@runeditrun/rer 0.2.1 → 0.2.2

package/cli/site-references.mjs

@@ -1,12 +1,162 @@
 import { memberName, stringValue, walkSyntax } from './site-syntax.mjs';
 import { localValues } from './site-bindings.mjs';
 import { browserObjects } from './site-browser-objects.mjs';
-import { markupReferences, cssReferences, markupStrings, cssStrings } from './site-markup.mjs';
+import { markupReferences, cssReferences, markupStrings, cssStrings, htmlElements } from './site-markup.mjs';
 
-export function javascriptContent(tree) {
+// A firstChild expression is not a type proof: its parent may contain an
+// object element. Admit CharacterData only from an unambiguous emitted text
+// child, consistent across all pages, with no script that can replace it.
+export function javascriptContext(documents, trees) {
+ const children = new Map();
+ // Recognize a balanced subset of ordinary HTML, rather than guessing at
+ // browser repair rules. Tables, foreign content, templates and formatting
+ // reconstruction leave every node unknown. Common page links, headings and
+ // buttons are safe when explicitly closed in their ordinary insertion mode.
+ const containers = new Set('p div span section article aside nav header footer main object a button h1 h2 h3 h4 h5 h6 ul ol li dl dt dd figure figcaption details summary'.split(' '));
+ const voids = new Set('br hr img input link meta wbr'.split(' '));
+ const raw = new Set(['script','style','title','textarea']);
+ const ordinary = new Set([...containers, ...voids, ...raw, 'html','head','body']);
+ const blocks = new Set('p div section article aside nav header footer main h1 h2 h3 h4 h5 h6 ul ol li dl dt dd figure figcaption details summary hr'.split(' '));
+ const unknown = () => ({textParents:new Set()});
+ for (const text of documents) {
+  const seen = new Set(), structure = new Set(), stack = [];
+  const tags = /<!--[\s\S]*?(?:-->|$)|<!doctype\s+html\s*>|<\/?([a-z][a-z0-9:-]*)\b((?:[^"'<>]|"[^"]*"|'[^']*')*)>|[^<]+|</gi;
+  for (let match; (match = tags.exec(text));) {
+   if (match[0] === '<') return unknown();
+   if (match[0].startsWith('<!--') && !/^<!--(?:[^<>-]|-(?!-))*-->$/.test(match[0])) return unknown();
+   if (!match[1]) continue;
+   const tag = match[1].toLowerCase();
+   if (!ordinary.has(tag)) return unknown();
+   if (match[0].startsWith('</')) {
+    if (match[2].trim() || stack.pop() !== tag) return unknown();
+    continue;
+   }
+   // Reject malformed attributes and non-void self-closing tags, which HTML
+   // parses differently from XML. Never infer text from the repaired tree.
+   if (!/^(?:\s+[^\s"'<>/=]+(?:\s*=\s*(?:"[^"]*"|'[^']*'|[^\s"'=<>`]+))?)*\s*\/?$/.test(match[2]) || (!voids.has(tag) && /\/\s*$/.test(match[2]))) return unknown();
+   if (stack.includes('head') && !['meta','link','title','style','script'].includes(tag)) return unknown();
+   if ((blocks.has(tag) && stack.includes('p')) || (['a','button','li'].includes(tag) && stack.includes(tag)) || (/^h[1-6]$/.test(tag) && stack.some(parent => /^h[1-6]$/.test(parent))) || (['dt','dd'].includes(tag) && stack.some(parent => ['dt','dd'].includes(parent)))) return unknown();
+   if (['html','head','body'].includes(tag)) {
+    if (structure.has(tag) || stack.some(parent => parent !== 'html') || (tag === 'html' && stack.length) || (tag === 'head' && structure.has('body'))) return unknown();
+    structure.add(tag);
+   }
+   const {attributes} = htmlElements(match[0])[0];
+   if ([...attributes.keys()].some(name => name.startsWith('on'))) return unknown();
+   const id = attributes.get('id');
+   if (id !== undefined) {
+    const firstText = /^[^<]*/.exec(text.slice(tags.lastIndex))[0].replace(/\0/g, '');
+    const textChild = containers.has(tag) && firstText.length > 0;
+    children.set(id, textChild && !seen.has(id) && children.get(id) !== false);
+    seen.add(id);
+   }
+   if (raw.has(tag)) {
+    if (tag === 'script' && !/^(?:|module|(?:text|application)\/(?:java|ecma)script|application\/(?:ld\+)?json)$/i.test(attributes.get('type') ?? '')) return unknown();
+    const closing = new RegExp('</' + tag + '(?=[\\s/>])[^>]*>', 'ig'); closing.lastIndex = tags.lastIndex;
+    const end = closing.exec(text);
+    if (!end || !new RegExp('^</' + tag + '\\s*>$', 'i').test(end[0])) return unknown();
+    if (tag === 'script' && /<!--|<script\b/i.test(text.slice(tags.lastIndex, end.index))) return unknown();
+    tags.lastIndex = closing.lastIndex;
+   } else if (!voids.has(tag)) stack.push(tag);
+  }
+  if (stack.length) return unknown();
+ }
+ // Include every emitted script: a different island can change the selected
+ // element, its id or its children before this assignment runs.
+ const nativeMethods = new Set(['querySelector','querySelectorAll','getElementById','getElementsByTagName','getElementsByClassName','getElementsByName','createElement','createElementNS','getAttribute','hasAttribute','addEventListener','removeEventListener','setAttribute','setAttributeNS','removeAttribute','removeAttributeNS']);
+ const reflectiveMethods = new Set(['assign','defineProperty','defineProperties','setPrototypeOf','set','deleteProperty']);
+ const writes = new Set(['id','innerHTML','outerHTML','textContent','innerText','outerText','srcdoc','document','head','firstChild','__proto__',...nativeMethods,...reflectiveMethods]);
+ const changes = new Set(['before','after','append','prepend','appendChild','removeChild','replaceChild','replaceChildren','insertBefore','insertAdjacentHTML','insertAdjacentElement','insertAdjacentText','replaceWith','remove','write','writeln','setHTML','setHTMLUnsafe','normalize','insertNode','surroundContents','extractContents','deleteContents','adoptNode','execCommand','setAttributeNode','setAttributeNodeNS','__defineGetter__','__defineSetter__']);
+ let stable = true;
+ for (const tree of trees) {
+  const values = localValues(tree), browser = browserObjects(values);
+  // A newly created metadata link appended to the head cannot replace a
+  // selected text child in the body. Its resource URLs still get checked.
+  // Requiring fresh native nodes also excludes moving an existing child out
+  // of a text parent. Any id write above still invalidates this proof.
+  const documentObject = node => {
+   const alternatives = values.origins(node);
+   return alternatives.length > 0 && alternatives.every(browser.document);
+  };
+  const plainObject = node => {
+   const receivers = values.origins(node);
+   return receivers.length > 0 && receivers.every(value => value.type === 'ObjectExpression' && value.properties.every(property => property.type === 'Property' && property.kind === 'init'));
+  };
+  // Selector, traversal and head-link proofs depend on native DOM methods.
+  // Writes to those members, including prototype mutation through reflection,
+  // remove the proof across all emitted scripts. A known fresh plain object
+  // can still receive ordinary metadata without changing the native APIs.
+  const reflectiveMutation = node => values.names(node).some(name => reflectiveMethods.has(name))
+   && ['Object','Reflect'].some(name => values.global(node.object, name));
+  const writeTargets = node => {
+   if (!node) return [];
+   if (node.type === 'ObjectPattern') return node.properties.flatMap(property => writeTargets(property.value ?? property.argument));
+   if (node.type === 'ArrayPattern') return node.elements.flatMap(writeTargets);
+   if (node.type === 'AssignmentPattern') return writeTargets(node.left);
+   if (node.type === 'RestElement') return writeTargets(node.argument);
+   return [node];
+  };
+  const headLink = node => {
+   if (node?.type !== 'CallExpression' || memberName(node.callee) !== 'appendChild' || node.arguments.length !== 1) return false;
+   const receivers = values.origins(node.callee.object), arguments_ = values.origins(node.arguments[0]);
+   return receivers.length > 0 && receivers.every(receiver => memberName(receiver) === 'head' && documentObject(receiver.object))
+    && arguments_.length > 0 && arguments_.every(value => value.type === 'CallExpression' && memberName(value.callee) === 'createElement' && value.arguments.length === 1
+     && documentObject(value.callee.object) && values.resources(value.arguments[0]).every(tag => tag.complete && tag.value.toLowerCase() === 'link'));
+  };
+  walkSyntax(tree, (node, parents) => {
+   const target = node.type === 'AssignmentExpression' ? node.left : node.type === 'UpdateExpression' || (node.type === 'UnaryExpression' && node.operator === 'delete') ? node.argument : undefined;
+   for (const write of writeTargets(target)) {
+    if (write.type === 'Identifier' && values.global(write, 'document')) stable = false;
+    if (write.type !== 'MemberExpression') continue;
+    const fields = values.names(write);
+    if ((!fields.length && !plainObject(write.object)) || fields.some(name => writes.has(name))) stable = false;
+   }
+   if (node.type === 'Property' && values.names(node).some(name => writes.has(name) || changes.has(name))) stable = false;
+   if (node.type === 'MemberExpression' && values.names(node).some(name => name === 'attributes' || changes.has(name)) && !headLink(parents.at(-1))) stable = false;
+   if (node.type === 'MemberExpression' && reflectiveMutation(node)) {
+    const call = parents.at(-1);
+    if (call?.type !== 'CallExpression' || call.callee !== node || !plainObject(call.arguments[0])) stable = false;
+   }
+   if (!['CallExpression','NewExpression'].includes(node.type)) return;
+   if (values.global(node.callee, 'eval') || values.global(node.callee, 'Function')) stable = false;
+   const appendsHeadLink = headLink(node);
+   for (const callee of values.origins(node.callee)) {
+    const methods = values.names(callee);
+    if (reflectiveMutation(callee) && !plainObject(node.arguments[0])) stable = false;
+    if (methods.some(name => changes.has(name)) && !appendsHeadLink) stable = false;
+    if (methods.some(name => ['setAttribute','setAttributeNS','removeAttribute','removeAttributeNS'].includes(name))) {
+     const index = methods.some(name => name.endsWith('NS')) ? 1 : 0, attributes = values.resources(node.arguments[index]);
+     if (attributes.some(({value, complete}) => !complete || /^(?:id|on.*)$/i.test(value))) stable = false;
+    } else if (!appendsHeadLink && node.arguments.some(argument => browser.dom(argument))) stable = false;
+    if (!appendsHeadLink && callee.type === 'MemberExpression' && (!methods.length || (browser.dom(callee.object) && methods.some(name => !nativeMethods.has(name))))) stable = false;
+   }
+  });
+ }
+ return {textParents:new Set(stable ? [...children].filter(([,text]) => text).map(([id]) => id) : [])};
+}
+
+export function javascriptContent(tree, {textParents = new Set()} = {}) {
  const values = localValues(tree), {strings, names, resources, origins, global, localClass} = values;
  const browser = browserObjects(values), found = [], literals = [], unresolved = [];
  const properties = new Set(['src','href','srcset','action','formaction','poster','data']);
+ // Unknown DOM nodes retain the data URL check. A selector or traversal
+ // alone cannot distinguish HTMLObjectElement from CharacterData.
+ const characterData = node => {
+  const alternatives = origins(node);
+  return alternatives.length > 0 && alternatives.every(value => {
+   if (value.type !== 'MemberExpression' || memberName(value) !== 'firstChild') return false;
+   const parents = origins(value.object);
+   return parents.length > 0 && parents.every(parent => {
+    if (parent.type !== 'CallExpression') return false;
+    const receivers = origins(parent.callee.object);
+    if (!receivers.length || !receivers.every(browser.document)) return false;
+    const method = memberName(parent.callee), selectors = resources(parent.arguments[0]);
+    return ['querySelector','getElementById'].includes(method) && selectors.length > 0 && selectors.every(({value, complete}) => {
+     const id = method === 'getElementById' ? value : /^#([a-z_][\w-]*)$/i.exec(value)?.[1];
+     return complete && id !== undefined && textParents.has(id);
+    });
+   });
+  });
+ };
  const elementFactory = callee => {
   const methods = names(callee);
   if (!methods.some(name => ['createElement','jsx','jsxs','jsxDEV'].includes(name)) || localClass(callee.object)) return false;
@@ -38,7 +188,7 @@ export function javascriptContent(tree) {
    if (browser.location(node.left)) add(node.right, 'location.href');
    for (const property of fields) {
     const name = property.toLowerCase();
-    if (properties.has(name) && browser.dom(object)) add(node.right, `DOM.${property}`, name === 'href' && browser.anchor(object), true, name === 'srcset');
+    if (properties.has(name) && browser.dom(object) && (name !== 'data' || !characterData(object))) add(node.right, `DOM.${property}`, name === 'href' && browser.anchor(object), true, name === 'srcset');
     if (property === 'href' && browser.location(object)) add(node.right, 'location.href');
     if (['innerHTML','outerHTML','srcdoc'].includes(property)) markup(node.right, browser.dom(object));
    }

package/global/CHANGELOG.md

@@ -1,5 +1,19 @@
 # Changelog
 
+## 0.2.2
+
+- `rer deploy` claims the hosted owner, exits cleanly when it finishes, changes and removes secrets safely, and removes the resources it created when you ask it to.
+- Local restore runs the seed's own restore-validation policies, so a seed no longer needs its own patch or adapter for them.
+- Hosted exports stay portable: the deploy kit's migration ledger is kept out of seed archives, compound D1 migrations such as triggers apply, and an archive or import target with uncertain migration history is refused.
+- Package-mode guidance in the exported docs names the commands a package-mode seed actually runs, and the local-run docs describe the sign-in outbox.
+- `rer release --help` and the job-queue help print their usage.
+- `rer describe` reports the effects a seed declares for each command instead of generic account effects.
+- Linked OIDC providers report health from the token exchange, stay healthy when one authorization code is rejected, and send failures to the configured sign-in path.
+- The run-site privacy check catches registered secrets inside prefixed base64 and accepts constant text that a client island imports.
+- Fresh rer launches provision pnpm, prefer the provisioned pnpm, keep state under your HOME, and clean up their probe processes.
+- Base can export a seed Verify workflow with source freshness checks for manual adoption.
+- Base's default seed and source import kit erase a person in bounded steps after retiring their imported custody; this kit is outside the rer npm package.
+
 ## 0.2.1
 
 - `rer release keygen` prepares publisher keys and anchor entries; `rer release sign` writes a detached signature for a completed tagged release.

package/global/README.md

@@ -22,8 +22,11 @@ refuses archives with absolute paths, `..` entries, links or devices, then runs
 the package's own `rer cli install`. A failed or refused download leaves the
 version you had selected.
 
-No installer edits shell profiles. When `~/.local/bin` is not on your PATH, the
-install prints the exact line to add for your shell. The launcher runs `node` from
+No installer edits shell profiles. The canonical launcher is `~/.local/bin/rer`.
+When that directory is absent from PATH, installation also links it into an
+existing writable, user-owned PATH directory if available, preserving foreign
+commands. Otherwise it prints one activation line to run in the current shell:
+`export PATH="$HOME/.local/bin:$PATH"` (with fish syntax for fish). The launcher runs `node` from
 PATH, so a Node upgrade does not break it. A re-run with the same build changes
 nothing; a different build is installed beside the current one, the previous one
 is kept and older ones are removed. It refuses to replace a `~/.local/bin/rer`
@@ -267,3 +270,10 @@ Anywhere: `rer list [DIR]`, `rer cli status|install|uninstall`, `rer update`,
 `rer queue NAME -- COMMAND`, `rer --version` and `rer --help`.
 
 Licence: MIT.
+
+First-party commands acquire the exact `packageManager` pnpm pin when PATH lacks
+it, verify its registry sha512 integrity and cache it under `$HOME/.rer/pnpm`.
+No global package manager installation or sudo is needed. Independent projects
+continue to run their declared commands with their own tools. Server and job
+state default to `$HOME/.rer/servers` and `$HOME/.rer/jobs`; supplied
+`RER_SERVERS_DIR` and `RER_JOBS_DIR` take precedence and are passed to older pins.

package/global/cli/install.mjs

@@ -2,10 +2,12 @@
 // version directory, switch `current` atomically, keep the previous version,
 // prune older ones and write the launcher. Never edits shell profiles.
 import { randomUUID } from 'node:crypto';
-import { chmod, cp, mkdir, readdir, readlink, realpath, rename, rm, symlink, writeFile } from 'node:fs/promises';
+import { access, constants, chmod, cp, mkdir, readdir, readlink, realpath, rename, rm, symlink, writeFile } from 'node:fs/promises';
 import { basename, join, resolve } from 'node:path';
 import { ownManifest, ownRoot, packageDigest, packageFileList } from '../package-info.mjs';
 import { installRecord, launcherOwner, launcherScript, layout } from './layout.mjs';
+import { exposeLauncher } from './path-link.mjs';
+import { shellQuote } from '../../cli/node-runtime-cache.mjs';
 import { runningDoor } from '../../cli/door.mjs';
 
 async function readLink(path) { try { return await readlink(path); } catch (error) { if (['ENOENT', 'EINVAL'].includes(error.code)) return undefined; throw error; } }
@@ -38,13 +40,20 @@ async function writeLauncher(paths) {
  await rename(temporary, paths.launcher);
 }
 
-export function pathAdvice(paths, env = process.env) {
+export async function pathAdvice(paths, env = process.env) {
  const entries = (env.PATH ?? '').split(':').filter(Boolean).map(entry => resolve(entry));
- if (entries.includes(resolve(paths.bin))) return undefined;
- const shell = basename(env.SHELL ?? '');
- if (shell === 'fish') return `${paths.bin} is not on your PATH. Run this once in fish, then open a new terminal:\n  fish_add_path $HOME/.local/bin`;
- const profile = shell === 'zsh' ? '~/.zshrc' : shell === 'bash' ? (process.platform === 'darwin' ? '~/.bash_profile' : '~/.bashrc') : '~/.profile';
- return `${paths.bin} is not on your PATH. Add this line to ${profile}, then open a new terminal:\n  export PATH="$HOME/.local/bin:$PATH"`;
+ for (const directory of entries) {
+  if (directory === resolve(paths.bin)) return undefined;
+  const candidate = join(directory, 'rer');
+  try {
+   await access(candidate, constants.X_OK);
+   const found = await launcherOwner(await realpath(candidate));
+   if (found.state === 'ours' && found.root === paths.data) return undefined;
+   break; // This command shadows the canonical launcher, even if it is later on PATH.
+  } catch (error) { if (!['ENOENT', 'EACCES', 'ENOTDIR'].includes(error.code)) throw error; }
+ }
+ if (basename(env.SHELL ?? '') === 'fish') return `Activate rer in this shell:\n  set -gx PATH ${shellQuote(paths.bin)} $PATH`;
+ return `Activate rer in this shell:\n  export PATH=${shellQuote(paths.bin)}:"$PATH"`;
 }
 
 export async function install() {
@@ -59,8 +68,8 @@ export async function install() {
  const script = launcherScript(paths.data);
  let present = false;
  try { present = await packageDigest(join(paths.versions, name)) === digest; } catch (error) { if (error.code !== 'ENOENT') throw error; }
- const advice = pathAdvice(paths);
  if (present && current === join('versions', name) && launcher.text === script && record?.channel === channel) {
+  const advice = await activation(paths, record);
   process.stdout.write(`rer ${manifest.version} is already current (${join(paths.versions, name)}). Nothing changed.\n${advice ? advice + '\n' : ''}`);
   return 0;
  }
@@ -72,8 +81,16 @@ export async function install() {
  const doorVersion = door?.versionDir && resolve(door.versionDir, '..') === await realpath(paths.versions).catch(() => resolve(paths.versions)) ? basename(door.versionDir) : undefined;
  const keep = new Set([name, previousName, doorVersion].filter(Boolean));
  for (const entry of await readdir(paths.versions)) if (!keep.has(entry) && !entry.startsWith('.staging-')) await rm(join(paths.versions, entry), { recursive: true, force: true });
- await writeFile(paths.record, JSON.stringify({ channel, previous: previousName && keep.has(previousName) ? previousName : null }, null, 2) + '\n', { mode: 0o644 });
+ await writeFile(paths.record, JSON.stringify({ channel, links: record?.links ?? [], previous: previousName && keep.has(previousName) ? previousName : null }, null, 2) + '\n', { mode: 0o644 });
  if (launcher.text !== script) await writeLauncher(paths);
+ const advice = await activation(paths, await installRecord(paths));
  process.stdout.write(`Installed rer ${manifest.version} in ${join(paths.versions, name)}.\n${paths.launcher} runs it.${previousName ? ` The previous version (${previousName}) is kept.` : ''}\n${advice ? advice + '\n' : ''}`);
  return 0;
 }
+
+async function activation(paths, record) {
+ const link = await exposeLauncher(paths);
+ const links = [...new Set([...(record?.links ?? []), ...(link ? [link] : [])])];
+ if (JSON.stringify(record?.links ?? []) !== JSON.stringify(links)) await writeFile(paths.record, JSON.stringify({ ...record, links }, null, 2) + '\n', { mode: 0o644 });
+ return link ? undefined : await pathAdvice(paths);
+}

package/global/cli/path-link.mjs

@@ -0,0 +1,30 @@
+// Offer the canonical launcher through an existing user-owned PATH directory.
+// Foreign commands and links are never replaced, including during uninstall.
+import { access, constants, lstat, readlink, symlink } from 'node:fs/promises';
+import { delimiter, isAbsolute, join, resolve } from 'node:path';
+
+export async function ownedPathLink(path, launcher) {
+ try { return (await lstat(path)).isSymbolicLink() && (await readlink(path)) === resolve(launcher); }
+ catch (error) { if (error.code === 'ENOENT' || error.code === 'EINVAL') return false; throw error; }
+}
+export async function exposeLauncher(paths, env = process.env) {
+ for (const entry of (env.PATH ?? '').split(delimiter).filter(Boolean)) {
+  const directory = resolve(entry), candidate = join(directory, 'rer');
+  if (directory === resolve(paths.bin)) return undefined;
+  try {
+   try {
+    await lstat(candidate);
+    if (await ownedPathLink(candidate, paths.launcher)) return candidate;
+    await access(candidate, constants.X_OK);
+    return undefined;
+   } catch (error) { if (error.code !== 'ENOENT') continue; }
+   // npm/npx add transient command directories; never install into them.
+   if (!isAbsolute(entry) || directory.split('/').includes('node_modules') || directory.split('/').includes('_npx')) continue;
+   const info = await lstat(directory);
+   if (!info.isDirectory() || !process.getuid || info.uid !== process.getuid() || (!(info.mode & 0o200) || (info.mode & 0o022))) continue;
+   await access(directory, constants.W_OK | constants.X_OK);
+   try { await symlink(paths.launcher, candidate); return candidate; }
+   catch (error) { if (error.code !== 'EEXIST' && error.code !== 'EACCES' && error.code !== 'EPERM') throw error; }
+  } catch (error) { if (!['ENOENT', 'EACCES', 'ENOTDIR'].includes(error.code)) throw error; }
+ }
+}

package/global/cli/status.mjs

@@ -24,7 +24,7 @@ export async function pathCommands(installRoot, env = process.env) {
   seen.add(candidate);
   try { await access(candidate, constants.X_OK); } catch { continue; }
   const target = await real(candidate);
-  const launcher = await launcherOwner(candidate);
+  const launcher = await launcherOwner(target ?? candidate);
   if (target && inside(target, ownRoot) || launcher.state === 'ours' && launcher.root && await real(launcher.root) === installRoot) self.push(candidate);
   else others.push(candidate);
  }

package/global/cli/uninstall.mjs

@@ -4,7 +4,8 @@
 // root. An npm global rer leaves other channels' installs alone.
 import { lstat, readlink, rm } from 'node:fs/promises';
 import { join } from 'node:path';
-import { launcherOwner, layout } from './layout.mjs';
+import { installRecord, launcherOwner, layout } from './layout.mjs';
+import { ownedPathLink } from './path-link.mjs';
 import { channelOf } from './status.mjs';
 
 // A folder `rer cli install` made: a versions/ directory and a `current` link into it.
@@ -26,6 +27,9 @@ export async function uninstall() {
   process.stdout.write(lines.join('\n') + '\n');
   return 0;
  }
+ for (const link of (await installRecord(paths))?.links ?? []) {
+  if (await ownedPathLink(link, paths.launcher)) { await rm(link); lines.push(`Removed ${link}.`); }
+ }
  if (launcher.state === 'ours') { await rm(paths.launcher); lines.push(`Removed ${paths.launcher}.`); }
  else if (launcher.state === 'foreign') lines.push(`Left ${paths.launcher} in place: rer cli install did not write it.`);
  if (await installRoot(root)) { await rm(root, { recursive: true, force: true }); lines.push(`Removed ${root}.`); }

package/global/launch/install-pinned.mjs

@@ -5,10 +5,14 @@
 import { spawn } from 'node:child_process';
 import { pinnedPackage } from '../checkout.mjs';
 import { packageName } from '../package-info.mjs';
+import { ensureProjectPnpm } from '../../cli/project-pnpm.mjs';
+import { RerError } from '../../cli/errors.mjs';
 import { LaunchFailure } from './failure.mjs';
 
 export async function installPinned(root, { env = process.env, output = text => process.stderr.write(text), children, signal } = {}) {
  signal?.throwIfAborted();
+ try { await ensureProjectPnpm(root, { env, signal, report: text => output(text + '\n') }); }
+ catch (error) { if (error instanceof RerError) throw new LaunchFailure(error.exitCode, error.message); throw error; }
  const child = spawn('pnpm', ['install', '--frozen-lockfile'], { cwd: root, env: { ...env, CI: 'true' }, stdio: ['ignore', 'pipe', 'pipe'] });
  children?.add(child);
  if (signal?.aborted) child.kill('SIGTERM');

package/global/main.mjs

@@ -8,7 +8,7 @@ const help = `Usage: rer VERB [FLAGS]
 
 Inside a project (the nearest OPERATIONS.json at or above this folder, or --cwd DIR),
 every verb runs that checkout's own pinned rer: the @runeditrun/rer version its package.json
-pins (installed first by rer install or rer dev), else its vendored scripts/rer.mjs.
+pins (installed first by rer install, rer setup or rer dev), else its vendored scripts/rer.mjs.
 
   rer dev              Launch a first-party checkout with no setup steps: installs dependencies,
                        sets up a local owner and a free port when needed, starts the app and prints
@@ -35,12 +35,16 @@ outbox, doctor, describe, check, release. Run rer VERB --help in a checkout for
 `;
 
 // The verbs that install an uninstalled pinned package before they run.
-const installsFirst = new Set(['install', 'check', 'describe']);
+const installsFirst = new Set(['install', 'setup', 'check', 'describe']);
 
 export async function main(argv) {
  handleBrokenPipes();
  const [verb] = argv;
  if (verb === '--version' || verb === '-v') return (await import('./version.mjs')).versionCommand(argv);
+ if (verb === 'queue' && argv.length === 2 && argv[1] === '--help') {
+  process.stdout.write('Usage: rer queue NAME -- COMMAND [ARGS]\nRun COMMAND once this computer\'s job queue admits it.\n');
+  return 0;
+ }
  // Only the zero-setup launch sets this, for its own setup child; an explicit
  // verb never inherits it.
  delete process.env[localDefaults];
@@ -54,6 +58,27 @@ export async function main(argv) {
  const target = locate(argv);
  if (target.profile === 'unsupported') { process.stderr.write(unsupportedMessage(target.root, target.version) + '\n'); return 2; }
  const first = target.profile === 'first-party', mode = first ? dispatcher(target.root).mode : undefined;
+ if (first) {
+  // Carry the effective directories to older dispatchers that used account HOME.
+  const { serversDirectory } = await import('./registry.mjs');
+  const { jobsDirectory } = await import('../modules/job-queue/config.mjs');
+  process.env.RER_SERVERS_DIR = serversDirectory(process.env);
+  process.env.RER_JOBS_DIR = jobsDirectory(process.env);
+  const bootstrap = pinnedPackage(target.root)?.ready === false && installsFirst.has(verb);
+  if ((bootstrap || ['install', 'setup', 'dev', 'preview', 'build', 'verify'].includes(verb)) && !argv.includes('--help') && !argv.includes('--stop')) {
+   const { parse } = await import('../cli/parse.mjs');
+   // The door's launch marker belongs to launchDev, which consumes it before
+   // calling the checkout's public dispatcher. Validate the same public args
+   // here, before provisioning the checkout's package manager.
+   const publicArgs = verb === 'dev' ? target.args.filter(arg => arg !== '--door-start') : target.args;
+   try { parse(publicArgs, target.root); }
+   catch (error) { process.stderr.write(error.message + '\n'); return error.exitCode ?? 2; }
+   const { ensureProjectPnpm } = await import('../cli/project-pnpm.mjs');
+   const { RerError } = await import('../cli/errors.mjs');
+   try { await ensureProjectPnpm(target.root, { report: text => process.stderr.write(text + '\n') }); }
+   catch (error) { if (!(error instanceof RerError)) throw error; process.stderr.write(error.message + '\n'); return error.exitCode; }
+  }
+ }
  if (verb === 'queue') {
   const [, name, separator, command] = argv;
   if (!name || separator !== '--' || !command) { process.stderr.write('Usage: rer queue NAME -- COMMAND [ARGS]\n'); return 2; }
@@ -61,7 +86,7 @@ export async function main(argv) {
   return (await import('../onboarding/queued-entry.mjs')).queuedCommandLine(argv.slice(1));
  }
  // A checkout that pins its own rer package runs all of it, launching included.
- // Until node_modules holds the pinned version, install, check and describe
+ // Until node_modules holds the pinned version, install, setup, check and describe
  // install it with the frozen lockfile (then run the pinned verb, so a fresh
  // clone checks with the pinned bytes), the zero-setup launch installs it
  // first, and every other verb says to install.

package/global/registry.mjs

@@ -1,11 +1,11 @@
 // Read-only view of the shared server registry that every pinned dispatcher
 // writes (RER_SERVERS_DIR, else the account's ~/.rer/servers).
 import { readFile } from 'node:fs/promises';
-import { userInfo } from 'node:os';
+import { homedir } from 'node:os';
 import { join, resolve } from 'node:path';
 import { alive } from '../modules/job-queue/identity.mjs';
 
-export const serversDirectory = (env = process.env) => resolve(env.RER_SERVERS_DIR ?? join(userInfo().homedir, '.rer/servers'));
+export const serversDirectory = (env = process.env) => resolve(env.RER_SERVERS_DIR ?? join((env.HOME || homedir()), '.rer/servers'));
 
 export async function liveServers(env = process.env) {
  let state;

package/modules/container/deploy-input.mjs

@@ -1,17 +1,13 @@
-import { open, readFile } from 'node:fs/promises';
-import { constants } from 'node:fs';
-import { join, resolve } from 'node:path';
+import { readFile } from 'node:fs/promises';
+import { join } from 'node:path';
 import { refuseLocalModels } from '../deploy-kit/local-only.mjs';
-import { LOCAL_ONLY_KEYS, localOnlyBinding } from '../deploy-kit/owner.mjs';
+import { localOnlyBinding } from '../deploy-kit/owner.mjs';
+import { readDeployEnvFile } from '../deploy-kit/env-file.mjs';
 export async function deployInputs({root,envFile,localOnlyKeys=[]}) {
  await refuseLocalModels(root);
  const declaration=JSON.parse(await readFile(join(root,'deploy.json'),'utf8'));
  if(localOnlyBinding(declaration,localOnlyKeys))throw new Error('Deploy declaration contains a local-only binding');
  if(!envFile)throw new Error('Container deploy requires --env-file with private production settings');
- const handle=await open(resolve(root,envFile),constants.O_RDONLY|constants.O_NOFOLLOW);
- let encoded;
- try{const status=await handle.stat();if(!status.isFile()||status.nlink!==1||(status.mode&0o077)!==0||(process.getuid&&status.uid!==process.getuid()))throw new Error('Deploy env file must be an owned private regular file (0600)');encoded=await handle.readFile('utf8');}finally{await handle.close();}
- const settings={};for(const line of encoded.split(/\r?\n/)){if(!line.trim()||line.trim().startsWith('#'))continue;const match=/^([A-Z][A-Z0-9_]*)=(.*)$/.exec(line);if(!match)throw new Error('Invalid deploy env file');if(Object.hasOwn(settings,match[1]))throw new Error('Repeated deploy env key');settings[match[1]]=match[2].replace(/^"(.*)"$/,'$1');}
- if([...LOCAL_ONLY_KEYS,...localOnlyKeys].some(key=>Object.hasOwn(settings,key)))throw new Error('Local-only keys are refused for deploy');
+ const settings=await readDeployEnvFile(root,envFile,localOnlyKeys);
  return{declaration,settings,encoded:Object.entries(settings).map(([key,value])=>key+'='+value).join('\n')+'\n'};
 }

package/modules/dependencies/auth.mjs

@@ -19,12 +19,13 @@ export function linkedProviders(options) {
    if(!await unclaimed())return null;
    if(native)return native.claimOwner?native.claimOwner({request,token,expectedPin}):null;
    return createIdpOwnerClaimHandler({expectedPin,db,authConfig:config,clientIp:()=>options.clientIp(request),clock:options.clock,fetch:options.fetch})(new Request(config.origin+'/auth/owner-claim',{method:'POST',headers:{Host:new URL(config.origin).host,Origin:config.origin,'Content-Type':'application/json'},body:JSON.stringify({token})}));
-  }, claimScope: unclaimed, config:{origin:config.origin,local:config.local,transactionSecret:config.OIDC_TRANSACTION_SECRET ?? config.SESSION_SECRET+'-oidc',providers:[{
+  }, claimScope: unclaimed, config:{origin:config.origin,local:config.local,signInPath:config.branding.signInPath,transactionSecret:config.OIDC_TRANSACTION_SECRET ?? config.SESSION_SECRET+'-oidc',providers:[{
    id:'auth',preset:'auth',issuer:link.issuer,clientId:link.client_id,privateKey:JSON.parse(row.private_key),
   }]}});
  }
  if(!config.dependencies) return staticProviders;
  return {
+  signInPath:config.branding.signInPath,
   ids:[...new Set(['auth',...(staticProviders?.ids??[])])],
   callbackPaths:{...staticProviders?.callbackPaths,'/auth/oidc/auth/callback':'auth'},
   async begin(...args){const p=args[1]!=='auth'?staticProviders:await current();return p?p.begin(...args):Response.json({error:'provider_unlinked'},{status:403});},

package/modules/deploy-kit/README.md

@@ -56,9 +56,9 @@ D1/Queue/DO account listings fully paginate with bounded page/request budgets. R
 
 The first receipt binds source commit SHA and tree, artifact/config SHA-256, effective deployment fingerprint, account/Worker, actual resource IDs, migration hashes, secret names and active provider deployment/version/etag. It contains no secret value. The CLI creates it exclusively at mode 0600 before the first health request; it is an identity receipt, not a claim that health passed (health attempts are added afterwards, see below). A failed health request still exits nonzero, while the retained identity allows the next explicit invocation to authenticate state without another upload. For the second deployment use the **same artifact, run/attempt and receipt**. Current provider state must match the prior receipt. The kit performs no resource creation, Worker/asset upload, SQL mutation, Cron/consumer update, or secret rewrite when unchanged. Read-only D1 queries use the provider's POST query transport; a POST is not by itself a database mutation. The receipt remains byte-identical on a repeat. Missing resources, drift or stale state fail without repair during this repeat.
 
-Opaque existing secrets are preserved by name and strict binding inheritance; values are never fetched or compared. Missing declared secrets are supplied in the upload metadata in memory only. Rotation is a separate explicit operation; changing an input value does not overwrite a deployed secret. No temporary secret files are used.
+Opaque existing secrets are preserved by name and strict binding inheritance; values are never fetched or compared. Missing declared secrets are supplied in the upload metadata in memory only. Rotation is a separate explicit operation (owner-account mode: `rer deploy --set-secret NAME`); changing an input value does not overwrite a deployed secret. No temporary secret files are used.
 
-Health independently reads current deployment/version/settings, resources, namespaces, schedules, consumers, secret presence and migration history. It requests only the authenticated account-derived `/health`, without credentials, rejects redirects/malformed/unhealthy/stale identity and reads deployment identity again afterward.
+Health independently reads current deployment/version/settings, resources, namespaces, schedules, consumers, secret presence and migration history. It requests only the authenticated account-derived `/health`, without credentials, rejects redirects/malformed/unhealthy/stale identity and reads deployment identity again afterward. A healthy answer naming another Worker version (an edge still serving the version before a secret change) is asked again within the window.
 
 `health.mjs` is Base's one health verifier. `waitForDeploymentHealth(url, options)` (formerly `deployment/health.mjs`) gives a newly published route and its bindings one bounded window, 30 seconds by default: only 404, 503 and network failures are retried, every other status and every redirect is terminal, and the final error states the last result. The standalone `health` command probes `/health` once; transient failures are recorded as failures without a retry. The library `verifyHealth` retains its bounded readiness window. After an upload, `deploy` uses the recorded readiness wait described below.
 
@@ -103,10 +103,20 @@ Ownership lives in a state file, by default `.rer/deploy/<environment>.json` und
 - **Partial failure and resume.** The kit records each create as `pending` before the request and `created` with the provider id after it. A failed create leaves `pending`. On the next run an absent pending name is created again, and a present one is refused as `uncertain-resource-create`, because a lost response cannot prove who created it. Inspect it: if it is the empty resource from the interrupted run, delete it and re-run. A Worker upload is recorded as created when the upload succeeds, so a failure after it resumes with one fresh upload. If the response to the very first upload is lost, the Worker exists but is still `pending`. The kit records the build and its fingerprint before sending an upload. With no prior receipt, the same build may recover its pending Worker only when the live fingerprint matches that intent, then resume with one fresh upload. A different build or fingerprint is refused as `uncertain-resource-create`; recover with the original build first. If the uncertain Worker cannot be authenticated, inspect it and delete it only after confirming that it is the kit-created Worker and that its Durable Object data is disposable. Back up any needed data before deleting it. Migration claims keep the rules under Migration safety.
 - **Drift.** A created resource that has gone is refused as `owned-resource-missing`; one replaced under the same name is refused as `owned-resource-replaced`. The kit never deletes or recreates them. This covers D1, KV, Queues and R2 (a bucket is identified by its creation date; a state file written before that was recorded keeps working and is not checked for that bucket). For the Worker, the live deployment (version id, deployment id and etag) must be the last receipt's before any write; someone else's upload under the same name is refused as `owned-resource-replaced` and never overwritten. Immediately before the Worker PUT, the kit rechecks every saved resource identity, including resources omitted from the current plan, then the Worker identity. A replacement during provisioning or asset upload is refused before the upload intent or receipt is saved. An interrupted successful upload may resume only when the live version id, deployment id and etag match the identity saved immediately after that upload. A historical fingerprint alone never overrides a receipt mismatch.
 - **Lost upgrade response.** If an upgrade response is lost and the live identity no longer matches the receipt, the kit refuses rather than guessing ownership. A [Cloudflare rollback](https://developers.cloudflare.com/workers/versions-and-deployments/rollbacks/) creates a new deployment, so it does not restore the recorded identity. Recover with a new environment and a fresh state path, or back up the state and any needed data, confirm ownership, and follow the cleanup under "If the state file is lost" with a fresh `--state` path.
+- **Settling listings.** Right after a create or delete, an account listing can briefly disagree with its own page counts (`provider-partial-list`: on 13 October 2026 D1's `total_count` lagged its rows by about 7 seconds after a create). Owner-mode deploy, health and removal discard such a snapshot and list again from the start for up to 30 seconds with a short backoff; a partial listing is never accepted.
 - **One run at a time.** A deploy takes an exclusive lock file, `<state file>.lock`, for the whole run and removes it at the end, even after a failure. A second run on the same state file is refused as `owner-state-locked` before any provider request. If a run was killed (power loss, `kill -9`) and no deploy is running, delete the lock file by hand.
 
 The CLI prints JSON: refusal codes and resource names only, never inputs, tokens or provider bodies.
 
+### rer deploy: inputs, the hosted owner, secret changes and removal
+
+`rer deploy` runs these steps for a seed whose adapter uses `ownerDeploy` from `cli/deploy.mjs`.
+
+- **Inputs.** Declared secrets come from the environment, then `--env-file FILE` (an owned 0600 file of `KEY=VALUE` lines), which wins. For a secret the Worker does not hold yet, rer supplies the setup manifest's owner email (`emailField`) from the local setup's private settings, and a fresh random value for each secret field the manifest generates (`generate`), such as the session secret and the setup token; a value the Worker already holds is kept. A still-missing secret stops the run before any write with a message that names it.
+- **Hosted owner.** After deploy and health pass, rer claims the setup owner on the hosted app: it POSTs the setup token to the seed's standard owner step (`hooks.owner`, by default `/auth/bootstrap`). 303 means claimed; `409 already_initialized` means an owner was already claimed and is kept. Then rer deletes the token secret from the Worker, records the new Worker version in the state file, and lists the token in `retiredSecrets`, so later plans no longer declare it. A Worker that still holds a token rer did not upload in this run (an older deploy) first gets a fresh token through the same recorded secret change. Dependency approvals that need the token run before the claim. A seed with an owner step function, an identity-provider claim, or no declared token secret claims its owner its own way.
+- **Secret changes.** `rer deploy --set-secret NAME` (value from the environment or `--env-file`, under the declaration's environment name) and `--unset-secret NAME` change one declared secret of the recorded Worker without a build. A secret change deploys a new Worker version of the same code, so rer checks the build fingerprint is unchanged and records the new version id, deployment id and etag as the receipt's provider identity: the next deploy recognises its own Worker. An unset secret is retired until it is set again. The change is recorded as pending before it is sent, and the secret listing and active deployment are read until they show it (they lag the change by seconds); a change the provider answers with an error clears that record. If a run ends before the change settles (a lost response), the next run adopts the live version only when the Worker's versions list shows exactly one version after the receipt's, it is the live one, and its script etag and build fingerprint are still the receipt's. A change made outside rer (dashboard, Wrangler), including one made after rer's own, still reads as a replacement and is refused.
+- **Removal.** `rer deploy --remove --yes` deletes what the state file says rer created for this environment: the Worker (schedules first; its Durable Objects go with it) and each D1, R2, KV and queue that is still the one rer created, after checking all of them before the first delete. A replaced or uncertain resource refuses the whole removal, except a resource whose create answer was lost: under this environment's derived name it is deleted once it is confirmed empty (a D1 with no tables, a KV namespace with no keys, an R2 bucket, which the provider refuses to delete while it holds objects); one holding data is refused as `uncertain-resource-not-empty`, and a queue, whose backlog rer cannot read, as `uncertain-resource-unverifiable` (delete it by hand if it is the empty one from the interrupted run). It then reads back that none is still listed and deletes the state file. An R2 bucket must be empty; a bucket with objects stays, the state file keeps it, and a later `--remove --yes` finishes. Resources rer did not create are never touched.
+
 ### If the state file is lost
 
 A fresh clone or CI runner has no `.rer/` directory, so the kit can no longer tell its own resources from anyone else's and refuses every later deploy as `resource-name-collision`. It is correct to refuse: the kit never adopts what it cannot prove it created. To recover, do one of these.
@@ -181,7 +191,7 @@ No Single Redirect (dynamic redirect ruleset) permission is needed. Base's refer
 
 ## Migration safety
 
-SQL files have ordered unique names and SHA-256 identities. `_rer_deploy_migrations` is permanent controller-owned history. Applied entries must be an unchanged prefix of the desired set. A new migration gets an `applying` claim before its SQL and completion marker are submitted together to the D1 batch query API. Any interrupted, failed or uncertain outcome remains blocked and must be inspected explicitly; the kit never automatically retries, rolls back user data, or marks an unknown outcome successful. Readback checks every final identity.
+SQL files have ordered unique names and SHA-256 identities. `d1_migrations` holds controller history with ordered IDs, names, timestamps, SHA-256 hashes and states. Native archives already exclude this installation table. Standard Wrangler name-only inserts remain possible, but their missing hashes/states block subsequent Base deployment pending reviewed adoption. Applied entries must be an unchanged prefix of the desired set. A new migration gets an `applying` claim before its SQL and completion marker are submitted together through the [Cloudflare D1 SQL import API](https://developers.cloudflare.com/api/resources/d1/subresources/database/methods/import/), using the same whole-file protocol as Wrangler to preserve compound trigger bodies and atomic SQL/completion. Uploads use bounded HTTPS R2 destinations, without account credentials; polling is bounded and signed URLs and import response text are never diagnostic output. Any interrupted, failed or uncertain outcome remains blocked and must be inspected explicitly; the kit never automatically retries, rolls back user data, or marks an unknown outcome successful. Readback checks every final identity.
 
 Completion preserves the original SQL bytes and always starts on a new line.
 Comment-only migrations are rejected before any provider request or ledger claim.
@@ -191,7 +201,7 @@ without treating quoted semicolons as terminators or changing migration hashes.
 
 A lexical guard rejects standalone transaction/resource control statements (`BEGIN`, `COMMIT`, `END`, `ROLLBACK`, `SAVEPOINT`, `RELEASE`, `ATTACH`, `DETACH`, `VACUUM`) at statement boundaries, including after a trigger. Bare `ROLLBACK` is also refused in conflict clauses and `RAISE`, which can roll back a batch without a standalone control statement. SQLite `CREATE [TEMP|TEMPORARY] TRIGGER` bodies and nested `CASE ... END` expressions are supported; quoted text and comments cannot create statement boundaries. Both ledger names are reserved in bare, double-quoted, backtick and bracket identifiers, including schema-qualified references. [SQLite also accepts single-quoted identifiers](https://www.sqlite.org/lang_keywords.html), so exact controller ledger names are reserved in every token, including data strings, relation names, virtual-table options and introspection arguments. Comments and longer descriptive strings remain allowed. This intentionally conservative policy does not attempt to authorize arbitrary SQLite name grammars. Incomplete quotes, block comments, parentheses, CASE expressions or trigger bodies and NUL bytes fail closed; trigger header expressions must close before BEGIN and body expressions before their statement semicolon. This guard protects controller custody; SQLite still validates application SQL syntax.
 
-Existing Wrangler `d1_migrations` records lack content hashes. Automatic adoption would fabricate historical certainty, so those installations require separately reviewed history/hash adoption before this kit proceeds. The kit can extend its own previous migrations while retaining existing application rows. Local SQLite tests prove failure rollback in the test transport; the provider's actual failure atomicity, retained data, and two-deploy no-mutation behavior remain live proof obligations. The conservative `applying` claim prevents automatic replay even if a remote batch partially commits.
+The old kit `_rer_deploy_migrations` ledger is moved atomically into `d1_migrations` only after every applied name/hash/state proves an exact desired-history prefix. An ordinary deploy performs this one-time metadata transition even for unchanged code; subsequent redeploys write nothing, and health remains read-only. Existing Wrangler `d1_migrations` records lack content hashes. Automatic adoption would fabricate historical certainty, so those installations require separately reviewed history/hash adoption before this kit proceeds unless their ordered rows exactly match a prefix already attested by the old kit ledger. That transition preserves their IDs and timestamps. The kit can extend its own previous migrations while retaining existing application rows. Local SQLite tests prove failure rollback in the test transport; the provider's actual failure atomicity, retained data, and two-deploy no-mutation behavior remain live proof obligations. The conservative `applying` claim prevents automatic replay even if a remote response is lost.
 
 ## Local operations and source templates
 
@@ -247,12 +257,20 @@ After an upload that changed the Worker, `deploy` gives `/health` a total
 90-second readiness budget (`readiness.totalMs`, never above 90000). Retries wait
 1 second, doubling to a 10-second cap, and never less than the 2-second poll of
 the standalone window: 2, 2, 4, 8, 10, 10 ... seconds. Only transport failures,
-404 and 5xx (including Cloudflare 52x) retry. A redirect, any other status, a
-malformed or unhealthy body and a deployment identity mismatch fail at once.
+404 and 5xx (including Cloudflare 52x) retry, and so does a healthy answer that
+names another Worker version (the edge still serving the previous version just
+after the upload). A redirect, any other status, a malformed or unhealthy body
+and a wrong identity from the uploaded version itself fail at once. The one
+built file then requested must answer 200; after an upload its 404, 5xx and
+transport failures are retried for up to 60 seconds, since an edge still serving
+the previous version does not have the new build's hashed files (seen live on
+13 October 2026).
 Each request is capped by both the 30-second request limit and the remaining
 budget, and no request starts at the deadline. An unchanged repeat uses the
 existing library window and does not record first-upload readiness attempts.
-The standalone CLI `health` command sends a single request. Library `verifyHealth`
+The standalone CLI `health` command sends a single request; only an answer from
+another Worker version (an edge still converging after a secret change) is asked
+again, within 30 seconds. Library `verifyHealth`
 retains the existing window, retrying only 404, 503 and network failures for
 30 seconds by default.