@runeditrun/rer 0.2.0 → 0.2.2

package/modules/operator-auth/identity/oidc/config.mjs

@@ -1,3 +1,4 @@
+import { configureBranding } from '../../branding.mjs';
 import { normalizeEmail } from '../../policy.mjs';
 import { isLoopbackHost } from '../../http.mjs';
 import { check } from './errors.mjs';
@@ -73,6 +74,7 @@ function provider(input, origin) {
 
 export function configure(input) {
   try {
+    const { signInPath } = configureBranding({ signInPath: input.signInPath });
     const origin = new URL(input.origin);
     check(origin.origin === input.origin && !origin.username && !origin.password);
     const local = input.local === true;
@@ -85,11 +87,11 @@ export function configure(input) {
     check(new Set(callbacks).size === providers.length);
     // Auth routes, owner-claim handlers and the local dev gate retain their
     // handlers even when an edition chooses its own OIDC callback pathname.
-    const reserved = new Set([input.signInPath ?? '/signin', '/auth/owner-claim', '/auth/dev/enter', '/__dev/personas', '/__dev/key', '/auth/bootstrap', '/auth/magic-link', '/auth/confirm', '/auth/signout', '/auth/session', '/auth/invite', '/auth/invite/cancel', '/auth/review-session', '/auth/operators', '/auth/sessions', '/auth/operator/status', '/auth/operator/role', '/auth/session/revoke', '/auth/step-up', '/auth/domain-rules', '/auth/providers', '/auth/providers/unlink', '/auth/providers/relink', '/auth/settings/identity', '/auth/setup-complete']);
+    const reserved = new Set([new URL(signInPath, origin).pathname, '/auth/owner-claim', '/auth/dev/enter', '/__dev/personas', '/__dev/key', '/auth/bootstrap', '/auth/magic-link', '/auth/confirm', '/auth/signout', '/auth/session', '/auth/invite', '/auth/invite/cancel', '/auth/review-session', '/auth/operators', '/auth/sessions', '/auth/operator/status', '/auth/operator/role', '/auth/session/revoke', '/auth/step-up', '/auth/domain-rules', '/auth/providers', '/auth/providers/unlink', '/auth/providers/relink', '/auth/settings/identity', '/auth/setup-complete']);
     check(callbacks.every((path, index) => !reserved.has(path) && !path.startsWith('/.well-known/') && !path.startsWith('/auth/dependencies/') && !providers.some(p => path === p.startPath) && (!path.startsWith('/auth/oidc/') || path === `/auth/oidc/${providers[index].id}/callback`)));
 
     return Object.freeze({ origin: input.origin, local, secure: origin.protocol === 'https:', transactionSecret: input.transactionSecret, providers: Object.freeze(providers),
-      signInPath: input.signInPath ?? '/signin',
+      signInPath,
       transactionSeconds: integer(input.transactionSeconds, 600, 60, 900), timeoutMs: integer(input.timeoutMs, 5000, 100, 15000),
       clockSkewSeconds: integer(input.clockSkewSeconds, 30, 0, 120), maxTokenAgeSeconds: integer(input.maxTokenAgeSeconds, 600, 60, 3600),
       startLimit: integer(input.startLimit, 30, 1, 1000) });

package/modules/operator-auth/identity/oidc/index.d.mts

@@ -29,5 +29,5 @@ export const HIDE_AFTER_MS: number;
 export const MINIMUM_PROVIDER_VERSION: string;
 export const PRESETS: Readonly<Record<'auth' | 'google' | 'microsoft' | 'okta' | 'legacy-rs256', { label: string; algorithms: string[]; methods: string[]; email: 'verified-at' | 'google' | 'subject' | 'legacy-verified' }>>;
 export function createOidcProviders<R extends string>(options: OidcProvidersOptions<R>): IdentityProviders;
-export function createOidcHandler(providers: IdentityProviders): (request: Request) => Promise<Response | null>;
+export function createOidcHandler(providers: IdentityProviders, options?: { signInPath?: string }): (request: Request) => Promise<Response | null>;
 export class OidcError extends Error { constructor(code: string, status?: number); code: string; status: number }

package/modules/operator-auth/identity/oidc/index.mjs

@@ -8,13 +8,23 @@ import { configure } from './config.mjs';
 import { check, OidcError } from './errors.mjs';
 import { random, isRandom, digest, keyedHash, seal, unseal } from './crypto.mjs';
 import { storage } from './store.mjs';
-import { discover, exchange, readJson } from './network.mjs';
+import { discover, exchange, readJson, GrantRejected } from './network.mjs';
 import { parseIdToken, knowsKey, verifyIdToken, principalOf } from './jwt.mjs';
 import { PRESETS, MINIMUM_PROVIDER_VERSION } from './presets.mjs';
 import { refuseInProduction } from '../principal.mjs';
 export { OidcError } from './errors.mjs';
 export { PRESETS, MINIMUM_PROVIDER_VERSION } from './presets.mjs';
 
+// Separate reachability from a verified exchange; discovery must never reset
+// exchange failure or certify a new registration. IDs cannot contain ':'.
+const exchangeKey = link => `exchange:${link.id}:${link.linkedAt}`;
+const working = (link, health) => {
+  const exchange = link && health.get(exchangeKey(link));
+  const reachability = link && health.get(link.id);
+  return link?.status === 'linked' && !!exchange && exchange.failingSince === null && exchange.hardFailureAt === null
+    && (!reachability || reachability.failingSince === null && reachability.hardFailureAt === null);
+};
+
 export const HIDE_AFTER_MS = 5 * 60000;
 const PROBE_EVERY_MS = 60000;
 
@@ -43,7 +53,9 @@ function errorResponse(error, config, request, clearCookie) {
   if (clearCookie) headers.append('Set-Cookie', clearCookie);
   const code = known ? error.code : 'oidc_unavailable';
   if (request && /\btext\/html\b/.test(request.headers.get('accept') ?? '')) {
-    headers.set('Location', `${config.signInPath}?notice=${encodeURIComponent(code)}`);
+    const location = new URL(config.signInPath, 'https://signin.invalid');
+    location.searchParams.set('notice', code);
+    headers.set('Location', location.pathname + location.search + location.hash);
     return new Response(null, { status: 303, headers });
   }
   return Response.json({ error: code }, { status: known ? error.status : 503, headers });
@@ -187,15 +199,20 @@ export function createOidcProviders({ admission, db, config: input, clientIp, fe
       if (url.searchParams.has('error')) { check(!url.searchParams.has('code')); throw new OidcError('oidc_provider_denied', 401); }
       const code = url.searchParams.get('code');
       check(typeof code === 'string' && code.length <= 4096 && /^[\x21-\x7e]+$/.test(code));
-      const tokens = await exchange(fetcher, link, view, config, code, transaction.verifier, clock());
-      let claims;
+      let tokens, claims;
       try {
+        tokens = await exchange(fetcher, link, view, config, code, transaction.verifier, clock());
         const parsed = parseIdToken(tokens.id_token, link);
         const keys = await keysFor(provider, link, parsed.header.kid);
         claims = await verifyIdToken(parsed, keys, link, view, config, transaction, { ...tokens, code }, clock());
-      } catch (error) { if (error instanceof OidcError && error.status !== 400) throw error; throw new OidcError(error instanceof OidcError ? error.code : 'oidc_invalid_response'); }
+      } catch (error) {
+        if (!(error instanceof GrantRejected) && error?.code !== 'oidc_storage_unavailable') await store.exchangeHealth(link, false, error?.hard === true, clock());
+        if (error instanceof OidcError && error.status !== 400) throw error;
+        throw new OidcError(error instanceof OidcError ? error.code : 'oidc_invalid_response');
+      }
       check(clock() < transaction.expiresAt, 'oidc_invalid_correlation');
       check(transaction.policyVersion === await policyVersion() && await enabled(), 'oidc_sign_in_disabled', 403);
+      await store.exchangeHealth(link, true, false, clock());
       const providerPin={id:link.id,issuer:link.issuer,clientId:link.clientId,linkedAt:link.linkedAt};
       if (Object.hasOwn(claims,'install_owner')) {
         check(typeof claim === 'function','oidc_claim_refused',403);
@@ -214,6 +231,7 @@ export function createOidcProviders({ admission, db, config: input, clientIp, fe
   }
   return Object.freeze({
     ids: Object.freeze([...providers.keys()]),
+    signInPath: config.signInPath,
     begin, callback,
     callbackPaths: Object.freeze(Object.fromEntries([...providers.values()].map(p => [new URL(p.redirectUri).pathname, p.id]))),
     /** The sign-in page's list: a provider is hidden while unlinked or unreachable. */
@@ -231,7 +249,7 @@ export function createOidcProviders({ admission, db, config: input, clientIp, fe
         // Where the start route sends the browser: a form posting there needs it in form-action.
         const authorizationOrigins = link ? [new URL(link.authorization).origin] : [...provider.endpointOrigins];
         result.push({ id: provider.id, label: provider.label, preset: provider.preset, startPath: provider.startPath, authorizationOrigins,
-          visible: link?.status !== 'unlinked' && !unreachable, linked: link?.status === 'linked', pendingRelink: !!link?.pendingAt });
+          visible: link?.status !== 'unlinked' && !unreachable, linked: working(link, health), pendingRelink: !!link?.pendingAt });
       }
       // A hidden provider is checked again at most once a minute, after the page answers.
       if (stale.length) { const probes = Promise.all(stale.map(probe)); if (typeof waitUntil === 'function') waitUntil(probes); else await probes; }
@@ -253,13 +271,14 @@ export function createOidcProviders({ admission, db, config: input, clientIp, fe
       await store.unlink(id);
     },
     async links() {
-      return (await store.links()).map(({ keySet: _, keysFetchedAt: __, ...link }) => link);
+      const [links, health] = await Promise.all([store.links(), store.health()]);
+      return links.map(({ keySet: _, keysFetchedAt: __, ...link }) => ({ ...link, healthy: working(link, health) }));
     },
   });
 }
 
 // Exact routes only: /auth/oidc/<id>/start and /auth/oidc/<id>/callback.
-export function createOidcHandler(oidc) {
+export function createOidcHandler(oidc, { signInPath = oidc.signInPath ?? '/signin' } = {}) {
   return async request => {
     const path = new URL(request.url).pathname;
     const callbackId = oidc.callbackPaths?.[path];
@@ -282,6 +301,6 @@ export function createOidcHandler(oidc) {
       else { const form = new URLSearchParams(text); check(form.getAll('returnTo').length <= 1); input = { returnTo: form.get('returnTo') ?? undefined }; }
       check(input && typeof input === 'object' && !Array.isArray(input));
       return oidc.begin(request, match[1], { returnTo: input.returnTo });
-    } catch (e) { return Response.json({ error: e instanceof OidcError ? e.code : 'oidc_invalid_input' }, { status: e instanceof OidcError ? e.status : 400, headers: securityHeaders() }); }
+    } catch (e) { return errorResponse(e instanceof OidcError ? e : new OidcError('oidc_invalid_input'), { signInPath }, request); }
   };
 }

package/modules/operator-auth/identity/oidc/network.mjs

@@ -7,10 +7,13 @@ import { clientAssertion } from './client-auth.mjs';
 // or its name does not resolve (a resolver error, or the 530 a Cloudflare
 // Worker receives for an origin DNS failure).
 export class ProviderUnreachable extends OidcError { constructor() { super('oidc_provider_unavailable', 502); this.hard = true; } }
+// A rejected authorization code says nothing about the registration's health.
+// Only a bounded, valid token-endpoint HTTP 400 response can produce this type.
+export class GrantRejected extends OidcError { constructor() { super('oidc_invalid_response'); } }
 const dnsFailure = error => /\b(?:dns|getaddrinfo|enotfound|eai_again|name not resolved|could not resolve)\b/i.test(String(error?.message ?? error));
 
 // The deadline includes stream consumption; redirects never forward credentials.
-export async function readJson(fetcher, uri, settings, init = {}, maxBytes = 65536) {
+export async function readJson(fetcher, uri, settings, init = {}, maxBytes = 65536, tokenExchange = false) {
   const controller = new AbortController();
   let timer, hard = false;
   const deadline = new Promise((_, reject) => { timer = setTimeout(() => { controller.abort(); reject(new Error('deadline')); }, settings.timeoutMs); });
@@ -22,7 +25,7 @@ export async function readJson(fetcher, uri, settings, init = {}, maxBytes = 655
       catch (error) { hard = dnsFailure(error); throw error; }
       check(response.status < 300 || response.status >= 400, 'oidc_provider_redirect', 502);
       if (response.status === 404 || response.status === 530) hard = true;
-      check(response.status === 200 && !response.redirected && (!response.url || response.url === uri), 'oidc_provider_unavailable', 502);
+      check((response.status === 200 || tokenExchange && response.status === 400) && !response.redirected && (!response.url || response.url === uri), 'oidc_provider_unavailable', 502);
       check(/^application\/(?:[a-z0-9.+-]+\+)?json(?:\s*;|$)/i.test(response.headers.get('content-type') ?? ''), 'oidc_provider_unavailable', 502);
       const length = response.headers.get('content-length');
       check(!length || /^\d+$/.test(length) && Number(length) <= maxBytes, 'oidc_provider_unavailable', 502);
@@ -34,9 +37,11 @@ export async function readJson(fetcher, uri, settings, init = {}, maxBytes = 655
       for (const chunk of chunks) { bytes.set(chunk, offset); offset += chunk.byteLength; }
       const body = JSON.parse(new TextDecoder('utf-8', { fatal: true }).decode(bytes));
       check(body && typeof body === 'object' && !Array.isArray(body), 'oidc_provider_unavailable', 502);
+      if (response.status === 400 && body.error === 'invalid_grant') throw new GrantRejected();
+      check(response.status === 200, 'oidc_provider_unavailable', 502);
       return body;
     })()]);
-  } catch { if (hard) throw new ProviderUnreachable(); fail('oidc_provider_unavailable', 502); }
+  } catch (error) { if (error instanceof GrantRejected) throw error; if (hard) throw new ProviderUnreachable(); fail('oidc_provider_unavailable', 502); }
   finally { clearTimeout(timer); controller.abort(); if (reader) void reader.cancel().catch(() => {}); }
 }
 
@@ -86,7 +91,7 @@ export async function exchange(fetcher, link, provider, settings, code, verifier
     form.set('client_assertion_type', 'urn:ietf:params:oauth:client-assertion-type:jwt-bearer');
     form.set('client_assertion', await clientAssertion(provider, link, now));
   }
-  const response = await readJson(fetcher, link.token, settings, { method: 'POST', headers, body: form.toString() });
+  const response = await readJson(fetcher, link.token, settings, { method: 'POST', headers, body: form.toString() }, 65536, true);
   check(!Object.hasOwn(response, 'error') && typeof response.id_token === 'string' && (response.access_token === undefined || typeof response.access_token === 'string' && /^[\x21-\x7e]+$/.test(response.access_token))
     && (response.token_type === undefined && response.access_token === undefined || typeof response.token_type === 'string' && response.token_type.toLowerCase() === 'bearer'));
   return response;

package/modules/operator-auth/identity/oidc/store.mjs

@@ -10,6 +10,8 @@ function link(row) {
 }
 
 export function storage(db) {
+  const pruneExchange = id => db.prepare(`DELETE FROM oa_identity_provider_health WHERE provider_id LIKE ? AND provider_id NOT IN
+    (SELECT 'exchange:' || provider_id || ':' || linked_at FROM oa_identity_providers WHERE provider_id=? AND status='linked')`).bind(`exchange:${id}:%`, id);
   const guarded = async operation => { try { return await operation(); } catch { fail('oidc_storage_unavailable', 503); } };
   return {
     async limit(bucket, expiresAt, maximum) {
@@ -37,10 +39,10 @@ export function storage(db) {
     },
     // A re-link the owner approved: the configured provider replaces the pin.
     async relink(id, provider, metadata, now) {
-      return guarded(() => db.prepare(`UPDATE oa_identity_providers SET preset=?,status='linked',issuer=?,client_id=?,jwks_uri=?,authorization_endpoint=?,token_endpoint=?,algorithms=?,token_auth_method=?,
+      return guarded(() => db.batch([db.prepare(`UPDATE oa_identity_providers SET preset=?,status='linked',issuer=?,client_id=?,jwks_uri=?,authorization_endpoint=?,token_endpoint=?,algorithms=?,token_auth_method=?,
         response_iss=?,interface_version=?,linked_at=MAX(linked_at+1,?),pending_issuer=NULL,pending_client_id=NULL,pending_preset=NULL,pending_at=NULL,jwks=NULL,jwks_fetched_at=NULL
         WHERE provider_id=?`).bind(provider.preset, metadata.issuer, provider.clientId, metadata.jwks, metadata.authorization, metadata.token, JSON.stringify(metadata.algorithms), provider.tokenAuthMethod,
-        metadata.responseIssuer ? 1 : 0, metadata.interfaceVersion, now, id).run());
+        metadata.responseIssuer ? 1 : 0, metadata.interfaceVersion, now, id), pruneExchange(id)]));
     },
     // A changed configuration only records what a re-link would pin.
     pending(id, provider, now) {
@@ -48,10 +50,24 @@ export function storage(db) {
         WHERE provider_id=? AND (pending_issuer IS NOT ? OR pending_client_id IS NOT ? OR pending_preset IS NOT ?)`).bind(provider.issuer, provider.clientId, provider.preset, now, id, provider.issuer, provider.clientId, provider.preset).run());
     },
     clearPending(id) { return guarded(() => db.prepare('UPDATE oa_identity_providers SET pending_issuer=NULL,pending_client_id=NULL,pending_preset=NULL,pending_at=NULL WHERE provider_id=?').bind(id).run()); },
-    unlink(id) { return guarded(() => db.prepare("UPDATE oa_identity_providers SET status='unlinked' WHERE provider_id=?").bind(id).run()); },
+    unlink(id) { return guarded(() => db.batch([db.prepare("UPDATE oa_identity_providers SET status='unlinked' WHERE provider_id=?").bind(id), pruneExchange(id)])); },
     keys(pin, keySet, now) {
       return guarded(() => db.prepare("UPDATE oa_identity_providers SET jwks=?,jwks_fetched_at=? WHERE provider_id=? AND status='linked' AND issuer=? AND client_id=? AND linked_at=?").bind(JSON.stringify(keySet), now, pin.id, pin.issuer, pin.clientId, pin.linkedAt).run());
     },
+    // Reuse the existing health schema with a reserved phase/generation key.
+    // A late callback can neither overwrite a replacement pin's proof nor retain
+    // stale generations. The pin fence is evaluated by SQL at write time.
+    exchangeHealth(pin, healthy, hard, now) {
+      const key = `exchange:${pin.id}:${pin.linkedAt}`;
+      return guarded(() => db.batch([
+        pruneExchange(pin.id),
+        db.prepare(`INSERT INTO oa_identity_provider_health(provider_id,failing_since,hard_failure_at,checked_at)
+          SELECT ?,?,?,? WHERE EXISTS(SELECT 1 FROM oa_identity_providers WHERE provider_id=? AND status='linked' AND issuer=? AND client_id=? AND linked_at=?)
+          ON CONFLICT(provider_id) DO UPDATE SET failing_since=CASE WHEN ? THEN NULL ELSE COALESCE(failing_since,excluded.failing_since) END,
+          hard_failure_at=CASE WHEN ? THEN NULL ELSE COALESCE(excluded.hard_failure_at,hard_failure_at) END,checked_at=excluded.checked_at`)
+          .bind(key, healthy ? null : now, !healthy && hard ? now : null, now, pin.id, pin.issuer, pin.clientId, pin.linkedAt, Number(healthy), Number(healthy)),
+      ]));
+    },
     async health() {
       return guarded(async () => new Map((await db.prepare('SELECT provider_id AS id,failing_since AS failingSince,hard_failure_at AS hardFailureAt,checked_at AS checkedAt FROM oa_identity_provider_health').all()).results.map(r => [r.id, r])));
     },

package/modules/operator-auth/index.d.mts

@@ -124,10 +124,12 @@ export interface ProviderEntry { id: string; label: string; preset: ProviderPres
 export interface ProviderLink {
   id: string; preset: ProviderPreset; status: 'linked' | 'unlinked'; issuer: string; clientId: string; jwks: string; authorization: string; token: string;
   algorithms: Array<'ES256' | 'RS256'>; tokenAuthMethod: string; responseIssuer: boolean; interfaceVersion: string | null; linkedAt: number;
+  healthy?: boolean;
   pendingIssuer: string | null; pendingClientId: string | null; pendingPreset: string | null; pendingAt: number | null;
 }
 export interface IdentityProviders {
   readonly ids: readonly string[];
+  readonly signInPath?: string;
   readonly callbackPaths?: Readonly<Record<string, string>>;
   begin(request: Request, id: string, input?: { returnTo?: string }): Promise<Response>;
   callback(request: Request, id: string): Promise<Response>;
@@ -149,6 +151,8 @@ export interface OperatorAuth<R extends string = Role> {
   checkCredentialFence(credential:{personId:string;fence?:number;kind?:SessionKind},request?:Request):Promise<boolean>;
   /** Frozen public branding only; contains no credentials or auth configuration. */
   readonly presentation: AuthPresentation;
+  /** Whether this composition has a sender for email sign-in. */
+  readonly emailSignInAvailable: boolean;
   /** Linked identity providers; null when none is configured. */
   readonly providers: IdentityProviders | null;
   readonly admission: Admission<R>;
@@ -191,15 +195,8 @@ export type { NativeProofPersistence } from './identity/email-link/index.mjs';
 export function createOperatorAuth<R extends string>(options: import('./accounts/native.mjs').NativeAuthOptions<R>): import('./accounts/native.mjs').NativeOperatorAuth<R>;
 export function createOperatorAuth(options: AuthOptions): OperatorAuth;
 export function createAuthHandler<R extends string>(auth: OperatorAuth<R>): (request: Request) => Promise<Response | null>;
-export interface SignInPageOptions {
-  /** While the first owner is unclaimed: the setup form and its instructions. */
-  setup?: (request: Request) => null | false | undefined | { instructions?: string } | Promise<null | false | undefined | { instructions?: string }>;
-  /** Extra same-origin links under the form (for example the local development outbox). */
-  links?: (request: Request) => Array<{ href: string; label: string }> | Promise<Array<{ href: string; label: string }>>;
-  defaultReturnTo?: string;
-}
-/** The shared server-rendered sign-in page at branding.signInPath (GET and HEAD); null for anything else. */
-export function createSignInHandler<R extends string>(auth: OperatorAuth<R>, options?: SignInPageOptions): (request: Request) => Promise<Response | null>;
+export { createSignInHandler } from './signin/index.mjs';
+export type { SignInPageOptions } from './signin/index.mjs';
 export class AuthError extends Error { constructor(code: string, status?: number); code: string; status: number }
 export const DEFAULT_ROLES: readonly Role[];
 export function defaultRolePolicy(input: PolicyInput): boolean;

package/modules/operator-auth/page.mjs

@@ -16,7 +16,7 @@ function stylesheet(accentColor) {
 }
 
 // Form controls and notices used by the sign-in page; part of the same hashed sheet.
-const FORMS = `label{display:block;font-weight:600;margin:0 0 8px}input{display:block;width:100%;margin:0 0 16px;padding:12px 14px;border:1px solid #64748b;border-radius:10px;font:inherit;line-height:1.5;color:inherit;background:transparent}input:focus-visible{outline:3px solid #172033;outline-offset:2px}.stack{display:grid;gap:12px;margin:0 0 24px}button.secondary{background:transparent;color:inherit}.divider{display:flex;align-items:center;gap:12px;margin:0 0 24px;color:#475569;font-size:14px}.divider::before,.divider::after{content:"";flex:1;border-top:1px solid #dce2ea}.notice{border-left:4px solid #64748b;padding:8px 12px;margin:0 0 24px}h2{font-size:20px;line-height:1.4;margin:32px 0 16px}.secondary-link{margin:16px 0 0;text-align:center;font-size:15px}.secondary-link a{color:#334155;font-weight:600;text-decoration:underline;text-decoration-thickness:1px;text-underline-offset:3px}.secondary-link a:hover{text-decoration-thickness:2px}.secondary-link a:focus-visible{outline:3px solid #172033;outline-offset:2px;border-radius:2px}@media(prefers-color-scheme:dark){input:focus-visible,.secondary-link a:focus-visible{outline-color:#f8fafc}.divider{color:#cbd5e1}.divider::before,.divider::after{border-color:#475569}.secondary-link a{color:#cbd5e1}}`;
+const FORMS = `label{display:block;font-weight:600;margin:0 0 8px}input{display:block;width:100%;margin:0 0 16px;padding:12px 14px;border:1px solid #64748b;border-radius:10px;font:inherit;line-height:1.5;color:inherit;background:transparent}input:focus-visible{outline:3px solid #172033;outline-offset:2px}.stack{display:grid;gap:12px;margin:0 0 24px}button.secondary{background:transparent;color:inherit}.divider{display:flex;align-items:center;gap:12px;margin:0 0 24px;color:#475569;font-size:14px}.divider::before,.divider::after{content:"";flex:1;border-top:1px solid #dce2ea}.notice{border-left:4px solid #64748b;padding:8px 12px;margin:0 0 24px}h2{font-size:20px;line-height:1.4;margin:32px 0 16px}.secondary-link{margin:16px 0 0;text-align:center;font-size:15px}.secondary-link a{display:inline-block;min-width:24px;min-height:24px;color:#334155;font-weight:600;text-decoration:underline;text-decoration-thickness:1px;text-underline-offset:3px}.secondary-link a:hover{text-decoration-thickness:2px}.secondary-link a:focus-visible{outline:3px solid #172033;outline-offset:2px;border-radius:2px}@media(prefers-color-scheme:dark){input:focus-visible,.secondary-link a:focus-visible{outline-color:#f8fafc}.divider{color:#cbd5e1}.divider::before,.divider::after{border-color:#475569}.secondary-link a{color:#cbd5e1}}`;
 
 export async function pageResponse({ branding, title, heading, content, status = 200, method = 'GET', referrer, formTargets = [] }) {
   const css = stylesheet(branding.accentColor) + FORMS + (branding.theme ? themed(branding.accentColor) : '');

package/modules/operator-auth/routes.mjs

@@ -19,7 +19,7 @@ function notice(auth, code, extra = {}) {
 
 /** Fetch-compatible optional HTTP adapter. Returns null for paths it does not own. */
 export function createAuthHandler(auth) {
-  const oidc = auth.providers ? createOidcHandler(auth.providers) : null;
+  const oidc = auth.providers ? createOidcHandler(auth.providers, { signInPath: auth.presentation.signInPath }) : null;
   return async function handleAuth(request) {
     const url = new URL(request.url);
     const path = url.pathname;

package/modules/operator-auth/service.mjs

@@ -75,6 +75,7 @@ export function createOperatorAuth(options) {
     ...providerControl({ store, accounts, authenticate, config, clock }),
     ...fencedCredentials({store,authenticate,requireFreshProof,config,clock,hash}),
     presentation: config.branding,
+    emailSignInAvailable: Boolean(mailSender),
     /** Identity providers (null when none is configured): routes, the sign-in page's list and owner actions. */
     providers,
     /** The admission identity methods use: a verified principal in, a session out. */

package/modules/operator-auth/signin/index.d.mts

@@ -0,0 +1,11 @@
+import type { OperatorAuth } from '../index.mjs';
+
+export interface SignInPageOptions {
+  /** While the first owner is unclaimed: the setup form and its instructions. */
+  setup?: (request: Request) => null | false | undefined | { instructions?: string } | Promise<null | false | undefined | { instructions?: string }>;
+  /** Extra same-origin links under the form (for example the local development outbox). */
+  links?: (request: Request) => Array<{ href: string; label: string }> | Promise<Array<{ href: string; label: string }>>;
+  defaultReturnTo?: string;
+}
+/** The shared server-rendered sign-in page at branding.signInPath (GET and HEAD); null for anything else. */
+export function createSignInHandler<R extends string>(auth: OperatorAuth<R>, options?: SignInPageOptions): (request: Request) => Promise<Response | null>;

package/modules/operator-auth/signin/index.mjs

@@ -1,6 +1,6 @@
 // The one sign-in page every Base seed mounts. Server-rendered plain HTML forms:
 // it works before any script loads (and without one). It lists "Continue
-// with…" for each linked, reachable provider and always offers the email link;
+// with…" for each linked, reachable provider and offers a configured email link;
 // a hidden provider's button is simply absent.
 import { escapeHtml } from '../http.mjs';
 import { safeReturnTo } from '../policy.mjs';
@@ -21,11 +21,12 @@ const NOTICES = {
 };
 const UNAVAILABLE = ['alert', 'That sign-in provider is not available right now. Use the email link instead.'];
 const UNFINISHED = ['alert', 'Signing in with that provider did not finish. Try again, or use the email link.'];
-function noticeFor(code) {
+function noticeFor(code, emailAvailable) {
   if (typeof code !== 'string') return null;
+  if (code === 'oidc_admission_denied' && !emailAvailable) return ['alert', 'That account cannot sign in here. Ask an owner of this app for an invitation.'];
   if (Object.hasOwn(NOTICES, code)) return NOTICES[code];
-  if (['oidc_provider_unavailable', 'oidc_relink_required', 'oidc_provider_unlinked', 'oidc_unavailable', 'oidc_provider_version_unsupported'].includes(code)) return UNAVAILABLE;
-  return code.startsWith('oidc_') ? UNFINISHED : null;
+  if (['oidc_provider_unavailable', 'oidc_relink_required', 'oidc_provider_unlinked', 'oidc_unavailable', 'oidc_provider_version_unsupported'].includes(code)) return emailAvailable ? UNAVAILABLE : ['alert', 'That sign-in provider is not available right now. Try again later.'];
+  return code.startsWith('oidc_') ? (emailAvailable ? UNFINISHED : ['alert', 'Signing in with that provider did not finish. Try again.']) : null;
 }
 const hidden = returnTo => `<input type="hidden" name="returnTo" value="${escapeHtml(returnTo)}">`;
 
@@ -43,7 +44,9 @@ export function createSignInHandler(auth, { setup, links, defaultReturnTo = '/ap
     const returnTo = safeReturnTo(url.searchParams.get('returnTo'), defaultReturnTo);
     const providers = auth.providers ? (await auth.providers.list()).filter(p => p.visible) : [];
     const parts = [];
-    const notice = noticeFor(url.searchParams.get('notice'));
+    const emailAvailable = auth.emailSignInAvailable;
+    const notice = noticeFor(url.searchParams.get('notice'), emailAvailable)
+      ?? (!emailAvailable && !providers.length ? NOTICES.mail_unavailable : null);
     if (notice) {
       const required = providers.find(p => p.id === url.searchParams.get('provider'));
       const extra = required ? ` Addresses at this domain sign in with ${escapeHtml(required.label)}.` : '';
@@ -51,9 +54,9 @@ export function createSignInHandler(auth, { setup, links, defaultReturnTo = '/ap
     }
     if (providers.length) {
       parts.push(`<div class="stack">${providers.map(p => `<form method="post" action="${escapeHtml(p.startPath)}">${hidden(returnTo)}<button class="secondary" type="submit">Continue with ${escapeHtml(p.label)}</button></form>`).join('')}</div>`);
-      parts.push('<p class="divider">or</p>');
+      if (emailAvailable) parts.push('<p class="divider">or</p>');
     }
-    parts.push(`<form method="post" action="/auth/magic-link">${hidden(returnTo)}<label for="signin-email">Email</label><input id="signin-email" name="email" type="email" autocomplete="email" required maxlength="254"><button type="submit">Email a sign-in link</button></form>`);
+    if (emailAvailable) parts.push(`<form method="post" action="/auth/magic-link">${hidden(returnTo)}<label for="signin-email">Email</label><input id="signin-email" name="email" type="email" autocomplete="email" required maxlength="254"><button type="submit">Email a sign-in link</button></form>`);
     for (const link of (await links?.(request)) ?? []) {
       if (typeof link?.href === 'string' && /^\/(?!\/)[^\s\\]*$/.test(link.href) && typeof link.label === 'string') parts.push(`<p class="secondary-link"><a href="${escapeHtml(link.href)}">${escapeHtml(link.label)}</a></p>`);
     }

package/modules/portability/README.md

@@ -32,6 +32,34 @@ schema at construction. Apply the bookkeeping migration first. Policy fields:
 | `extraPayloads` | Named `{produce,consume}` pairs. Producers return bytes or a byte stream. Consumers receive a verified byte stream and descriptor before D1 commit. |
 | `partBytes` | Maximum part size, default 16 MiB, configurable from 1 KiB to 16 MiB. |
 
+For native local CLI transfers, declare executable policy through
+`localPortability({database, buckets, policyModule})`. `policyModule` is a
+seed-root-relative path or a `file:` URL (including `new URL('./archive-policy.mjs',
+import.meta.url)` in the seed adapter). Its real path must be a file inside the
+seed root, and its **default export** must be the policy object:
+
+```js
+const allowedDomains = new Set(['example.org']);
+export default {
+  product: 'my-product',
+  validateStaged: async ({read}) =>
+    (await read('contacts')).every(row => allowedDomains.has(row.domain)),
+};
+```
+
+The runner validates the module/export before applying data migrations. The
+native transfer worker imports that same seed-owned entry point, preserving
+functions and module-local closures. Modules should have no top-level effects:
+preflight and transfer each load them in a separate process. Archive metadata
+never selects executable policy. Invalid paths, missing/invalid default exports,
+and declaring both `policy` and `policyModule` fail closed. Serializable object
+`policy` declarations remain supported; inline functions (including nested
+schema-upgrade and payload callbacks) are refused instead of being dropped by
+JSON transport. Container transfer currently refuses `policyModule` explicitly;
+it continues to accept serializable object policies. Malformed primary or later
+journal JSON is reported once as `archive_json` with exit 2, before local data
+migrations, without echoing archive content or parser diagnostics.
+
 Default exclusions are `sqlite_%`, `_cf_%`, `d1_migrations`,
 `rer_portability_%`, `rer_mail_development_outbox`, `oa_%`, `oc_%`,
 `rer_dependency_keys`, `rer_dependency_pending` and `rer_dependency_codes`.

package/modules/portability/bridge.mjs

@@ -3,12 +3,19 @@ import { canonicalJson } from './hash.mjs';
 import { tokens, identifier, folded } from './generated.mjs';
 import { changesData } from './migration-statements.mjs';
 
-// Applied product migrations in the ledger's own order: the deploy ledger when
-// present (it covers any older Wrangler history), else Wrangler's.
+// Applied product migrations in the ledger's own order. A state-bearing D1
+// ledger may hold an unacknowledged migration whose effects are unknown; neither
+// an archive nor a restore can attest its history until that is resolved.
 export async function appliedMigrations(db) {
   const ledgers=(await all(db,"SELECT name FROM sqlite_master WHERE type='table' AND name IN ('_rer_deploy_migrations','d1_migrations')")).map(x=>x.name);
   if(ledgers.includes('_rer_deploy_migrations'))return (await all(db,"SELECT name FROM _rer_deploy_migrations WHERE state='applied' ORDER BY name")).map(x=>x.name);
-  return ledgers.includes('d1_migrations')?(await all(db,'SELECT name FROM d1_migrations ORDER BY id')).map(x=>x.name):undefined;
+  if(!ledgers.includes('d1_migrations'))return;
+  const columns=(await all(db,'PRAGMA table_info(d1_migrations)')).map(x=>x.name);
+  const tracked=columns.includes('state') || columns.includes('sha256');
+  if(tracked)insist(columns.includes('state') && columns.includes('sha256'),'schema_mismatch:migration_history',409);
+  const rows=await all(db,`SELECT name${tracked?',state':''} FROM d1_migrations ORDER BY id`);
+  if(tracked)insist(rows.every(row=>row.state==='applied'),'schema_mismatch:uncertain_migrations',409);
+  return rows.map(row=>row.name);
 }
 // Where an archive sits in the destination's applied migrations: those its
 // rows passed through (earlier) and those applied after it (unapplied).

package/modules/portability/import.mjs

@@ -8,11 +8,13 @@ import { fence, mergeJournal, tombstone } from './journal.mjs';
 import { writeObject } from './payloads.mjs';
 import { createCopy,sidecar,readCopy,restoreCopy } from './copies.mjs';
 import { excludedDependentGuards } from './restore-safety.mjs';
-import { additiveBridge, sameSchemaMigrations } from './bridge.mjs';
+import { additiveBridge, sameSchemaMigrations, appliedMigrations } from './bridge.mjs';
 import { legacyEmptyGuards, legacyAuditStatements, requireLegacyEmpty } from './legacy-safety.mjs';
 export async function createImport(context,manifest,actor='direct',legacyRecovery) {
-  const {db,config,buckets}=context;await checkManifest(manifest);await state(db);
+  const {db,config,buckets}=context;await checkManifest(manifest);
   insist(manifest.product===config.product,'wrong_product');
+  // Explicit schema upgrades can reconcile rows, but cannot attest an interrupted deployment.
+  await appliedMigrations(db);await state(db);
   const cat=await catalogue(db,config),upgrade=config.acceptedSchemas[manifest.schema];
   const same=manifest.schema===cat.identity;
   const bridge=same || upgrade?undefined:await additiveBridge(db,manifest,cat,context.migrations);

package/modules/release/README.md

@@ -212,3 +212,66 @@ tag in the private repository.
 Generated source commits and annotated tags identify Run Edit Run with the
 non-contact address `releases@runeditrun.invalid`. Provenance remains bound to
 the source commit and tree; the Git author address is not a delivery destination.
+
+## Signing and checking release receipts
+
+`rer release keygen` creates a publisher key and its proof-of-possession anchor
+entry; `rer release sign` signs a completed tagged release; and
+`rer release receipt` verifies that detached signature against a local anchor
+set. Use `--scope test` for development. The owner's production `rer` key is a
+later vault operation and is not generated during this work; the owner will
+create it directly in the vault.
+
+Key generation accepts `--scope test|rer --publisher NAMESPACE
+--github-owner LOGIN --github-owner-id ID --anchor-out FILE`, with optional
+`--not-before YYYY-MM-DDTHH:MM:SSZ`, `--not-after YYYY-MM-DDTHH:MM:SSZ` and
+repeatable `--unsigned-through PROJECT:VERSION`. `--anchor-out` receives one
+public anchor entry with its enrolment proof and pending review status; it is
+not a complete anchor set. On success the PKCS#8 private key goes to stdout
+only when stdout is not a terminal. Pipe it directly to the owner's vault;
+never send private key bytes to a terminal, repository, log or evidence. The
+signer accepts `--artifact DIR` and exactly one of `--key-file FILE` or
+`--key-stdin`, with `--scope test|rer` (default `rer`). Read production
+signing material from the vault through `--key-stdin`; `sign` never echoes it.
+`--key-stdin` refuses terminal input; pipe the key from a vault or file instead.
+
+Signing requires `release-receipt.json` to record a completed `RELEASED`
+tagged release with a created public tag. It writes the detached DSSE envelope
+as `rer-release.dsse.json` beside the receipt. The statement binds the public
+repository, tag, commit, tree and tag object, and hashes `public-source.tar`,
+`release-receipt.json`, `publish-check.json`, the bundle's single
+`site/<id>/<version>/release.json`, and every document under that bundle's
+`documents/` directory. The envelope is an artifact file; signing does not
+change the existing release or registry pins.
+
+After writing the signature, `sign` prints (but never runs) a shell-quoted
+`gh release upload` command for attaching `rer-release.dsse.json` to the
+already-created GitHub release. The emitted command has this form:
+
+```sh
+gh release upload 'TAG' '/absolute/path/rer-release.dsse.json' --repo 'OWNER/REPOSITORY'
+```
+
+Review and run the actual printed command to upload the asset. `sign` itself
+performs no upload.
+
+Receipt verification accepts `--artifact DIR --anchors FILE`, optional
+`--environment test`, and optional `--after VERSION:SHA256`; the environment
+defaults to `production`. It checks the artifact and detached signature using
+the same offline verifier used by signing. Exit 0 prints
+`{"verdict":"VERIFIED"}`; exit 1 prints a refusal code as
+`{"verdict":"REFUSED","code":"..."}`; invalid arguments exit 2. A
+Base receipt check always requires a signature and refuses a missing envelope
+with `SIGNATURE_MISSING`, even where site or service consumers accept a legacy
+unsigned listing.
+
+The dependency-free verifier source is `modules/release/signature.mjs`; it has
+no `node:` imports and is exported as
+`@runeditrun/rer/modules/release/signature`. Its default-seed portable copy is
+generated byte-for-byte at
+`default-seed/scripts/base-cli/modules/release/signature.mjs`. Shared public
+test vectors live in `modules/release/vectors/release-signature-vectors.json`
+and are generated byte-for-byte at
+`default-seed/scripts/base-cli/modules/release/vectors/release-signature-vectors.json`.
+The vectors use the existing public Octocat example repository context with synthetic bundle bytes and throwaway test keys; they do not represent an actual release.
+Consumers vendor and pin the verifier source by Base commit and SHA-256.

package/modules/release/keygen.mjs

@@ -0,0 +1,18 @@
+import { generateKeyPairSync } from 'node:crypto';
+import { loadAnchors } from './signature.mjs';
+import { publicEntry, anchorSet, validity } from './signing-key.mjs';
+import { writeNew } from './signing-io.mjs';
+
+export async function keygen(options) {
+  if (process.stdout.isTTY) throw new TypeError('ARGUMENT_INVALID');
+  const { privateKey } = generateKeyPairSync('ed25519');
+  const dates = validity(options['not-before'] ? new Date(options['not-before']) : new Date());
+  const entry = await publicEntry(privateKey, { scope: options.scope, publisher: options.publisher,
+    githubOwner: { login: options['github-owner'], id: Number(options['github-owner-id']) },
+    notBefore: options['not-before'] ?? dates.notBefore, notAfter: options['not-after'] ?? dates.notAfter,
+    unsignedThrough: options.unsignedThrough });
+  const anchors = anchorSet(entry, options.scope);
+  await loadAnchors(anchors, anchors.environment);
+  writeNew(options['anchor-out'], JSON.stringify(entry, null, 2) + '\n');
+  process.stdout.write(privateKey.export({ type: 'pkcs8', format: 'pem' }));
+}

package/modules/release/produce.mjs

@@ -121,6 +121,15 @@ export async function release({ repo, ref = 'HEAD', output, project, repository,
         // so a failed write or changed remote cannot leave a private tag.
         if (!destination) annotate(source.repo, source, source.commit);
         receipt.tag.created = true;
+        // Bind the receipt to the annotated tag in the published history.
+        // Clean/public-child exports have a different commit from the source.
+        const tagRepo = exported?.repo ?? source.repo, tagRef = `refs/tags/${source.tag}`;
+        Object.assign(receipt.publicExport, {
+          tag: source.tag,
+          tagObject: git(tagRepo, 'rev-parse', `${tagRef}^{tag}`).toString().trim(),
+          commit: git(tagRepo, 'rev-parse', `${tagRef}^{commit}`).toString().trim(),
+          tree: git(tagRepo, 'rev-parse', `${tagRef}^{tree}`).toString().trim(),
+        });
       }
     }
     if (passed && tag && destination) writePublishHandoff(output, destination, receipt);

package/modules/release/sign.mjs

@@ -0,0 +1,44 @@
+import { createPrivateKey } from 'node:crypto';
+import { resolve } from 'node:path';
+import { loadAnchors, PAYLOAD_TYPE } from './signature.mjs';
+import { readArtifact, statementFor } from './statement.mjs';
+import { verifyArtifact } from './verify.mjs';
+import { publicEntry, anchorSet, envelope, validity, timestamp } from './signing-key.mjs';
+import { SIGNATURE_FILE, readBounded, writeNew, refuse } from './signing-io.mjs';
+
+async function keyInput(options) {
+  if (options['key-file']) return readBounded(options['key-file'], 16384);
+  const chunks = []; let size = 0;
+  for await (const chunk of process.stdin) {
+    size += chunk.length;
+    if (size > 16384) refuse('INPUT_TOO_LARGE');
+    chunks.push(chunk);
+  }
+  return Buffer.concat(chunks);
+}
+
+export async function signArtifact(options) {
+  let privateKey;
+  try {
+    const bytes = await keyInput(options);
+    if (!/^-----BEGIN PRIVATE KEY-----\r?\n[\s\S]+\r?\n-----END PRIVATE KEY-----\s*$/.test(bytes.toString('ascii'))) throw new Error();
+    privateKey = createPrivateKey({ key: bytes, format: 'pem', type: 'pkcs8' });
+    if (privateKey.asymmetricKeyType !== 'ed25519') throw new Error();
+  } catch { refuse('SIGNATURE_INVALID'); }
+  const artifact = await readArtifact(options.artifact);
+  if (artifact.receipt.status !== 'RELEASED' || artifact.receipt.tag?.created !== true) refuse('SUBJECT_MISMATCH');
+  const scope = options.scope ?? 'rer', issuedAt = timestamp(new Date());
+  // This ephemeral proof checks our output, not publisher admission. The
+  // consumer still needs a separately reviewed anchor with the real owner ID.
+  const entry = await publicEntry(privateKey, { scope, publisher: artifact.subject.publisher,
+    githubOwner: { login: artifact.subject.repository.split('/')[3], id: 1 }, ...validity(new Date(issuedAt)), issuedAt });
+  const anchors = anchorSet(entry, scope);
+  const loaded = await loadAnchors(anchors, anchors.environment);
+  const statement = statementFor(artifact, entry.keyId, issuedAt);
+  const bytes = Buffer.from(JSON.stringify(envelope(privateKey, entry.keyId, PAYLOAD_TYPE, statement)) + '\n');
+  await verifyArtifact(artifact, loaded, anchors.environment, bytes);
+  const target = resolve(artifact.root, SIGNATURE_FILE);
+  writeNew(target, bytes);
+  const shell = value => `'${value.replace(/'/g, `'\\''`)}'`;
+  return `gh release upload ${shell(statement.tag)} ${shell(target)} --repo ${shell(statement.repository.slice('https://github.com/'.length))}`;
+}