@runeditrun/rer 0.1.1 → 0.2.0

package/modules/operator-auth/dev/index.mjs

@@ -50,7 +50,7 @@ export function withDevIdentity(worker, { bindings = env => env, config: authCon
         if (!gate || env.RER_DEV_IDENTITY === 'off' || !await gate.admits(request)) return devNotFound();
         const context = identity(env, authConfig, declared);
         try {
-          return path === '/__dev/personas' ? Response.json(context.list(), { headers }) : await enter(request, gate, context);
+          return path === '/__dev/personas' ? Response.json(await context.list(), { headers }) : await enter(request, gate, context);
         } catch (error) {
           if (error instanceof AuthError) return Response.json({ error: error.code }, { status: error.status, headers });
           throw error;
@@ -68,7 +68,16 @@ export function withDevIdentity(worker, { bindings = env => env, config: authCon
 function identity(env, authConfig, declared) {
   const config = configure(authConfig(env)), store = new AuthStore(env.DB);
   const hash = token => hashToken(config.SESSION_SECRET, 'session', token);
-  const everyone = () => [{ as: 'owner', email: config.OWNER_EMAIL }, ...declared];
+  // The `owner` persona is the owner rer setup claimed while that owner is
+  // active; after that owner has left, the earliest-created active owner; with
+  // no active owner left, nobody (email null), so rer names who it signs in as.
+  const owner = async () => {
+    const setup = await store.byEmail(config.OWNER_EMAIL);
+    if (setup?.role === 'owner' && isActiveOperator(setup, config.allowList)) return setup.email;
+    const rows = (await store.statement(`SELECT email FROM oa_operators WHERE role='owner' AND status='active' ORDER BY created_at, id`).all()).results;
+    return rows.find(row => isActiveOperator({ ...row, status: 'active' }, config.allowList))?.email ?? (setup ? null : config.OWNER_EMAIL);
+  };
+  const everyone = async () => [{ as: 'owner', email: await owner() }, ...declared];
   async function current(request) {
     const token = readCookie(request, config);
     if (!token) return null;
@@ -85,8 +94,8 @@ function identity(env, authConfig, declared) {
       if (!defaultRolePolicy({ actor: actor.operator, action: 'operators:invite', role: 'owner' })) throw new AuthError('forbidden', 403);
       return { ...actor, hash: await hash(readCookie(request, config)) };
     },
-    list: () => [...everyone().map(({ as, email, role }) => ({ as, email, ...(role ? { role } : {}) })), { as: 'signed-out' }],
-    async badge(request) { return { session: await current(request), choices: everyone() }; },
+    list: async () => [...(await everyone()).map(({ as, email, role }) => ({ as, email, ...(role ? { role } : {}) })), { as: 'signed-out' }],
+    async badge(request) { return { session: await current(request), choices: (await everyone()).filter(persona => persona.email) }; },
   };
 }
 
@@ -104,8 +113,9 @@ async function enter(request, gate, { config, store, hash, current, everyone, ow
     reply.set('location', '/');
     return new Response(null, { status: 303, headers: reply });
   }
-  const persona = everyone().find(p => p.as === as);
+  const persona = (await everyone()).find(p => p.as === as);
   if (!persona) return devNotFound();
+  if (!persona.email) return text(409, 'No active owner remains in this app. Sign in another way, or run rer reset --yes and rer setup for a new owner.');
   let operator = await store.byEmail(persona.email);
   // Personas are real operators, created only here, in local dev.
   if (!operator && persona.role) {

package/modules/operator-auth/http.mjs

@@ -1,8 +1,7 @@
 import { deny } from './errors.mjs';
 import { validToken } from './crypto.mjs';
-export function isLoopbackHost(hostname) {
-  return hostname === 'localhost' || hostname === '127.0.0.1' || hostname === '[::1]';
-}
+import { isLoopbackHost } from './loopback.mjs';
+export { isLoopbackHost };
 // Browsers keep cookies per host, not per port, so checkouts side by side on
 // one loopback host would overwrite each other's cookies. A local cookie name
 // therefore carries its origin's port; hosted names never change. Seeds on

package/modules/operator-auth/loopback.mjs

@@ -0,0 +1,17 @@
+// The one loopback predicate every local-only check shares. A local origin's
+// host is one of the three loopback hosts or a name under `.localhost`, which
+// RFC 6761 reserves for loopback and browsers resolve to it themselves: the
+// front door serves each checkout at `http://<name>.localhost:<port>`. Hosted
+// origins never pass through this predicate; they must be https.
+const label = '[a-z0-9](?:[a-z0-9-]{0,61}[a-z0-9])?';
+const localhostName = new RegExp(`^(?:${label}\\.)+localhost$`);
+
+/** A name under `.localhost` (lowercase, no trailing dot), such as `cradle.localhost`. */
+export function isLocalhostName(hostname) {
+  return typeof hostname === 'string' && hostname.length <= 253 && localhostName.test(hostname);
+}
+
+/** `localhost`, `127.0.0.1`, `[::1]` (as URL.hostname spells it) or a `*.localhost` name. */
+export function isLoopbackHost(hostname) {
+  return hostname === 'localhost' || hostname === '127.0.0.1' || hostname === '[::1]' || isLocalhostName(hostname);
+}

package/modules/owner-claim/verify.mjs

@@ -1,4 +1,5 @@
 // Portable Web Crypto verifier. This file has no application or database imports.
+import { isLoopbackHost } from '../operator-auth/loopback.mjs';
 export class OwnerClaimError extends Error {
   constructor(code = 'invalid_claim', status = 403) { super(code); this.name = 'OwnerClaimError'; this.code = code; this.status = status; }
 }
@@ -10,7 +11,7 @@ function coordinate(value) {
   return btoa(atob(value.replaceAll('-', '+').replaceAll('_', '/'))).replaceAll('+', '-').replaceAll('/', '_').replace(/=+$/, '') === value;
 }
 function origin(value) {
-  try { const u = new URL(value); return u.origin === value && !u.username && !u.password && (u.protocol === 'https:' || (u.protocol === 'http:' && ['localhost', '127.0.0.1', '[::1]'].includes(u.hostname))); } catch { return false; }
+  try { const u = new URL(value); return u.origin === value && !u.username && !u.password && (u.protocol === 'https:' || (u.protocol === 'http:' && isLoopbackHost(u.hostname))); } catch { return false; }
 }
 export function configureClaim(input) {
   if (!input || !origin(input.issuer) || !origin(input.appOrigin)

package/modules/portability/README.md

@@ -217,6 +217,14 @@ and refuses rows matching its tombstones or any destination erasure fence.
 Product validation, foreign keys and normal restore safeguards still apply.
 Any mismatch refuses recovery; this mode does not repair damaged archives.
 
+Recovery needs a new installation. SQLite, migration and transfer bookkeeping, the
+storage tables of FTS5 indexes (`<index>_data|idx|content|docsize|config`; the index
+itself is still checked through its own SELECT) and the rows the destination's own
+migrations seed may exist; the seed rows are compared with a scratch replay of the
+applied migrations (Node runners) and must be unchanged. Any other row refuses with
+`legacy_target_not_empty`, before staging and again inside the restore batch. A table
+the policy lists in `replaceableTables` is replaced by the restore as usual.
+
 V1 cannot authenticate the complete manifest: source identity, export time,
 erasure epoch/journal, rowids and other metadata lack the v2 archive binding.
 Checksums are consistency checks, not proof of authorship. A missing or altered

package/modules/portability/hash.mjs

@@ -17,9 +17,13 @@ export function base64(bytes) {
   for (let i = 0; i < bytes.length; i += 8192) result += String.fromCharCode(...bytes.subarray(i, i + 8192));
   return btoa(result);
 }
+// Canonical base64 only: a plain character-class scan (no group repetition, so no regex stack) and
+// the padding rule by arithmetic, in time linear in the input however large an original is.
 export function unbase64(value) {
-  if (typeof value !== 'string' || !/^(?:[A-Za-z0-9+/]{4})*(?:[A-Za-z0-9+/]{2}==|[A-Za-z0-9+/]{3}=)?$/.test(value)) throw new Error('invalid_base64');
-  return Uint8Array.from(atob(value), c => c.charCodeAt(0));
+  if (typeof value !== 'string' || value.length % 4 !== 0 || !/^[A-Za-z0-9+/]*={0,2}$/.test(value)) throw new Error('invalid_base64');
+  const text = atob(value), bytes = new Uint8Array(text.length);
+  for (let i = 0; i < text.length; i++) bytes[i] = text.charCodeAt(i);
+  return bytes;
 }
 
 // Incremental SHA-256 for semantic JSON and objects. SubtleCrypto has no streaming

package/modules/portability/import.mjs

@@ -134,7 +134,7 @@ export async function finalizeImport(context,id,{contentHash,archiveHash,laterJo
   const digest=verifier.digest();if(contentHash!==undefined)insist(contentHash===digest,'content_checksum');
   insist(archiveHash===archive.digest(),'archive_checksum',409);
   const checked=await fence(db,manifest,row.metadata.copies,laterJournal);
-  if(row.metadata.legacyRecovery)await requireLegacyEmpty(context,row.metadata.legacyRecovery.emptyTables);
+  if(row.metadata.legacyRecovery)await requireLegacyEmpty(context,row.metadata.legacyRecovery);
   for(const table of row.metadata.targets) if(!config.replaceableTables.includes(table.name))insist(!(await statement(db,`SELECT 1 FROM ${quote(table.name)} LIMIT 1`).first()),'target_not_empty:'+table.name,409);
   const dependentGuards=await excludedDependentGuards(db,row.metadata.targets,config.replaceableTables);
   await bucketsEmpty(context,row);

package/modules/portability/legacy-files.mjs

@@ -4,7 +4,7 @@ import { createPortability } from './index.mjs';
 import { createImport, uploadPart, finalizeImport, abortImport } from './import.mjs';
 import { readLegacyArchive, ArchiveVerifier } from './format.mjs';
 import { fileRecords, exportArchive } from './files.mjs';
-import { ensureLegacyAudit, legacyEmptyTables, requireLegacyEmpty } from './legacy-safety.mjs';
+import { ensureLegacyAudit, legacyTargetState, requireLegacyEmpty } from './legacy-safety.mjs';
 import { insist, PortabilityError } from './storage.mjs';
 
 export async function recoverLegacyArchive({db,buckets,policy:input,migrations},path,output,transient,acknowledged) {
@@ -13,8 +13,8 @@ export async function recoverLegacyArchive({db,buckets,policy:input,migrations},
  insist(!(await lstat(output).catch(error=>{if(error.code==='ENOENT')return null;throw error;})),'legacy_output_exists',409);
  // Whole-file verification precedes even staging/audit schema writes.
  for await(const record of fileRecords(path,readLegacyArchive)){}
- const context={db,buckets,config:policy(input),migrations},emptyTables=await legacyEmptyTables(db);
- await requireLegacyEmpty(context,emptyTables);
+ const context={db,buckets,config:policy(input),migrations},target=await legacyTargetState(db,migrations);
+ await requireLegacyEmpty(context,target);
  let id,manifest,closing,integrity,status,complete=false;
  try {
   for await(const record of fileRecords(path,readLegacyArchive)) {
@@ -25,7 +25,7 @@ export async function recoverLegacyArchive({db,buckets,policy:input,migrations},
     id=await createImport(context,manifest,'legacy-v1',{
      event:'legacy_v1_unverified_restore',acknowledgedUnverifiedMetadata:true,
      sourceIdentity:record.sourceIdentity,exportedAt:record.exportedAt,
-     recoveryOutput:output,emptyTables,
+     recoveryOutput:output,...target,
     });
     // A refused schema writes nothing, not even the audit table.
     await ensureLegacyAudit(db);

package/modules/portability/legacy-safety.mjs

@@ -2,18 +2,59 @@ import { all, statement, guard, quote, insist } from './storage.mjs';
 import { canonicalJson } from './hash.mjs';
 
 // Recovery requires a new installation, including excluded identity tables and
-// normally replaceable product rows. Only SQLite/migration/transfer bookkeeping
-// may already exist. Do not use the product's export exclusions for this check.
-export async function legacyEmptyTables(db) {
- const tables=await all(db,"SELECT name FROM sqlite_master WHERE type='table' AND sql IS NOT NULL ORDER BY name");
- return tables.map(t=>t.name).filter(name=>!(/^(sqlite_|_cf_|rer_portability_)/i.test(name) || ['d1_migrations','_rer_deploy_migrations','_rer_portability_migrations'].includes(name.toLowerCase())));
+// normally replaceable product rows. Only SQLite/migration/transfer bookkeeping,
+// the storage of FTS5 indexes and rows the destination's own migrations seed may
+// already exist. Do not use the product's export exclusions for this check.
+const bookkeeping=name=>/^(sqlite_|_cf_|rer_portability_)/i.test(name) || ['d1_migrations','_rer_deploy_migrations','_rer_portability_migrations'].includes(name.toLowerCase());
+const fts5=/^\s*CREATE\s+VIRTUAL\s+TABLE\s+(?:IF\s+NOT\s+EXISTS\s+)?(?:"((?:[^"]|"")+)"|`([^`]+)`|\[([^\]]+)\]|'((?:[^']|'')+)'|([A-Za-z0-9_$]+))\s+USING\s+fts5\b/i;
+const unquoted=m=>m[1]!==undefined?m[1].replaceAll('""','"'):m[4]!==undefined?m[4].replaceAll("''","'"):m[2]??m[3]??m[5];
+// An FTS5 index keeps its data in <name>_data|idx|content|docsize|config. The index itself stays
+// listed and is checked through its own SELECT, so a real indexed row still refuses.
+function shadowTables(tables) {
+ const shadows=new Set();
+ for(const table of tables) {
+  const match=fts5.exec(table.sql);
+  if(match)for(const suffix of ['data','idx','content','docsize','config'])shadows.add(unquoted(match).toLowerCase()+'_'+suffix);
+ }
+ return shadows;
 }
-export async function requireLegacyEmpty({db,buckets},tables) {
- for(const table of tables)insist(!(await statement(db,`SELECT 1 FROM ${quote(table)} LIMIT 1`).first()),'legacy_target_not_empty:'+table,409);
+const imageSql=(table,columns)=>`SELECT json_array(${columns.map(c=>`quote(${quote(c)})`).join(',')}) AS image FROM ${quote(table)}`;
+const MAX_SEED_ROWS=10000;
+
+/** What the destination must still hold when the restore commits: `emptyTables` stay empty and
+ * each of `seededTables` keeps exactly the rows its migrations put there. A table with rows the
+ * replay of the destination's applied migrations (migrations(), a node runner's scratch database)
+ * does not produce is listed as to-be-empty, so the preflight refuses it. */
+export async function legacyTargetState(db,migrations) {
+ const tables=await all(db,"SELECT name,sql FROM sqlite_master WHERE type='table' AND sql IS NOT NULL ORDER BY name"),shadows=shadowTables(tables);
+ const names=tables.map(t=>t.name).filter(name=>!bookkeeping(name) && !shadows.has(name.toLowerCase()));
+ const filled=[];
+ for(const name of names)if(await statement(db,`SELECT 1 FROM ${quote(name)} LIMIT 1`).first())filled.push(name);
+ const seeded=[];
+ if(filled.length && migrations) {
+  const requests=[];
+  for(const name of filled)requests.push({name,columns:(await all(db,`SELECT name FROM pragma_table_info(?)`,name)).map(c=>c.name)});
+  // Without a usable replay no seed is vouched for, so those rows count as the installation's own.
+  const expected=await migrations().then(replay=>replay.rowImages(requests,MAX_SEED_ROWS),()=>new Map());
+  for(const {name,columns} of requests) {
+   const want=expected.get(name);
+   if(!want || (await statement(db,`SELECT count(*) AS n FROM ${quote(name)}`).first()).n!==want.length)continue;
+   const found=(await all(db,imageSql(name,columns))).map(r=>r.image).sort();
+   if(canonicalJson(found)===canonicalJson(want))seeded.push({name,columns,images:found});
+  }
+ }
+ return {emptyTables:names.filter(name=>!seeded.some(s=>s.name===name)),seededTables:seeded};
+}
+const seededCondition=(db,table)=>[`(SELECT count(*) FROM ${quote(table.name)})=? AND NOT EXISTS(SELECT 1 FROM (${imageSql(table.name,table.columns)}) WHERE image NOT IN (SELECT value FROM json_each(?)))`,table.images.length,JSON.stringify(table.images)];
+export async function requireLegacyEmpty({db,buckets},{emptyTables,seededTables=[]}) {
+ for(const table of emptyTables)insist(!(await statement(db,`SELECT 1 FROM ${quote(table)} LIMIT 1`).first()),'legacy_target_not_empty:'+table,409);
+ for(const table of seededTables){const [condition,...values]=seededCondition(db,table);insist((await statement(db,`SELECT CASE WHEN (${condition}) THEN 1 ELSE 0 END AS ok`,...values).first()).ok===1,'legacy_target_not_empty:'+table.name,409);}
  for(const [name,bucket] of Object.entries(buckets))insist(!(await bucket.list({limit:1})).objects.length,'legacy_bucket_not_empty:'+name,409);
 }
 export function legacyEmptyGuards(db,row) {
- return (row.metadata.legacyRecovery?.emptyTables??[]).map(table=>guard(db,`NOT EXISTS(SELECT 1 FROM ${quote(table)})`));
+ const recovery=row.metadata.legacyRecovery;
+ return [...(recovery?.emptyTables??[]).map(table=>guard(db,`NOT EXISTS(SELECT 1 FROM ${quote(table)})`)),
+  ...(recovery?.seededTables??[]).map(table=>{const [condition,...values]=seededCondition(db,table);return guard(db,condition,...values);})];
 }
 export async function ensureLegacyAudit(db) {
  // Additive sidecar, installed only by recovery; existing product migrations
@@ -22,6 +63,6 @@ export async function ensureLegacyAudit(db) {
 }
 export function legacyAuditStatements(db,row) {
  if(!row.metadata.legacyRecovery)return [];
- const {emptyTables,...details}=row.metadata.legacyRecovery;
- return [statement(db,'INSERT INTO rer_portability_recovery_audit VALUES(?,?,?)',row.id,new Date().toISOString(),canonicalJson({...details,contentHash:row.metadata.contentHash,...(row.metadata.bridge?{bridged:row.metadata.bridge}:{})}))];
+ const {emptyTables,seededTables=[],...details}=row.metadata.legacyRecovery;
+ return [statement(db,'INSERT INTO rer_portability_recovery_audit VALUES(?,?,?)',row.id,new Date().toISOString(),canonicalJson({...details,...(seededTables.length?{seededTables:seededTables.map(t=>t.name)}:{}),contentHash:row.metadata.contentHash,...(row.metadata.bridge?{bridged:row.metadata.bridge}:{})}))];
 }

package/modules/portability/migration-history.mjs

@@ -14,5 +14,20 @@ export function migrationReplay(plan,input) {
       for(const migration of plan.filter(m=>names.includes(m.name)))for(const sql of migration.statements)scratch.exec(sql);
       return await schemaIdentity(db,config);
     }finally{scratch.close();}
+  },
+  // The rows the whole replay leaves in each requested table, as sorted images (legacy-safety.mjs).
+  // A table the replay lacks, or one holding more than `limit` rows, has no entry.
+  async rowImages(requests,limit) {
+    const scratch=new DatabaseSync(':memory:'),found=new Map();
+    try {
+      for(const migration of plan)for(const sql of migration.statements)scratch.exec(sql);
+      for(const {name,columns} of requests) {
+        try {
+          const rows=scratch.prepare(`SELECT json_array(${columns.map(c=>`quote("${c.replaceAll('"','""')}")`).join(',')}) AS image FROM "${name.replaceAll('"','""')}" LIMIT ?`).all(limit+1).map(r=>r.image);
+          if(rows.length<=limit)found.set(name,rows.sort());
+        }catch{}
+      }
+      return found;
+    }finally{scratch.close();}
   }};
 }

package/modules/release/README.md

@@ -55,9 +55,11 @@ default verification succeeds. Keep capacity, maximum-size memory and load cases
 in that release-only script. Both dry runs and releases require it to pass;
 `gates.verify.release` records its result. Routine CI and default verification
 do not invoke it.
-Child logs are suppressed to avoid credential disclosure; the receipt retains
-exit status and numeric final summaries from Node's spec/TAP reporters and
-Playwright's text reporters. Counts add across suites: `tests`, `passed`,
+A passing step's receipt retains exit status and numeric final summaries from
+Node's spec/TAP reporters and Playwright's text reporters. A failing install,
+`verify` or `verify:release` step also keeps `output`: the last 40 lines (at most
+8 KB) of that child's output, after the command store's credential redaction.
+The output stays in the receipt and is left out of the site preview. Counts add across suites: `tests`, `passed`,
 `failed`, `skipped` and `flaky`; nonzero `cancelled`, `todo`, `interrupted` and
 `notRun` counts are retained when reported. Playwright's total includes each
 outcome once, with flaky tests counted separately from passed tests. Node's

package/modules/release/produce.mjs

@@ -8,6 +8,9 @@ import { publicationScan, validatePublicationDestination } from './publication-s
 import { publicDestination, requirePublicDestination, remotePublicHead, publicChild, assertPublicTree } from './public-child.mjs';
 import { writePublishHandoff } from './publish-handoff.mjs';
 
+// Failure output belongs to the private receipt, not the site preview.
+const withoutOutput = gates => JSON.parse(JSON.stringify(gates, (key, value) => key === 'output' ? undefined : value));
+
 export async function release({ repo, ref = 'HEAD', output, project, repository, dryRun = false, tag = false, cleanHistory: clean = false, envFile, onto }) {
   if (!/^[\w.-]+\/[\w.-]+$/.test(project ?? '')) throw Error('--project must be publisher/name');
   if (!/^https:\/\/github\.com\/[\w.-]+\/[\w.-]+(?:\.git)?$/i.test(repository ?? '')) throw Error('--repository must be a credential-free GitHub repository URL');
@@ -37,7 +40,7 @@ export async function release({ repo, ref = 'HEAD', output, project, repository,
     // Honour the seed's committed install policy. Base's native-build settings
     // are not interchangeable with pnpm 8's locked onlyBuiltDependencies.
     const install = await command('pnpm', ['install', '--frozen-lockfile'], checkout);
-    const verify = install.status === 'PASS' ? await command('pnpm', ['run', 'verify'], checkout) : { status: 'FAIL', reason: 'frozen-install-failed', tests: 0, passed: 0, failed: 0 };
+    const verify = install.status === 'PASS' ? await command('pnpm', ['run', 'verify'], checkout) : { status: 'FAIL', reason: 'frozen-install-failed', tests: 0, passed: 0, failed: 0, output: install.output };
     // Release-only scale and capacity cases stay outside routine CI. The
     // committed seed script is an additional gate in previews and releases.
     if (verify.status === 'PASS' && JSON.parse(source.bytes('package.json')).scripts['verify:release']) {
@@ -101,7 +104,7 @@ export async function release({ repo, ref = 'HEAD', output, project, repository,
     // A blocked preview may prepare the site metadata/docs for local review.
     // Its provenance explicitly records blocked gates; it is never a release.
     const publicSource = exported ? { ...source, commit: exported.commit, publicTagStaged: Boolean(destination && tag) } : source;
-    if (passed || preview) receipt.siteRelease = writeCatalogue(publicSource, output, catalogue(publicSource, project, repository, gates, preview));
+    if (passed || preview) receipt.siteRelease = writeCatalogue(publicSource, output, catalogue(publicSource, project, repository, withoutOutput(gates), preview));
     if (passed) {
       if (tag) {
         receipt.publicExport = publicExport(source, temporary, output);

package/modules/release/source.mjs

@@ -4,6 +4,7 @@ import { shared } from '../../cli/shared.mjs';
 import { execFileSync, spawn } from 'node:child_process';
 import { realpathSync, existsSync, lstatSync, mkdirSync } from 'node:fs';
 import { resolve, dirname, relative, isAbsolute } from 'node:path';
+import { stripVTControlCharacters } from 'node:util';
 import { testSummary } from './test-summary.mjs';
 
 export function git(repo, ...args) {
@@ -56,16 +57,26 @@ export function newOutput(repo, output) {
   return output;
 }
 
-// Keep child diagnostics private: arbitrary verify scripts can print credential
-// values. Only exit status and numeric test summaries leave this boundary.
+// Child output is redacted by the command store before it is kept. A failing
+// step's receipt carries the last 40 lines of it, at most 8 KB; a passing step
+// carries only its exit status and numeric test summaries.
+const TAIL_LINES = 40, TAIL_BYTES = 8192;
+function failureTail(logs) {
+  const lines = stripVTControlCharacters(logs.join('\n')).split('\n');
+  while (lines.length && lines.at(-1).trim() === '') lines.pop();
+  const bytes = Buffer.from(lines.slice(-TAIL_LINES).join('\n'));
+  return bytes.subarray(Math.max(0, bytes.length - TAIL_BYTES)).toString('utf8').replace(/^\uFFFD+/, '');
+}
+
 export async function command(command, args, cwd) {
  const {createCommands}=await shared('commands.mjs');
  const directory=await mkdtemp(resolve(tmpdir(),'rer-release-'));
- const store=await createCommands(directory,{logs:[]},{terminal:()=>{},queue:{verb:'release'}});
+ const state={logs:[]};
+ const store=await createCommands(directory,state,{terminal:()=>{},queue:{verb:'release'}});
  const summary=testSummary(),env={...process.env,FORCE_COLOR:'0'};delete env.NODE_TEST_CONTEXT;
  try {
   await store.run('Release verification',command,args,{cwd,env,onChild:child=>child.stdout.on('data',bytes=>summary.write(bytes))});
   return {status:'PASS',exitCode:0,...summary.finish()};
- }catch(error){return {status:'FAIL',exitCode:error.childExitCode??null,...summary.finish()};}
+ }catch(error){return {status:'FAIL',exitCode:error.childExitCode??null,...summary.finish(),output:failureTail(state.logs)};}
  finally{await store.closeCommands();await rm(directory,{recursive:true,force:true});}
 }

package/onboarding/adapter-auth.mjs

@@ -1,4 +1,5 @@
 import { approveSetupDependencies } from './dependency-approval.mjs';
+import { appFetch } from './app-fetch.mjs';
 import { createHmac } from 'node:crypto';
 import {commandFailure,installationFailure} from './failures.mjs';
 import { labels } from './adapter-labels.mjs';
@@ -10,10 +11,10 @@ const outboxPath = '/__dev/outbox'; // modules/mail/src/development default path
 // that is not in local mode ignores the header. The proof comes from the
 // setting the seed's adapter declares as its session secret (sessionSecretKey,
 // default SESSION_SECRET).
-const localCliProof = secret => createHmac('sha256', secret).update('local-cli\0sign-in').digest('hex');
+export const localCliProof = secret => createHmac('sha256', secret).update('local-cli\0sign-in').digest('hex');
 const post = (context, path, body) => {
  const secret = context.vars[context.sessionSecretKey ?? 'SESSION_SECRET'];
- return fetch(new URL(path, context.origin), {
+ return appFetch(new URL(path, context.origin), {
   method: 'POST', redirect: 'manual', signal: context.signal,
   headers: { Origin: context.origin, 'Content-Type': 'application/json', ...(typeof secret === 'string' && secret ? { 'x-rer-local-cli': localCliProof(secret) } : {}) }, body: JSON.stringify(body),
  });
@@ -75,7 +76,7 @@ export async function signIn(context, hook) {
 async function outboxMessages(context, path, address, required = false) {
  let response;
  // A dev-identity seed gates its outbox with the checkout's key; present it.
- try { response = await fetch(new URL(path, context.origin), { signal: context.signal, headers: context.devKey ? { 'x-rer-dev-key': context.devKey } : {} }); } catch (error) {
+ try { response = await appFetch(new URL(path, context.origin), { signal: context.signal, headers: context.devKey ? { 'x-rer-dev-key': context.devKey } : {} }); } catch (error) {
   if (context.signal?.aborted) throw error;
   if(required){context.store.report?.('Local development outbox is unavailable. Run rer setup before requesting sign-in.');throw context.fail('setup');}
   return [];

package/onboarding/adapter-settings.mjs

@@ -1,6 +1,7 @@
 import { randomBytes } from 'node:crypto';
 import { createServer } from 'node:net';
-import { isAbsolute, relative, resolve, sep } from 'node:path';
+import { basename, dirname, isAbsolute, relative, resolve, sep } from 'node:path';
+import { fileURLToPath } from 'node:url';
 import { labels } from './adapter-labels.mjs';
 import { credentialValues } from './redaction.mjs';
 import { privateDirectory, readPrivateFile, writePrivateFile } from './private-files.mjs';
@@ -8,6 +9,9 @@ import { localVariables } from './local/environment.mjs';
 import { assertRegular, inspect } from './local/files.mjs';
 import { localOperation } from './local/operation.mjs';
 import { recoverInterrupted } from './local/recovery.mjs';
+// The shared loopback predicate, beside this copy in Base or in a seed's scripts/.
+const portable = basename(dirname(fileURLToPath(import.meta.url))) === 'base-onboarding';
+const { isLocalhostName } = await import(new URL(portable ? '../base-cli/modules/operator-auth/loopback.mjs' : '../modules/operator-auth/loopback.mjs', import.meta.url));
 
 async function freePort() {
  const socket = createServer();
@@ -17,15 +21,16 @@ async function freePort() {
  return port;
 }
 
-// A rerun keeps the loopback origin already saved in the seed's settings, so
-// sessions, links and the owner's bookmarks stay valid.
+// A rerun keeps the loopback origin already saved in the seed's settings (a
+// 127.0.0.1 port or a front-door `NAME.localhost` origin), so sessions, links
+// and the owner's bookmarks stay valid.
 async function chooseOrigin(context, hooks) {
  if (context.selectedOrigin) return context.selectedOrigin;
  if (typeof hooks.origin === 'function') return hooks.origin(context);
  const key = hooks.secrets?.originKey;
  if (key) {
   const saved = (await readSettings(context.root, hooks.secrets)).values[key];
-  try { const url = new URL(saved); if (url.protocol === 'http:' && url.hostname === '127.0.0.1' && url.port && url.origin === saved) return saved; } catch {}
+  try { const url = new URL(saved); if (url.protocol === 'http:' && (url.hostname === '127.0.0.1' || isLocalhostName(url.hostname)) && url.port && url.origin === saved) return saved; } catch {}
  }
  return `http://127.0.0.1:${await freePort()}`;
 }
@@ -110,7 +115,18 @@ async function writeSecrets(context, options) {
 async function moveSavedOrigin(context, options, values) {
  const key = options.originKey ?? 'AUTH_ORIGIN', origin = context.selectedOrigin;
  if (!origin || values[key] === undefined || values[key] === origin) return values;
- const current = await readSettings(context.root, options), format = options.format ?? 'dotenv', merged = { ...values, [key]: origin };
+ return rewriteOrigin(context.root, options, values, origin);
+}
+
+// Rewrite only the saved origin (rer dev --door and --direct). The caller holds
+// the local operation lock.
+export async function replaceSavedOrigin(root, options, origin) {
+ return rewriteOrigin(root, options, (await readSettings(root, options)).values, origin);
+}
+
+async function rewriteOrigin(root, options, values, origin) {
+ const key = options.originKey ?? 'AUTH_ORIGIN';
+ const current = await readSettings(root, options), format = options.format ?? 'dotenv', merged = { ...values, [key]: origin };
  const text = format === 'json' ? JSON.stringify(merged, null, 1) + '\n' : current.text.replace(new RegExp(`^${key}=.*$`, 'm'), `${key}=${dotenvValue(origin)}`);
  if (format !== 'json' && localVariables(text)[key] !== origin) throw new Error(`Could not move ${key} in ${options.file ?? '.dev.vars'}; put ${key}=${origin} on its own line.`);
  await writePrivateFile(current.path, text);

package/onboarding/adapter.mjs

@@ -10,6 +10,7 @@ import { credentialValues } from './redaction.mjs';
 import { labels } from './adapter-labels.mjs';
 import { chooseOrigin, prepareSettings, readSettings } from './adapter-settings.mjs';
 import {listenerPorts} from './process-diagnostics.mjs';
+import { appFetch } from './app-fetch.mjs';
 import { owner, signIn } from './adapter-auth.mjs';
 import { installerDevKey } from './dev-identity.mjs';
 import { assertArchiveFree } from './archive-output.mjs';
@@ -180,7 +181,7 @@ async function build(context, hooks) {
 // Health is the application's own /health: HTTP 200 with JSON status "ok"
 // unless the seed supplies another check. Each probe honours its signal.
 export async function defaultHealth(url, signal) {
- const response = await fetch(url, { signal });
+ const response = await appFetch(url, { signal });
  if (!response.ok) {
   await response.body?.cancel();
   return { ready: false, message: `HTTP ${response.status}` };

package/onboarding/app-fetch.mjs

@@ -0,0 +1,79 @@
+// Requests rer itself makes to a local app's own origin (health, sign-in,
+// outbox, dev identity). A directly served origin uses fetch. A front-door
+// origin (http://NAME.localhost:PORT) is never resolved and never goes through
+// the door: rer connects with node:http to that checkout's own proxy on
+// 127.0.0.1, which keeps the Host header (fetch drops a Host override, and musl
+// and some Linux resolvers do not resolve *.localhost), and adds the proxy's
+// per-start secret. Redirects within the routed origin are followed the way
+// fetch follows them. A `*.localhost` origin with no route (its server is not
+// running in this process's knowledge) is refused before anything is sent:
+// whatever answers that name (the door, or a process that took its port) never
+// receives rer's own requests, which can carry the checkout's dev key.
+import http from 'node:http';
+import { basename, dirname } from 'node:path';
+import { fileURLToPath } from 'node:url';
+// The shared loopback predicate, beside this copy in Base or in a seed's scripts/.
+const portable = basename(dirname(fileURLToPath(import.meta.url))) === 'base-onboarding';
+const { isLocalhostName } = await import(new URL(portable ? '../base-cli/modules/operator-auth/loopback.mjs' : '../modules/operator-auth/loopback.mjs', import.meta.url));
+
+const routes = new Map();
+
+/** Send this process's requests for `origin` to 127.0.0.1:`port` with `headers` added. */
+export function routeOrigin(origin, { port, headers = {} }) {
+ routes.set(new URL(origin).origin, { port, headers });
+}
+
+/** One HTTP/1.1 exchange with a loopback listener, Host as given. */
+export function loopbackRequest({ host = '127.0.0.1', port, path = '/', method = 'GET', headers = {}, body, signal, timeoutMs = 30000 }) {
+ return new Promise((resolve, reject) => {
+  const request = http.request({ host, port, path, method, headers, agent: false, signal }, response => {
+   const chunks = [];
+   response.on('data', chunk => chunks.push(chunk));
+   response.on('end', () => resolve({ status: response.statusCode, statusText: response.statusMessage ?? '', rawHeaders: response.rawHeaders, body: Buffer.concat(chunks) }));
+   response.on('error', reject);
+  });
+  request.setTimeout(timeoutMs, () => request.destroy(Object.assign(Error(`No answer from ${host}:${port} within ${timeoutMs / 1000} s.`), { code: 'ETIMEDOUT' })));
+  request.on('error', reject);
+  request.end(body);
+ });
+}
+
+async function bodyBytes(body) {
+ if (body === undefined || body === null) return undefined;
+ if (typeof body === 'string' || Buffer.isBuffer(body) || body instanceof Uint8Array) return Buffer.from(body);
+ return Buffer.from(await new Response(body).arrayBuffer());
+}
+
+const nullBody = status => [101, 103, 204, 205, 304].includes(status);
+
+function unrouted(url) {
+ return Object.assign(new TypeError(`fetch failed: rer sends nothing to ${url.origin} except through that checkout's own server, which is not running here.`), { code: 'ERR_RER_UNROUTED' });
+}
+
+export async function appFetch(input, init = {}) {
+ let url = new URL(input instanceof Request ? input.url : String(input));
+ if (!routes.has(url.origin) && isLocalhostName(url.hostname)) throw unrouted(url);
+ if (!routes.has(url.origin)) return fetch(input, init);
+ let method = (init.method ?? 'GET').toUpperCase(), body = await bodyBytes(init.body);
+ const sent = Object.fromEntries(new Headers(init.headers ?? {}));
+ if (body !== undefined && init.body instanceof URLSearchParams && !sent['content-type']) sent['content-type'] = 'application/x-www-form-urlencoded;charset=UTF-8';
+ for (let hops = 0; ; hops++) {
+  const route = routes.get(url.origin);
+  if (!route && isLocalhostName(url.hostname)) throw unrouted(url);
+  if (!route) return fetch(url, { ...init, method, body });
+  const reply = await loopbackRequest({ port: route.port, path: url.pathname + url.search, method, headers: { ...sent, ...route.headers, host: url.host, ...(body ? { 'content-length': String(body.length) } : {}) }, body, signal: init.signal });
+  const headers = new Headers();
+  for (let i = 0; i < reply.rawHeaders.length; i += 2) headers.append(reply.rawHeaders[i], reply.rawHeaders[i + 1]);
+  const location = headers.get('location');
+  if (location && [301, 302, 303, 307, 308].includes(reply.status) && (init.redirect ?? 'follow') !== 'manual') {
+   if (init.redirect === 'error') throw new TypeError('fetch failed: redirect');
+   if (hops >= 20) throw new TypeError('fetch failed: too many redirects');
+   if (reply.status === 303 || ([301, 302].includes(reply.status) && method === 'POST')) { method = 'GET'; body = undefined; delete sent['content-type']; }
+   url = new URL(location, url);
+   continue;
+  }
+  const response = new Response(nullBody(reply.status) || method === 'HEAD' ? null : reply.body, { status: reply.status, statusText: reply.statusText, headers });
+  Object.defineProperty(response, 'url', { value: url.href });
+  return response;
+ }
+}

package/onboarding/archive-output.d.mts

@@ -1,3 +1,5 @@
 import type { Plugin } from 'vite';
-export function assertArchiveFree(directory: string): Promise<void>;
-export function archiveOutputGuard(): Plugin;
+/** `formats`: the seed's own archive formats, matched against a leading JSON object's `payload.format`. */
+export interface ArchiveFormats { formats?: string[] }
+export function assertArchiveFree(directory: string, options?: ArchiveFormats): Promise<void>;
+export function archiveOutputGuard(options?: ArchiveFormats): Plugin;