@runeditrun/rer 0.1.1 → 0.2.0

package/onboarding/archive-output.mjs

@@ -4,9 +4,13 @@ import { join, resolve } from 'node:path';
 
 // Stream output, including copied public assets: a renamed archive is still
 // private. Never include its contents in an error or read it into one buffer.
-async function hasManifest(file) {
+// A seed whose own export writes another format declares that format's
+// `payload.format` strings; a file whose leading JSON object carries one of them
+// is an archive too.
+async function hasManifest(file, formats) {
  let tail = '', kind = false, format = false, header = '', depth = 0, quoted = false, escaped = false, reading = true, started = false;
- const manifest = text => { try { const value = JSON.parse(text); return value?.kind === 'manifest' && value.format === 'runeditrun-portability'; } catch { return false; } };
+ const manifest = text => { try { const value = JSON.parse(text); return value?.kind === 'manifest' && value.format === 'runeditrun-portability' || formats.includes(value?.payload?.format); } catch { return false; } };
+ const declared = formats.map(name => new RegExp(`"format"\\s*:\\s*${JSON.stringify(name).replace(/[.*+?^${}()|[\]\\]/g, '\\$&')}`));
  for await (const chunk of createReadStream(file, { encoding: 'utf8' })) {
   // Parse the leading JSON object too, so escaped property names and pretty
   // printing cannot hide an otherwise valid portability manifest. The format
@@ -14,7 +18,8 @@ async function hasManifest(file) {
   if (reading) for (const character of chunk) {
    if (!started) { if (/\s/.test(character)) continue; if (character !== '{') { reading = false; break; } started = true; }
    header += character;
-   if (header.length > 24 * 1024 * 1024) { reading = false; header = ''; break; }
+   // A leading object past the limit is an archive when it names a declared format.
+   if (header.length > 24 * 1024 * 1024) { if (declared.some(pattern => pattern.test(header))) return true; reading = false; header = ''; break; }
    if (quoted) { if (escaped) escaped = false; else if (character === '\\') escaped = true; else if (character === '"') quoted = false; }
    else if (character === '"') quoted = true;
    else if (character === '{') depth++;
@@ -28,27 +33,34 @@ async function hasManifest(file) {
  }
  return false;
 }
-export async function assertArchiveFree(directory) {
+export async function assertArchiveFree(directory, { formats = [] } = {}) {
+ assert(formats);
  const status = await lstat(directory).catch(error => { if (error.code === 'ENOENT') return null; throw error; });
  if (!status) return;
  if (status.isSymbolicLink()) throw new Error('Build output must not contain symbolic links.');
  if (status.isDirectory()) {
-  for (const name of await readdir(directory)) await assertArchiveFree(join(directory, name));
- } else if (status.isFile() && (/\.rer(?:\.[\w-]+\.partial)?$/i.test(directory) || await hasManifest(directory))) {
+  for (const name of await readdir(directory)) await assertArchiveFree(join(directory, name), { formats });
+ } else if (status.isFile() && (/\.rer(?:\.[\w-]+\.partial)?$/i.test(directory) || await hasManifest(directory, formats))) {
   throw new Error('Build output contains an installation archive. Move archives to exports/ and build again.');
  }
 }
 
+function assert(formats) {
+ if (!Array.isArray(formats) || formats.some(name => typeof name !== 'string' || !name.trim())) throw new Error('Archive formats must be a list of non-empty payload.format strings.');
+}
+
 // Runs after Vite copies publicDir and writes each client/Worker bundle, also
-// for direct vite build and custom output directories.
-export function archiveOutputGuard() {
+// for direct vite build and custom output directories. `formats` lists the
+// seed's own archive formats (`archiveOutputGuard({ formats: ['acme/local-data.v1'] })`).
+export function archiveOutputGuard({ formats = [] } = {}) {
+ assert(formats);
  let root;
  return {
   name: 'rer:private-archives', apply: 'build', enforce: 'post',
   configResolved(config) { root = config.root; },
   writeBundle: { order: 'post', async handler(options) {
-   if (options.dir) await assertArchiveFree(resolve(root, options.dir));
-   else if (options.file) await assertArchiveFree(resolve(root, options.file));
+   if (options.dir) await assertArchiveFree(resolve(root, options.dir), { formats });
+   else if (options.file) await assertArchiveFree(resolve(root, options.file), { formats });
   } },
  };
 }

package/onboarding/dependency-approval.mjs

@@ -1,3 +1,4 @@
+import { appFetch } from './app-fetch.mjs';
 // Setup opens app-local approvals before native bootstrap. Existing owners must
 // prove their email afresh through the local outbox, just like owner controls.
 export async function approveSetupDependencies(context, post, messages) {
@@ -5,7 +6,7 @@ export async function approveSetupDependencies(context, post, messages) {
  if(!selected.length)return;
  const failure=()=>Error('Application dependency approval failed. Complete fresh app-owner approval before linking.');
  let cookie;
- const current=await fetch(new URL('/auth/dependencies/status',context.origin),{signal:context.signal}).then(response=>response.ok?response.json():null);
+ const current=await appFetch(new URL('/auth/dependencies/status',context.origin),{signal:context.signal}).then(response=>response.ok?response.json():null);
  const files=process.env.RER_LINK_TOKEN_FILES?JSON.parse(process.env.RER_LINK_TOKEN_FILES):{};
  for(const dependency of selected) {
   const body={interface:dependency.interface,issuer:context.input[dependency.address]};
@@ -21,7 +22,7 @@ export async function approveSetupDependencies(context, post, messages) {
    let id;
    for(let attempt=0;attempt<50 && !id;attempt++) {id=(await messages(context,path,email)).find(value=>!before.has(value));if(!id)await new Promise(resolve=>setTimeout(resolve,200));}
    if(!id)throw failure();
-   const response=await fetch(new URL(path+'?message='+encodeURIComponent(id),context.origin),{signal:context.signal,headers:context.devKey?{'x-rer-dev-key':context.devKey}:{}});
+   const response=await appFetch(new URL(path+'?message='+encodeURIComponent(id),context.origin),{signal:context.signal,headers:context.devKey?{'x-rer-dev-key':context.devKey}:{}});
    if(!response.ok)throw failure();
    const html=await response.text(),href=/<a\b[^>]*class="open"[^>]*href="([^"]+)"/.exec(html)?.[1];
    if(!href)throw failure();
@@ -30,7 +31,7 @@ export async function approveSetupDependencies(context, post, messages) {
    if(confirmed.status!==303)throw failure();cookie=confirmed.headers.get('set-cookie')?.split(';')[0];await confirmed.body?.cancel();
    if(!cookie)throw failure();context.store.addSecrets?.([cookie]);
   }
-  const approved=await fetch(new URL('/auth/dependencies/relink',context.origin),{method:'POST',redirect:'manual',signal:context.signal,headers:{Origin:context.origin,'Content-Type':'application/json',Cookie:cookie},body:JSON.stringify(body)});
+  const approved=await appFetch(new URL('/auth/dependencies/relink',context.origin),{method:'POST',redirect:'manual',signal:context.signal,headers:{Origin:context.origin,'Content-Type':'application/json',Cookie:cookie},body:JSON.stringify(body)});
   if(!approved.ok)throw failure();await approved.body?.cancel();
  }
 }

package/onboarding/local/environment.mjs

@@ -1,4 +1,9 @@
 import { parseEnv } from 'node:util'
+import { basename, dirname } from 'node:path'
+import { fileURLToPath } from 'node:url'
+// The shared loopback predicate, beside this copy in Base or in a seed's scripts/.
+const portable = basename(dirname(dirname(fileURLToPath(import.meta.url)))) === 'base-onboarding'
+const { isLocalhostName } = await import(new URL(portable ? '../../base-cli/modules/operator-auth/loopback.mjs' : '../../modules/operator-auth/loopback.mjs', import.meta.url))
 
 export function localVariables(text) {
   // Node's dotenv parser can consume the next assignment after an unquoted
@@ -23,8 +28,8 @@ export const secretValues = (vars) => Object.entries(vars).filter(([key]) => /SE
 export function localOrigin(vars) {
   let url
   try { url = new URL(vars.AUTH_ORIGIN) } catch { /* Use a fixed, non-secret diagnostic. */ }
-  if (vars.AUTH_LOCAL !== 'true' || !url || url.protocol !== 'http:' || url.hostname !== '127.0.0.1' || url.origin !== vars.AUTH_ORIGIN || url.username || url.password) {
-    throw new Error('Invalid local origin in .dev.vars: AUTH_ORIGIN must be http://127.0.0.1:PORT with AUTH_LOCAL=true. Run rer setup to save a valid one. If you changed AUTH_ORIGIN yourself, put back the http://127.0.0.1:PORT origin setup saved, or pick a port with rer setup --port PORT.')
+  if (vars.AUTH_LOCAL !== 'true' || !url || url.protocol !== 'http:' || (url.hostname !== '127.0.0.1' && !isLocalhostName(url.hostname)) || url.origin !== vars.AUTH_ORIGIN || url.username || url.password) {
+    throw new Error('Invalid local origin in .dev.vars: AUTH_ORIGIN must be http://127.0.0.1:PORT (or a front-door http://NAME.localhost:PORT) with AUTH_LOCAL=true. Run rer setup to save a valid one. If you changed AUTH_ORIGIN yourself, put back the http://127.0.0.1:PORT origin setup saved, or pick a port with rer setup --port PORT.')
   }
   return url
 }

package/onboarding/operator-install.mjs

@@ -1,11 +1,17 @@
 import { randomUUID } from 'node:crypto';
+import { existsSync } from 'node:fs';
 import { readFile, unlink } from 'node:fs/promises';
 import { join, relative } from 'node:path';
+import { fileURLToPath } from 'node:url';
 import { chooseOrigin } from './adapter-settings.mjs';
 import { privateDirectory, writePrivateFile } from './private-files.mjs';
 import { installationFailure, installationFailureMessage } from './failures.mjs';
 import { labels } from './adapter-labels.mjs';
 
+// The rer that nested commands run: a vendored checkout's own scripts/rer.mjs,
+// else this copy's own (a checkout that pins the @runeditrun/rer package).
+const rerEntry=root=>existsSync(join(root,'scripts/rer.mjs'))?'scripts/rer.mjs':fileURLToPath(new URL('../bin/rer.mjs',import.meta.url));
+
 // The browser and terminal use the same bounded setup journey. Its temporary
 // runtime is gone before that lease releases. The foreground preview belongs
 // to the installer process, outside the bounded job's descendant tree.
@@ -20,14 +26,14 @@ export async function installOperator(root,input,store,onApp,signal,hooks){
   // The browser owns no local operation. A verifier may have launched it while
   // holding a different checkout's token; each public command takes its own.
   const env={...process.env};delete env.RER_LOCAL_OPERATION;
-  const run=(label,args)=>store.run(label,process.execPath,['scripts/rer.mjs',...args,'--non-interactive','--json'],{cwd:root,signal,env,heavy:false});
+  const run=(label,args)=>store.run(label,process.execPath,[rerEntry(root),...args,'--non-interactive','--json'],{cwd:root,signal,env,heavy:false});
   step='dependencies';await store.step(labels.dependencies);await run(labels.dependencies,['install']);
   step='setup';await store.step(labels.build);await run(labels.build,['setup','--answers',relative(root,answer),'--host',address.hostname.replace(/^\[|\]$/g,''),'--port',address.port]);
   await unlink(answer);answer=undefined;
   // Preview's ready event carries RER_OPEN; keep the checkout's dev key out of this log.
   const devKey=/^RER_DEV_KEY=(\S+)$/m.exec(await readFile(join(root,'.rer/local/dev-key.env'),'utf8').catch(()=>''))?.[1];if(devKey)store.addSecrets?.([devKey]);
   step='start';await store.step(labels.start);
-  app=store.spawn(labels.start,process.execPath,['scripts/rer.mjs','preview','--non-interactive','--json'],{cwd:root,signal,env});onApp(app);
+  app=store.spawn(labels.start,process.execPath,[rerEntry(root),'preview','--non-interactive','--json'],{cwd:root,signal,env});onApp(app);
   let buffer='',ready=false,openUrl;
   app.stdout.on('data',chunk=>{buffer+=chunk;let end;while((end=buffer.indexOf('\n'))>=0){const line=buffer.slice(0,end);buffer=buffer.slice(end+1);try{const event=JSON.parse(line);if(event.version===1&&event.verb==='preview'&&event.event==='ready'&&event.url===origin){ready=true;openUrl=event.openUrl;}}catch{}}});
   await store.waitForReady(labels.start,app,async probeSignal=>{

package/onboarding/operator-prerequisites.mjs

@@ -18,8 +18,11 @@ export async function operatorPrerequisites(root,email){
    db=new DatabaseSync(join(directory,file.name),{readOnly:true});
    const applied=new Set(db.prepare('SELECT name FROM d1_migrations').all().map(row=>row.name));
    const claimed=db.prepare('SELECT COUNT(*) AS count FROM oa_bootstrap').get().count;
-   const owner=db.prepare("SELECT COUNT(*) AS count FROM oa_operators WHERE email=? AND role='owner' AND status='active'").get(email).count;
-   if(claimed===1&&owner===1&&migrations.every(name=>applied.has(name)))return true;
+   // Setup claimed this saved owner, and an active owner remains: after that
+   // owner has left, dev signs in as the remaining owner (dev identity's owner persona).
+   const saved=db.prepare('SELECT COUNT(*) AS count FROM oa_operators WHERE email=?').get(email).count;
+   const owners=db.prepare("SELECT COUNT(*) AS count FROM oa_operators WHERE role='owner' AND status='active'").get().count;
+   if(claimed===1&&saved===1&&owners>0&&migrations.every(name=>applied.has(name)))return true;
   }catch{/* A missing/corrupt/unrelated database cannot prove prior setup. */}
   finally{db?.close();}
  }

package/onboarding/queued-entry.mjs

@@ -23,12 +23,16 @@ export async function queuedEntrypoint(url,verb='verify') {
  }finally{await store?.closeCommands();await rm(directory,{recursive:true,force:true});}
 }
 
-if(process.argv[1] && pathToFileURL(resolve(process.argv[1])).href===import.meta.url){
- const [verb,separator,command,...args]=process.argv.slice(2);
- if(separator!=='--'||!command)throw Error('Usage: queued-entry VERB -- COMMAND ARGS');
+// `node queued-entry.mjs VERB -- COMMAND ARGS` (a vendored copy) and
+// `rer queue VERB -- COMMAND ARGS` (a pinned package): run COMMAND once the
+// machine job queue admits it, and return its exit status.
+export async function queuedCommandLine([verb,separator,command,...args]){
+ if(!verb||separator!=='--'||!command)throw Error('Usage: queued-entry VERB -- COMMAND ARGS');
  const directory=await mkdtemp(join(tmpdir(),'rer-heavy-'));
  const store=await createCommands(directory,{logs:[]},{terminal:text=>process.stdout.write(text),queue:{verb}});
- try{await store.run(verb,command,args,{cwd:process.cwd()});}
- catch(error){process.exitCode=error.childExitCode??1;}
+ try{await store.run(verb,command,args,{cwd:process.cwd()});return 0;}
+ catch(error){return error.childExitCode??1;}
  finally{await store.closeCommands();await rm(directory,{recursive:true,force:true});}
 }
+
+if(process.argv[1] && pathToFileURL(resolve(process.argv[1])).href===import.meta.url)process.exitCode=await queuedCommandLine(process.argv.slice(2));

package/operations/operations.mjs

@@ -1,5 +1,5 @@
 import { readFile, access } from 'node:fs/promises';
-import { existsSync } from 'node:fs';
+import { existsSync, readFileSync } from 'node:fs';
 import { relative, resolve } from 'node:path';
 import { pathToFileURL } from 'node:url';
 import { spawnSync } from 'node:child_process';
@@ -136,8 +136,17 @@ async function checkSummary(result, descriptor, root) {
   return lines.join('\n');
 }
 
+// A first-party checkout's rer: its vendored scripts/rer.mjs, or the
+// @runeditrun/rer package it pins.
+function checkoutRer(root) {
+  const vendored = resolve(root, 'scripts/rer.mjs'), pinned = resolve(root, 'node_modules/@runeditrun/rer/bin/rer.mjs');
+  if (existsSync(vendored)) return vendored;
+  try { const pkg = JSON.parse(readFileSync(resolve(root, 'package.json'), 'utf8')); if ((pkg.devDependencies?.['@runeditrun/rer'] ?? pkg.dependencies?.['@runeditrun/rer']) && existsSync(pinned)) return pinned; } catch {}
+  return vendored;
+}
+
 export async function main(args = process.argv.slice(2), root = process.cwd()) {
-  const rer = resolve(root, 'scripts/rer.mjs');
+  const rer = checkoutRer(root);
   if (!['describe', 'check'].includes(args[0]) || (args.length !== 1 && !existsSync(rer))) throw new Error('Unsupported operations command.');
   // First-party projects describe and check through their RER command.
   if (existsSync(rer)) {

package/package.json

@@ -1,12 +1,86 @@
 {
   "name": "@runeditrun/rer",
-  "version": "0.1.1",
+  "version": "0.2.0",
   "description": "The rer command: install, set up, run and launch Run Edit Run checkouts.",
   "license": "MIT",
   "type": "module",
   "bin": {
     "rer": "global/rer.mjs"
   },
+  "exports": {
+    "./adapter": "./cli/adapter.mjs",
+    "./deploy": "./cli/deploy.mjs",
+    "./portability": "./cli/portability.mjs",
+    "./errors": "./cli/errors.mjs",
+    "./jsonc": "./cli/jsonc.mjs",
+    "./parse": "./cli/parse.mjs",
+    "./scheduled": "./cli/scheduled.mjs",
+    "./dev-identity": "./cli/dev-identity.mjs",
+    "./local-installer": "./onboarding/adapter.mjs",
+    "./state": "./onboarding/state.mjs",
+    "./commands": "./onboarding/commands.mjs",
+    "./operator-installer": "./onboarding/operator-installer.mjs",
+    "./operator-install": "./onboarding/operator-install.mjs",
+    "./operator-prerequisites": "./onboarding/operator-prerequisites.mjs",
+    "./adapter-auth": "./onboarding/adapter-auth.mjs",
+    "./adapter-hosting": "./onboarding/adapter-hosting.mjs",
+    "./adapter-settings": "./onboarding/adapter-settings.mjs",
+    "./failures": "./onboarding/failures.mjs",
+    "./private-files": "./onboarding/private-files.mjs",
+    "./process-diagnostics": "./onboarding/process-diagnostics.mjs",
+    "./process-cleanup": "./onboarding/process-cleanup.mjs",
+    "./process-scope": "./onboarding/process-scope.mjs",
+    "./redaction": "./onboarding/redaction.mjs",
+    "./setup-manifest": "./onboarding/setup-manifest.mjs",
+    "./setup-schema": "./onboarding/schema/SETUP.schema.json",
+    "./local/environment": "./onboarding/local/environment.mjs",
+    "./local/files": "./onboarding/local/files.mjs",
+    "./local/build": "./onboarding/local/build.mjs",
+    "./local/operation": "./onboarding/local/operation.mjs",
+    "./local/recovery": "./onboarding/local/recovery.mjs",
+    "./local/state": "./onboarding/local/state.mjs",
+    "./production-runtime": "./onboarding/production-runtime.mjs",
+    "./production-modules": "./onboarding/production-modules.mjs",
+    "./queued-entry": "./onboarding/queued-entry.mjs",
+    "./archive-output": {
+      "types": "./onboarding/archive-output.d.mts",
+      "default": "./onboarding/archive-output.mjs"
+    },
+    "./launcher": "./onboarding/launcher.mjs",
+    "./installer-server": "./onboarding/server.mjs",
+    "./server-resources": "./cli/server-resources.mjs",
+    "./operations": "./operations/operations.mjs",
+    "./modules/portability": "./modules/portability/index.mjs",
+    "./modules/portability/catalogue": "./modules/portability/catalogue.mjs",
+    "./modules/portability/cli": "./modules/portability/cli.mjs",
+    "./modules/portability/cli-options": "./modules/portability/cli-options.mjs",
+    "./modules/portability/files": "./modules/portability/files.mjs",
+    "./modules/portability/format": "./modules/portability/format.mjs",
+    "./modules/portability/http": "./modules/portability/http.mjs",
+    "./modules/portability/import": "./modules/portability/import.mjs",
+    "./modules/portability/journal": "./modules/portability/journal.mjs",
+    "./modules/portability/legacy-safety": "./modules/portability/legacy-safety.mjs",
+    "./modules/portability/migration-history": "./modules/portability/migration-history.mjs",
+    "./modules/portability/storage": "./modules/portability/storage.mjs",
+    "./modules/erasure/fence": "./modules/erasure/fence.mjs",
+    "./modules/deploy-kit/owner": "./modules/deploy-kit/owner.mjs",
+    "./modules/deploy-kit/owner-cli": "./modules/deploy-kit/owner-cli.mjs",
+    "./modules/deploy-kit/prepare": "./modules/deploy-kit/prepare.mjs",
+    "./modules/deploy-kit/provider": "./modules/deploy-kit/provider.mjs",
+    "./modules/release/export": "./modules/release/export.mjs",
+    "./modules/release/publication-scan": "./modules/release/publication-scan.mjs",
+    "./modules/release/source": "./modules/release/source.mjs",
+    "./modules/operator-auth": "./modules/operator-auth/index.mjs",
+    "./modules/operator-auth/accounts/native": "./modules/operator-auth/accounts/native.mjs",
+    "./modules/operator-auth/dev": "./modules/operator-auth/dev/index.mjs",
+    "./modules/operator-auth/dev-admission": "./modules/operator-auth/dev-admission.mjs",
+    "./modules/operator-auth/dev/badge": "./modules/operator-auth/dev/badge.mjs",
+    "./modules/operator-auth/identity/email-link": "./modules/operator-auth/identity/email-link/index.mjs",
+    "./modules/owner-claim": "./modules/owner-claim/index.mjs",
+    "./modules/dependencies": "./modules/dependencies/index.mjs",
+    "./internal/*": "./*",
+    "./package.json": "./package.json"
+  },
   "engines": {
     "node": ">=22"
   }

package/scripts/publish-check/github_refs.py

@@ -51,6 +51,10 @@ CONTEXT_URL = re.compile(r'(?i)(?<![A-Za-z])(?:' + REPOSITORY_CONTEXT + r')'
                          + r'''[`*_~\[\]\s"']*(?:''' + URL.pattern.replace('(?i)', '') + ')')
 LINK_URL = re.compile(r'(?i)\[(?P<label>[^]\n]+)\]\(\s*(?P<url>' + URL.pattern.replace('(?i)', '') + ')')
 REPOSITORY_LABEL = re.compile(r'(?i)\b(?:' + REPOSITORY_CONTEXT + r')\b')
+# Words that make a nearby `owner/name` a repository rather than an identifier.
+# A bare "source" is not one: "source commit/tree" is ordinary prose.
+NEARBY_CONTEXT = re.compile(r'(?i)\b(?:github|repositor(?:y|ies)|repos?|forks?|forked|clones?|cloned|upstream|downstream|origin|submodules?)\b')
+CONTEXT_WINDOW = 60
 
 
 def explicit_references(text, path):
@@ -76,6 +80,20 @@ class RepositoryObject(dict):
 
 
 def references(text, path, local_paths=frozenset(), project_identity=None):
+    stated, ambiguous = reference_sets(text, path, local_paths, project_identity)
+    return stated | ambiguous
+
+
+def reference_sets(text, path, local_paths=frozenset(), project_identity=None):
+    """Split `owner/name` tokens into stated repositories and ambiguous ones.
+
+    A stated reference has GitHub context: a URL, a repository field, a labelled
+    or commanded mention, a repository route. An ambiguous token is a bare
+    word/word in prose (`commit/tree`, `rer-delegation/1`, `dmsans/v17`): it is
+    a repository only if one answers to that name privately, never because none
+    does.
+    """
+    ambiguous = set()
     repository_text = SERVICE_URL.sub('', text)
     found = {normalize(m.group(1)) for m in URL.finditer(repository_text)
              if not SPONSORS_URL.match(repository_text, m.start())}
@@ -106,8 +124,16 @@ def references(text, path, local_paths=frozenset(), project_identity=None):
             # A plain multi-segment path is ambiguous; GitHub's repository
             # routes, a labeled field or a GitHub command disambiguate it.
             labeled = explicit and (re.search(r'[:=|]', match['separator']) or re.match(r'(?i)github|gh\s', match['label']))
-            if not suffix or REPOSITORY_ROUTE.match(suffix) or labeled:
+            if REPOSITORY_ROUTE.match(suffix) or labeled:
                 found.add(normalize(repository))
+            elif not suffix:
+                if explicit:
+                    weak = re.fullmatch(r'(?i)source', match['label']) and not re.search(r'(?i)repository|repo', markdown[match.start():match.start('reference')])
+                else:
+                    line_start = markdown.rfind('\n', 0, match.start()) + 1
+                    around = markdown[max(line_start, match.start() - CONTEXT_WINDOW):match.end() + CONTEXT_WINDOW].split('\n', 1)[0]
+                    weak = not NEARBY_CONTEXT.search(around)
+                (ambiguous if weak else found).add(normalize(repository))
     elif METADATA.search(path) or SOURCE.search(path):
         if path.lower().endswith('.json'):
             try:
@@ -146,7 +172,7 @@ def references(text, path, local_paths=frozenset(), project_identity=None):
             found.update(normalize(m.group(1)) for m in TYPED_REPOSITORY.finditer(text))
             for declaration in declarations(text):
                 found.update(normalize(m.group(1)) for m in DECLARED_SHORTHAND.finditer(declaration))
-    return found
+    return found, ambiguous - found
 
 
 def local_dependencies(data, path):

package/scripts/publish-check/public_hygiene.py

@@ -1,7 +1,7 @@
 """Public-tree and message hygiene; findings never include matched values."""
 from collections import Counter
 import re
-from github_refs import REPOSITORY_HOSTS, references
+from github_refs import REPOSITORY_HOSTS, reference_sets
 from destination import RULE as PENDING_DESTINATION
 from hygiene_text import decoded_text
 from provenance import provenance_text
@@ -25,12 +25,35 @@ def private_emails(text, config):
     # URL paths, queries and fragments remain visible to email inspection.
     email_text = URI_AUTHORITY.sub(email_userinfo, without_required_notices(text))
     email_text = re.sub(r'(?i)\b(?a:git@github\.com:)(?=[A-Za-z0-9])', '', email_text)
-    version = r'(?:v?[0-9]+(?:\.[0-9]+)*(?:-[A-Za-z0-9-]+)?|[a-f0-9]{40})(?![A-Za-z0-9_.-])'
+    # A package manager's patch file is named name@version.patch.
+    version = r'(?:v?[0-9]+(?:\.[0-9]+)*(?:-[A-Za-z0-9-]+)?|[a-f0-9]{40})(?:\.patch)?(?![A-Za-z0-9_.-])'
     email_text = re.sub(r'(?m)^\s*-?\s*uses:\s*[\"\']?[A-Za-z0-9_.-]+/[A-Za-z0-9_.-]+@[^\s\"\']+', '', email_text)
     email_text = re.sub(r'(?<![A-Za-z0-9])(?:@[A-Za-z0-9_.-]+/)?[A-Za-z0-9_.-]+(?:/[A-Za-z0-9_.-]+)?@' + version, '', email_text)
     return [match.group() for match in EMAIL.finditer(email_text) if not public_email(match.group(), config)]
 
 
+# A stored host name is lower case, upper case or capitalised, label by label.
+# Bytes that merely decode to text, such as compressed pixels, rarely are.
+HOST_LABEL = re.compile(r'(?:[a-z0-9-]+|[A-Z0-9-]+|[A-Z][a-z0-9-]*)')
+
+
+# Control bytes that no text encoding uses (tab, newline, form feed and carriage
+# return are text). Legacy 8-bit text such as latin-1 or Windows-1252 has none,
+# while compressed or packed data is about one byte in nine.
+NON_TEXT = re.compile(rb'[\x01-\x08\x0b\x0e-\x1f\x7f]')
+BINARY_SHARE = 0.05
+
+
+def binary(data):
+    # NULs are not counted: UTF-16 and UTF-32 text carries them between letters.
+    text = data.replace(b'\0', b'')
+    return bool(text) and len(NON_TEXT.findall(text)) / len(text) > BINARY_SHARE
+
+
+def stored_host(address):
+    return all(HOST_LABEL.fullmatch(label) for label in address.rsplit('@', 1)[1].split('.'))
+
+
 def certificate_metadata(data, bundle, emails, config):
     # Every match lies inside a verified trust-anchor subject value: none
     # remains once those values are blanked, and each is one of theirs.
@@ -62,15 +85,23 @@ def inspect_text(data, path, config, resolver):
         emails = private_emails(text, config)
         bundle = config.get('trustBundles', {}).get(path)
         if emails and not (bundle and certificate_metadata(data, bundle, emails, config)):
-            rules.add('hygiene.email')
+            # Inside binary data a mailbox is judged by its own shape: a host
+            # name with mixed-case letters inside a label is not one.
+            if not binary(data) or any(stored_host(email) for email in emails):
+                rules.add('hygiene.email')
     ref_text, provenance = provenance_text(text, path, config.get('declaredSources', frozenset()))
-    for repository in references(ref_text, path, config.get('localPaths', frozenset()), config.get('projectIdentity')):
+    stated, ambiguous = reference_sets(ref_text, path, config.get('localPaths', frozenset()), config.get('projectIdentity'))
+    for repository in sorted(stated | ambiguous):
         # A future source identity does not assert current GitHub visibility.
         # Explicit release destinations still take the strict visibility path.
         if (repository in config.get('intendedPublicRepositories', frozenset()) and
                 repository != config.get('pendingDestination')):
             continue
         state = resolver.resolve(repository)
+        # A bare word/word with no GitHub context names a repository only when
+        # one exists privately; that no repository answers to it proves nothing.
+        if state == 'missing' and repository in ambiguous and repository != config.get('pendingDestination'):
+            continue
         if state == 'missing' and repository == config.get('pendingDestination'):
             rules.add(PENDING_DESTINATION)
         elif state in ('private', 'missing'):

package/scripts/publish-check/publication-config.json

@@ -7,6 +7,19 @@
     { "repository": "just-every/lamp", "reason": "Owner-declared public identity; created by clean-history export at the first public tag." },
     { "repository": "just-every/dial", "reason": "Owner-declared public identity; created by clean-history export at the first public tag." },
     { "repository": "just-every/orbit", "reason": "Owner-declared public identity; created by clean-history export at the first public tag." },
-    { "repository": "just-every/uptime-monitor", "reason": "Owner-declared public identity; created by clean-history export at the first public tag." }
+    { "repository": "just-every/uptime-monitor", "reason": "Owner-declared public identity; created by clean-history export at the first public tag." },
+    { "repository": "just-every/run-slate", "reason": "Owner-proposed public name (13 Oct 2026), accepted ahead of the rename; created by clean-history export at the first public tag." },
+    { "repository": "just-every/run-pencil", "reason": "Owner-proposed public name (13 Oct 2026), accepted ahead of the rename; created by clean-history export at the first public tag." },
+    { "repository": "just-every/run-lamp", "reason": "Owner-proposed public name (13 Oct 2026), accepted ahead of the rename; created by clean-history export at the first public tag." },
+    { "repository": "just-every/run-uptime", "reason": "Owner-proposed public name (13 Oct 2026), accepted ahead of the rename; created by clean-history export at the first public tag." },
+    { "repository": "just-every/run-cradle", "reason": "Owner-proposed public name (13 Oct 2026), accepted ahead of the rename; created by clean-history export at the first public tag." },
+    { "repository": "just-every/run-vector", "reason": "Owner-proposed public name (13 Oct 2026), accepted ahead of the rename; created by clean-history export at the first public tag." },
+    { "repository": "just-every/run-mango", "reason": "Owner-proposed public name (13 Oct 2026), accepted ahead of the rename; created by clean-history export at the first public tag." },
+    { "repository": "just-every/run-dial", "reason": "Owner-proposed public name (13 Oct 2026), accepted ahead of the rename; created by clean-history export at the first public tag." },
+    { "repository": "just-every/run-penny", "reason": "Owner-proposed public name (13 Oct 2026), accepted ahead of the rename; created by clean-history export at the first public tag." },
+    { "repository": "just-every/run-nook", "reason": "Owner-proposed public name (13 Oct 2026), accepted ahead of the rename; created by clean-history export at the first public tag." },
+    { "repository": "just-every/run-orbit", "reason": "Owner-proposed public name (13 Oct 2026), accepted ahead of the rename; created by clean-history export at the first public tag." },
+    { "repository": "just-every/run-oncall", "reason": "Owner-proposed public name (13 Oct 2026), accepted ahead of the rename; created by clean-history export at the first public tag." },
+    { "repository": "just-every/run-spool", "reason": "Owner-proposed public name (13 Oct 2026), accepted ahead of the rename; created by clean-history export at the first public tag." }
   ]
 }