@runeditrun/rer 0.1.1 → 0.2.1

package/modules/mail/src/development/index.d.mts

@@ -27,6 +27,12 @@ export interface DevelopmentD1Database {
   prepare(sql: string): DevelopmentD1Statement;
   batch(statements: DevelopmentD1Statement[]): Promise<Array<{ success: boolean; results: unknown[] }>>;
 }
+/** Storage failure: the message is valid, so a queue consumer retries instead of dropping it. Invalid input throws `MailValidationError`, which is permanent. */
+export class DevelopmentOutboxError extends Error {
+  readonly name: 'DevelopmentOutboxError';
+  readonly code: 'development_outbox_failed';
+  readonly retryable: true;
+}
 export function createD1DevelopmentOutbox(options: { db: DevelopmentD1Database; maxMessages?: number; maxAgeMs?: number; clock?: () => number }): DevelopmentOutbox;
 export function createDevelopmentOutboxHandler(options: {
   local: boolean; origin: string; outbox: Pick<DevelopmentOutbox, 'list' | 'get'>; path?: string;

package/modules/mail/src/development/index.mjs

@@ -1,9 +1,10 @@
-import { MailValidationError, fail } from '../core/errors.mjs';
+import { MailValidationError, DevelopmentOutboxError, fail } from '../core/errors.mjs';
 import { validateConfig, validateMessage } from '../core/validation.mjs';
 import { sendResult } from '../core/transport.mjs';
 
 export { createD1DevelopmentOutbox } from './outbox.mjs';
 export { createDevelopmentOutboxHandler } from './viewer.mjs';
+export { DevelopmentOutboxError } from '../core/errors.mjs';
 
 function validate(operation, errorCode) {
   try {
@@ -27,8 +28,10 @@ export async function sendDevelopment(config, message, dependencies = {}) {
 
   try {
     await dependencies.outbox.put(snapshot);
-  } catch {
-    fail('development_outbox_failed');
+  } catch (error) {
+    // Input the outbox itself refuses stays permanent; a storage failure is worth a retry.
+    if (error instanceof MailValidationError) throw error;
+    throw new DevelopmentOutboxError();
   }
 
   return sendResult('development', 'development', null);

package/modules/mail/src/development/viewer-html.mjs

@@ -1,4 +1,4 @@
-export const style = `*{box-sizing:border-box}body{margin:0;background:#f5f7fa;color:#17212e;font:16px/1.6 system-ui,sans-serif}main{max-width:52rem;margin:0 auto;padding:24px 16px}h1{font-size:1.75rem;line-height:1.2}article{margin:20px 0;padding:20px;background:white;border:1px solid #cad2dc;border-radius:12px}h2{font-size:1.2rem}h1,h2,p,a,pre{overflow-wrap:anywhere;word-break:normal}pre{white-space:pre-wrap;font:inherit}a{color:#174fb5}a.open{display:block;padding:16px;margin:20px 0;border-radius:8px;background:#174fb5;color:white;font-weight:700;text-align:center;text-decoration:none;min-height:56px}small{color:#465569}`;
+export const style = `*{box-sizing:border-box}body{margin:0;background:#f5f7fa;color:#17212e;font:16px/1.6 system-ui,sans-serif}main{max-width:52rem;margin:0 auto;padding:24px 16px}h1{font-size:1.75rem;line-height:1.2}article{margin:20px 0;padding:20px;background:white;border:1px solid #cad2dc;border-radius:12px}h2{font-size:1.2rem}h1,h2,p,a,pre{overflow-wrap:anywhere;word-break:normal}pre{white-space:pre-wrap;font:inherit}a{color:#174fb5}a.open{display:block;padding:16px;margin:20px 0;border-radius:8px;background:#174fb5;color:white;font-weight:700;text-align:center;text-decoration:none;min-height:56px}a.nav{display:inline-block;padding:4px 0}small{color:#465569}`;
 
 // Added only when the seed declares a theme: its linked rer-theme.css supplies the
 // --rer-* tokens. Each falls back to the plain sheet's value, and the focus ring is
@@ -33,10 +33,10 @@ export function document(body, theme) {
 }
 
 export function listing(rows, path) {
-  return rows.length ? rows.map(row => `<article>${metadata(row)}<p><a href="${escape(`${path}?message=${encodeURIComponent(row.id)}`)}">Read message</a></p></article>`).join('') : '<p>No messages yet.</p>';
+  return rows.length ? rows.map(row => `<article>${metadata(row)}<p><a href="${escape(`${path}?message=${encodeURIComponent(row.id)}`)}" class="nav">Read message</a></p></article>`).join('') : '<p>No messages yet.</p>';
 }
 
 export function detail(row, path) {
   const link = firstLink(row.message);
-  return `<p><a href="${escape(path)}">All messages</a></p><article>${metadata(row)}${link ? `<a class="open" href="${escape(link)}" rel="noreferrer noopener">Open this link</a>` : ''}<h2>Message text</h2><pre>${escape(row.message.text || row.message.html || '')}</pre>${row.message.attachments?.length ? `<p>${row.message.attachments.length} attachment(s) stored with this message.</p>` : ''}</article>`;
+  return `<p><a href="${escape(path)}" class="nav">All messages</a></p><article>${metadata(row)}${link ? `<a class="open" href="${escape(link)}" rel="noreferrer noopener">Open this link</a>` : ''}<h2>Message text</h2><pre>${escape(row.message.text || row.message.html || '')}</pre>${row.message.attachments?.length ? `<p>${row.message.attachments.length} attachment(s) stored with this message.</p>` : ''}</article>`;
 }

package/modules/mail/src/development/viewer.mjs

@@ -1,11 +1,18 @@
 import { detail, document, listing, style, themedStyle } from './viewer-html.mjs';
 
+// The mail module runs as its own module root (in workerd too), so it cannot
+// import operator-auth's shared predicate (modules/operator-auth/loopback.mjs);
+// this is the same rule: the loopback hosts, 127/8, or a name under .localhost
+// (the front door's http://NAME.localhost:PORT).
+const localhostName = /^(?:[a-z0-9](?:[a-z0-9-]{0,61}[a-z0-9])?\.)+localhost$/;
+const isLoopbackHost = hostname => hostname === 'localhost' || hostname === '127.0.0.1' || hostname === '[::1]' || (hostname.length <= 253 && localhostName.test(hostname));
+
 function localOrigin(origin) {
   if (typeof origin !== 'string') return null;
   try {
     const url = new URL(origin);
     const ipv4 = url.hostname.split('.');
-    const loopback = url.hostname === 'localhost' || url.hostname === '[::1]' ||
+    const loopback = isLoopbackHost(url.hostname) ||
       (ipv4.length === 4 && ipv4[0] === '127' && ipv4.every(part => /^(0|[1-9]\d{0,2})$/.test(part) && Number(part) <= 255));
     return loopback && ['http:', 'https:'].includes(url.protocol) && url.origin === origin ? url : null;
   } catch { return null; }

package/modules/operator-auth/accounts/native.mjs

@@ -111,7 +111,7 @@ export function createNativeAuth({ accounts, proofs, db, config, clock, hooks, m
     // explicit refusals, never apparently successful writes to an unused store.
     ...Object.fromEntries(['invite', 'listOperators', 'cancelInvitation', 'setOperatorStatus', 'setRole', 'listSessions', 'revokeSession',
       'listDomainRules', 'setDomainRule', 'unlinkProvider', 'relinkProvider', 'mintCredential', 'authenticateCredential'].map(k => [k, unavailable])),
-    native: true, presentation: config.branding, accounts, admission, providers,
+    native: true, presentation: config.branding, emailSignInAvailable: Boolean(mailSender), accounts, admission, providers,
     requestMagicLink: email.requestMagicLink, previewLink: email.previewLink, confirmLink: email.confirmLink,
     requestStepUp: email.requestStepUp, requireStepUp: email.requireStepUp,
     ...legacyAdmission({ admission, config, policyVersion }),

package/modules/operator-auth/dev/badge.mjs

@@ -5,7 +5,7 @@ import { escapeHtml } from '../http.mjs';
 // starts after it and nothing is ever covered. A grid body (the frames that
 // centre their card) gives the bar its own auto row and keeps the card centred
 // in the rest.
-const STYLE = 'body:has(>#rer-dev-badge){grid-template-rows:auto 1fr}#rer-dev-badge{grid-column:1/-1;justify-self:stretch;align-self:start;position:relative;z-index:2147483647;box-sizing:border-box;width:100%;margin:0 0 12px;padding:6px 12px;border-radius:8px;background:#111827;color:#f9fafb;font:13px/1.5 system-ui,sans-serif;text-align:left}#rer-dev-badge summary{cursor:pointer;overflow-wrap:anywhere}#rer-dev-badge ul{margin:6px 0 0;padding:0;list-style:none;display:flex;flex-wrap:wrap;gap:4px 16px}#rer-dev-badge li{margin:0}#rer-dev-badge a{display:inline-block;min-height:24px;color:#bfdbfe;text-decoration:underline}#rer-dev-badge a[aria-current]{color:#fff;font-weight:700}#rer-dev-badge a:focus-visible,#rer-dev-badge summary:focus-visible{outline:2px solid #fff;outline-offset:2px}';
+const STYLE = 'body:has(>#rer-dev-badge){grid-template-rows:auto 1fr}#rer-dev-badge{grid-column:1/-1;justify-self:stretch;align-self:start;position:relative;z-index:2147483647;box-sizing:border-box;width:100%;margin:0 0 12px;padding:6px 12px;border-radius:8px;background:#111827;color:#f9fafb;font:13px/1.5 system-ui,sans-serif;text-align:left}#rer-dev-badge summary{min-width:24px;min-height:24px;cursor:pointer;overflow-wrap:anywhere}#rer-dev-badge ul{margin:6px 0 0;padding:0;list-style:none;display:flex;flex-wrap:wrap;gap:4px 16px}#rer-dev-badge li{margin:0}#rer-dev-badge a{display:inline-block;min-width:24px;min-height:24px;color:#bfdbfe;text-decoration:underline}#rer-dev-badge a[aria-current]{color:#fff;font-weight:700}#rer-dev-badge a:focus-visible,#rer-dev-badge summary:focus-visible{outline:2px solid #fff;outline-offset:2px}';
 let styleHash;
 async function sha256(text) {
   const bytes = await crypto.subtle.digest('SHA-256', new TextEncoder().encode(text));
@@ -39,6 +39,9 @@ function allow(policy, directive, source) {
 
 /** Adds the fragment key exchange (root only) and the badge to an HTML document. */
 export async function decorate(response, { exchange, badge }) {
+  // The Lobby is deliberately script-free. RER_OPEN uses /__dev/key, whose
+  // dedicated document exchanges the fragment under its own exact-hash CSP.
+  if (response.headers.get('x-rer-document') === 'lobby') exchange = false;
   if ((!exchange && !badge) || !response.headers.get('content-type')?.toLowerCase().startsWith('text/html') || !response.body) return response;
   let bar = '', scripts = '';
   const headers = new Headers(response.headers);

package/modules/operator-auth/dev/index.mjs

@@ -50,7 +50,7 @@ export function withDevIdentity(worker, { bindings = env => env, config: authCon
         if (!gate || env.RER_DEV_IDENTITY === 'off' || !await gate.admits(request)) return devNotFound();
         const context = identity(env, authConfig, declared);
         try {
-          return path === '/__dev/personas' ? Response.json(context.list(), { headers }) : await enter(request, gate, context);
+          return path === '/__dev/personas' ? Response.json(await context.list(), { headers }) : await enter(request, gate, context);
         } catch (error) {
           if (error instanceof AuthError) return Response.json({ error: error.code }, { status: error.status, headers });
           throw error;
@@ -68,7 +68,16 @@ export function withDevIdentity(worker, { bindings = env => env, config: authCon
 function identity(env, authConfig, declared) {
   const config = configure(authConfig(env)), store = new AuthStore(env.DB);
   const hash = token => hashToken(config.SESSION_SECRET, 'session', token);
-  const everyone = () => [{ as: 'owner', email: config.OWNER_EMAIL }, ...declared];
+  // The `owner` persona is the owner rer setup claimed while that owner is
+  // active; after that owner has left, the earliest-created active owner; with
+  // no active owner left, nobody (email null), so rer names who it signs in as.
+  const owner = async () => {
+    const setup = await store.byEmail(config.OWNER_EMAIL);
+    if (setup?.role === 'owner' && isActiveOperator(setup, config.allowList)) return setup.email;
+    const rows = (await store.statement(`SELECT email FROM oa_operators WHERE role='owner' AND status='active' ORDER BY created_at, id`).all()).results;
+    return rows.find(row => isActiveOperator({ ...row, status: 'active' }, config.allowList))?.email ?? (setup ? null : config.OWNER_EMAIL);
+  };
+  const everyone = async () => [{ as: 'owner', email: await owner() }, ...declared];
   async function current(request) {
     const token = readCookie(request, config);
     if (!token) return null;
@@ -85,8 +94,8 @@ function identity(env, authConfig, declared) {
       if (!defaultRolePolicy({ actor: actor.operator, action: 'operators:invite', role: 'owner' })) throw new AuthError('forbidden', 403);
       return { ...actor, hash: await hash(readCookie(request, config)) };
     },
-    list: () => [...everyone().map(({ as, email, role }) => ({ as, email, ...(role ? { role } : {}) })), { as: 'signed-out' }],
-    async badge(request) { return { session: await current(request), choices: everyone() }; },
+    list: async () => [...(await everyone()).map(({ as, email, role }) => ({ as, email, ...(role ? { role } : {}) })), { as: 'signed-out' }],
+    async badge(request) { return { session: await current(request), choices: (await everyone()).filter(persona => persona.email) }; },
   };
 }
 
@@ -104,8 +113,9 @@ async function enter(request, gate, { config, store, hash, current, everyone, ow
     reply.set('location', '/');
     return new Response(null, { status: 303, headers: reply });
   }
-  const persona = everyone().find(p => p.as === as);
+  const persona = (await everyone()).find(p => p.as === as);
   if (!persona) return devNotFound();
+  if (!persona.email) return text(409, 'No active owner remains in this app. Sign in another way, or run rer reset --yes and rer setup for a new owner.');
   let operator = await store.byEmail(persona.email);
   // Personas are real operators, created only here, in local dev.
   if (!operator && persona.role) {

package/modules/operator-auth/http.mjs

@@ -1,8 +1,7 @@
 import { deny } from './errors.mjs';
 import { validToken } from './crypto.mjs';
-export function isLoopbackHost(hostname) {
-  return hostname === 'localhost' || hostname === '127.0.0.1' || hostname === '[::1]';
-}
+import { isLoopbackHost } from './loopback.mjs';
+export { isLoopbackHost };
 // Browsers keep cookies per host, not per port, so checkouts side by side on
 // one loopback host would overwrite each other's cookies. A local cookie name
 // therefore carries its origin's port; hosted names never change. Seeds on

package/modules/operator-auth/index.d.mts

@@ -149,6 +149,8 @@ export interface OperatorAuth<R extends string = Role> {
   checkCredentialFence(credential:{personId:string;fence?:number;kind?:SessionKind},request?:Request):Promise<boolean>;
   /** Frozen public branding only; contains no credentials or auth configuration. */
   readonly presentation: AuthPresentation;
+  /** Whether this composition has a sender for email sign-in. */
+  readonly emailSignInAvailable: boolean;
   /** Linked identity providers; null when none is configured. */
   readonly providers: IdentityProviders | null;
   readonly admission: Admission<R>;
@@ -191,15 +193,8 @@ export type { NativeProofPersistence } from './identity/email-link/index.mjs';
 export function createOperatorAuth<R extends string>(options: import('./accounts/native.mjs').NativeAuthOptions<R>): import('./accounts/native.mjs').NativeOperatorAuth<R>;
 export function createOperatorAuth(options: AuthOptions): OperatorAuth;
 export function createAuthHandler<R extends string>(auth: OperatorAuth<R>): (request: Request) => Promise<Response | null>;
-export interface SignInPageOptions {
-  /** While the first owner is unclaimed: the setup form and its instructions. */
-  setup?: (request: Request) => null | false | undefined | { instructions?: string } | Promise<null | false | undefined | { instructions?: string }>;
-  /** Extra same-origin links under the form (for example the local development outbox). */
-  links?: (request: Request) => Array<{ href: string; label: string }> | Promise<Array<{ href: string; label: string }>>;
-  defaultReturnTo?: string;
-}
-/** The shared server-rendered sign-in page at branding.signInPath (GET and HEAD); null for anything else. */
-export function createSignInHandler<R extends string>(auth: OperatorAuth<R>, options?: SignInPageOptions): (request: Request) => Promise<Response | null>;
+export { createSignInHandler } from './signin/index.mjs';
+export type { SignInPageOptions } from './signin/index.mjs';
 export class AuthError extends Error { constructor(code: string, status?: number); code: string; status: number }
 export const DEFAULT_ROLES: readonly Role[];
 export function defaultRolePolicy(input: PolicyInput): boolean;

package/modules/operator-auth/loopback.mjs

@@ -0,0 +1,17 @@
+// The one loopback predicate every local-only check shares. A local origin's
+// host is one of the three loopback hosts or a name under `.localhost`, which
+// RFC 6761 reserves for loopback and browsers resolve to it themselves: the
+// front door serves each checkout at `http://<name>.localhost:<port>`. Hosted
+// origins never pass through this predicate; they must be https.
+const label = '[a-z0-9](?:[a-z0-9-]{0,61}[a-z0-9])?';
+const localhostName = new RegExp(`^(?:${label}\\.)+localhost$`);
+
+/** A name under `.localhost` (lowercase, no trailing dot), such as `cradle.localhost`. */
+export function isLocalhostName(hostname) {
+  return typeof hostname === 'string' && hostname.length <= 253 && localhostName.test(hostname);
+}
+
+/** `localhost`, `127.0.0.1`, `[::1]` (as URL.hostname spells it) or a `*.localhost` name. */
+export function isLoopbackHost(hostname) {
+  return hostname === 'localhost' || hostname === '127.0.0.1' || hostname === '[::1]' || isLocalhostName(hostname);
+}

package/modules/operator-auth/page.mjs

@@ -16,7 +16,7 @@ function stylesheet(accentColor) {
 }
 
 // Form controls and notices used by the sign-in page; part of the same hashed sheet.
-const FORMS = `label{display:block;font-weight:600;margin:0 0 8px}input{display:block;width:100%;margin:0 0 16px;padding:12px 14px;border:1px solid #64748b;border-radius:10px;font:inherit;line-height:1.5;color:inherit;background:transparent}input:focus-visible{outline:3px solid #172033;outline-offset:2px}.stack{display:grid;gap:12px;margin:0 0 24px}button.secondary{background:transparent;color:inherit}.divider{display:flex;align-items:center;gap:12px;margin:0 0 24px;color:#475569;font-size:14px}.divider::before,.divider::after{content:"";flex:1;border-top:1px solid #dce2ea}.notice{border-left:4px solid #64748b;padding:8px 12px;margin:0 0 24px}h2{font-size:20px;line-height:1.4;margin:32px 0 16px}.secondary-link{margin:16px 0 0;text-align:center;font-size:15px}.secondary-link a{color:#334155;font-weight:600;text-decoration:underline;text-decoration-thickness:1px;text-underline-offset:3px}.secondary-link a:hover{text-decoration-thickness:2px}.secondary-link a:focus-visible{outline:3px solid #172033;outline-offset:2px;border-radius:2px}@media(prefers-color-scheme:dark){input:focus-visible,.secondary-link a:focus-visible{outline-color:#f8fafc}.divider{color:#cbd5e1}.divider::before,.divider::after{border-color:#475569}.secondary-link a{color:#cbd5e1}}`;
+const FORMS = `label{display:block;font-weight:600;margin:0 0 8px}input{display:block;width:100%;margin:0 0 16px;padding:12px 14px;border:1px solid #64748b;border-radius:10px;font:inherit;line-height:1.5;color:inherit;background:transparent}input:focus-visible{outline:3px solid #172033;outline-offset:2px}.stack{display:grid;gap:12px;margin:0 0 24px}button.secondary{background:transparent;color:inherit}.divider{display:flex;align-items:center;gap:12px;margin:0 0 24px;color:#475569;font-size:14px}.divider::before,.divider::after{content:"";flex:1;border-top:1px solid #dce2ea}.notice{border-left:4px solid #64748b;padding:8px 12px;margin:0 0 24px}h2{font-size:20px;line-height:1.4;margin:32px 0 16px}.secondary-link{margin:16px 0 0;text-align:center;font-size:15px}.secondary-link a{display:inline-block;min-width:24px;min-height:24px;color:#334155;font-weight:600;text-decoration:underline;text-decoration-thickness:1px;text-underline-offset:3px}.secondary-link a:hover{text-decoration-thickness:2px}.secondary-link a:focus-visible{outline:3px solid #172033;outline-offset:2px;border-radius:2px}@media(prefers-color-scheme:dark){input:focus-visible,.secondary-link a:focus-visible{outline-color:#f8fafc}.divider{color:#cbd5e1}.divider::before,.divider::after{border-color:#475569}.secondary-link a{color:#cbd5e1}}`;
 
 export async function pageResponse({ branding, title, heading, content, status = 200, method = 'GET', referrer, formTargets = [] }) {
   const css = stylesheet(branding.accentColor) + FORMS + (branding.theme ? themed(branding.accentColor) : '');

package/modules/operator-auth/service.mjs

@@ -75,6 +75,7 @@ export function createOperatorAuth(options) {
     ...providerControl({ store, accounts, authenticate, config, clock }),
     ...fencedCredentials({store,authenticate,requireFreshProof,config,clock,hash}),
     presentation: config.branding,
+    emailSignInAvailable: Boolean(mailSender),
     /** Identity providers (null when none is configured): routes, the sign-in page's list and owner actions. */
     providers,
     /** The admission identity methods use: a verified principal in, a session out. */

package/modules/operator-auth/signin/index.d.mts

@@ -0,0 +1,11 @@
+import type { OperatorAuth } from '../index.mjs';
+
+export interface SignInPageOptions {
+  /** While the first owner is unclaimed: the setup form and its instructions. */
+  setup?: (request: Request) => null | false | undefined | { instructions?: string } | Promise<null | false | undefined | { instructions?: string }>;
+  /** Extra same-origin links under the form (for example the local development outbox). */
+  links?: (request: Request) => Array<{ href: string; label: string }> | Promise<Array<{ href: string; label: string }>>;
+  defaultReturnTo?: string;
+}
+/** The shared server-rendered sign-in page at branding.signInPath (GET and HEAD); null for anything else. */
+export function createSignInHandler<R extends string>(auth: OperatorAuth<R>, options?: SignInPageOptions): (request: Request) => Promise<Response | null>;

package/modules/operator-auth/signin/index.mjs

@@ -1,6 +1,6 @@
 // The one sign-in page every Base seed mounts. Server-rendered plain HTML forms:
 // it works before any script loads (and without one). It lists "Continue
-// with…" for each linked, reachable provider and always offers the email link;
+// with…" for each linked, reachable provider and offers a configured email link;
 // a hidden provider's button is simply absent.
 import { escapeHtml } from '../http.mjs';
 import { safeReturnTo } from '../policy.mjs';
@@ -21,11 +21,12 @@ const NOTICES = {
 };
 const UNAVAILABLE = ['alert', 'That sign-in provider is not available right now. Use the email link instead.'];
 const UNFINISHED = ['alert', 'Signing in with that provider did not finish. Try again, or use the email link.'];
-function noticeFor(code) {
+function noticeFor(code, emailAvailable) {
   if (typeof code !== 'string') return null;
+  if (code === 'oidc_admission_denied' && !emailAvailable) return ['alert', 'That account cannot sign in here. Ask an owner of this app for an invitation.'];
   if (Object.hasOwn(NOTICES, code)) return NOTICES[code];
-  if (['oidc_provider_unavailable', 'oidc_relink_required', 'oidc_provider_unlinked', 'oidc_unavailable', 'oidc_provider_version_unsupported'].includes(code)) return UNAVAILABLE;
-  return code.startsWith('oidc_') ? UNFINISHED : null;
+  if (['oidc_provider_unavailable', 'oidc_relink_required', 'oidc_provider_unlinked', 'oidc_unavailable', 'oidc_provider_version_unsupported'].includes(code)) return emailAvailable ? UNAVAILABLE : ['alert', 'That sign-in provider is not available right now. Try again later.'];
+  return code.startsWith('oidc_') ? (emailAvailable ? UNFINISHED : ['alert', 'Signing in with that provider did not finish. Try again.']) : null;
 }
 const hidden = returnTo => `<input type="hidden" name="returnTo" value="${escapeHtml(returnTo)}">`;
 
@@ -43,7 +44,9 @@ export function createSignInHandler(auth, { setup, links, defaultReturnTo = '/ap
     const returnTo = safeReturnTo(url.searchParams.get('returnTo'), defaultReturnTo);
     const providers = auth.providers ? (await auth.providers.list()).filter(p => p.visible) : [];
     const parts = [];
-    const notice = noticeFor(url.searchParams.get('notice'));
+    const emailAvailable = auth.emailSignInAvailable;
+    const notice = noticeFor(url.searchParams.get('notice'), emailAvailable)
+      ?? (!emailAvailable && !providers.length ? NOTICES.mail_unavailable : null);
     if (notice) {
       const required = providers.find(p => p.id === url.searchParams.get('provider'));
       const extra = required ? ` Addresses at this domain sign in with ${escapeHtml(required.label)}.` : '';
@@ -51,9 +54,9 @@ export function createSignInHandler(auth, { setup, links, defaultReturnTo = '/ap
     }
     if (providers.length) {
       parts.push(`<div class="stack">${providers.map(p => `<form method="post" action="${escapeHtml(p.startPath)}">${hidden(returnTo)}<button class="secondary" type="submit">Continue with ${escapeHtml(p.label)}</button></form>`).join('')}</div>`);
-      parts.push('<p class="divider">or</p>');
+      if (emailAvailable) parts.push('<p class="divider">or</p>');
     }
-    parts.push(`<form method="post" action="/auth/magic-link">${hidden(returnTo)}<label for="signin-email">Email</label><input id="signin-email" name="email" type="email" autocomplete="email" required maxlength="254"><button type="submit">Email a sign-in link</button></form>`);
+    if (emailAvailable) parts.push(`<form method="post" action="/auth/magic-link">${hidden(returnTo)}<label for="signin-email">Email</label><input id="signin-email" name="email" type="email" autocomplete="email" required maxlength="254"><button type="submit">Email a sign-in link</button></form>`);
     for (const link of (await links?.(request)) ?? []) {
       if (typeof link?.href === 'string' && /^\/(?!\/)[^\s\\]*$/.test(link.href) && typeof link.label === 'string') parts.push(`<p class="secondary-link"><a href="${escapeHtml(link.href)}">${escapeHtml(link.label)}</a></p>`);
     }

package/modules/owner-claim/verify.mjs

@@ -1,4 +1,5 @@
 // Portable Web Crypto verifier. This file has no application or database imports.
+import { isLoopbackHost } from '../operator-auth/loopback.mjs';
 export class OwnerClaimError extends Error {
   constructor(code = 'invalid_claim', status = 403) { super(code); this.name = 'OwnerClaimError'; this.code = code; this.status = status; }
 }
@@ -10,7 +11,7 @@ function coordinate(value) {
   return btoa(atob(value.replaceAll('-', '+').replaceAll('_', '/'))).replaceAll('+', '-').replaceAll('/', '_').replace(/=+$/, '') === value;
 }
 function origin(value) {
-  try { const u = new URL(value); return u.origin === value && !u.username && !u.password && (u.protocol === 'https:' || (u.protocol === 'http:' && ['localhost', '127.0.0.1', '[::1]'].includes(u.hostname))); } catch { return false; }
+  try { const u = new URL(value); return u.origin === value && !u.username && !u.password && (u.protocol === 'https:' || (u.protocol === 'http:' && isLoopbackHost(u.hostname))); } catch { return false; }
 }
 export function configureClaim(input) {
   if (!input || !origin(input.issuer) || !origin(input.appOrigin)

package/modules/portability/README.md

@@ -217,6 +217,14 @@ and refuses rows matching its tombstones or any destination erasure fence.
 Product validation, foreign keys and normal restore safeguards still apply.
 Any mismatch refuses recovery; this mode does not repair damaged archives.
 
+Recovery needs a new installation. SQLite, migration and transfer bookkeeping, the
+storage tables of FTS5 indexes (`<index>_data|idx|content|docsize|config`; the index
+itself is still checked through its own SELECT) and the rows the destination's own
+migrations seed may exist; the seed rows are compared with a scratch replay of the
+applied migrations (Node runners) and must be unchanged. Any other row refuses with
+`legacy_target_not_empty`, before staging and again inside the restore batch. A table
+the policy lists in `replaceableTables` is replaced by the restore as usual.
+
 V1 cannot authenticate the complete manifest: source identity, export time,
 erasure epoch/journal, rowids and other metadata lack the v2 archive binding.
 Checksums are consistency checks, not proof of authorship. A missing or altered

package/modules/portability/hash.mjs

@@ -17,9 +17,13 @@ export function base64(bytes) {
   for (let i = 0; i < bytes.length; i += 8192) result += String.fromCharCode(...bytes.subarray(i, i + 8192));
   return btoa(result);
 }
+// Canonical base64 only: a plain character-class scan (no group repetition, so no regex stack) and
+// the padding rule by arithmetic, in time linear in the input however large an original is.
 export function unbase64(value) {
-  if (typeof value !== 'string' || !/^(?:[A-Za-z0-9+/]{4})*(?:[A-Za-z0-9+/]{2}==|[A-Za-z0-9+/]{3}=)?$/.test(value)) throw new Error('invalid_base64');
-  return Uint8Array.from(atob(value), c => c.charCodeAt(0));
+  if (typeof value !== 'string' || value.length % 4 !== 0 || !/^[A-Za-z0-9+/]*={0,2}$/.test(value)) throw new Error('invalid_base64');
+  const text = atob(value), bytes = new Uint8Array(text.length);
+  for (let i = 0; i < text.length; i++) bytes[i] = text.charCodeAt(i);
+  return bytes;
 }
 
 // Incremental SHA-256 for semantic JSON and objects. SubtleCrypto has no streaming

package/modules/portability/import.mjs

@@ -134,7 +134,7 @@ export async function finalizeImport(context,id,{contentHash,archiveHash,laterJo
   const digest=verifier.digest();if(contentHash!==undefined)insist(contentHash===digest,'content_checksum');
   insist(archiveHash===archive.digest(),'archive_checksum',409);
   const checked=await fence(db,manifest,row.metadata.copies,laterJournal);
-  if(row.metadata.legacyRecovery)await requireLegacyEmpty(context,row.metadata.legacyRecovery.emptyTables);
+  if(row.metadata.legacyRecovery)await requireLegacyEmpty(context,row.metadata.legacyRecovery);
   for(const table of row.metadata.targets) if(!config.replaceableTables.includes(table.name))insist(!(await statement(db,`SELECT 1 FROM ${quote(table.name)} LIMIT 1`).first()),'target_not_empty:'+table.name,409);
   const dependentGuards=await excludedDependentGuards(db,row.metadata.targets,config.replaceableTables);
   await bucketsEmpty(context,row);

package/modules/portability/legacy-files.mjs

@@ -4,7 +4,7 @@ import { createPortability } from './index.mjs';
 import { createImport, uploadPart, finalizeImport, abortImport } from './import.mjs';
 import { readLegacyArchive, ArchiveVerifier } from './format.mjs';
 import { fileRecords, exportArchive } from './files.mjs';
-import { ensureLegacyAudit, legacyEmptyTables, requireLegacyEmpty } from './legacy-safety.mjs';
+import { ensureLegacyAudit, legacyTargetState, requireLegacyEmpty } from './legacy-safety.mjs';
 import { insist, PortabilityError } from './storage.mjs';
 
 export async function recoverLegacyArchive({db,buckets,policy:input,migrations},path,output,transient,acknowledged) {
@@ -13,8 +13,8 @@ export async function recoverLegacyArchive({db,buckets,policy:input,migrations},
  insist(!(await lstat(output).catch(error=>{if(error.code==='ENOENT')return null;throw error;})),'legacy_output_exists',409);
  // Whole-file verification precedes even staging/audit schema writes.
  for await(const record of fileRecords(path,readLegacyArchive)){}
- const context={db,buckets,config:policy(input),migrations},emptyTables=await legacyEmptyTables(db);
- await requireLegacyEmpty(context,emptyTables);
+ const context={db,buckets,config:policy(input),migrations},target=await legacyTargetState(db,migrations);
+ await requireLegacyEmpty(context,target);
  let id,manifest,closing,integrity,status,complete=false;
  try {
   for await(const record of fileRecords(path,readLegacyArchive)) {
@@ -25,7 +25,7 @@ export async function recoverLegacyArchive({db,buckets,policy:input,migrations},
     id=await createImport(context,manifest,'legacy-v1',{
      event:'legacy_v1_unverified_restore',acknowledgedUnverifiedMetadata:true,
      sourceIdentity:record.sourceIdentity,exportedAt:record.exportedAt,
-     recoveryOutput:output,emptyTables,
+     recoveryOutput:output,...target,
     });
     // A refused schema writes nothing, not even the audit table.
     await ensureLegacyAudit(db);

package/modules/portability/legacy-safety.mjs

@@ -2,18 +2,59 @@ import { all, statement, guard, quote, insist } from './storage.mjs';
 import { canonicalJson } from './hash.mjs';
 
 // Recovery requires a new installation, including excluded identity tables and
-// normally replaceable product rows. Only SQLite/migration/transfer bookkeeping
-// may already exist. Do not use the product's export exclusions for this check.
-export async function legacyEmptyTables(db) {
- const tables=await all(db,"SELECT name FROM sqlite_master WHERE type='table' AND sql IS NOT NULL ORDER BY name");
- return tables.map(t=>t.name).filter(name=>!(/^(sqlite_|_cf_|rer_portability_)/i.test(name) || ['d1_migrations','_rer_deploy_migrations','_rer_portability_migrations'].includes(name.toLowerCase())));
+// normally replaceable product rows. Only SQLite/migration/transfer bookkeeping,
+// the storage of FTS5 indexes and rows the destination's own migrations seed may
+// already exist. Do not use the product's export exclusions for this check.
+const bookkeeping=name=>/^(sqlite_|_cf_|rer_portability_)/i.test(name) || ['d1_migrations','_rer_deploy_migrations','_rer_portability_migrations'].includes(name.toLowerCase());
+const fts5=/^\s*CREATE\s+VIRTUAL\s+TABLE\s+(?:IF\s+NOT\s+EXISTS\s+)?(?:"((?:[^"]|"")+)"|`([^`]+)`|\[([^\]]+)\]|'((?:[^']|'')+)'|([A-Za-z0-9_$]+))\s+USING\s+fts5\b/i;
+const unquoted=m=>m[1]!==undefined?m[1].replaceAll('""','"'):m[4]!==undefined?m[4].replaceAll("''","'"):m[2]??m[3]??m[5];
+// An FTS5 index keeps its data in <name>_data|idx|content|docsize|config. The index itself stays
+// listed and is checked through its own SELECT, so a real indexed row still refuses.
+function shadowTables(tables) {
+ const shadows=new Set();
+ for(const table of tables) {
+  const match=fts5.exec(table.sql);
+  if(match)for(const suffix of ['data','idx','content','docsize','config'])shadows.add(unquoted(match).toLowerCase()+'_'+suffix);
+ }
+ return shadows;
 }
-export async function requireLegacyEmpty({db,buckets},tables) {
- for(const table of tables)insist(!(await statement(db,`SELECT 1 FROM ${quote(table)} LIMIT 1`).first()),'legacy_target_not_empty:'+table,409);
+const imageSql=(table,columns)=>`SELECT json_array(${columns.map(c=>`quote(${quote(c)})`).join(',')}) AS image FROM ${quote(table)}`;
+const MAX_SEED_ROWS=10000;
+
+/** What the destination must still hold when the restore commits: `emptyTables` stay empty and
+ * each of `seededTables` keeps exactly the rows its migrations put there. A table with rows the
+ * replay of the destination's applied migrations (migrations(), a node runner's scratch database)
+ * does not produce is listed as to-be-empty, so the preflight refuses it. */
+export async function legacyTargetState(db,migrations) {
+ const tables=await all(db,"SELECT name,sql FROM sqlite_master WHERE type='table' AND sql IS NOT NULL ORDER BY name"),shadows=shadowTables(tables);
+ const names=tables.map(t=>t.name).filter(name=>!bookkeeping(name) && !shadows.has(name.toLowerCase()));
+ const filled=[];
+ for(const name of names)if(await statement(db,`SELECT 1 FROM ${quote(name)} LIMIT 1`).first())filled.push(name);
+ const seeded=[];
+ if(filled.length && migrations) {
+  const requests=[];
+  for(const name of filled)requests.push({name,columns:(await all(db,`SELECT name FROM pragma_table_info(?)`,name)).map(c=>c.name)});
+  // Without a usable replay no seed is vouched for, so those rows count as the installation's own.
+  const expected=await migrations().then(replay=>replay.rowImages(requests,MAX_SEED_ROWS),()=>new Map());
+  for(const {name,columns} of requests) {
+   const want=expected.get(name);
+   if(!want || (await statement(db,`SELECT count(*) AS n FROM ${quote(name)}`).first()).n!==want.length)continue;
+   const found=(await all(db,imageSql(name,columns))).map(r=>r.image).sort();
+   if(canonicalJson(found)===canonicalJson(want))seeded.push({name,columns,images:found});
+  }
+ }
+ return {emptyTables:names.filter(name=>!seeded.some(s=>s.name===name)),seededTables:seeded};
+}
+const seededCondition=(db,table)=>[`(SELECT count(*) FROM ${quote(table.name)})=? AND NOT EXISTS(SELECT 1 FROM (${imageSql(table.name,table.columns)}) WHERE image NOT IN (SELECT value FROM json_each(?)))`,table.images.length,JSON.stringify(table.images)];
+export async function requireLegacyEmpty({db,buckets},{emptyTables,seededTables=[]}) {
+ for(const table of emptyTables)insist(!(await statement(db,`SELECT 1 FROM ${quote(table)} LIMIT 1`).first()),'legacy_target_not_empty:'+table,409);
+ for(const table of seededTables){const [condition,...values]=seededCondition(db,table);insist((await statement(db,`SELECT CASE WHEN (${condition}) THEN 1 ELSE 0 END AS ok`,...values).first()).ok===1,'legacy_target_not_empty:'+table.name,409);}
  for(const [name,bucket] of Object.entries(buckets))insist(!(await bucket.list({limit:1})).objects.length,'legacy_bucket_not_empty:'+name,409);
 }
 export function legacyEmptyGuards(db,row) {
- return (row.metadata.legacyRecovery?.emptyTables??[]).map(table=>guard(db,`NOT EXISTS(SELECT 1 FROM ${quote(table)})`));
+ const recovery=row.metadata.legacyRecovery;
+ return [...(recovery?.emptyTables??[]).map(table=>guard(db,`NOT EXISTS(SELECT 1 FROM ${quote(table)})`)),
+  ...(recovery?.seededTables??[]).map(table=>{const [condition,...values]=seededCondition(db,table);return guard(db,condition,...values);})];
 }
 export async function ensureLegacyAudit(db) {
  // Additive sidecar, installed only by recovery; existing product migrations
@@ -22,6 +63,6 @@ export async function ensureLegacyAudit(db) {
 }
 export function legacyAuditStatements(db,row) {
  if(!row.metadata.legacyRecovery)return [];
- const {emptyTables,...details}=row.metadata.legacyRecovery;
- return [statement(db,'INSERT INTO rer_portability_recovery_audit VALUES(?,?,?)',row.id,new Date().toISOString(),canonicalJson({...details,contentHash:row.metadata.contentHash,...(row.metadata.bridge?{bridged:row.metadata.bridge}:{})}))];
+ const {emptyTables,seededTables=[],...details}=row.metadata.legacyRecovery;
+ return [statement(db,'INSERT INTO rer_portability_recovery_audit VALUES(?,?,?)',row.id,new Date().toISOString(),canonicalJson({...details,...(seededTables.length?{seededTables:seededTables.map(t=>t.name)}:{}),contentHash:row.metadata.contentHash,...(row.metadata.bridge?{bridged:row.metadata.bridge}:{})}))];
 }

package/modules/portability/migration-history.mjs

@@ -14,5 +14,20 @@ export function migrationReplay(plan,input) {
       for(const migration of plan.filter(m=>names.includes(m.name)))for(const sql of migration.statements)scratch.exec(sql);
       return await schemaIdentity(db,config);
     }finally{scratch.close();}
+  },
+  // The rows the whole replay leaves in each requested table, as sorted images (legacy-safety.mjs).
+  // A table the replay lacks, or one holding more than `limit` rows, has no entry.
+  async rowImages(requests,limit) {
+    const scratch=new DatabaseSync(':memory:'),found=new Map();
+    try {
+      for(const migration of plan)for(const sql of migration.statements)scratch.exec(sql);
+      for(const {name,columns} of requests) {
+        try {
+          const rows=scratch.prepare(`SELECT json_array(${columns.map(c=>`quote("${c.replaceAll('"','""')}")`).join(',')}) AS image FROM "${name.replaceAll('"','""')}" LIMIT ?`).all(limit+1).map(r=>r.image);
+          if(rows.length<=limit)found.set(name,rows.sort());
+        }catch{}
+      }
+      return found;
+    }finally{scratch.close();}
   }};
 }

package/modules/release/README.md

@@ -55,9 +55,11 @@ default verification succeeds. Keep capacity, maximum-size memory and load cases
 in that release-only script. Both dry runs and releases require it to pass;
 `gates.verify.release` records its result. Routine CI and default verification
 do not invoke it.
-Child logs are suppressed to avoid credential disclosure; the receipt retains
-exit status and numeric final summaries from Node's spec/TAP reporters and
-Playwright's text reporters. Counts add across suites: `tests`, `passed`,
+A passing step's receipt retains exit status and numeric final summaries from
+Node's spec/TAP reporters and Playwright's text reporters. A failing install,
+`verify` or `verify:release` step also keeps `output`: the last 40 lines (at most
+8 KB) of that child's output, after the command store's credential redaction.
+The output stays in the receipt and is left out of the site preview. Counts add across suites: `tests`, `passed`,
 `failed`, `skipped` and `flaky`; nonzero `cancelled`, `todo`, `interrupted` and
 `notRun` counts are retained when reported. Playwright's total includes each
 outcome once, with flaky tests counted separately from passed tests. Node's
@@ -210,3 +212,66 @@ tag in the private repository.
 Generated source commits and annotated tags identify Run Edit Run with the
 non-contact address `releases@runeditrun.invalid`. Provenance remains bound to
 the source commit and tree; the Git author address is not a delivery destination.
+
+## Signing and checking release receipts
+
+`rer release keygen` creates a publisher key and its proof-of-possession anchor
+entry; `rer release sign` signs a completed tagged release; and
+`rer release receipt` verifies that detached signature against a local anchor
+set. Use `--scope test` for development. The owner's production `rer` key is a
+later vault operation and is not generated during this work; the owner will
+create it directly in the vault.
+
+Key generation accepts `--scope test|rer --publisher NAMESPACE
+--github-owner LOGIN --github-owner-id ID --anchor-out FILE`, with optional
+`--not-before YYYY-MM-DDTHH:MM:SSZ`, `--not-after YYYY-MM-DDTHH:MM:SSZ` and
+repeatable `--unsigned-through PROJECT:VERSION`. `--anchor-out` receives one
+public anchor entry with its enrolment proof and pending review status; it is
+not a complete anchor set. On success the PKCS#8 private key goes to stdout
+only when stdout is not a terminal. Pipe it directly to the owner's vault;
+never send private key bytes to a terminal, repository, log or evidence. The
+signer accepts `--artifact DIR` and exactly one of `--key-file FILE` or
+`--key-stdin`, with `--scope test|rer` (default `rer`). Read production
+signing material from the vault through `--key-stdin`; `sign` never echoes it.
+`--key-stdin` refuses terminal input; pipe the key from a vault or file instead.
+
+Signing requires `release-receipt.json` to record a completed `RELEASED`
+tagged release with a created public tag. It writes the detached DSSE envelope
+as `rer-release.dsse.json` beside the receipt. The statement binds the public
+repository, tag, commit, tree and tag object, and hashes `public-source.tar`,
+`release-receipt.json`, `publish-check.json`, the bundle's single
+`site/<id>/<version>/release.json`, and every document under that bundle's
+`documents/` directory. The envelope is an artifact file; signing does not
+change the existing release or registry pins.
+
+After writing the signature, `sign` prints (but never runs) a shell-quoted
+`gh release upload` command for attaching `rer-release.dsse.json` to the
+already-created GitHub release. The emitted command has this form:
+
+```sh
+gh release upload 'TAG' '/absolute/path/rer-release.dsse.json' --repo 'OWNER/REPOSITORY'
+```
+
+Review and run the actual printed command to upload the asset. `sign` itself
+performs no upload.
+
+Receipt verification accepts `--artifact DIR --anchors FILE`, optional
+`--environment test`, and optional `--after VERSION:SHA256`; the environment
+defaults to `production`. It checks the artifact and detached signature using
+the same offline verifier used by signing. Exit 0 prints
+`{"verdict":"VERIFIED"}`; exit 1 prints a refusal code as
+`{"verdict":"REFUSED","code":"..."}`; invalid arguments exit 2. A
+Base receipt check always requires a signature and refuses a missing envelope
+with `SIGNATURE_MISSING`, even where site or service consumers accept a legacy
+unsigned listing.
+
+The dependency-free verifier source is `modules/release/signature.mjs`; it has
+no `node:` imports and is exported as
+`@runeditrun/rer/modules/release/signature`. Its default-seed portable copy is
+generated byte-for-byte at
+`default-seed/scripts/base-cli/modules/release/signature.mjs`. Shared public
+test vectors live in `modules/release/vectors/release-signature-vectors.json`
+and are generated byte-for-byte at
+`default-seed/scripts/base-cli/modules/release/vectors/release-signature-vectors.json`.
+The vectors use the existing public Octocat example repository context with synthetic bundle bytes and throwaway test keys; they do not represent an actual release.
+Consumers vendor and pin the verifier source by Base commit and SHA-256.

package/modules/release/keygen.mjs

@@ -0,0 +1,18 @@
+import { generateKeyPairSync } from 'node:crypto';
+import { loadAnchors } from './signature.mjs';
+import { publicEntry, anchorSet, validity } from './signing-key.mjs';
+import { writeNew } from './signing-io.mjs';
+
+export async function keygen(options) {
+  if (process.stdout.isTTY) throw new TypeError('ARGUMENT_INVALID');
+  const { privateKey } = generateKeyPairSync('ed25519');
+  const dates = validity(options['not-before'] ? new Date(options['not-before']) : new Date());
+  const entry = await publicEntry(privateKey, { scope: options.scope, publisher: options.publisher,
+    githubOwner: { login: options['github-owner'], id: Number(options['github-owner-id']) },
+    notBefore: options['not-before'] ?? dates.notBefore, notAfter: options['not-after'] ?? dates.notAfter,
+    unsignedThrough: options.unsignedThrough });
+  const anchors = anchorSet(entry, options.scope);
+  await loadAnchors(anchors, anchors.environment);
+  writeNew(options['anchor-out'], JSON.stringify(entry, null, 2) + '\n');
+  process.stdout.write(privateKey.export({ type: 'pkcs8', format: 'pem' }));
+}