@runeditrun/rer 0.2.1 → 0.2.2

package/modules/deploy-kit/d1-import.mjs

@@ -0,0 +1,35 @@
+import { createHash } from 'node:crypto';
+import { assert, uuid } from './validation.mjs';
+
+// Wrangler's remote --file protocol. D1 imports execute the whole file atomically,
+// including trigger bodies; the query endpoint's semicolon splitting cannot.
+export async function importD1({ envelope, upload }, id, sql) {
+  assert(uuid(id) && typeof sql === 'string' && Buffer.byteLength(sql) <= 4 * 1024 * 1024, 'invalid-d1-import');
+  const bytes = Buffer.from(sql), etag = createHash('md5').update(bytes).digest('hex');
+  const post = async body => (await envelope(`/d1/database/${id}/import`, { method:'POST', body })).result;
+  let response = await post({ action:'init', etag });
+  if (response && Object.hasOwn(response, 'upload_url')) {
+    assert(typeof response.filename === 'string' && response.filename.length > 0 && response.filename.length <= 1024 && !/[\x00-\x1f\x7f]/.test(response.filename), 'invalid-d1-import-filename');
+    await upload(response.upload_url, bytes, etag);
+    response = await post({ action:'ingest', filename:response.filename, etag });
+  }
+  for (let polls = 0; polls < 100; polls++) {
+    // REST places errors on the envelope; validate nested errors when supplied.
+    assert(response?.success === true && response.type === 'import' && (!Object.hasOwn(response, 'errors') || Array.isArray(response.errors) && !response.errors.length), 'd1-import-failed');
+    if (response.status === 'complete') {
+      assert(Number.isSafeInteger(response.result?.num_queries) && response.result.num_queries > 0 && typeof response.result.final_bookmark === 'string' && response.result.final_bookmark.length > 0, 'd1-import-invalid-result');
+      return;
+    }
+    assert(response.status === 'active' && typeof response.at_bookmark === 'string' && response.at_bookmark.length > 0 && response.at_bookmark.length <= 1024, 'd1-import-uncertain');
+    response = await post({ action:'poll', current_bookmark:response.at_bookmark });
+  }
+  throw new Error('d1-import-poll-limit');
+}
+
+export function importUploadURL(value) {
+  assert(typeof value === 'string' && value.length <= 16384 && !/[\x00-\x20\x7f\\]/.test(value), 'invalid-d1-import-upload-url');
+  let url;
+  try { url = new URL(value); } catch { throw new Error('invalid-d1-import-upload-url'); }
+  assert(url.protocol === 'https:' && /^[a-f0-9]{32}\.r2\.cloudflarestorage\.com$/.test(url.hostname) && !url.port && !url.username && !url.password && !url.hash && url.pathname.length > 1 && url.search.length > 1, 'invalid-d1-import-upload-url');
+  return url.href;
+}

package/modules/deploy-kit/deploy.mjs

@@ -33,13 +33,14 @@ export async function deploy({api,plan,artifact,artifactSha256,previousReceipt,r
   const authenticated = previousReceipt?.fingerprint === fingerprint && previousReceipt.accountId === api.accountId && previousReceipt.worker === plan.worker && previousReceipt.provider?.versionId === existing?.versionId && previousReceipt.provider?.etag === existing?.etag && previousReceipt.provider?.deploymentId === existing?.deploymentId;
   const unchanged = priorFingerprint === fingerprint && secrets.missing.length === 0 && !migration && !(uploadWithoutReceipt && !authenticated);
   if (repeatOnly) assert(unchanged && previousReceipt?.fingerprint === fingerprint && previousReceipt?.provider?.versionId === existing?.versionId && previousReceipt?.provider?.etag === existing?.etag, 'repeat-deployment-drift');
-  const migrations = [];
-  for (const item of plan.d1) migrations.push({binding:item.binding,...await migrate(api,resources.d1.find(x => x.binding === item.binding).id,item.migrations,{apply:!unchanged})});
   if (unchanged) {
     assert(previousReceipt?.fingerprint === fingerprint && previousReceipt.accountId === api.accountId && previousReceipt.worker === plan.worker && previousReceipt.provider?.versionId === existing.versionId && previousReceipt.provider?.etag === existing.etag && previousReceipt.provider?.deploymentId === existing.deploymentId, 'no-op-requires-authenticated-prior-receipt');
     verifyBindings(existing.settings.bindings,bindings);
   }
-  else await uploadWorker(api,{plan,artifact,bindings,secrets,migration,fingerprint});
+  const migrations = [];
+  // A migration failure names its database, so the owner knows which one to inspect.
+  for (const item of plan.d1) migrations.push({binding:item.binding,...await migrate(api,resources.d1.find(x => x.binding === item.binding).id,item.migrations,{apply:!unchanged,upgrade:true}).catch(error => { error.resource ??= `d1:${item.name}`; throw error; })});
+  if (!unchanged) await uploadWorker(api,{plan,artifact,bindings,secrets,migration,fingerprint});
   const published = unchanged ? existing : await activeWorker(api,plan.worker); assert(published,'missing-deployed-worker');
   verifyBindings(published.settings.bindings,bindings);
   verifyScheduledHandler(published,plan);

package/modules/deploy-kit/diagnostics.mjs

@@ -29,6 +29,7 @@ function operation(path, options = {}) {
   if (write && path.startsWith('/workers/')) return 'upload Worker';
   return 'check Worker';
 }
+const CREATED_KINDS = {D1:'d1',R2:'r2',KV:'kv',queue:'queues'};
 export function deploymentDiagnostics(api, {onCreated} = {}) {
   const created = [];
   const recordCreated = resource => { created.push(resource); onCreated?.(resource); };
@@ -40,9 +41,18 @@ export function deploymentDiagnostics(api, {onCreated} = {}) {
       const result = await api[method](path,options);
       if (step.startsWith('create ')) recordCreated(`${step.slice(7)}:${options.body.name ?? options.body.queue_name ?? options.body.title}`);
       return result;
-    } catch (error) { throw recordDeployFailure(error,{step,created:[...created]}); }
+    } catch (error) {
+      // A failed create names the resource it asked for: a lost answer may still have created it.
+      if (step.startsWith('create ') && error.resource === undefined) error.resource = `${CREATED_KINDS[step.slice(7)]}:${options.body.name ?? options.body.queue_name ?? options.body.title}`;
+      throw recordDeployFailure(error,{step,created:[...created]});
+    }
   };
   return {...api,request:guard('request'),list:guard('list'),envelope:guard('envelope'),recordCreated,
+    async importSql(id, sql) {
+      currentStep = 'migrate D1';
+      try { return await api.importSql(id, sql); }
+      catch (error) { throw recordDeployFailure(error,{step:currentStep,created:[...created]}); }
+    },
     annotateFailure(error, step = currentStep) {
       const prior = failures.get(error);
       // Node filesystem/CLI codes are structural; their messages can hold paths

package/modules/deploy-kit/env-file.mjs

@@ -0,0 +1,26 @@
+import { open } from 'node:fs/promises';
+import { constants } from 'node:fs';
+import { resolve } from 'node:path';
+import { LOCAL_ONLY_KEYS } from './owner.mjs';
+
+/** A deploy's private settings file: an owned 0600 regular file of KEY=VALUE lines
+ * (blank lines and # comments allowed, one optional pair of double quotes). */
+export async function readDeployEnvFile(root, envFile, localOnlyKeys = []) {
+  const handle = await open(resolve(root, envFile), constants.O_RDONLY | constants.O_NOFOLLOW);
+  let encoded;
+  try {
+    const status = await handle.stat();
+    if (!status.isFile() || status.nlink !== 1 || (status.mode & 0o077) !== 0 || (process.getuid && status.uid !== process.getuid())) throw new Error('Deploy env file must be an owned private regular file (0600)');
+    encoded = await handle.readFile('utf8');
+  } finally { await handle.close(); }
+  const settings = {};
+  for (const line of encoded.split(/\r?\n/)) {
+    if (!line.trim() || line.trim().startsWith('#')) continue;
+    const match = /^([A-Z][A-Z0-9_]*)=(.*)$/.exec(line);
+    if (!match) throw new Error('Invalid deploy env file');
+    if (Object.hasOwn(settings, match[1])) throw new Error('Repeated deploy env key');
+    settings[match[1]] = match[2].replace(/^"(.*)"$/, '$1');
+  }
+  if ([...LOCAL_ONLY_KEYS, ...localOnlyKeys].some(key => Object.hasOwn(settings, key))) throw new Error('Local-only keys are refused for deploy');
+  return settings;
+}

package/modules/deploy-kit/health-request.mjs

@@ -55,6 +55,10 @@ export async function healthRequest({origin, receipt, versionId, request, timeou
   catch { attempt.errorClass = 'malformed-response'; return {attempt,transient:false}; }
   if (body?.ok !== true || body.deployment?.sourceSha !== receipt.source.sha || body.deployment?.fingerprint !== receipt.fingerprint || body.deployment?.versionId !== versionId) {
     attempt.errorClass = 'health-identity-mismatch';
+    // Right after an upload the edge can still answer from another version: that
+    // settles within the bound. The expected version answering wrongly does not.
+    const other = body?.ok === true && typeof body.deployment?.versionId === 'string' && body.deployment.versionId !== versionId;
+    return {attempt,transient:other};
   }
   return {attempt,transient:false};
 }
@@ -74,7 +78,8 @@ export async function waitHealth({origin,receipt,versionId,request,timeoutMs=300
     const result = await healthRequest({origin,receipt,versionId,request,timeoutMs:Math.max(1,Math.ceil(Math.min(timeoutMs,remaining))),offsetMs:Math.round(clock()-start)});
     attempts.push(result.attempt); await onAttempt(result.attempt,attempts);
     if (!result.attempt.errorClass) return {ok:true,versionId,attempts};
-    if (single || !result.transient) break;
+    // `single` asks once, except that an edge still answering from the previous version settles within the bound.
+    if (!result.transient || single && result.attempt.errorClass !== 'health-identity-mismatch') break;
     const rest = totalMs - (clock()-start);
     if (rest <= 0) break;
     await sleep(Math.min(Math.max(delay,MIN_DELAY_MS),rest)); delay = Math.min(delay*2,MAX_DELAY_MS);

package/modules/deploy-kit/health.mjs

@@ -46,14 +46,24 @@ export async function waitForDeploymentHealth(url, {
   throw healthError(`Deployment did not become healthy at ${url} within ${timeoutMs}ms; last result: ${lastResult}.`, lastResult === 'network error' ? 'health-transport-failed' : 'health-http-failed', lastResult);
 }
 
-/** One unauthenticated GET of a built file; anything but 200 means the browser gets no assets. */
-async function servedAsset(origin, path, request, timeoutMs) {
-  let response;
-  try { response = await request(`${origin}/${path.split('/').map(encodeURIComponent).join('/')}`,{redirect:'manual',signal:AbortSignal.timeout(timeoutMs),headers:{'Cache-Control':'no-cache'}}); }
-  catch { throw new Error('asset-transport-failed'); }
-  await response.body?.cancel().catch(() => {});
-  assert(response.status === 200 && !response.redirected,'asset-http-failed');
-  return {path,status:response.status};
+/** An unauthenticated GET of a built file; anything but 200 means the browser gets no assets.
+ * After an upload (`windowMs`), an edge still serving the previous version answers 404 for
+ * the new build's hashed files: 404, 5xx and transport failures are retried within the window. */
+async function servedAsset(origin, path, request, timeoutMs, {windowMs = 0, clock = () => performance.now(), sleep = ms => new Promise(resolve => setTimeout(resolve, ms))} = {}) {
+  const start = clock();
+  for (;;) {
+    let response, failure;
+    try { response = await request(`${origin}/${path.split('/').map(encodeURIComponent).join('/')}`,{redirect:'manual',signal:AbortSignal.timeout(timeoutMs),headers:{'Cache-Control':'no-cache'}}); }
+    catch { failure = 'asset-transport-failed'; }
+    if (response) {
+      await response.body?.cancel().catch(() => {});
+      if (response.status === 200 && !response.redirected) return {path,status:response.status};
+      failure = 'asset-http-failed';
+      if (response.redirected || response.status !== 404 && response.status < 500) throw new Error(failure);
+    }
+    if (clock() - start + 2000 > windowMs) throw new Error(failure);
+    await sleep(2000);
+  }
 }
 
 /** Authenticated provider readback, then the unauthenticated account-derived /health.
@@ -82,16 +92,26 @@ export async function verifyHealth({api,plan,receipt,fetch:request=globalThis.fe
   if (plan.workersDev === false) health = {ok:true,versionId:current.versionId,route:'none'};
   else if (readiness) health = await waitHealth({origin,receipt,versionId:current.versionId,request,timeoutMs,...readiness});
   else {
-    let response;
-    try {
-      response = await waitForDeploymentHealth(`${origin}/health`,{timeoutMs,intervalMs,attemptTimeoutMs:timeoutMs,headers:{'Cache-Control':'no-cache','Accept':'application/json'},fetchImpl:request,...(now ? {now} : {}),...(sleep ? {sleep} : {})});
-    } catch (error) { throw new Error(error.code ?? 'health-transport-failed'); }
-    assert(response.ok && response.status === 200 && !response.redirected,'health-http-failed');
-    const body = await boundedJSON(response,65536);
+    // A secret change makes a new version of the same build; until it reaches
+    // every edge, a healthy answer can still name the previous version. Ask again
+    // within the window; any other wrong identity fails at once.
+    const clock = now ?? Date.now, wait = sleep ?? (ms => new Promise(resolve => setTimeout(resolve, ms))), start = clock();
+    let body;
+    for (;;) {
+      let response;
+      try {
+        response = await waitForDeploymentHealth(`${origin}/health`,{timeoutMs,intervalMs,attemptTimeoutMs:timeoutMs,headers:{'Cache-Control':'no-cache','Accept':'application/json'},fetchImpl:request,...(now ? {now} : {}),...(sleep ? {sleep} : {})});
+      } catch (error) { throw new Error(error.code ?? 'health-transport-failed'); }
+      assert(response.ok && response.status === 200 && !response.redirected,'health-http-failed');
+      body = await boundedJSON(response,65536);
+      const other = body?.ok === true && typeof body.deployment?.versionId === 'string' && body.deployment.versionId !== current.versionId;
+      if (!other || clock() - start + intervalMs > timeoutMs) break;
+      await wait(intervalMs);
+    }
     assert(body?.ok === true && body.deployment?.sourceSha === receipt.source.sha && body.deployment?.fingerprint === receipt.fingerprint && body.deployment?.versionId === current.versionId,'health-identity-mismatch');
     health = {ok:true,versionId:current.versionId};
   }
-  if (asset && origin) health.asset = await servedAsset(origin,asset,request,timeoutMs);
+  if (asset && origin) health.asset = await servedAsset(origin,asset,request,timeoutMs,readiness ? {windowMs:60000,...(readiness.clock ? {clock:readiness.clock} : {}),...(readiness.sleep ? {sleep:readiness.sleep} : {})} : {});
   const after = await activeWorker(api,plan.worker);
   assert(after.versionId === current.versionId && after.deploymentId === current.deploymentId && after.etag === current.etag,'deployment-changed-during-health');
   await verifyServiceGrants(api, plan);

package/modules/deploy-kit/migration-ledger.mjs

@@ -0,0 +1,48 @@
+import { assert } from './validation.mjs';
+
+export const ledger = 'd1_migrations';
+const legacy = '_rer_deploy_migrations';
+export const literal = value => `'${value.replaceAll("'","''")}'`;
+export const createLedger = `CREATE TABLE ${ledger} (id INTEGER PRIMARY KEY AUTOINCREMENT, name TEXT NOT NULL UNIQUE, applied_at TEXT NOT NULL DEFAULT CURRENT_TIMESTAMP, sha256 TEXT, state TEXT CHECK(state IN ('applying','applied')))`;
+const validPrefix = (rows, migrations) => rows.every((row, index) => row.name === migrations[index]?.name && row.sha256 === migrations[index]?.sha256 && row.state === 'applied');
+const same = (a, b) => a.length === b.length && a.every((row, index) => row.name === b[index].name && row.sha256 === b[index].sha256 && row.state === b[index].state);
+
+export async function readLedger(api, id, migrations, query) {
+  const read = async sql => (await query(api, id, sql))[0].results;
+  const tables = (await read(`SELECT name FROM sqlite_master WHERE type='table' AND name IN ('${legacy}','${ledger}')`)).map(row => row.name);
+  let old = [], applied = [], transition = '';
+  if (tables.includes(legacy)) {
+    const columns = await read(`SELECT name FROM pragma_table_info('${legacy}')`);
+    assert(columns.length === 3 && columns.every(row => ['name','sha256','state'].includes(row.name)), 'invalid-migration-ledger');
+    old = await read(`SELECT name, sha256, state FROM ${legacy} ORDER BY name`);
+    assert(validPrefix(old, migrations), 'changed-or-uncertain-migration-history');
+  }
+  if (tables.includes(ledger)) {
+    const columns = (await read(`SELECT name FROM pragma_table_info('${ledger}')`)).map(row => row.name);
+    assert(['id','name','applied_at'].every(name => columns.includes(name)), 'invalid-migration-ledger');
+    if (columns.includes('sha256') && columns.includes('state')) {
+      applied = await read(`SELECT name, sha256, state FROM ${ledger} ORDER BY id`);
+      assert(validPrefix(applied, migrations), 'changed-or-uncertain-migration-history');
+      if (tables.includes(legacy)) assert(same(applied, old), 'changed-or-uncertain-migration-history');
+    } else {
+      assert(!columns.includes('sha256') && !columns.includes('state'), 'invalid-migration-ledger');
+      const prior = await read(`SELECT name FROM ${ledger} ORDER BY id`);
+      // Names alone cannot attest historical bytes. Only an already verified kit
+      // prefix can supply hashes; preserve Wrangler row IDs and timestamps.
+      assert(prior.length <= old.length && prior.every((row,index) => row.name === old[index].name), 'legacy-migration-history-needs-reviewed-hash-adoption');
+      transition += `ALTER TABLE ${ledger} ADD COLUMN sha256 TEXT;\nALTER TABLE ${ledger} ADD COLUMN state TEXT;\n`;
+      for (const row of old.slice(0,prior.length)) transition += `UPDATE ${ledger} SET sha256=${literal(row.sha256)}, state='applied' WHERE name=${literal(row.name)};\n`;
+      for (const row of old.slice(prior.length)) transition += insert(row);
+      applied = old;
+    }
+  } else if (tables.includes(legacy)) {
+    transition = `${createLedger};\n`;
+    for (const row of old) transition += insert(row);
+    applied = old;
+  }
+  if (tables.includes(legacy)) transition += `DROP TABLE ${legacy};`;
+  return { applied, transition, exists:tables.includes(ledger) || tables.includes(legacy) };
+}
+function insert(row) {
+  return `INSERT INTO ${ledger}(name,sha256,state) VALUES (${literal(row.name)},${literal(row.sha256)},'applied');\n`;
+}

package/modules/deploy-kit/migrations.mjs

@@ -1,8 +1,7 @@
 import { assert, hash } from './validation.mjs';
 import { assertMigrationSqlSafe } from './sql-safety.mjs';
 import { sqlTokens } from './sql-tokens.mjs';
-const ledger = '_rer_deploy_migrations';
-const literal = value => `'${value.replaceAll("'","''")}'`;
+import { ledger, literal, createLedger, readLedger } from './migration-ledger.mjs';
 export function validateMigrations(migrations) {
   let previous = '';
   for (const migration of migrations) {
@@ -17,20 +16,17 @@ export async function query(api, id, sql) {
   assert(Array.isArray(rows) && rows.length > 0 && rows.every(x => x.success === true && Array.isArray(x.results)), 'd1-query-failed');
   return rows;
 }
-export async function migrate(api, id, migrations, { apply = true } = {}) {
+export async function migrate(api, id, migrations, { apply = true, upgrade = apply } = {}) {
   validateMigrations(migrations);
-  const tables = (await query(api,id,"SELECT name FROM sqlite_master WHERE type='table' AND name IN ('_rer_deploy_migrations','d1_migrations')"))[0].results.map(x => x.name);
-  let applied = [];
-  if (tables.includes(ledger)) applied = (await query(api,id,`SELECT name, sha256, state FROM ${ledger} ORDER BY name`))[0].results;
-  // Wrangler history has no hashes. Never assume old SQL bytes from its names alone.
-  if (tables.includes('d1_migrations')) {
-    const prior = (await query(api,id,'SELECT name FROM d1_migrations ORDER BY id'))[0].results;
-    assert(prior.every(x => applied.some(y => x.name === y.name && y.state === 'applied')), 'legacy-migration-history-needs-reviewed-hash-adoption');
-  }
-  assert(applied.every((row,index) => row.name === migrations[index]?.name && row.sha256 === migrations[index]?.sha256 && row.state === 'applied'), 'changed-or-uncertain-migration-history');
+  const { applied, transition, exists } = await readLedger(api, id, migrations, query);
   const pending = migrations.slice(applied.length);
   assert(apply || pending.length === 0,'pending-migrations');
-  if (pending.length && !tables.includes(ledger)) await query(api,id,`CREATE TABLE ${ledger} (name TEXT PRIMARY KEY, sha256 TEXT NOT NULL, state TEXT NOT NULL CHECK(state IN ('applying','applied')))`);
+  if (transition && upgrade) {
+    await api.importSql(id, transition);
+    const verified = await readLedger(api, id, migrations, query);
+    assert(!verified.transition && verified.applied.length === applied.length, 'migration-readback-mismatch');
+  }
+  if (pending.length && !exists) await query(api,id,createLedger);
   for (const migration of pending) {
     // Claim before execution. A lost response/partial provider failure is never automatically replayed.
     await query(api,id,`INSERT INTO ${ledger}(name,sha256,state) VALUES (${literal(migration.name)},${literal(migration.sha256)},'applying')`);
@@ -38,10 +34,10 @@ export async function migrate(api, id, migrations, { apply = true } = {}) {
     // A second terminator after trailing comments creates an empty D1 statement.
     // Keep the newline even when terminated: a final line comment must end.
     const separator = last?.kind === 'symbol' && last.value === ';' ? '' : '; ';
-    await query(api,id,`${migration.sql}\n${separator}UPDATE ${ledger} SET state='applied' WHERE name=${literal(migration.name)} AND sha256=${literal(migration.sha256)};`);
+    await api.importSql(id,`${migration.sql}\n${separator}UPDATE ${ledger} SET state='applied' WHERE name=${literal(migration.name)} AND sha256=${literal(migration.sha256)};`);
   }
   if (pending.length) {
-    const final = (await query(api,id,`SELECT name, sha256, state FROM ${ledger} ORDER BY name`))[0].results;
+    const final = (await query(api,id,`SELECT name, sha256, state FROM ${ledger} ORDER BY id`))[0].results;
     assert(final.length === migrations.length && final.every((x,i) => x.state === 'applied' && x.name === migrations[i].name && x.sha256 === migrations[i].sha256), 'migration-readback-mismatch');
   }
   return { applied:pending.map(x => x.name), history:migrations.map(({name,sha256}) => ({name,sha256})) };

package/modules/deploy-kit/owner-cli.mjs

@@ -7,11 +7,13 @@ import { assert, hexId } from './validation.mjs';
 import { regularBytes } from './artifact.mjs';
 import { packageBuild } from './prepare.mjs';
 import { cloudflare } from './provider.mjs';
-import { ownerTarget, ownerPlan, ownerDeploy, ownerHealth } from './owner.mjs';
+import { ownerTarget, ownerPlan, ownerDeploy, ownerHealth, settleOwnerState } from './owner.mjs';
+import { ownerSecret } from './owner-secret.mjs';
+import { ownerRemove } from './owner-remove.mjs';
 import { refuseLocalModels } from './local-only.mjs';
 
 export const cronNotice = 'This Worker has a Cron Trigger. Cloudflare may take up to about two hours to start its first scheduled run on some accounts.';
-const usage = 'usage: owner-cli.mjs deploy|health --declaration <file> --environment <name> [--product <dir>] [--state <file>]';
+const usage = 'usage: owner-cli.mjs deploy|health|remove --declaration <file> --environment <name> [--product <dir>] [--state <file>] | secret ... --set NAME|--unset NAME';
 
 /** The owner's committed source and existing local build. Run the seed's build first. */
 async function ownerArtifact(root, product) {
@@ -24,10 +26,11 @@ async function ownerArtifact(root, product) {
 /** Inputs: CLOUDFLARE_ACCOUNT_ID and CLOUDFLARE_API_TOKEN, plus the secrets the declaration names on first deploy. */
 export async function main(argv = process.argv.slice(2), env = process.env, {fetch = globalThis.fetch, cwd = process.cwd(), healthOptions, localOnlyKeys = [], notice = line => console.error(line), onCreated} = {}) {
   let parsed;
-  try { parsed = parseArgs({args:argv,allowPositionals:true,strict:true,options:{declaration:{type:'string'},environment:{type:'string'},product:{type:'string',default:''},state:{type:'string'}}}); }
+  try { parsed = parseArgs({args:argv,allowPositionals:true,strict:true,options:{declaration:{type:'string'},environment:{type:'string'},product:{type:'string',default:''},state:{type:'string'},set:{type:'string'},unset:{type:'string'}}}); }
   catch { throw new Error('usage'); }
   const {positionals:[command,...rest],values} = parsed;
-  if (!['deploy','health'].includes(command) || rest.length || !values.declaration || !values.environment) throw new Error('usage');
+  if (!['deploy','health','secret','remove'].includes(command) || rest.length || !values.declaration || !values.environment) throw new Error('usage');
+  if ((command === 'secret') !== (values.set !== undefined || values.unset !== undefined) || values.set !== undefined && values.unset !== undefined) throw new Error('usage');
   await refuseLocalModels(resolve(cwd));
   const missing = ['CLOUDFLARE_ACCOUNT_ID','CLOUDFLARE_API_TOKEN'].filter(key => typeof env[key] !== 'string' || !env[key].trim());
   if (missing.length) { const error = new Error('missing-input'); error.inputs = missing; throw error; }
@@ -40,19 +43,29 @@ export async function main(argv = process.argv.slice(2), env = process.env, {fet
   const api = deploymentDiagnostics(cloudflare({accountId:env.CLOUDFLARE_ACCOUNT_ID,token:env.CLOUDFLARE_API_TOKEN,fetch}),{onCreated});
   const target = await ownerTarget(api,{project:declaration.project,environment:values.environment});
   const statePath = values.state ? resolve(root,values.state) : join(root,'.rer','deploy',`${target.environment}.json`);
+  if (command === 'remove') return {ok:true,...await ownerRemove({api,target,statePath}).catch(error => { throw api.annotateFailure(error,'remove'); })};
+  if (command === 'secret') {
+    const binding = values.set ?? values.unset, item = (Array.isArray(declaration.secrets) ? declaration.secrets : []).find(entry => entry?.binding === binding);
+    if (!item) { const error = new Error('undeclared-secret'); error.resource = `secret:${binding}`; throw error; }
+    const value = values.set === undefined ? undefined : env[item.environment];
+    return {ok:true,...await ownerSecret({api,target,statePath,binding,value}).catch(error => { throw api.annotateFailure(error,'secrets'); })};
+  }
+  // A secret rer retired (the spent setup token) is no longer part of the plan.
+  const {retiredSecrets = []} = await settleOwnerState({api,target,statePath});
+  const current = retiredSecrets.length && Array.isArray(declaration.secrets) ? {...declaration,secrets:declaration.secrets.filter(item => !retiredSecrets.includes(item?.binding))} : declaration;
   const artifact = await ownerArtifact(root,values.product);
-  const plan = ownerPlan(target,declaration,artifact,{localOnlyKeys});
+  const plan = ownerPlan(target,current,artifact,{localOnlyKeys});
   if (command === 'health') {
     await ownerHealth({api,target,plan,statePath,fetch,healthOptions:{...healthOptions,readiness:{single:true,totalMs:30000}}}).catch(error=>{throw api.annotateFailure(error,'health');});
     return {ok:true,worker:target.worker,origin:target.origin};
   }
   // Dispatch is the provider's: on some accounts a new Cron starts only at the account scheduler's next refresh.
   if (plan.crons.length) notice(cronNotice);
-  const {receipt,created} = await ownerDeploy({api,target,plan,artifact,statePath,env,fetch,healthOptions}).catch(error => {
+  const {receipt,created,sentSecrets} = await ownerDeploy({api,target,plan,artifact,statePath,env,fetch,healthOptions}).catch(error => {
     api.annotateFailure(error,error.message.startsWith('missing-secret-') ? 'secrets' : undefined);
     throw error;
   });
-  return {ok:true,changed:receipt.changed,worker:target.worker,origin:receipt.origin,versionId:receipt.provider.versionId,created,state:statePath};
+  return {ok:true,changed:receipt.changed,worker:target.worker,origin:receipt.origin,versionId:receipt.provider.versionId,created,sentSecrets,retiredSecrets,state:statePath};
 }
 
 /** Prints refusal codes and resource names only; never inputs, tokens or provider bodies. */

package/modules/deploy-kit/owner-remove.mjs

@@ -0,0 +1,105 @@
+import { rm } from 'node:fs/promises';
+import { assert } from './validation.mjs';
+import { resourceKinds, findResource } from './resources.mjs';
+import { activeWorker } from './worker.mjs';
+import { deleteWorker } from './teardown.mjs';
+import { workerConsumerScript } from './queue-consumer.mjs';
+import { query } from './migrations.mjs';
+import { KINDS, readOwnerState, writeOwnerState, withStateLock, withScopeHints, withSettledLists, workerSettings, sameDeployment, resourceId, checkResourceIdentity, refuse, settlePendingSecret } from './owner.mjs';
+
+const remove = {
+  d1: (api, id) => api.request(`/d1/database/${id}`, {method:'DELETE'}),
+  r2: (api, _id, name) => api.request(`/r2/buckets/${name}`, {method:'DELETE'}),
+  kv: (api, id) => api.request(`/storage/kv/namespaces/${id}`, {method:'DELETE'}),
+  queues: (api, id) => api.request(`/queues/${id}`, {method:'DELETE'}),
+};
+
+/** A resource whose create response was lost (still `pending` in the state file) may be
+ * rer's or someone else's. It is removed only under this environment's derived name and
+ * once it is confirmed empty: a D1 with no tables, a KV namespace with no keys, an R2
+ * bucket (the provider refuses to delete one holding objects). A queue's backlog cannot
+ * be read, so an uncertain queue refuses with its own code. */
+async function confirmEmpty(api, worker, kind, name, id) {
+  if (!name.startsWith(`${worker}-`)) throw refuse('uncertain-resource-create', kind, name);
+  if (kind === 'queues') throw refuse('uncertain-resource-unverifiable', kind, name);
+  if (kind === 'd1') {
+    const [{results}] = await query(api, id, "SELECT name FROM sqlite_master WHERE type='table' AND name NOT LIKE 'sqlite~_%' ESCAPE '~' AND name NOT LIKE '~_cf~_%' ESCAPE '~'");
+    if (results.length) throw refuse('uncertain-resource-not-empty', kind, name);
+  }
+  if (kind === 'kv') {
+    const keys = await api.request(`/storage/kv/namespaces/${id}/keys?limit=10`);
+    assert(Array.isArray(keys), 'invalid-kv-key-list');
+    if (keys.length) throw refuse('uncertain-resource-not-empty', kind, name);
+  }
+}
+
+/** Delete exactly what this environment's state file says rer created: the Worker (its
+ * schedules first; its Durable Objects go with it), then each D1, R2, KV and queue,
+ * each only while it is still the one rer created. Read back that each is gone, then
+ * drop the state file. Nothing else in the account is touched. Ownership is checked for
+ * everything before the first delete; a replaced or uncertain resource refuses it all,
+ * except an uncertain one confirmed empty (see confirmEmpty). */
+export async function ownerRemove({api: provider, target, statePath, clock, sleep}) {
+  const api = withSettledLists(withScopeHints(provider));
+  return withStateLock(statePath, async () => {
+    const state = await readOwnerState(statePath, target);
+    if (await settlePendingSecret(api, target.worker, state)) await writeOwnerState(statePath, state);
+    const owned = KINDS.flatMap(kind => Object.entries(state.owned[kind]).map(([name, entry]) => ({kind, name, entry})));
+    assert(state.owned.worker || owned.length, 'nothing-to-remove');
+    // Preflight, read-only.
+    let worker = null;
+    if (await workerSettings(api, target.worker) !== null) {
+      if (!state.owned.worker) throw refuse('resource-name-collision', 'worker', target.worker);
+      const expected = state.pendingUpload?.provider ?? state.receipt?.provider;
+      if (!expected) throw refuse('uncertain-resource-create', 'worker', target.worker);
+      const live = await activeWorker(api, target.worker);
+      if (!sameDeployment(live, expected)) throw refuse('owned-resource-replaced', 'worker', target.worker);
+      worker = target.worker;
+    }
+    const listed = {}, doomed = [];
+    for (const kind of KINDS) {
+      if (!owned.some(item => item.kind === kind)) continue;
+      listed[kind] = await resourceKinds[kind].list(api);
+      for (const {name, entry} of owned.filter(item => item.kind === kind)) {
+        const row = findResource(listed[kind], kind, name);
+        if (!row) continue;
+        if (entry.status === 'pending') await confirmEmpty(api, target.worker, kind, name, resourceId(kind, row));
+        else checkResourceIdentity(kind, name, row, entry);
+        doomed.push({kind, name, id:resourceId(kind, row)});
+      }
+    }
+    const removed = [];
+    // A Worker that consumes one of these queues is released first.
+    for (const queue of doomed.filter(item => item.kind === 'queues')) {
+      for (const consumer of await api.list(`/queues/${queue.id}/consumers`, {pagination:'single'})) {
+        if (workerConsumerScript(consumer) === target.worker) await api.request(`/queues/${queue.id}/consumers/${consumer.consumer_id}`, {method:'DELETE'});
+      }
+    }
+    if (worker) { await deleteWorker({api, worker, ...(clock ? {clock} : {}), ...(sleep ? {sleep} : {})}); removed.push(`worker:${worker}`); }
+    const failed = [];
+    for (const item of doomed) {
+      try { await remove[item.kind](api, item.id, item.name); removed.push(`${item.kind}:${item.name}`); }
+      catch (error) { failed.push({resource:`${item.kind}:${item.name}`, code:error.message}); }
+    }
+    // Read back: nothing this environment created is still listed.
+    const remaining = [];
+    if (await workerSettings(api, target.worker) !== null) remaining.push(`worker:${target.worker}`);
+    const namespaces = await api.list('/workers/durable_objects/namespaces');
+    for (const row of namespaces) if (row.script === target.worker) remaining.push(`durable-object:${row.class}`);
+    for (const kind of KINDS) {
+      if (!listed[kind]) continue;
+      const rows = await resourceKinds[kind].list(api);
+      for (const {name} of owned.filter(item => item.kind === kind)) if (findResource(rows, kind, name)) remaining.push(`${kind}:${name}`);
+    }
+    if (remaining.length) {
+      // Keep the record of what is left, so a later --remove finishes it.
+      for (const kind of KINDS) for (const name of Object.keys(state.owned[kind])) if (!remaining.includes(`${kind}:${name}`)) delete state.owned[kind][name];
+      if (!remaining.includes(`worker:${target.worker}`)) { state.owned.worker = null; state.receipt = null; delete state.pendingUpload; }
+      await writeOwnerState(statePath, state);
+      const error = new Error('remove-incomplete'); error.remaining = remaining; error.failed = failed; error.removed = removed;
+      throw error;
+    }
+    await rm(statePath, {force:true});
+    return {worker:target.worker, removed, remaining:[]};
+  });
+}

package/modules/deploy-kit/owner-secret.mjs

@@ -0,0 +1,49 @@
+import { assert, identifier } from './validation.mjs';
+import { activeWorker, deployedFingerprint } from './worker.mjs';
+import { readOwnerState, writeOwnerState, withStateLock, withScopeHints, sameDeployment, refuse, recordSecretChange, settlePendingSecret } from './owner.mjs';
+
+/** Set (`value` given) or remove one Worker secret of the owner's last deployment, then
+ * record the Worker version the change made in the state file, so the next deploy
+ * recognises its own Worker. A Worker someone else replaced is refused untouched.
+ * The change is recorded as pending first: if the provider applies it but rer never
+ * sees it settle, a later run adopts it (see settlePendingSecret). A change the provider
+ * answered with an error clears the pending record. The secret listing
+ * and active deployment lag a change, so they are read until they show it, up to `windowMs`.
+ * A removed declared secret is retired: later plans omit it until it is set again. */
+export async function ownerSecret({api: provider, target, statePath, binding, value, windowMs = 30000, clock = () => performance.now(), sleep = ms => new Promise(resolve => setTimeout(resolve, ms))}) {
+  const api = withScopeHints(provider);
+  assert(identifier(binding), 'invalid-secret-name');
+  assert(value === undefined || typeof value === 'string' && value.trim(), `missing-secret-${binding}`);
+  return withStateLock(statePath, async () => {
+    const state = await readOwnerState(statePath, target);
+    assert(state.receipt && !state.pendingUpload, 'missing-owner-receipt');
+    if (await settlePendingSecret(api, target.worker, state)) await writeOwnerState(statePath, state);
+    const live = await activeWorker(api, target.worker);
+    if (!live) throw refuse('owned-resource-missing', 'worker', target.worker);
+    if (!sameDeployment(live, state.receipt.provider)) throw refuse('owned-resource-replaced', 'worker', target.worker);
+    const path = `/workers/scripts/${target.worker}/secrets`, present = value !== undefined;
+    const names = async () => { const rows = await api.request(path); assert(Array.isArray(rows), 'invalid-secret-list'); return rows.map(row => row.name); };
+    const changed = present || (await names()).includes(binding);
+    state.pendingSecret = {binding, present}; await writeOwnerState(statePath, state);
+    try {
+      if (present) await api.request(path, {method:'PUT', body:{name:binding, text:value, type:'secret_text'}});
+      else if (changed) await api.request(`${path}/${binding}`, {method:'DELETE'});
+    } catch (error) {
+      // The provider answered and refused: nothing changed, so nothing is pending. Only a lost
+      // response (no answer at all) may have applied the change.
+      if (error.status !== undefined) { delete state.pendingSecret; await writeOwnerState(statePath, state); }
+      throw error;
+    }
+    let current;
+    for (const start = clock(); ; await sleep(2000)) {
+      current = await activeWorker(api, target.worker);
+      if (current && (!changed || !sameDeployment(current, live)) && (await names()).includes(binding) === present) break;
+      if (clock() - start + 2000 > windowMs) throw new Error('secret-change-unsettled');
+    }
+    // A secret change makes a new version of the same code: the script and build fingerprint must not move.
+    assert(current.etag === live.etag && deployedFingerprint(current.settings) === deployedFingerprint(live.settings), 'secret-change-drift');
+    recordSecretChange(state, current, {binding, present});
+    await writeOwnerState(statePath, state);
+    return {worker:target.worker, binding, present, versionId:current.versionId};
+  });
+}