@runeditrun/rer 0.2.0 → 0.2.2

package/modules/deploy-kit/migrations.mjs

@@ -1,8 +1,7 @@
 import { assert, hash } from './validation.mjs';
 import { assertMigrationSqlSafe } from './sql-safety.mjs';
 import { sqlTokens } from './sql-tokens.mjs';
-const ledger = '_rer_deploy_migrations';
-const literal = value => `'${value.replaceAll("'","''")}'`;
+import { ledger, literal, createLedger, readLedger } from './migration-ledger.mjs';
 export function validateMigrations(migrations) {
   let previous = '';
   for (const migration of migrations) {
@@ -17,20 +16,17 @@ export async function query(api, id, sql) {
   assert(Array.isArray(rows) && rows.length > 0 && rows.every(x => x.success === true && Array.isArray(x.results)), 'd1-query-failed');
   return rows;
 }
-export async function migrate(api, id, migrations, { apply = true } = {}) {
+export async function migrate(api, id, migrations, { apply = true, upgrade = apply } = {}) {
   validateMigrations(migrations);
-  const tables = (await query(api,id,"SELECT name FROM sqlite_master WHERE type='table' AND name IN ('_rer_deploy_migrations','d1_migrations')"))[0].results.map(x => x.name);
-  let applied = [];
-  if (tables.includes(ledger)) applied = (await query(api,id,`SELECT name, sha256, state FROM ${ledger} ORDER BY name`))[0].results;
-  // Wrangler history has no hashes. Never assume old SQL bytes from its names alone.
-  if (tables.includes('d1_migrations')) {
-    const prior = (await query(api,id,'SELECT name FROM d1_migrations ORDER BY id'))[0].results;
-    assert(prior.every(x => applied.some(y => x.name === y.name && y.state === 'applied')), 'legacy-migration-history-needs-reviewed-hash-adoption');
-  }
-  assert(applied.every((row,index) => row.name === migrations[index]?.name && row.sha256 === migrations[index]?.sha256 && row.state === 'applied'), 'changed-or-uncertain-migration-history');
+  const { applied, transition, exists } = await readLedger(api, id, migrations, query);
   const pending = migrations.slice(applied.length);
   assert(apply || pending.length === 0,'pending-migrations');
-  if (pending.length && !tables.includes(ledger)) await query(api,id,`CREATE TABLE ${ledger} (name TEXT PRIMARY KEY, sha256 TEXT NOT NULL, state TEXT NOT NULL CHECK(state IN ('applying','applied')))`);
+  if (transition && upgrade) {
+    await api.importSql(id, transition);
+    const verified = await readLedger(api, id, migrations, query);
+    assert(!verified.transition && verified.applied.length === applied.length, 'migration-readback-mismatch');
+  }
+  if (pending.length && !exists) await query(api,id,createLedger);
   for (const migration of pending) {
     // Claim before execution. A lost response/partial provider failure is never automatically replayed.
     await query(api,id,`INSERT INTO ${ledger}(name,sha256,state) VALUES (${literal(migration.name)},${literal(migration.sha256)},'applying')`);
@@ -38,10 +34,10 @@ export async function migrate(api, id, migrations, { apply = true } = {}) {
     // A second terminator after trailing comments creates an empty D1 statement.
     // Keep the newline even when terminated: a final line comment must end.
     const separator = last?.kind === 'symbol' && last.value === ';' ? '' : '; ';
-    await query(api,id,`${migration.sql}\n${separator}UPDATE ${ledger} SET state='applied' WHERE name=${literal(migration.name)} AND sha256=${literal(migration.sha256)};`);
+    await api.importSql(id,`${migration.sql}\n${separator}UPDATE ${ledger} SET state='applied' WHERE name=${literal(migration.name)} AND sha256=${literal(migration.sha256)};`);
   }
   if (pending.length) {
-    const final = (await query(api,id,`SELECT name, sha256, state FROM ${ledger} ORDER BY name`))[0].results;
+    const final = (await query(api,id,`SELECT name, sha256, state FROM ${ledger} ORDER BY id`))[0].results;
     assert(final.length === migrations.length && final.every((x,i) => x.state === 'applied' && x.name === migrations[i].name && x.sha256 === migrations[i].sha256), 'migration-readback-mismatch');
   }
   return { applied:pending.map(x => x.name), history:migrations.map(({name,sha256}) => ({name,sha256})) };

package/modules/deploy-kit/owner-cli.mjs

@@ -1,3 +1,4 @@
+import { deploymentDiagnostics, deployDiagnostic } from './diagnostics.mjs';
 import { execFileSync } from 'node:child_process';
 import { resolve, join } from 'node:path';
 import { pathToFileURL } from 'node:url';
@@ -6,11 +7,13 @@ import { assert, hexId } from './validation.mjs';
 import { regularBytes } from './artifact.mjs';
 import { packageBuild } from './prepare.mjs';
 import { cloudflare } from './provider.mjs';
-import { ownerTarget, ownerPlan, ownerDeploy, ownerHealth } from './owner.mjs';
+import { ownerTarget, ownerPlan, ownerDeploy, ownerHealth, settleOwnerState } from './owner.mjs';
+import { ownerSecret } from './owner-secret.mjs';
+import { ownerRemove } from './owner-remove.mjs';
 import { refuseLocalModels } from './local-only.mjs';
 
 export const cronNotice = 'This Worker has a Cron Trigger. Cloudflare may take up to about two hours to start its first scheduled run on some accounts.';
-const usage = 'usage: owner-cli.mjs deploy|health --declaration <file> --environment <name> [--product <dir>] [--state <file>]';
+const usage = 'usage: owner-cli.mjs deploy|health|remove --declaration <file> --environment <name> [--product <dir>] [--state <file>] | secret ... --set NAME|--unset NAME';
 
 /** The owner's committed source and existing local build. Run the seed's build first. */
 async function ownerArtifact(root, product) {
@@ -21,12 +24,13 @@ async function ownerArtifact(root, product) {
 }
 
 /** Inputs: CLOUDFLARE_ACCOUNT_ID and CLOUDFLARE_API_TOKEN, plus the secrets the declaration names on first deploy. */
-export async function main(argv = process.argv.slice(2), env = process.env, {fetch = globalThis.fetch, cwd = process.cwd(), healthOptions, localOnlyKeys = [], notice = line => console.error(line)} = {}) {
+export async function main(argv = process.argv.slice(2), env = process.env, {fetch = globalThis.fetch, cwd = process.cwd(), healthOptions, localOnlyKeys = [], notice = line => console.error(line), onCreated} = {}) {
   let parsed;
-  try { parsed = parseArgs({args:argv,allowPositionals:true,strict:true,options:{declaration:{type:'string'},environment:{type:'string'},product:{type:'string',default:''},state:{type:'string'}}}); }
+  try { parsed = parseArgs({args:argv,allowPositionals:true,strict:true,options:{declaration:{type:'string'},environment:{type:'string'},product:{type:'string',default:''},state:{type:'string'},set:{type:'string'},unset:{type:'string'}}}); }
   catch { throw new Error('usage'); }
   const {positionals:[command,...rest],values} = parsed;
-  if (!['deploy','health'].includes(command) || rest.length || !values.declaration || !values.environment) throw new Error('usage');
+  if (!['deploy','health','secret','remove'].includes(command) || rest.length || !values.declaration || !values.environment) throw new Error('usage');
+  if ((command === 'secret') !== (values.set !== undefined || values.unset !== undefined) || values.set !== undefined && values.unset !== undefined) throw new Error('usage');
   await refuseLocalModels(resolve(cwd));
   const missing = ['CLOUDFLARE_ACCOUNT_ID','CLOUDFLARE_API_TOKEN'].filter(key => typeof env[key] !== 'string' || !env[key].trim());
   if (missing.length) { const error = new Error('missing-input'); error.inputs = missing; throw error; }
@@ -36,23 +40,38 @@ export async function main(argv = process.argv.slice(2), env = process.env, {fet
   try { declaration = JSON.parse(await regularBytes(resolve(root,values.declaration),256 * 1024)); }
   catch (error) { throw new Error(error.code === 'ENOENT' ? 'missing-owner-declaration' : 'invalid-owner-declaration'); }
   assert(typeof declaration?.project === 'string','missing-owner-project');
-  const api = cloudflare({accountId:env.CLOUDFLARE_ACCOUNT_ID,token:env.CLOUDFLARE_API_TOKEN,fetch});
+  const api = deploymentDiagnostics(cloudflare({accountId:env.CLOUDFLARE_ACCOUNT_ID,token:env.CLOUDFLARE_API_TOKEN,fetch}),{onCreated});
   const target = await ownerTarget(api,{project:declaration.project,environment:values.environment});
   const statePath = values.state ? resolve(root,values.state) : join(root,'.rer','deploy',`${target.environment}.json`);
+  if (command === 'remove') return {ok:true,...await ownerRemove({api,target,statePath}).catch(error => { throw api.annotateFailure(error,'remove'); })};
+  if (command === 'secret') {
+    const binding = values.set ?? values.unset, item = (Array.isArray(declaration.secrets) ? declaration.secrets : []).find(entry => entry?.binding === binding);
+    if (!item) { const error = new Error('undeclared-secret'); error.resource = `secret:${binding}`; throw error; }
+    const value = values.set === undefined ? undefined : env[item.environment];
+    return {ok:true,...await ownerSecret({api,target,statePath,binding,value}).catch(error => { throw api.annotateFailure(error,'secrets'); })};
+  }
+  // A secret rer retired (the spent setup token) is no longer part of the plan.
+  const {retiredSecrets = []} = await settleOwnerState({api,target,statePath});
+  const current = retiredSecrets.length && Array.isArray(declaration.secrets) ? {...declaration,secrets:declaration.secrets.filter(item => !retiredSecrets.includes(item?.binding))} : declaration;
   const artifact = await ownerArtifact(root,values.product);
-  const plan = ownerPlan(target,declaration,artifact,{localOnlyKeys});
+  const plan = ownerPlan(target,current,artifact,{localOnlyKeys});
   if (command === 'health') {
-    await ownerHealth({api,target,plan,statePath,fetch,healthOptions:{...healthOptions,readiness:{single:true,totalMs:30000}}});
+    await ownerHealth({api,target,plan,statePath,fetch,healthOptions:{...healthOptions,readiness:{single:true,totalMs:30000}}}).catch(error=>{throw api.annotateFailure(error,'health');});
     return {ok:true,worker:target.worker,origin:target.origin};
   }
   // Dispatch is the provider's: on some accounts a new Cron starts only at the account scheduler's next refresh.
   if (plan.crons.length) notice(cronNotice);
-  const {receipt,created} = await ownerDeploy({api,target,plan,artifact,statePath,env,fetch,healthOptions});
-  return {ok:true,changed:receipt.changed,worker:target.worker,origin:receipt.origin,versionId:receipt.provider.versionId,created,state:statePath};
+  const {receipt,created,sentSecrets} = await ownerDeploy({api,target,plan,artifact,statePath,env,fetch,healthOptions}).catch(error => {
+    api.annotateFailure(error,error.message.startsWith('missing-secret-') ? 'secrets' : undefined);
+    throw error;
+  });
+  return {ok:true,changed:receipt.changed,worker:target.worker,origin:receipt.origin,versionId:receipt.provider.versionId,created,sentSecrets,retiredSecrets,state:statePath};
 }
 
 /** Prints refusal codes and resource names only; never inputs, tokens or provider bodies. */
 export function report(error) {
+  const diagnostic = deployDiagnostic(error);
+  if (diagnostic) return {ok:false,...diagnostic};
   if (error.message === 'missing-input') return {ok:false,code:'missing-input',inputs:error.inputs};
   if (error.message === 'usage') return {ok:false,code:'usage',usage};
   return {ok:false,code:/^[a-zA-Z0-9_-]{1,120}$/.test(error.message) ? error.message : 'owner-deploy-failed',...(error.resource ? {resource:error.resource} : {})};

package/modules/deploy-kit/owner-remove.mjs

@@ -0,0 +1,105 @@
+import { rm } from 'node:fs/promises';
+import { assert } from './validation.mjs';
+import { resourceKinds, findResource } from './resources.mjs';
+import { activeWorker } from './worker.mjs';
+import { deleteWorker } from './teardown.mjs';
+import { workerConsumerScript } from './queue-consumer.mjs';
+import { query } from './migrations.mjs';
+import { KINDS, readOwnerState, writeOwnerState, withStateLock, withScopeHints, withSettledLists, workerSettings, sameDeployment, resourceId, checkResourceIdentity, refuse, settlePendingSecret } from './owner.mjs';
+
+const remove = {
+  d1: (api, id) => api.request(`/d1/database/${id}`, {method:'DELETE'}),
+  r2: (api, _id, name) => api.request(`/r2/buckets/${name}`, {method:'DELETE'}),
+  kv: (api, id) => api.request(`/storage/kv/namespaces/${id}`, {method:'DELETE'}),
+  queues: (api, id) => api.request(`/queues/${id}`, {method:'DELETE'}),
+};
+
+/** A resource whose create response was lost (still `pending` in the state file) may be
+ * rer's or someone else's. It is removed only under this environment's derived name and
+ * once it is confirmed empty: a D1 with no tables, a KV namespace with no keys, an R2
+ * bucket (the provider refuses to delete one holding objects). A queue's backlog cannot
+ * be read, so an uncertain queue refuses with its own code. */
+async function confirmEmpty(api, worker, kind, name, id) {
+  if (!name.startsWith(`${worker}-`)) throw refuse('uncertain-resource-create', kind, name);
+  if (kind === 'queues') throw refuse('uncertain-resource-unverifiable', kind, name);
+  if (kind === 'd1') {
+    const [{results}] = await query(api, id, "SELECT name FROM sqlite_master WHERE type='table' AND name NOT LIKE 'sqlite~_%' ESCAPE '~' AND name NOT LIKE '~_cf~_%' ESCAPE '~'");
+    if (results.length) throw refuse('uncertain-resource-not-empty', kind, name);
+  }
+  if (kind === 'kv') {
+    const keys = await api.request(`/storage/kv/namespaces/${id}/keys?limit=10`);
+    assert(Array.isArray(keys), 'invalid-kv-key-list');
+    if (keys.length) throw refuse('uncertain-resource-not-empty', kind, name);
+  }
+}
+
+/** Delete exactly what this environment's state file says rer created: the Worker (its
+ * schedules first; its Durable Objects go with it), then each D1, R2, KV and queue,
+ * each only while it is still the one rer created. Read back that each is gone, then
+ * drop the state file. Nothing else in the account is touched. Ownership is checked for
+ * everything before the first delete; a replaced or uncertain resource refuses it all,
+ * except an uncertain one confirmed empty (see confirmEmpty). */
+export async function ownerRemove({api: provider, target, statePath, clock, sleep}) {
+  const api = withSettledLists(withScopeHints(provider));
+  return withStateLock(statePath, async () => {
+    const state = await readOwnerState(statePath, target);
+    if (await settlePendingSecret(api, target.worker, state)) await writeOwnerState(statePath, state);
+    const owned = KINDS.flatMap(kind => Object.entries(state.owned[kind]).map(([name, entry]) => ({kind, name, entry})));
+    assert(state.owned.worker || owned.length, 'nothing-to-remove');
+    // Preflight, read-only.
+    let worker = null;
+    if (await workerSettings(api, target.worker) !== null) {
+      if (!state.owned.worker) throw refuse('resource-name-collision', 'worker', target.worker);
+      const expected = state.pendingUpload?.provider ?? state.receipt?.provider;
+      if (!expected) throw refuse('uncertain-resource-create', 'worker', target.worker);
+      const live = await activeWorker(api, target.worker);
+      if (!sameDeployment(live, expected)) throw refuse('owned-resource-replaced', 'worker', target.worker);
+      worker = target.worker;
+    }
+    const listed = {}, doomed = [];
+    for (const kind of KINDS) {
+      if (!owned.some(item => item.kind === kind)) continue;
+      listed[kind] = await resourceKinds[kind].list(api);
+      for (const {name, entry} of owned.filter(item => item.kind === kind)) {
+        const row = findResource(listed[kind], kind, name);
+        if (!row) continue;
+        if (entry.status === 'pending') await confirmEmpty(api, target.worker, kind, name, resourceId(kind, row));
+        else checkResourceIdentity(kind, name, row, entry);
+        doomed.push({kind, name, id:resourceId(kind, row)});
+      }
+    }
+    const removed = [];
+    // A Worker that consumes one of these queues is released first.
+    for (const queue of doomed.filter(item => item.kind === 'queues')) {
+      for (const consumer of await api.list(`/queues/${queue.id}/consumers`, {pagination:'single'})) {
+        if (workerConsumerScript(consumer) === target.worker) await api.request(`/queues/${queue.id}/consumers/${consumer.consumer_id}`, {method:'DELETE'});
+      }
+    }
+    if (worker) { await deleteWorker({api, worker, ...(clock ? {clock} : {}), ...(sleep ? {sleep} : {})}); removed.push(`worker:${worker}`); }
+    const failed = [];
+    for (const item of doomed) {
+      try { await remove[item.kind](api, item.id, item.name); removed.push(`${item.kind}:${item.name}`); }
+      catch (error) { failed.push({resource:`${item.kind}:${item.name}`, code:error.message}); }
+    }
+    // Read back: nothing this environment created is still listed.
+    const remaining = [];
+    if (await workerSettings(api, target.worker) !== null) remaining.push(`worker:${target.worker}`);
+    const namespaces = await api.list('/workers/durable_objects/namespaces');
+    for (const row of namespaces) if (row.script === target.worker) remaining.push(`durable-object:${row.class}`);
+    for (const kind of KINDS) {
+      if (!listed[kind]) continue;
+      const rows = await resourceKinds[kind].list(api);
+      for (const {name} of owned.filter(item => item.kind === kind)) if (findResource(rows, kind, name)) remaining.push(`${kind}:${name}`);
+    }
+    if (remaining.length) {
+      // Keep the record of what is left, so a later --remove finishes it.
+      for (const kind of KINDS) for (const name of Object.keys(state.owned[kind])) if (!remaining.includes(`${kind}:${name}`)) delete state.owned[kind][name];
+      if (!remaining.includes(`worker:${target.worker}`)) { state.owned.worker = null; state.receipt = null; delete state.pendingUpload; }
+      await writeOwnerState(statePath, state);
+      const error = new Error('remove-incomplete'); error.remaining = remaining; error.failed = failed; error.removed = removed;
+      throw error;
+    }
+    await rm(statePath, {force:true});
+    return {worker:target.worker, removed, remaining:[]};
+  });
+}

package/modules/deploy-kit/owner-secret.mjs

@@ -0,0 +1,49 @@
+import { assert, identifier } from './validation.mjs';
+import { activeWorker, deployedFingerprint } from './worker.mjs';
+import { readOwnerState, writeOwnerState, withStateLock, withScopeHints, sameDeployment, refuse, recordSecretChange, settlePendingSecret } from './owner.mjs';
+
+/** Set (`value` given) or remove one Worker secret of the owner's last deployment, then
+ * record the Worker version the change made in the state file, so the next deploy
+ * recognises its own Worker. A Worker someone else replaced is refused untouched.
+ * The change is recorded as pending first: if the provider applies it but rer never
+ * sees it settle, a later run adopts it (see settlePendingSecret). A change the provider
+ * answered with an error clears the pending record. The secret listing
+ * and active deployment lag a change, so they are read until they show it, up to `windowMs`.
+ * A removed declared secret is retired: later plans omit it until it is set again. */
+export async function ownerSecret({api: provider, target, statePath, binding, value, windowMs = 30000, clock = () => performance.now(), sleep = ms => new Promise(resolve => setTimeout(resolve, ms))}) {
+  const api = withScopeHints(provider);
+  assert(identifier(binding), 'invalid-secret-name');
+  assert(value === undefined || typeof value === 'string' && value.trim(), `missing-secret-${binding}`);
+  return withStateLock(statePath, async () => {
+    const state = await readOwnerState(statePath, target);
+    assert(state.receipt && !state.pendingUpload, 'missing-owner-receipt');
+    if (await settlePendingSecret(api, target.worker, state)) await writeOwnerState(statePath, state);
+    const live = await activeWorker(api, target.worker);
+    if (!live) throw refuse('owned-resource-missing', 'worker', target.worker);
+    if (!sameDeployment(live, state.receipt.provider)) throw refuse('owned-resource-replaced', 'worker', target.worker);
+    const path = `/workers/scripts/${target.worker}/secrets`, present = value !== undefined;
+    const names = async () => { const rows = await api.request(path); assert(Array.isArray(rows), 'invalid-secret-list'); return rows.map(row => row.name); };
+    const changed = present || (await names()).includes(binding);
+    state.pendingSecret = {binding, present}; await writeOwnerState(statePath, state);
+    try {
+      if (present) await api.request(path, {method:'PUT', body:{name:binding, text:value, type:'secret_text'}});
+      else if (changed) await api.request(`${path}/${binding}`, {method:'DELETE'});
+    } catch (error) {
+      // The provider answered and refused: nothing changed, so nothing is pending. Only a lost
+      // response (no answer at all) may have applied the change.
+      if (error.status !== undefined) { delete state.pendingSecret; await writeOwnerState(statePath, state); }
+      throw error;
+    }
+    let current;
+    for (const start = clock(); ; await sleep(2000)) {
+      current = await activeWorker(api, target.worker);
+      if (current && (!changed || !sameDeployment(current, live)) && (await names()).includes(binding) === present) break;
+      if (clock() - start + 2000 > windowMs) throw new Error('secret-change-unsettled');
+    }
+    // A secret change makes a new version of the same code: the script and build fingerprint must not move.
+    assert(current.etag === live.etag && deployedFingerprint(current.settings) === deployedFingerprint(live.settings), 'secret-change-drift');
+    recordSecretChange(state, current, {binding, present});
+    await writeOwnerState(statePath, state);
+    return {worker:target.worker, binding, present, versionId:current.versionId};
+  });
+}

package/modules/deploy-kit/owner.mjs

@@ -16,11 +16,11 @@ import { verifyHealth } from './health.mjs';
 
 const segment = /^[a-z][a-z0-9]*(?:-[a-z0-9]+)*$/;
 const STATE_KIND = 'rer-deploy-owner-state';
-const KINDS = ['d1','r2','kv','queues'];
+export const KINDS = ['d1','r2','kv','queues'];
 const DECLARATION_KEYS = ['version','project','compatibilityDate','compatibilityFlags','d1','r2','kv','queues','durableObjects','secrets','crons','vars','originVar','services','workersDev','platforms','container'];
 const ENTRY_KEYS = {d1:['binding'],r2:['binding','locationHint'],kv:['binding'],queues:['binding','consumer','deadLetterQueue'],durableObjects:['binding','className','storage'],secrets:['binding','environment','verifyStandIn'],services:['binding','project','entrypoint','allowedHosts','grant']};
 
-function refuse(code, kind, name) { const error = new Error(code); error.resource = `${kind}:${name}`; return error; }
+export function refuse(code, kind, name) { const error = new Error(code); error.resource = `${kind}:${name}`; return error; }
 
 export function ownerWorkerName(project, environment) {
   assert(typeof project === 'string' && /^(?:[a-z0-9][a-z0-9-]*\/)?[a-z0-9-]+$/.test(project) && segment.test(project.split('/').at(-1)), 'invalid-owner-project');
@@ -49,6 +49,24 @@ export function withScopeHints(api) {
   const guard = method => async (path, ...rest) => { try { return await api[method](path, ...rest); } catch (error) { return hint(path, error); } };
   return {...api, scopeHints:true, request:guard('request'), envelope:guard('envelope'), list:guard('list')};
 }
+/** Right after a create, an account listing can disagree with its own page counts
+ * (D1's total_count lagged its rows by about 7 seconds, measured 13 October 2026).
+ * Owner mode discards such a snapshot and lists again from the start for up to
+ * `windowMs`; a partial listing is never accepted. */
+export function withSettledLists(api, {windowMs = 30000, clock = () => performance.now(), sleep = ms => new Promise(resolve => setTimeout(resolve, ms))} = {}) {
+  if (api.settledLists) return api;
+  const list = async (...args) => {
+    const start = clock();
+    for (let delay = 500; ; delay = Math.min(delay * 2, 4000)) {
+      try { return await api.list(...args); }
+      catch (error) {
+        if (!['provider-partial-list','provider-pagination-changed'].includes(error.message) || clock() - start + delay > windowMs) throw error;
+        await sleep(delay);
+      }
+    }
+  };
+  return {...api, settledLists:true, list};
+}
 /** Reads the account's workers.dev subdomain; no other provider request. */
 export async function ownerTarget(provider, {project, environment}) {
   const api = withScopeHints(provider);
@@ -134,18 +152,21 @@ export async function readOwnerState(path, target) {
     && (state.owned.worker === null || ['pending','created'].includes(state.owned.worker?.status))
     && KINDS.every(kind => state.owned[kind] && typeof state.owned[kind] === 'object' && Object.values(state.owned[kind]).every(entry => ['pending','created'].includes(entry?.status))), 'invalid-owner-state');
   assert(state.pendingUpload === undefined || typeof state.pendingUpload?.fingerprint === 'string' && typeof state.pendingUpload?.build === 'string', 'invalid-owner-state');
+  // Declared secrets rer removed on purpose (the spent setup token): later plans omit them.
+  assert(state.pendingSecret === undefined || identifier(state.pendingSecret?.binding) && typeof state.pendingSecret?.present === 'boolean', 'invalid-owner-state');
+  assert(state.retiredSecrets === undefined || Array.isArray(state.retiredSecrets) && state.retiredSecrets.every(identifier), 'invalid-owner-state');
   assert(state.accountId === target.accountId && state.project === target.project && state.environment === target.environment && state.worker === target.worker, 'owner-state-target-mismatch');
   return state;
 }
-async function writeOwnerState(path, state) {
+export async function writeOwnerState(path, state) {
   await mkdir(dirname(path),{recursive:true,mode:0o700});
   const temporary = `${path}.${process.pid}.tmp`;
   await writeFile(temporary,JSON.stringify(state,null,2)+'\n',{flag:'wx',mode:0o600});
   await rename(temporary,path);
 }
-const resourceId = (kind, row) => ({d1:row.uuid,r2:row.creation_date,kv:row.id,queues:row.queue_id})[kind];
+export const resourceId = (kind, row) => ({d1:row.uuid,r2:row.creation_date,kv:row.id,queues:row.queue_id})[kind];
 
-function checkResourceIdentity(kind, name, row, entry) {
+export function checkResourceIdentity(kind, name, row, entry) {
   if (row) {
     if (!entry) throw refuse('resource-name-collision',kind,name);
     if (entry.status !== 'created') throw refuse('uncertain-resource-create',kind,name);
@@ -194,7 +215,43 @@ async function uploadFingerprint(body) {
   assert(typeof fingerprint === 'string' && fingerprint, 'invalid-upload-metadata');
   return fingerprint;
 }
-const sameDeployment = (a, b) => a?.versionId === b?.versionId && a?.deploymentId === b?.deploymentId && a?.etag === b?.etag;
+/** Record a secret change's outcome on the receipt: the Worker version it made, and whether
+ * the secret is now retired (a removed declared secret stays out of later plans). */
+export function recordSecretChange(state, current, {binding, present}) {
+  state.receipt.provider = {versionId:current.versionId, deploymentId:current.deploymentId, etag:current.etag};
+  const retired = new Set(state.retiredSecrets ?? []);
+  if (present) retired.delete(binding); else retired.add(binding);
+  if (retired.size) state.retiredSecrets = [...retired].sort(); else delete state.retiredSecrets;
+  delete state.pendingSecret;
+}
+/** A secret change rer recorded as pending but never confirmed (a lost response, or a run that
+ * ended before the change settled). It is that change only when the Worker's versions list shows
+ * exactly one version after the receipt's and it is the live one, still running the receipt's
+ * exact script and build fingerprint: adopt its version. Anything else, such as a later change
+ * someone made after rer's, is left to the identity check, which refuses it. */
+export async function settlePendingSecret(api, worker, state) {
+  if (!state.pendingSecret || !state.receipt) return false;
+  const live = await activeWorker(api, worker);
+  if (!live || sameDeployment(live, state.receipt.provider) || live.etag !== state.receipt.provider.etag || deployedFingerprint(live.settings) !== state.receipt.fingerprint) return false;
+  // Newest first, as the provider lists them.
+  const versions = (await api.request(`/workers/scripts/${worker}/versions`))?.items;
+  const ids = Array.isArray(versions) ? versions.map(item => item?.id) : [];
+  if (ids[0] !== live.versionId || ids.indexOf(state.receipt.provider.versionId) !== 1) return false;
+  const rows = await api.request(`/workers/scripts/${worker}/secrets`);
+  if (!Array.isArray(rows) || rows.some(row => row.name === state.pendingSecret.binding) !== state.pendingSecret.present) return false;
+  recordSecretChange(state, live, state.pendingSecret);
+  return true;
+}
+/** Settle a pending secret change under the state lock, before a plan reads the retired list. */
+export async function settleOwnerState({api: provider, target, statePath}) {
+  const api = withScopeHints(provider);
+  return withStateLock(statePath, async () => {
+    const state = await readOwnerState(statePath, target);
+    if (await settlePendingSecret(api, target.worker, state)) await writeOwnerState(statePath, state);
+    return state;
+  });
+}
+export const sameDeployment = (a, b) => a?.versionId === b?.versionId && a?.deploymentId === b?.deploymentId && a?.etag === b?.etag;
 
 /** A completed receipt or the exact identity of an interrupted successful upload proves ownership.
  * Only the first upload, with no receipt, may recover a lost response by its pending build. */
@@ -238,7 +295,7 @@ export async function withStateLock(path, run) {
  * Ownership preflight precedes provider writes. A re-run of the same build writes nothing. */
 export async function ownerDeploy({api: provider, target, plan, artifact, statePath, env = {}, fetch = globalThis.fetch, healthOptions = {}, readiness = {}}) {
   assert(typeof statePath === 'string' && statePath.length, 'missing-owner-state-path');
-  const api = withScopeHints(provider);
+  const api = withSettledLists(withScopeHints(provider));
   assert(target?.accountId === api.accountId, 'owner-account-mismatch');
   validatePlan(plan); assertOwnerNames(target, plan);
   for (const item of plan.d1) validateMigrations(item.migrations);
@@ -252,7 +309,8 @@ async function deployLocked({api, target, plan, artifact, statePath, env, fetch,
   const exists = priorWorker !== null;
   const create = await ownedResourcesToCreate(api, plan, state);
   if (exists) await checkCronOwnership(api, plan);
-  await secretBindings(api, plan.worker, plan, env, exists);
+  // The declared secrets this run uploads; every other one is inherited unchanged.
+  const {missing:sentSecrets} = await secretBindings(api, plan.worker, plan, env, exists);
   // Record intent before each create. A failed or lost response leaves it pending:
   // absent on resume means create again; present means an uncertain outcome to inspect.
   for (const {kind,item} of create) {
@@ -273,6 +331,9 @@ async function deployLocked({api, target, plan, artifact, statePath, env, fetch,
     }
     const result = await api.request(path, options);
     if (sending) {
+      // A successful upload creates a Worker only when ownership preflight found
+      // it absent. Record it before readback, which can fail after creation.
+      if (!exists) api.recordCreated?.(`Worker:${plan.worker}`);
       const active = await activeWorker(api, plan.worker);
       assert(active && deployedFingerprint(active.settings) === state.pendingUpload.fingerprint, 'uploaded-worker-drift');
       state.pendingUpload.provider = {versionId:active.versionId,deploymentId:active.deploymentId,etag:active.etag};
@@ -285,12 +346,12 @@ async function deployLocked({api, target, plan, artifact, statePath, env, fetch,
     onReceipt: async candidate => { if (candidate.changed || !state.receipt) { state.receipt = candidate; delete state.pendingUpload; await save(); } },
     // Keep each first-health attempt beside the identity it belongs to.
     onHealth: async candidate => { if (candidate.changed) { state.receipt = candidate; await save(); } }});
-  return {receipt, created:create.map(({kind,item}) => `${kind}:${item.name}`)};
+  return {receipt, created:create.map(({kind,item}) => `${kind}:${item.name}`), sentSecrets};
 }
 
 /** Independent read-only health of the last owner deployment recorded in the state file. */
 export async function ownerHealth({api: provider, target, plan, statePath, fetch = globalThis.fetch, healthOptions = {}}) {
-  const api = withScopeHints(provider);
+  const api = withSettledLists(withScopeHints(provider));
   validatePlan(plan); assertOwnerNames(target, plan);
   const state = await readOwnerState(statePath, target);
   assert(state.receipt, 'missing-owner-receipt');

package/modules/deploy-kit/provider.mjs

@@ -1,11 +1,30 @@
+import { recordDeployFailure } from './diagnostics.mjs';
+import { importD1, importUploadURL } from './d1-import.mjs';
 import { assert, hexId } from './validation.mjs';
 
-export async function boundedJSON(response, limit = 4 * 1024 * 1024) {
+async function boundedText(response, limit = 4 * 1024 * 1024, onReadError) {
   assert(response.body, 'empty-response');
   const reader = response.body.getReader(); const chunks = []; let length = 0;
-  try { while (true) { const { done, value } = await reader.read(); if (done) break; length += value.length; assert(length <= limit, 'response-too-large'); chunks.push(value); } }
+  try { while (true) {
+    let chunk;
+    // Only a failed stream read is transport failure; retain size/shape codes.
+    try { chunk = await reader.read(); } catch (cause) { throw onReadError ? onReadError(cause) : cause; }
+    const { done, value } = chunk; if (done) break;
+    length += value.length; assert(length <= limit, 'response-too-large'); chunks.push(value);
+  } }
   finally { await reader.cancel().catch(() => {}); }
-  try { return JSON.parse(Buffer.concat(chunks).toString('utf8')); } catch { throw new Error('malformed-response'); }
+  return Buffer.concat(chunks).toString('utf8');
+}
+export async function boundedJSON(response, limit) {
+  try { return JSON.parse(await boundedText(response,limit)); } catch (error) { if (error instanceof SyntaxError) throw new Error('malformed-response'); throw error; }
+}
+function transportOutput(error) {
+  const lines = []; const seen = new Set();
+  for (let cause = error; cause && !seen.has(cause) && seen.size < 4; cause = cause.cause) {
+    seen.add(cause);
+    lines.push([typeof cause.code === 'string' ? cause.code : '', typeof cause.message === 'string' ? cause.message : ''].filter(Boolean).join(': '));
+  }
+  return lines.filter(Boolean).join('\n');
 }
 /** Only this fixed origin and the explicitly selected account ever receive the token. */
 export function cloudflare({ accountId, token, fetch: request = globalThis.fetch, timeoutMs = 30000, maxRequests = 500 }) {
@@ -18,15 +37,36 @@ export function cloudflare({ accountId, token, fetch: request = globalThis.fetch
     assert(!zone || /^\/zones(?:[/?]|$)/.test(path), 'invalid-provider-path');
     assert(++requests <= maxRequests, 'provider-request-budget');
     assert(!assetToken || path === '/workers/assets/upload?base64=true', 'invalid-asset-auth-target');
+    // Asset-session credentials are discovered at runtime, outside the CLI env.
+    // Preserve complete text for the CLI's remaining redaction before truncation.
+    const redactAuth = text => /\/d1\/database\/[^/]+\/import$/.test(path) ? '[D1 import details omitted]' : [accountId,token,assetToken].filter(Boolean).flatMap(value=>[value,encodeURIComponent(value),JSON.stringify(value).slice(1,-1)]).sort((a,b)=>b.length-a.length).reduce((value,secret)=>value.split(secret).join('[REDACTED]'),text);
+    const transportFailure = cause => recordDeployFailure(new Error('provider-transport-failed'),{output:redactAuth(transportOutput(cause))});
     const signal = AbortSignal.timeout(timeoutMs);
     let response;
     try { response = await request(zone ? `https://api.cloudflare.com/client/v4${path}` : `https://api.cloudflare.com/client/v4/accounts/${accountId}${path}`, {
       method, redirect: 'error', signal, headers: { Authorization: `Bearer ${assetToken ?? token}`, ...(body && !(body instanceof FormData) ? { 'Content-Type':'application/json' } : {}) },
       ...(body === undefined ? {} : { body: body instanceof FormData ? body : JSON.stringify(body) }),
-    }); } catch { throw new Error('provider-transport-failed'); }
-    if (!response.ok) { const error = new Error(`provider-http-${response.status}`); error.status = response.status; await response.body?.cancel(); throw error; }
-    const payload = await boundedJSON(response);
+    }); } catch (cause) { throw transportFailure(cause); }
+    const output = response.body ? await boundedText(response,undefined,transportFailure) : '';
+    let payload;
+    try { payload = JSON.parse(output); } catch { if (response.ok) throw new Error('malformed-response'); }
+    if (!response.ok || payload?.success === false) {
+      const error = new Error(response.ok ? 'provider-unsuccessful-or-malformed' : `provider-http-${response.status}`);
+      error.status = response.status;
+      throw recordDeployFailure(error,{providerCodes:(Array.isArray(payload?.errors) ? payload.errors : []).filter(x => Number.isSafeInteger(x?.code)).map(x=>x.code).slice(0,8),
+        output:redactAuth(Array.isArray(payload?.errors) ? payload.errors.filter(x=>typeof x?.message==='string').map(x=>x.message).join('\n') : output)});
+    }
     assert(payload?.success === true && Object.hasOwn(payload,'result') && (!payload.errors || Array.isArray(payload.errors) && !payload.errors.length), 'provider-unsuccessful-or-malformed');
+    if (/^\/d1\/database\/[^/]+\/query$/.test(path) && Array.isArray(payload.result)) {
+      const failed = payload.result.filter(row => row?.success === false);
+      if (failed.length) {
+        // D1 can fail inside a successful HTTP/API envelope. Read only typed
+        // error fields; query results and metadata are never diagnostic output.
+        const errors = failed.flatMap(row => [typeof row.error === 'string' ? {message:row.error} : row.error, ...(Array.isArray(row.errors) ? row.errors : [])]);
+        throw recordDeployFailure(new Error('d1-query-failed'),{providerCodes:errors.filter(error=>Number.isSafeInteger(error?.code)).map(error=>error.code).slice(0,8),
+          output:redactAuth(errors.filter(error=>typeof error?.message==='string').map(error=>error.message).join('\n'))});
+      }
+    }
     return payload;
   }
   async function list(path, { field, pagination = 'page' } = {}) {
@@ -97,6 +137,18 @@ export function cloudflare({ accountId, token, fetch: request = globalThis.fetch
     }
     throw new Error('provider-pagination-limit');
   }
-  return { accountId, envelope, list, async request(path, options) { return (await envelope(path, options)).result; },
+  async function upload(url, bytes, etag) {
+    const destination = importUploadURL(url);
+    assert(++requests <= maxRequests, 'provider-request-budget');
+    let response;
+    try {
+      response = await request(destination, { method:'PUT', redirect:'error', signal:AbortSignal.timeout(timeoutMs), headers:{'Content-Length':String(bytes.length)}, body:bytes });
+    } catch { throw new Error('d1-import-upload-transport-failed'); }
+    // Upload bodies and signed URLs are never diagnostics, including on failure.
+    await response.body?.cancel().catch(() => {});
+    assert(response.status === 200, 'd1-import-upload-failed');
+    assert(response.headers.get('etag')?.replace(/^"|"$/g, '') === etag, 'd1-import-upload-etag-mismatch');
+  }
+  return { accountId, envelope, list, importSql(id, sql) { return importD1({envelope,upload}, id, sql); }, async request(path, options) { return (await envelope(path, options)).result; },
     async zoneRequest(path, options = {}) { return (await envelope(path, { ...options, zone: true })).result; } };
 }

package/modules/job-queue/config.mjs

@@ -1,4 +1,4 @@
-import { cpus, totalmem, userInfo } from 'node:os';
+import { cpus, totalmem, homedir } from 'node:os';
 import { readFile } from 'node:fs/promises';
 import { resolve } from 'node:path';
 
@@ -9,8 +9,10 @@ const names = { slots: 'SLOTS', loadThreshold: 'LOAD_THRESHOLD',
   minFreeMemoryBytes: 'MIN_FREE_MEMORY_BYTES', pollMs: 'POLL_MS',
   nice: 'NICE', killGraceMs: 'KILL_GRACE_MS' };
 
+export const jobsDirectory = (env = process.env) => resolve(env.RER_JOBS_DIR ?? `${env.HOME || homedir()}/.rer/jobs`);
+
 export async function configuration({ env = process.env, ...overrides } = {}) {
-  const directory = resolve(overrides.directory ?? env.RER_JOBS_DIR ?? `${userInfo().homedir}/.rer/jobs`);
+  const directory = resolve(overrides.directory ?? jobsDirectory(env));
   let disk = {};
   try { disk = JSON.parse(await readFile(resolve(directory, 'config.json'), 'utf8')); }
   catch (error) { if (error.code !== 'ENOENT') throw error; }

package/modules/operator-auth/accounts/native.mjs

@@ -111,7 +111,7 @@ export function createNativeAuth({ accounts, proofs, db, config, clock, hooks, m
     // explicit refusals, never apparently successful writes to an unused store.
     ...Object.fromEntries(['invite', 'listOperators', 'cancelInvitation', 'setOperatorStatus', 'setRole', 'listSessions', 'revokeSession',
       'listDomainRules', 'setDomainRule', 'unlinkProvider', 'relinkProvider', 'mintCredential', 'authenticateCredential'].map(k => [k, unavailable])),
-    native: true, presentation: config.branding, accounts, admission, providers,
+    native: true, presentation: config.branding, emailSignInAvailable: Boolean(mailSender), accounts, admission, providers,
     requestMagicLink: email.requestMagicLink, previewLink: email.previewLink, confirmLink: email.confirmLink,
     requestStepUp: email.requestStepUp, requireStepUp: email.requireStepUp,
     ...legacyAdmission({ admission, config, policyVersion }),

package/modules/operator-auth/dev/badge.mjs

@@ -5,7 +5,7 @@ import { escapeHtml } from '../http.mjs';
 // starts after it and nothing is ever covered. A grid body (the frames that
 // centre their card) gives the bar its own auto row and keeps the card centred
 // in the rest.
-const STYLE = 'body:has(>#rer-dev-badge){grid-template-rows:auto 1fr}#rer-dev-badge{grid-column:1/-1;justify-self:stretch;align-self:start;position:relative;z-index:2147483647;box-sizing:border-box;width:100%;margin:0 0 12px;padding:6px 12px;border-radius:8px;background:#111827;color:#f9fafb;font:13px/1.5 system-ui,sans-serif;text-align:left}#rer-dev-badge summary{cursor:pointer;overflow-wrap:anywhere}#rer-dev-badge ul{margin:6px 0 0;padding:0;list-style:none;display:flex;flex-wrap:wrap;gap:4px 16px}#rer-dev-badge li{margin:0}#rer-dev-badge a{display:inline-block;min-height:24px;color:#bfdbfe;text-decoration:underline}#rer-dev-badge a[aria-current]{color:#fff;font-weight:700}#rer-dev-badge a:focus-visible,#rer-dev-badge summary:focus-visible{outline:2px solid #fff;outline-offset:2px}';
+const STYLE = 'body:has(>#rer-dev-badge){grid-template-rows:auto 1fr}#rer-dev-badge{grid-column:1/-1;justify-self:stretch;align-self:start;position:relative;z-index:2147483647;box-sizing:border-box;width:100%;margin:0 0 12px;padding:6px 12px;border-radius:8px;background:#111827;color:#f9fafb;font:13px/1.5 system-ui,sans-serif;text-align:left}#rer-dev-badge summary{min-width:24px;min-height:24px;cursor:pointer;overflow-wrap:anywhere}#rer-dev-badge ul{margin:6px 0 0;padding:0;list-style:none;display:flex;flex-wrap:wrap;gap:4px 16px}#rer-dev-badge li{margin:0}#rer-dev-badge a{display:inline-block;min-width:24px;min-height:24px;color:#bfdbfe;text-decoration:underline}#rer-dev-badge a[aria-current]{color:#fff;font-weight:700}#rer-dev-badge a:focus-visible,#rer-dev-badge summary:focus-visible{outline:2px solid #fff;outline-offset:2px}';
 let styleHash;
 async function sha256(text) {
   const bytes = await crypto.subtle.digest('SHA-256', new TextEncoder().encode(text));
@@ -39,6 +39,9 @@ function allow(policy, directive, source) {
 
 /** Adds the fragment key exchange (root only) and the badge to an HTML document. */
 export async function decorate(response, { exchange, badge }) {
+  // The Lobby is deliberately script-free. RER_OPEN uses /__dev/key, whose
+  // dedicated document exchanges the fragment under its own exact-hash CSP.
+  if (response.headers.get('x-rer-document') === 'lobby') exchange = false;
   if ((!exchange && !badge) || !response.headers.get('content-type')?.toLowerCase().startsWith('text/html') || !response.body) return response;
   let bar = '', scripts = '';
   const headers = new Headers(response.headers);

package/modules/operator-auth/identity/oidc/README.md

@@ -145,6 +145,24 @@ sign-in page, which offers the email link instead of redirecting. A hidden
 provider is checked again at most once a minute, after the page answers
 (`waitUntil`), and shown again once a check succeeds.
 
+Connection health is separate from the pin's `status`. `list().linked` and
+`links().healthy` require a successfully exchanged, signature- and claim-verified
+ID token for the current `linkedAt` generation, with no subsequent provider-side
+exchange or reachability failure. A token endpoint's HTTP 400 `invalid_grant`
+refuses the bad or replayed code without changing connection health. Network
+failures, HTTP 5xx, `invalid_client`, and invalid ID tokens or JWKS still invalidate
+exchange health. A pin created by discovery alone is not healthy. Successful
+discovery or a JWKS probe cannot clear exchange failure; a valid new exchange
+can. Application membership and admission remain separate from provider health.
+The existing health table stores exchange observations under reserved
+`exchange:<id>:<linkedAt>` keys (configured IDs cannot contain colons), so older
+stores need no schema change. Writes fence the current pin and prune obsolete
+exchange generations. Relinking therefore requires fresh exchange proof.
+
+After upgrading, existing provider links show **not linked** until the next
+successful sign-in through **each provider**, because older stores have no
+verified exchange observation for those links.
+
 ## Storage and limits
 
 `oa_oidc_transactions` stores domain-separated HMAC hashes of state, binding and