@runeditrun/rer 0.2.0 → 0.2.1

package/modules/deploy-kit/provider.mjs

@@ -1,11 +1,29 @@
+import { recordDeployFailure } from './diagnostics.mjs';
 import { assert, hexId } from './validation.mjs';
 
-export async function boundedJSON(response, limit = 4 * 1024 * 1024) {
+async function boundedText(response, limit = 4 * 1024 * 1024, onReadError) {
   assert(response.body, 'empty-response');
   const reader = response.body.getReader(); const chunks = []; let length = 0;
-  try { while (true) { const { done, value } = await reader.read(); if (done) break; length += value.length; assert(length <= limit, 'response-too-large'); chunks.push(value); } }
+  try { while (true) {
+    let chunk;
+    // Only a failed stream read is transport failure; retain size/shape codes.
+    try { chunk = await reader.read(); } catch (cause) { throw onReadError ? onReadError(cause) : cause; }
+    const { done, value } = chunk; if (done) break;
+    length += value.length; assert(length <= limit, 'response-too-large'); chunks.push(value);
+  } }
   finally { await reader.cancel().catch(() => {}); }
-  try { return JSON.parse(Buffer.concat(chunks).toString('utf8')); } catch { throw new Error('malformed-response'); }
+  return Buffer.concat(chunks).toString('utf8');
+}
+export async function boundedJSON(response, limit) {
+  try { return JSON.parse(await boundedText(response,limit)); } catch (error) { if (error instanceof SyntaxError) throw new Error('malformed-response'); throw error; }
+}
+function transportOutput(error) {
+  const lines = []; const seen = new Set();
+  for (let cause = error; cause && !seen.has(cause) && seen.size < 4; cause = cause.cause) {
+    seen.add(cause);
+    lines.push([typeof cause.code === 'string' ? cause.code : '', typeof cause.message === 'string' ? cause.message : ''].filter(Boolean).join(': '));
+  }
+  return lines.filter(Boolean).join('\n');
 }
 /** Only this fixed origin and the explicitly selected account ever receive the token. */
 export function cloudflare({ accountId, token, fetch: request = globalThis.fetch, timeoutMs = 30000, maxRequests = 500 }) {
@@ -18,15 +36,36 @@ export function cloudflare({ accountId, token, fetch: request = globalThis.fetch
     assert(!zone || /^\/zones(?:[/?]|$)/.test(path), 'invalid-provider-path');
     assert(++requests <= maxRequests, 'provider-request-budget');
     assert(!assetToken || path === '/workers/assets/upload?base64=true', 'invalid-asset-auth-target');
+    // Asset-session credentials are discovered at runtime, outside the CLI env.
+    // Preserve complete text for the CLI's remaining redaction before truncation.
+    const redactAuth = text => [accountId,token,assetToken].filter(Boolean).flatMap(value=>[value,encodeURIComponent(value),JSON.stringify(value).slice(1,-1)]).sort((a,b)=>b.length-a.length).reduce((value,secret)=>value.split(secret).join('[REDACTED]'),text);
+    const transportFailure = cause => recordDeployFailure(new Error('provider-transport-failed'),{output:redactAuth(transportOutput(cause))});
     const signal = AbortSignal.timeout(timeoutMs);
     let response;
     try { response = await request(zone ? `https://api.cloudflare.com/client/v4${path}` : `https://api.cloudflare.com/client/v4/accounts/${accountId}${path}`, {
       method, redirect: 'error', signal, headers: { Authorization: `Bearer ${assetToken ?? token}`, ...(body && !(body instanceof FormData) ? { 'Content-Type':'application/json' } : {}) },
       ...(body === undefined ? {} : { body: body instanceof FormData ? body : JSON.stringify(body) }),
-    }); } catch { throw new Error('provider-transport-failed'); }
-    if (!response.ok) { const error = new Error(`provider-http-${response.status}`); error.status = response.status; await response.body?.cancel(); throw error; }
-    const payload = await boundedJSON(response);
+    }); } catch (cause) { throw transportFailure(cause); }
+    const output = response.body ? await boundedText(response,undefined,transportFailure) : '';
+    let payload;
+    try { payload = JSON.parse(output); } catch { if (response.ok) throw new Error('malformed-response'); }
+    if (!response.ok || payload?.success === false) {
+      const error = new Error(response.ok ? 'provider-unsuccessful-or-malformed' : `provider-http-${response.status}`);
+      error.status = response.status;
+      throw recordDeployFailure(error,{providerCodes:(Array.isArray(payload?.errors) ? payload.errors : []).filter(x => Number.isSafeInteger(x?.code)).map(x=>x.code).slice(0,8),
+        output:redactAuth(Array.isArray(payload?.errors) ? payload.errors.filter(x=>typeof x?.message==='string').map(x=>x.message).join('\n') : output)});
+    }
     assert(payload?.success === true && Object.hasOwn(payload,'result') && (!payload.errors || Array.isArray(payload.errors) && !payload.errors.length), 'provider-unsuccessful-or-malformed');
+    if (/^\/d1\/database\/[^/]+\/query$/.test(path) && Array.isArray(payload.result)) {
+      const failed = payload.result.filter(row => row?.success === false);
+      if (failed.length) {
+        // D1 can fail inside a successful HTTP/API envelope. Read only typed
+        // error fields; query results and metadata are never diagnostic output.
+        const errors = failed.flatMap(row => [typeof row.error === 'string' ? {message:row.error} : row.error, ...(Array.isArray(row.errors) ? row.errors : [])]);
+        throw recordDeployFailure(new Error('d1-query-failed'),{providerCodes:errors.filter(error=>Number.isSafeInteger(error?.code)).map(error=>error.code).slice(0,8),
+          output:redactAuth(errors.filter(error=>typeof error?.message==='string').map(error=>error.message).join('\n'))});
+      }
+    }
     return payload;
   }
   async function list(path, { field, pagination = 'page' } = {}) {

package/modules/operator-auth/accounts/native.mjs

@@ -111,7 +111,7 @@ export function createNativeAuth({ accounts, proofs, db, config, clock, hooks, m
     // explicit refusals, never apparently successful writes to an unused store.
     ...Object.fromEntries(['invite', 'listOperators', 'cancelInvitation', 'setOperatorStatus', 'setRole', 'listSessions', 'revokeSession',
       'listDomainRules', 'setDomainRule', 'unlinkProvider', 'relinkProvider', 'mintCredential', 'authenticateCredential'].map(k => [k, unavailable])),
-    native: true, presentation: config.branding, accounts, admission, providers,
+    native: true, presentation: config.branding, emailSignInAvailable: Boolean(mailSender), accounts, admission, providers,
     requestMagicLink: email.requestMagicLink, previewLink: email.previewLink, confirmLink: email.confirmLink,
     requestStepUp: email.requestStepUp, requireStepUp: email.requireStepUp,
     ...legacyAdmission({ admission, config, policyVersion }),

package/modules/operator-auth/dev/badge.mjs

@@ -5,7 +5,7 @@ import { escapeHtml } from '../http.mjs';
 // starts after it and nothing is ever covered. A grid body (the frames that
 // centre their card) gives the bar its own auto row and keeps the card centred
 // in the rest.
-const STYLE = 'body:has(>#rer-dev-badge){grid-template-rows:auto 1fr}#rer-dev-badge{grid-column:1/-1;justify-self:stretch;align-self:start;position:relative;z-index:2147483647;box-sizing:border-box;width:100%;margin:0 0 12px;padding:6px 12px;border-radius:8px;background:#111827;color:#f9fafb;font:13px/1.5 system-ui,sans-serif;text-align:left}#rer-dev-badge summary{cursor:pointer;overflow-wrap:anywhere}#rer-dev-badge ul{margin:6px 0 0;padding:0;list-style:none;display:flex;flex-wrap:wrap;gap:4px 16px}#rer-dev-badge li{margin:0}#rer-dev-badge a{display:inline-block;min-height:24px;color:#bfdbfe;text-decoration:underline}#rer-dev-badge a[aria-current]{color:#fff;font-weight:700}#rer-dev-badge a:focus-visible,#rer-dev-badge summary:focus-visible{outline:2px solid #fff;outline-offset:2px}';
+const STYLE = 'body:has(>#rer-dev-badge){grid-template-rows:auto 1fr}#rer-dev-badge{grid-column:1/-1;justify-self:stretch;align-self:start;position:relative;z-index:2147483647;box-sizing:border-box;width:100%;margin:0 0 12px;padding:6px 12px;border-radius:8px;background:#111827;color:#f9fafb;font:13px/1.5 system-ui,sans-serif;text-align:left}#rer-dev-badge summary{min-width:24px;min-height:24px;cursor:pointer;overflow-wrap:anywhere}#rer-dev-badge ul{margin:6px 0 0;padding:0;list-style:none;display:flex;flex-wrap:wrap;gap:4px 16px}#rer-dev-badge li{margin:0}#rer-dev-badge a{display:inline-block;min-width:24px;min-height:24px;color:#bfdbfe;text-decoration:underline}#rer-dev-badge a[aria-current]{color:#fff;font-weight:700}#rer-dev-badge a:focus-visible,#rer-dev-badge summary:focus-visible{outline:2px solid #fff;outline-offset:2px}';
 let styleHash;
 async function sha256(text) {
   const bytes = await crypto.subtle.digest('SHA-256', new TextEncoder().encode(text));
@@ -39,6 +39,9 @@ function allow(policy, directive, source) {
 
 /** Adds the fragment key exchange (root only) and the badge to an HTML document. */
 export async function decorate(response, { exchange, badge }) {
+  // The Lobby is deliberately script-free. RER_OPEN uses /__dev/key, whose
+  // dedicated document exchanges the fragment under its own exact-hash CSP.
+  if (response.headers.get('x-rer-document') === 'lobby') exchange = false;
   if ((!exchange && !badge) || !response.headers.get('content-type')?.toLowerCase().startsWith('text/html') || !response.body) return response;
   let bar = '', scripts = '';
   const headers = new Headers(response.headers);

package/modules/operator-auth/index.d.mts

@@ -149,6 +149,8 @@ export interface OperatorAuth<R extends string = Role> {
   checkCredentialFence(credential:{personId:string;fence?:number;kind?:SessionKind},request?:Request):Promise<boolean>;
   /** Frozen public branding only; contains no credentials or auth configuration. */
   readonly presentation: AuthPresentation;
+  /** Whether this composition has a sender for email sign-in. */
+  readonly emailSignInAvailable: boolean;
   /** Linked identity providers; null when none is configured. */
   readonly providers: IdentityProviders | null;
   readonly admission: Admission<R>;
@@ -191,15 +193,8 @@ export type { NativeProofPersistence } from './identity/email-link/index.mjs';
 export function createOperatorAuth<R extends string>(options: import('./accounts/native.mjs').NativeAuthOptions<R>): import('./accounts/native.mjs').NativeOperatorAuth<R>;
 export function createOperatorAuth(options: AuthOptions): OperatorAuth;
 export function createAuthHandler<R extends string>(auth: OperatorAuth<R>): (request: Request) => Promise<Response | null>;
-export interface SignInPageOptions {
-  /** While the first owner is unclaimed: the setup form and its instructions. */
-  setup?: (request: Request) => null | false | undefined | { instructions?: string } | Promise<null | false | undefined | { instructions?: string }>;
-  /** Extra same-origin links under the form (for example the local development outbox). */
-  links?: (request: Request) => Array<{ href: string; label: string }> | Promise<Array<{ href: string; label: string }>>;
-  defaultReturnTo?: string;
-}
-/** The shared server-rendered sign-in page at branding.signInPath (GET and HEAD); null for anything else. */
-export function createSignInHandler<R extends string>(auth: OperatorAuth<R>, options?: SignInPageOptions): (request: Request) => Promise<Response | null>;
+export { createSignInHandler } from './signin/index.mjs';
+export type { SignInPageOptions } from './signin/index.mjs';
 export class AuthError extends Error { constructor(code: string, status?: number); code: string; status: number }
 export const DEFAULT_ROLES: readonly Role[];
 export function defaultRolePolicy(input: PolicyInput): boolean;

package/modules/operator-auth/page.mjs

@@ -16,7 +16,7 @@ function stylesheet(accentColor) {
 }
 
 // Form controls and notices used by the sign-in page; part of the same hashed sheet.
-const FORMS = `label{display:block;font-weight:600;margin:0 0 8px}input{display:block;width:100%;margin:0 0 16px;padding:12px 14px;border:1px solid #64748b;border-radius:10px;font:inherit;line-height:1.5;color:inherit;background:transparent}input:focus-visible{outline:3px solid #172033;outline-offset:2px}.stack{display:grid;gap:12px;margin:0 0 24px}button.secondary{background:transparent;color:inherit}.divider{display:flex;align-items:center;gap:12px;margin:0 0 24px;color:#475569;font-size:14px}.divider::before,.divider::after{content:"";flex:1;border-top:1px solid #dce2ea}.notice{border-left:4px solid #64748b;padding:8px 12px;margin:0 0 24px}h2{font-size:20px;line-height:1.4;margin:32px 0 16px}.secondary-link{margin:16px 0 0;text-align:center;font-size:15px}.secondary-link a{color:#334155;font-weight:600;text-decoration:underline;text-decoration-thickness:1px;text-underline-offset:3px}.secondary-link a:hover{text-decoration-thickness:2px}.secondary-link a:focus-visible{outline:3px solid #172033;outline-offset:2px;border-radius:2px}@media(prefers-color-scheme:dark){input:focus-visible,.secondary-link a:focus-visible{outline-color:#f8fafc}.divider{color:#cbd5e1}.divider::before,.divider::after{border-color:#475569}.secondary-link a{color:#cbd5e1}}`;
+const FORMS = `label{display:block;font-weight:600;margin:0 0 8px}input{display:block;width:100%;margin:0 0 16px;padding:12px 14px;border:1px solid #64748b;border-radius:10px;font:inherit;line-height:1.5;color:inherit;background:transparent}input:focus-visible{outline:3px solid #172033;outline-offset:2px}.stack{display:grid;gap:12px;margin:0 0 24px}button.secondary{background:transparent;color:inherit}.divider{display:flex;align-items:center;gap:12px;margin:0 0 24px;color:#475569;font-size:14px}.divider::before,.divider::after{content:"";flex:1;border-top:1px solid #dce2ea}.notice{border-left:4px solid #64748b;padding:8px 12px;margin:0 0 24px}h2{font-size:20px;line-height:1.4;margin:32px 0 16px}.secondary-link{margin:16px 0 0;text-align:center;font-size:15px}.secondary-link a{display:inline-block;min-width:24px;min-height:24px;color:#334155;font-weight:600;text-decoration:underline;text-decoration-thickness:1px;text-underline-offset:3px}.secondary-link a:hover{text-decoration-thickness:2px}.secondary-link a:focus-visible{outline:3px solid #172033;outline-offset:2px;border-radius:2px}@media(prefers-color-scheme:dark){input:focus-visible,.secondary-link a:focus-visible{outline-color:#f8fafc}.divider{color:#cbd5e1}.divider::before,.divider::after{border-color:#475569}.secondary-link a{color:#cbd5e1}}`;
 
 export async function pageResponse({ branding, title, heading, content, status = 200, method = 'GET', referrer, formTargets = [] }) {
   const css = stylesheet(branding.accentColor) + FORMS + (branding.theme ? themed(branding.accentColor) : '');

package/modules/operator-auth/service.mjs

@@ -75,6 +75,7 @@ export function createOperatorAuth(options) {
     ...providerControl({ store, accounts, authenticate, config, clock }),
     ...fencedCredentials({store,authenticate,requireFreshProof,config,clock,hash}),
     presentation: config.branding,
+    emailSignInAvailable: Boolean(mailSender),
     /** Identity providers (null when none is configured): routes, the sign-in page's list and owner actions. */
     providers,
     /** The admission identity methods use: a verified principal in, a session out. */

package/modules/operator-auth/signin/index.d.mts

@@ -0,0 +1,11 @@
+import type { OperatorAuth } from '../index.mjs';
+
+export interface SignInPageOptions {
+  /** While the first owner is unclaimed: the setup form and its instructions. */
+  setup?: (request: Request) => null | false | undefined | { instructions?: string } | Promise<null | false | undefined | { instructions?: string }>;
+  /** Extra same-origin links under the form (for example the local development outbox). */
+  links?: (request: Request) => Array<{ href: string; label: string }> | Promise<Array<{ href: string; label: string }>>;
+  defaultReturnTo?: string;
+}
+/** The shared server-rendered sign-in page at branding.signInPath (GET and HEAD); null for anything else. */
+export function createSignInHandler<R extends string>(auth: OperatorAuth<R>, options?: SignInPageOptions): (request: Request) => Promise<Response | null>;

package/modules/operator-auth/signin/index.mjs

@@ -1,6 +1,6 @@
 // The one sign-in page every Base seed mounts. Server-rendered plain HTML forms:
 // it works before any script loads (and without one). It lists "Continue
-// with…" for each linked, reachable provider and always offers the email link;
+// with…" for each linked, reachable provider and offers a configured email link;
 // a hidden provider's button is simply absent.
 import { escapeHtml } from '../http.mjs';
 import { safeReturnTo } from '../policy.mjs';
@@ -21,11 +21,12 @@ const NOTICES = {
 };
 const UNAVAILABLE = ['alert', 'That sign-in provider is not available right now. Use the email link instead.'];
 const UNFINISHED = ['alert', 'Signing in with that provider did not finish. Try again, or use the email link.'];
-function noticeFor(code) {
+function noticeFor(code, emailAvailable) {
   if (typeof code !== 'string') return null;
+  if (code === 'oidc_admission_denied' && !emailAvailable) return ['alert', 'That account cannot sign in here. Ask an owner of this app for an invitation.'];
   if (Object.hasOwn(NOTICES, code)) return NOTICES[code];
-  if (['oidc_provider_unavailable', 'oidc_relink_required', 'oidc_provider_unlinked', 'oidc_unavailable', 'oidc_provider_version_unsupported'].includes(code)) return UNAVAILABLE;
-  return code.startsWith('oidc_') ? UNFINISHED : null;
+  if (['oidc_provider_unavailable', 'oidc_relink_required', 'oidc_provider_unlinked', 'oidc_unavailable', 'oidc_provider_version_unsupported'].includes(code)) return emailAvailable ? UNAVAILABLE : ['alert', 'That sign-in provider is not available right now. Try again later.'];
+  return code.startsWith('oidc_') ? (emailAvailable ? UNFINISHED : ['alert', 'Signing in with that provider did not finish. Try again.']) : null;
 }
 const hidden = returnTo => `<input type="hidden" name="returnTo" value="${escapeHtml(returnTo)}">`;
 
@@ -43,7 +44,9 @@ export function createSignInHandler(auth, { setup, links, defaultReturnTo = '/ap
     const returnTo = safeReturnTo(url.searchParams.get('returnTo'), defaultReturnTo);
     const providers = auth.providers ? (await auth.providers.list()).filter(p => p.visible) : [];
     const parts = [];
-    const notice = noticeFor(url.searchParams.get('notice'));
+    const emailAvailable = auth.emailSignInAvailable;
+    const notice = noticeFor(url.searchParams.get('notice'), emailAvailable)
+      ?? (!emailAvailable && !providers.length ? NOTICES.mail_unavailable : null);
     if (notice) {
       const required = providers.find(p => p.id === url.searchParams.get('provider'));
       const extra = required ? ` Addresses at this domain sign in with ${escapeHtml(required.label)}.` : '';
@@ -51,9 +54,9 @@ export function createSignInHandler(auth, { setup, links, defaultReturnTo = '/ap
     }
     if (providers.length) {
       parts.push(`<div class="stack">${providers.map(p => `<form method="post" action="${escapeHtml(p.startPath)}">${hidden(returnTo)}<button class="secondary" type="submit">Continue with ${escapeHtml(p.label)}</button></form>`).join('')}</div>`);
-      parts.push('<p class="divider">or</p>');
+      if (emailAvailable) parts.push('<p class="divider">or</p>');
     }
-    parts.push(`<form method="post" action="/auth/magic-link">${hidden(returnTo)}<label for="signin-email">Email</label><input id="signin-email" name="email" type="email" autocomplete="email" required maxlength="254"><button type="submit">Email a sign-in link</button></form>`);
+    if (emailAvailable) parts.push(`<form method="post" action="/auth/magic-link">${hidden(returnTo)}<label for="signin-email">Email</label><input id="signin-email" name="email" type="email" autocomplete="email" required maxlength="254"><button type="submit">Email a sign-in link</button></form>`);
     for (const link of (await links?.(request)) ?? []) {
       if (typeof link?.href === 'string' && /^\/(?!\/)[^\s\\]*$/.test(link.href) && typeof link.label === 'string') parts.push(`<p class="secondary-link"><a href="${escapeHtml(link.href)}">${escapeHtml(link.label)}</a></p>`);
     }

package/modules/release/README.md

@@ -212,3 +212,66 @@ tag in the private repository.
 Generated source commits and annotated tags identify Run Edit Run with the
 non-contact address `releases@runeditrun.invalid`. Provenance remains bound to
 the source commit and tree; the Git author address is not a delivery destination.
+
+## Signing and checking release receipts
+
+`rer release keygen` creates a publisher key and its proof-of-possession anchor
+entry; `rer release sign` signs a completed tagged release; and
+`rer release receipt` verifies that detached signature against a local anchor
+set. Use `--scope test` for development. The owner's production `rer` key is a
+later vault operation and is not generated during this work; the owner will
+create it directly in the vault.
+
+Key generation accepts `--scope test|rer --publisher NAMESPACE
+--github-owner LOGIN --github-owner-id ID --anchor-out FILE`, with optional
+`--not-before YYYY-MM-DDTHH:MM:SSZ`, `--not-after YYYY-MM-DDTHH:MM:SSZ` and
+repeatable `--unsigned-through PROJECT:VERSION`. `--anchor-out` receives one
+public anchor entry with its enrolment proof and pending review status; it is
+not a complete anchor set. On success the PKCS#8 private key goes to stdout
+only when stdout is not a terminal. Pipe it directly to the owner's vault;
+never send private key bytes to a terminal, repository, log or evidence. The
+signer accepts `--artifact DIR` and exactly one of `--key-file FILE` or
+`--key-stdin`, with `--scope test|rer` (default `rer`). Read production
+signing material from the vault through `--key-stdin`; `sign` never echoes it.
+`--key-stdin` refuses terminal input; pipe the key from a vault or file instead.
+
+Signing requires `release-receipt.json` to record a completed `RELEASED`
+tagged release with a created public tag. It writes the detached DSSE envelope
+as `rer-release.dsse.json` beside the receipt. The statement binds the public
+repository, tag, commit, tree and tag object, and hashes `public-source.tar`,
+`release-receipt.json`, `publish-check.json`, the bundle's single
+`site/<id>/<version>/release.json`, and every document under that bundle's
+`documents/` directory. The envelope is an artifact file; signing does not
+change the existing release or registry pins.
+
+After writing the signature, `sign` prints (but never runs) a shell-quoted
+`gh release upload` command for attaching `rer-release.dsse.json` to the
+already-created GitHub release. The emitted command has this form:
+
+```sh
+gh release upload 'TAG' '/absolute/path/rer-release.dsse.json' --repo 'OWNER/REPOSITORY'
+```
+
+Review and run the actual printed command to upload the asset. `sign` itself
+performs no upload.
+
+Receipt verification accepts `--artifact DIR --anchors FILE`, optional
+`--environment test`, and optional `--after VERSION:SHA256`; the environment
+defaults to `production`. It checks the artifact and detached signature using
+the same offline verifier used by signing. Exit 0 prints
+`{"verdict":"VERIFIED"}`; exit 1 prints a refusal code as
+`{"verdict":"REFUSED","code":"..."}`; invalid arguments exit 2. A
+Base receipt check always requires a signature and refuses a missing envelope
+with `SIGNATURE_MISSING`, even where site or service consumers accept a legacy
+unsigned listing.
+
+The dependency-free verifier source is `modules/release/signature.mjs`; it has
+no `node:` imports and is exported as
+`@runeditrun/rer/modules/release/signature`. Its default-seed portable copy is
+generated byte-for-byte at
+`default-seed/scripts/base-cli/modules/release/signature.mjs`. Shared public
+test vectors live in `modules/release/vectors/release-signature-vectors.json`
+and are generated byte-for-byte at
+`default-seed/scripts/base-cli/modules/release/vectors/release-signature-vectors.json`.
+The vectors use the existing public Octocat example repository context with synthetic bundle bytes and throwaway test keys; they do not represent an actual release.
+Consumers vendor and pin the verifier source by Base commit and SHA-256.

package/modules/release/keygen.mjs

@@ -0,0 +1,18 @@
+import { generateKeyPairSync } from 'node:crypto';
+import { loadAnchors } from './signature.mjs';
+import { publicEntry, anchorSet, validity } from './signing-key.mjs';
+import { writeNew } from './signing-io.mjs';
+
+export async function keygen(options) {
+  if (process.stdout.isTTY) throw new TypeError('ARGUMENT_INVALID');
+  const { privateKey } = generateKeyPairSync('ed25519');
+  const dates = validity(options['not-before'] ? new Date(options['not-before']) : new Date());
+  const entry = await publicEntry(privateKey, { scope: options.scope, publisher: options.publisher,
+    githubOwner: { login: options['github-owner'], id: Number(options['github-owner-id']) },
+    notBefore: options['not-before'] ?? dates.notBefore, notAfter: options['not-after'] ?? dates.notAfter,
+    unsignedThrough: options.unsignedThrough });
+  const anchors = anchorSet(entry, options.scope);
+  await loadAnchors(anchors, anchors.environment);
+  writeNew(options['anchor-out'], JSON.stringify(entry, null, 2) + '\n');
+  process.stdout.write(privateKey.export({ type: 'pkcs8', format: 'pem' }));
+}

package/modules/release/produce.mjs

@@ -121,6 +121,15 @@ export async function release({ repo, ref = 'HEAD', output, project, repository,
         // so a failed write or changed remote cannot leave a private tag.
         if (!destination) annotate(source.repo, source, source.commit);
         receipt.tag.created = true;
+        // Bind the receipt to the annotated tag in the published history.
+        // Clean/public-child exports have a different commit from the source.
+        const tagRepo = exported?.repo ?? source.repo, tagRef = `refs/tags/${source.tag}`;
+        Object.assign(receipt.publicExport, {
+          tag: source.tag,
+          tagObject: git(tagRepo, 'rev-parse', `${tagRef}^{tag}`).toString().trim(),
+          commit: git(tagRepo, 'rev-parse', `${tagRef}^{commit}`).toString().trim(),
+          tree: git(tagRepo, 'rev-parse', `${tagRef}^{tree}`).toString().trim(),
+        });
       }
     }
     if (passed && tag && destination) writePublishHandoff(output, destination, receipt);

package/modules/release/sign.mjs

@@ -0,0 +1,44 @@
+import { createPrivateKey } from 'node:crypto';
+import { resolve } from 'node:path';
+import { loadAnchors, PAYLOAD_TYPE } from './signature.mjs';
+import { readArtifact, statementFor } from './statement.mjs';
+import { verifyArtifact } from './verify.mjs';
+import { publicEntry, anchorSet, envelope, validity, timestamp } from './signing-key.mjs';
+import { SIGNATURE_FILE, readBounded, writeNew, refuse } from './signing-io.mjs';
+
+async function keyInput(options) {
+  if (options['key-file']) return readBounded(options['key-file'], 16384);
+  const chunks = []; let size = 0;
+  for await (const chunk of process.stdin) {
+    size += chunk.length;
+    if (size > 16384) refuse('INPUT_TOO_LARGE');
+    chunks.push(chunk);
+  }
+  return Buffer.concat(chunks);
+}
+
+export async function signArtifact(options) {
+  let privateKey;
+  try {
+    const bytes = await keyInput(options);
+    if (!/^-----BEGIN PRIVATE KEY-----\r?\n[\s\S]+\r?\n-----END PRIVATE KEY-----\s*$/.test(bytes.toString('ascii'))) throw new Error();
+    privateKey = createPrivateKey({ key: bytes, format: 'pem', type: 'pkcs8' });
+    if (privateKey.asymmetricKeyType !== 'ed25519') throw new Error();
+  } catch { refuse('SIGNATURE_INVALID'); }
+  const artifact = await readArtifact(options.artifact);
+  if (artifact.receipt.status !== 'RELEASED' || artifact.receipt.tag?.created !== true) refuse('SUBJECT_MISMATCH');
+  const scope = options.scope ?? 'rer', issuedAt = timestamp(new Date());
+  // This ephemeral proof checks our output, not publisher admission. The
+  // consumer still needs a separately reviewed anchor with the real owner ID.
+  const entry = await publicEntry(privateKey, { scope, publisher: artifact.subject.publisher,
+    githubOwner: { login: artifact.subject.repository.split('/')[3], id: 1 }, ...validity(new Date(issuedAt)), issuedAt });
+  const anchors = anchorSet(entry, scope);
+  const loaded = await loadAnchors(anchors, anchors.environment);
+  const statement = statementFor(artifact, entry.keyId, issuedAt);
+  const bytes = Buffer.from(JSON.stringify(envelope(privateKey, entry.keyId, PAYLOAD_TYPE, statement)) + '\n');
+  await verifyArtifact(artifact, loaded, anchors.environment, bytes);
+  const target = resolve(artifact.root, SIGNATURE_FILE);
+  writeNew(target, bytes);
+  const shell = value => `'${value.replace(/'/g, `'\\''`)}'`;
+  return `gh release upload ${shell(statement.tag)} ${shell(target)} --repo ${shell(statement.repository.slice('https://github.com/'.length))}`;
+}