   if (existsSync(rer)) {

package/package.json

@@ -1,12 +1,86 @@
 {
   "name": "@runeditrun/rer",
-  "version": "0.1.0",
+  "version": "0.2.0",
   "description": "The rer command: install, set up, run and launch Run Edit Run checkouts.",
   "license": "MIT",
   "type": "module",
   "bin": {
     "rer": "global/rer.mjs"
   },
+  "exports": {
+    "./adapter": "./cli/adapter.mjs",
+    "./deploy": "./cli/deploy.mjs",
+    "./portability": "./cli/portability.mjs",
+    "./errors": "./cli/errors.mjs",
+    "./jsonc": "./cli/jsonc.mjs",
+    "./parse": "./cli/parse.mjs",
+    "./scheduled": "./cli/scheduled.mjs",
+    "./dev-identity": "./cli/dev-identity.mjs",
+    "./local-installer": "./onboarding/adapter.mjs",
+    "./state": "./onboarding/state.mjs",
+    "./commands": "./onboarding/commands.mjs",
+    "./operator-installer": "./onboarding/operator-installer.mjs",
+    "./operator-install": "./onboarding/operator-install.mjs",
+    "./operator-prerequisites": "./onboarding/operator-prerequisites.mjs",
+    "./adapter-auth": "./onboarding/adapter-auth.mjs",
+    "./adapter-hosting": "./onboarding/adapter-hosting.mjs",
+    "./adapter-settings": "./onboarding/adapter-settings.mjs",
+    "./failures": "./onboarding/failures.mjs",
+    "./private-files": "./onboarding/private-files.mjs",
+    "./process-diagnostics": "./onboarding/process-diagnostics.mjs",
+    "./process-cleanup": "./onboarding/process-cleanup.mjs",
+    "./process-scope": "./onboarding/process-scope.mjs",
+    "./redaction": "./onboarding/redaction.mjs",
+    "./setup-manifest": "./onboarding/setup-manifest.mjs",
+    "./setup-schema": "./onboarding/schema/SETUP.schema.json",
+    "./local/environment": "./onboarding/local/environment.mjs",
+    "./local/files": "./onboarding/local/files.mjs",
+    "./local/build": "./onboarding/local/build.mjs",
+    "./local/operation": "./onboarding/local/operation.mjs",
+    "./local/recovery": "./onboarding/local/recovery.mjs",
+    "./local/state": "./onboarding/local/state.mjs",
+    "./production-runtime": "./onboarding/production-runtime.mjs",
+    "./production-modules": "./onboarding/production-modules.mjs",
+    "./queued-entry": "./onboarding/queued-entry.mjs",
+    "./archive-output": {
+      "types": "./onboarding/archive-output.d.mts",
+      "default": "./onboarding/archive-output.mjs"
+    },
+    "./launcher": "./onboarding/launcher.mjs",
+    "./installer-server": "./onboarding/server.mjs",
+    "./server-resources": "./cli/server-resources.mjs",
+    "./operations": "./operations/operations.mjs",
+    "./modules/portability": "./modules/portability/index.mjs",
+    "./modules/portability/catalogue": "./modules/portability/catalogue.mjs",
+    "./modules/portability/cli": "./modules/portability/cli.mjs",
+    "./modules/portability/cli-options": "./modules/portability/cli-options.mjs",
+    "./modules/portability/files": "./modules/portability/files.mjs",
+    "./modules/portability/format": "./modules/portability/format.mjs",
+    "./modules/portability/http": "./modules/portability/http.mjs",
+    "./modules/portability/import": "./modules/portability/import.mjs",
+    "./modules/portability/journal": "./modules/portability/journal.mjs",
+    "./modules/portability/legacy-safety": "./modules/portability/legacy-safety.mjs",
+    "./modules/portability/migration-history": "./modules/portability/migration-history.mjs",
+    "./modules/portability/storage": "./modules/portability/storage.mjs",
+    "./modules/erasure/fence": "./modules/erasure/fence.mjs",
+    "./modules/deploy-kit/owner": "./modules/deploy-kit/owner.mjs",
+    "./modules/deploy-kit/owner-cli": "./modules/deploy-kit/owner-cli.mjs",
+    "./modules/deploy-kit/prepare": "./modules/deploy-kit/prepare.mjs",
+    "./modules/deploy-kit/provider": "./modules/deploy-kit/provider.mjs",
+    "./modules/release/export": "./modules/release/export.mjs",
+    "./modules/release/publication-scan": "./modules/release/publication-scan.mjs",
+    "./modules/release/source": "./modules/release/source.mjs",
+    "./modules/operator-auth": "./modules/operator-auth/index.mjs",
+    "./modules/operator-auth/accounts/native": "./modules/operator-auth/accounts/native.mjs",
+    "./modules/operator-auth/dev": "./modules/operator-auth/dev/index.mjs",
+    "./modules/operator-auth/dev-admission": "./modules/operator-auth/dev-admission.mjs",
+    "./modules/operator-auth/dev/badge": "./modules/operator-auth/dev/badge.mjs",
+    "./modules/operator-auth/identity/email-link": "./modules/operator-auth/identity/email-link/index.mjs",
+    "./modules/owner-claim": "./modules/owner-claim/index.mjs",
+    "./modules/dependencies": "./modules/dependencies/index.mjs",
+    "./internal/*": "./*",
+    "./package.json": "./package.json"
+  },
   "engines": {
     "node": ">=22"
   }

package/scripts/publish-check/github_refs.py

@@ -51,6 +51,10 @@ CONTEXT_URL = re.compile(r'(?i)(?<![A-Za-z])(?:' + REPOSITORY_CONTEXT + r')'
                          + r'''[`*_~\[\]\s"']*(?:''' + URL.pattern.replace('(?i)', '') + ')')
 LINK_URL = re.compile(r'(?i)\[(?P<label>[^]\n]+)\]\(\s*(?P<url>' + URL.pattern.replace('(?i)', '') + ')')
 REPOSITORY_LABEL = re.compile(r'(?i)\b(?:' + REPOSITORY_CONTEXT + r')\b')
+# Words that make a nearby `owner/name` a repository rather than an identifier.
+# A bare "source" is not one: "source commit/tree" is ordinary prose.
+NEARBY_CONTEXT = re.compile(r'(?i)\b(?:github|repositor(?:y|ies)|repos?|forks?|forked|clones?|cloned|upstream|downstream|origin|submodules?)\b')
+CONTEXT_WINDOW = 60
 
 
 def explicit_references(text, path):
@@ -76,6 +80,20 @@ class RepositoryObject(dict):
 
 
 def references(text, path, local_paths=frozenset(), project_identity=None):
+    stated, ambiguous = reference_sets(text, path, local_paths, project_identity)
+    return stated | ambiguous
+
+
+def reference_sets(text, path, local_paths=frozenset(), project_identity=None):
+    """Split `owner/name` tokens into stated repositories and ambiguous ones.
+
+    A stated reference has GitHub context: a URL, a repository field, a labelled
+    or commanded mention, a repository route. An ambiguous token is a bare
+    word/word in prose (`commit/tree`, `rer-delegation/1`, `dmsans/v17`): it is
+    a repository only if one answers to that name privately, never because none
+    does.
+    """
+    ambiguous = set()
     repository_text = SERVICE_URL.sub('', text)
     found = {normalize(m.group(1)) for m in URL.finditer(repository_text)
              if not SPONSORS_URL.match(repository_text, m.start())}
@@ -106,8 +124,16 @@ def references(text, path, local_paths=frozenset(), project_identity=None):
             # A plain multi-segment path is ambiguous; GitHub's repository
             # routes, a labeled field or a GitHub command disambiguate it.
             labeled = explicit and (re.search(r'[:=|]', match['separator']) or re.match(r'(?i)github|gh\s', match['label']))
-            if not suffix or REPOSITORY_ROUTE.match(suffix) or labeled:
+            if REPOSITORY_ROUTE.match(suffix) or labeled:
                 found.add(normalize(repository))
+            elif not suffix:
+                if explicit:
+                    weak = re.fullmatch(r'(?i)source', match['label']) and not re.search(r'(?i)repository|repo', markdown[match.start():match.start('reference')])
+                else:
+                    line_start = markdown.rfind('\n', 0, match.start()) + 1
+                    around = markdown[max(line_start, match.start() - CONTEXT_WINDOW):match.end() + CONTEXT_WINDOW].split('\n', 1)[0]
+                    weak = not NEARBY_CONTEXT.search(around)
+                (ambiguous if weak else found).add(normalize(repository))
     elif METADATA.search(path) or SOURCE.search(path):
         if path.lower().endswith('.json'):
             try:
@@ -146,7 +172,7 @@ def references(text, path, local_paths=frozenset(), project_identity=None):
             found.update(normalize(m.group(1)) for m in TYPED_REPOSITORY.finditer(text))
             for declaration in declarations(text):
                 found.update(normalize(m.group(1)) for m in DECLARED_SHORTHAND.finditer(declaration))
-    return found
+    return found, ambiguous - found
 
 
 def local_dependencies(data, path):