@runeditrun/rer 0.2.1 → 0.2.2

package/modules/deploy-kit/owner.mjs

@@ -16,11 +16,11 @@ import { verifyHealth } from './health.mjs';
 
 const segment = /^[a-z][a-z0-9]*(?:-[a-z0-9]+)*$/;
 const STATE_KIND = 'rer-deploy-owner-state';
-const KINDS = ['d1','r2','kv','queues'];
+export const KINDS = ['d1','r2','kv','queues'];
 const DECLARATION_KEYS = ['version','project','compatibilityDate','compatibilityFlags','d1','r2','kv','queues','durableObjects','secrets','crons','vars','originVar','services','workersDev','platforms','container'];
 const ENTRY_KEYS = {d1:['binding'],r2:['binding','locationHint'],kv:['binding'],queues:['binding','consumer','deadLetterQueue'],durableObjects:['binding','className','storage'],secrets:['binding','environment','verifyStandIn'],services:['binding','project','entrypoint','allowedHosts','grant']};
 
-function refuse(code, kind, name) { const error = new Error(code); error.resource = `${kind}:${name}`; return error; }
+export function refuse(code, kind, name) { const error = new Error(code); error.resource = `${kind}:${name}`; return error; }
 
 export function ownerWorkerName(project, environment) {
   assert(typeof project === 'string' && /^(?:[a-z0-9][a-z0-9-]*\/)?[a-z0-9-]+$/.test(project) && segment.test(project.split('/').at(-1)), 'invalid-owner-project');
@@ -49,6 +49,24 @@ export function withScopeHints(api) {
   const guard = method => async (path, ...rest) => { try { return await api[method](path, ...rest); } catch (error) { return hint(path, error); } };
   return {...api, scopeHints:true, request:guard('request'), envelope:guard('envelope'), list:guard('list')};
 }
+/** Right after a create, an account listing can disagree with its own page counts
+ * (D1's total_count lagged its rows by about 7 seconds, measured 13 October 2026).
+ * Owner mode discards such a snapshot and lists again from the start for up to
+ * `windowMs`; a partial listing is never accepted. */
+export function withSettledLists(api, {windowMs = 30000, clock = () => performance.now(), sleep = ms => new Promise(resolve => setTimeout(resolve, ms))} = {}) {
+  if (api.settledLists) return api;
+  const list = async (...args) => {
+    const start = clock();
+    for (let delay = 500; ; delay = Math.min(delay * 2, 4000)) {
+      try { return await api.list(...args); }
+      catch (error) {
+        if (!['provider-partial-list','provider-pagination-changed'].includes(error.message) || clock() - start + delay > windowMs) throw error;
+        await sleep(delay);
+      }
+    }
+  };
+  return {...api, settledLists:true, list};
+}
 /** Reads the account's workers.dev subdomain; no other provider request. */
 export async function ownerTarget(provider, {project, environment}) {
   const api = withScopeHints(provider);
@@ -134,18 +152,21 @@ export async function readOwnerState(path, target) {
     && (state.owned.worker === null || ['pending','created'].includes(state.owned.worker?.status))
     && KINDS.every(kind => state.owned[kind] && typeof state.owned[kind] === 'object' && Object.values(state.owned[kind]).every(entry => ['pending','created'].includes(entry?.status))), 'invalid-owner-state');
   assert(state.pendingUpload === undefined || typeof state.pendingUpload?.fingerprint === 'string' && typeof state.pendingUpload?.build === 'string', 'invalid-owner-state');
+  // Declared secrets rer removed on purpose (the spent setup token): later plans omit them.
+  assert(state.pendingSecret === undefined || identifier(state.pendingSecret?.binding) && typeof state.pendingSecret?.present === 'boolean', 'invalid-owner-state');
+  assert(state.retiredSecrets === undefined || Array.isArray(state.retiredSecrets) && state.retiredSecrets.every(identifier), 'invalid-owner-state');
   assert(state.accountId === target.accountId && state.project === target.project && state.environment === target.environment && state.worker === target.worker, 'owner-state-target-mismatch');
   return state;
 }
-async function writeOwnerState(path, state) {
+export async function writeOwnerState(path, state) {
   await mkdir(dirname(path),{recursive:true,mode:0o700});
   const temporary = `${path}.${process.pid}.tmp`;
   await writeFile(temporary,JSON.stringify(state,null,2)+'\n',{flag:'wx',mode:0o600});
   await rename(temporary,path);
 }
-const resourceId = (kind, row) => ({d1:row.uuid,r2:row.creation_date,kv:row.id,queues:row.queue_id})[kind];
+export const resourceId = (kind, row) => ({d1:row.uuid,r2:row.creation_date,kv:row.id,queues:row.queue_id})[kind];
 
-function checkResourceIdentity(kind, name, row, entry) {
+export function checkResourceIdentity(kind, name, row, entry) {
   if (row) {
     if (!entry) throw refuse('resource-name-collision',kind,name);
     if (entry.status !== 'created') throw refuse('uncertain-resource-create',kind,name);
@@ -194,7 +215,43 @@ async function uploadFingerprint(body) {
   assert(typeof fingerprint === 'string' && fingerprint, 'invalid-upload-metadata');
   return fingerprint;
 }
-const sameDeployment = (a, b) => a?.versionId === b?.versionId && a?.deploymentId === b?.deploymentId && a?.etag === b?.etag;
+/** Record a secret change's outcome on the receipt: the Worker version it made, and whether
+ * the secret is now retired (a removed declared secret stays out of later plans). */
+export function recordSecretChange(state, current, {binding, present}) {
+  state.receipt.provider = {versionId:current.versionId, deploymentId:current.deploymentId, etag:current.etag};
+  const retired = new Set(state.retiredSecrets ?? []);
+  if (present) retired.delete(binding); else retired.add(binding);
+  if (retired.size) state.retiredSecrets = [...retired].sort(); else delete state.retiredSecrets;
+  delete state.pendingSecret;
+}
+/** A secret change rer recorded as pending but never confirmed (a lost response, or a run that
+ * ended before the change settled). It is that change only when the Worker's versions list shows
+ * exactly one version after the receipt's and it is the live one, still running the receipt's
+ * exact script and build fingerprint: adopt its version. Anything else, such as a later change
+ * someone made after rer's, is left to the identity check, which refuses it. */
+export async function settlePendingSecret(api, worker, state) {
+  if (!state.pendingSecret || !state.receipt) return false;
+  const live = await activeWorker(api, worker);
+  if (!live || sameDeployment(live, state.receipt.provider) || live.etag !== state.receipt.provider.etag || deployedFingerprint(live.settings) !== state.receipt.fingerprint) return false;
+  // Newest first, as the provider lists them.
+  const versions = (await api.request(`/workers/scripts/${worker}/versions`))?.items;
+  const ids = Array.isArray(versions) ? versions.map(item => item?.id) : [];
+  if (ids[0] !== live.versionId || ids.indexOf(state.receipt.provider.versionId) !== 1) return false;
+  const rows = await api.request(`/workers/scripts/${worker}/secrets`);
+  if (!Array.isArray(rows) || rows.some(row => row.name === state.pendingSecret.binding) !== state.pendingSecret.present) return false;
+  recordSecretChange(state, live, state.pendingSecret);
+  return true;
+}
+/** Settle a pending secret change under the state lock, before a plan reads the retired list. */
+export async function settleOwnerState({api: provider, target, statePath}) {
+  const api = withScopeHints(provider);
+  return withStateLock(statePath, async () => {
+    const state = await readOwnerState(statePath, target);
+    if (await settlePendingSecret(api, target.worker, state)) await writeOwnerState(statePath, state);
+    return state;
+  });
+}
+export const sameDeployment = (a, b) => a?.versionId === b?.versionId && a?.deploymentId === b?.deploymentId && a?.etag === b?.etag;
 
 /** A completed receipt or the exact identity of an interrupted successful upload proves ownership.
  * Only the first upload, with no receipt, may recover a lost response by its pending build. */
@@ -238,7 +295,7 @@ export async function withStateLock(path, run) {
  * Ownership preflight precedes provider writes. A re-run of the same build writes nothing. */
 export async function ownerDeploy({api: provider, target, plan, artifact, statePath, env = {}, fetch = globalThis.fetch, healthOptions = {}, readiness = {}}) {
   assert(typeof statePath === 'string' && statePath.length, 'missing-owner-state-path');
-  const api = withScopeHints(provider);
+  const api = withSettledLists(withScopeHints(provider));
   assert(target?.accountId === api.accountId, 'owner-account-mismatch');
   validatePlan(plan); assertOwnerNames(target, plan);
   for (const item of plan.d1) validateMigrations(item.migrations);
@@ -252,7 +309,8 @@ async function deployLocked({api, target, plan, artifact, statePath, env, fetch,
   const exists = priorWorker !== null;
   const create = await ownedResourcesToCreate(api, plan, state);
   if (exists) await checkCronOwnership(api, plan);
-  await secretBindings(api, plan.worker, plan, env, exists);
+  // The declared secrets this run uploads; every other one is inherited unchanged.
+  const {missing:sentSecrets} = await secretBindings(api, plan.worker, plan, env, exists);
   // Record intent before each create. A failed or lost response leaves it pending:
   // absent on resume means create again; present means an uncertain outcome to inspect.
   for (const {kind,item} of create) {
@@ -288,12 +346,12 @@ async function deployLocked({api, target, plan, artifact, statePath, env, fetch,
     onReceipt: async candidate => { if (candidate.changed || !state.receipt) { state.receipt = candidate; delete state.pendingUpload; await save(); } },
     // Keep each first-health attempt beside the identity it belongs to.
     onHealth: async candidate => { if (candidate.changed) { state.receipt = candidate; await save(); } }});
-  return {receipt, created:create.map(({kind,item}) => `${kind}:${item.name}`)};
+  return {receipt, created:create.map(({kind,item}) => `${kind}:${item.name}`), sentSecrets};
 }
 
 /** Independent read-only health of the last owner deployment recorded in the state file. */
 export async function ownerHealth({api: provider, target, plan, statePath, fetch = globalThis.fetch, healthOptions = {}}) {
-  const api = withScopeHints(provider);
+  const api = withSettledLists(withScopeHints(provider));
   validatePlan(plan); assertOwnerNames(target, plan);
   const state = await readOwnerState(statePath, target);
   assert(state.receipt, 'missing-owner-receipt');

package/modules/deploy-kit/provider.mjs

@@ -1,4 +1,5 @@
 import { recordDeployFailure } from './diagnostics.mjs';
+import { importD1, importUploadURL } from './d1-import.mjs';
 import { assert, hexId } from './validation.mjs';
 
 async function boundedText(response, limit = 4 * 1024 * 1024, onReadError) {
@@ -38,7 +39,7 @@ export function cloudflare({ accountId, token, fetch: request = globalThis.fetch
     assert(!assetToken || path === '/workers/assets/upload?base64=true', 'invalid-asset-auth-target');
     // Asset-session credentials are discovered at runtime, outside the CLI env.
     // Preserve complete text for the CLI's remaining redaction before truncation.
-    const redactAuth = text => [accountId,token,assetToken].filter(Boolean).flatMap(value=>[value,encodeURIComponent(value),JSON.stringify(value).slice(1,-1)]).sort((a,b)=>b.length-a.length).reduce((value,secret)=>value.split(secret).join('[REDACTED]'),text);
+    const redactAuth = text => /\/d1\/database\/[^/]+\/import$/.test(path) ? '[D1 import details omitted]' : [accountId,token,assetToken].filter(Boolean).flatMap(value=>[value,encodeURIComponent(value),JSON.stringify(value).slice(1,-1)]).sort((a,b)=>b.length-a.length).reduce((value,secret)=>value.split(secret).join('[REDACTED]'),text);
     const transportFailure = cause => recordDeployFailure(new Error('provider-transport-failed'),{output:redactAuth(transportOutput(cause))});
     const signal = AbortSignal.timeout(timeoutMs);
     let response;
@@ -136,6 +137,18 @@ export function cloudflare({ accountId, token, fetch: request = globalThis.fetch
     }
     throw new Error('provider-pagination-limit');
   }
-  return { accountId, envelope, list, async request(path, options) { return (await envelope(path, options)).result; },
+  async function upload(url, bytes, etag) {
+    const destination = importUploadURL(url);
+    assert(++requests <= maxRequests, 'provider-request-budget');
+    let response;
+    try {
+      response = await request(destination, { method:'PUT', redirect:'error', signal:AbortSignal.timeout(timeoutMs), headers:{'Content-Length':String(bytes.length)}, body:bytes });
+    } catch { throw new Error('d1-import-upload-transport-failed'); }
+    // Upload bodies and signed URLs are never diagnostics, including on failure.
+    await response.body?.cancel().catch(() => {});
+    assert(response.status === 200, 'd1-import-upload-failed');
+    assert(response.headers.get('etag')?.replace(/^"|"$/g, '') === etag, 'd1-import-upload-etag-mismatch');
+  }
+  return { accountId, envelope, list, importSql(id, sql) { return importD1({envelope,upload}, id, sql); }, async request(path, options) { return (await envelope(path, options)).result; },
     async zoneRequest(path, options = {}) { return (await envelope(path, { ...options, zone: true })).result; } };
 }

package/modules/job-queue/config.mjs

@@ -1,4 +1,4 @@
-import { cpus, totalmem, userInfo } from 'node:os';
+import { cpus, totalmem, homedir } from 'node:os';
 import { readFile } from 'node:fs/promises';
 import { resolve } from 'node:path';
 
@@ -9,8 +9,10 @@ const names = { slots: 'SLOTS', loadThreshold: 'LOAD_THRESHOLD',
   minFreeMemoryBytes: 'MIN_FREE_MEMORY_BYTES', pollMs: 'POLL_MS',
   nice: 'NICE', killGraceMs: 'KILL_GRACE_MS' };
 
+export const jobsDirectory = (env = process.env) => resolve(env.RER_JOBS_DIR ?? `${env.HOME || homedir()}/.rer/jobs`);
+
 export async function configuration({ env = process.env, ...overrides } = {}) {
-  const directory = resolve(overrides.directory ?? env.RER_JOBS_DIR ?? `${userInfo().homedir}/.rer/jobs`);
+  const directory = resolve(overrides.directory ?? jobsDirectory(env));
   let disk = {};
   try { disk = JSON.parse(await readFile(resolve(directory, 'config.json'), 'utf8')); }
   catch (error) { if (error.code !== 'ENOENT') throw error; }

package/modules/operator-auth/identity/oidc/README.md

@@ -145,6 +145,24 @@ sign-in page, which offers the email link instead of redirecting. A hidden
 provider is checked again at most once a minute, after the page answers
 (`waitUntil`), and shown again once a check succeeds.
 
+Connection health is separate from the pin's `status`. `list().linked` and
+`links().healthy` require a successfully exchanged, signature- and claim-verified
+ID token for the current `linkedAt` generation, with no subsequent provider-side
+exchange or reachability failure. A token endpoint's HTTP 400 `invalid_grant`
+refuses the bad or replayed code without changing connection health. Network
+failures, HTTP 5xx, `invalid_client`, and invalid ID tokens or JWKS still invalidate
+exchange health. A pin created by discovery alone is not healthy. Successful
+discovery or a JWKS probe cannot clear exchange failure; a valid new exchange
+can. Application membership and admission remain separate from provider health.
+The existing health table stores exchange observations under reserved
+`exchange:<id>:<linkedAt>` keys (configured IDs cannot contain colons), so older
+stores need no schema change. Writes fence the current pin and prune obsolete
+exchange generations. Relinking therefore requires fresh exchange proof.
+
+After upgrading, existing provider links show **not linked** until the next
+successful sign-in through **each provider**, because older stores have no
+verified exchange observation for those links.
+
 ## Storage and limits
 
 `oa_oidc_transactions` stores domain-separated HMAC hashes of state, binding and

package/modules/operator-auth/identity/oidc/config.mjs

@@ -1,3 +1,4 @@
+import { configureBranding } from '../../branding.mjs';
 import { normalizeEmail } from '../../policy.mjs';
 import { isLoopbackHost } from '../../http.mjs';
 import { check } from './errors.mjs';
@@ -73,6 +74,7 @@ function provider(input, origin) {
 
 export function configure(input) {
   try {
+    const { signInPath } = configureBranding({ signInPath: input.signInPath });
     const origin = new URL(input.origin);
     check(origin.origin === input.origin && !origin.username && !origin.password);
     const local = input.local === true;
@@ -85,11 +87,11 @@ export function configure(input) {
     check(new Set(callbacks).size === providers.length);
     // Auth routes, owner-claim handlers and the local dev gate retain their
     // handlers even when an edition chooses its own OIDC callback pathname.
-    const reserved = new Set([input.signInPath ?? '/signin', '/auth/owner-claim', '/auth/dev/enter', '/__dev/personas', '/__dev/key', '/auth/bootstrap', '/auth/magic-link', '/auth/confirm', '/auth/signout', '/auth/session', '/auth/invite', '/auth/invite/cancel', '/auth/review-session', '/auth/operators', '/auth/sessions', '/auth/operator/status', '/auth/operator/role', '/auth/session/revoke', '/auth/step-up', '/auth/domain-rules', '/auth/providers', '/auth/providers/unlink', '/auth/providers/relink', '/auth/settings/identity', '/auth/setup-complete']);
+    const reserved = new Set([new URL(signInPath, origin).pathname, '/auth/owner-claim', '/auth/dev/enter', '/__dev/personas', '/__dev/key', '/auth/bootstrap', '/auth/magic-link', '/auth/confirm', '/auth/signout', '/auth/session', '/auth/invite', '/auth/invite/cancel', '/auth/review-session', '/auth/operators', '/auth/sessions', '/auth/operator/status', '/auth/operator/role', '/auth/session/revoke', '/auth/step-up', '/auth/domain-rules', '/auth/providers', '/auth/providers/unlink', '/auth/providers/relink', '/auth/settings/identity', '/auth/setup-complete']);
     check(callbacks.every((path, index) => !reserved.has(path) && !path.startsWith('/.well-known/') && !path.startsWith('/auth/dependencies/') && !providers.some(p => path === p.startPath) && (!path.startsWith('/auth/oidc/') || path === `/auth/oidc/${providers[index].id}/callback`)));
 
     return Object.freeze({ origin: input.origin, local, secure: origin.protocol === 'https:', transactionSecret: input.transactionSecret, providers: Object.freeze(providers),
-      signInPath: input.signInPath ?? '/signin',
+      signInPath,
       transactionSeconds: integer(input.transactionSeconds, 600, 60, 900), timeoutMs: integer(input.timeoutMs, 5000, 100, 15000),
       clockSkewSeconds: integer(input.clockSkewSeconds, 30, 0, 120), maxTokenAgeSeconds: integer(input.maxTokenAgeSeconds, 600, 60, 3600),
       startLimit: integer(input.startLimit, 30, 1, 1000) });

package/modules/operator-auth/identity/oidc/index.d.mts

@@ -29,5 +29,5 @@ export const HIDE_AFTER_MS: number;
 export const MINIMUM_PROVIDER_VERSION: string;
 export const PRESETS: Readonly<Record<'auth' | 'google' | 'microsoft' | 'okta' | 'legacy-rs256', { label: string; algorithms: string[]; methods: string[]; email: 'verified-at' | 'google' | 'subject' | 'legacy-verified' }>>;
 export function createOidcProviders<R extends string>(options: OidcProvidersOptions<R>): IdentityProviders;
-export function createOidcHandler(providers: IdentityProviders): (request: Request) => Promise<Response | null>;
+export function createOidcHandler(providers: IdentityProviders, options?: { signInPath?: string }): (request: Request) => Promise<Response | null>;
 export class OidcError extends Error { constructor(code: string, status?: number); code: string; status: number }

package/modules/operator-auth/identity/oidc/index.mjs

@@ -8,13 +8,23 @@ import { configure } from './config.mjs';
 import { check, OidcError } from './errors.mjs';
 import { random, isRandom, digest, keyedHash, seal, unseal } from './crypto.mjs';
 import { storage } from './store.mjs';
-import { discover, exchange, readJson } from './network.mjs';
+import { discover, exchange, readJson, GrantRejected } from './network.mjs';
 import { parseIdToken, knowsKey, verifyIdToken, principalOf } from './jwt.mjs';
 import { PRESETS, MINIMUM_PROVIDER_VERSION } from './presets.mjs';
 import { refuseInProduction } from '../principal.mjs';
 export { OidcError } from './errors.mjs';
 export { PRESETS, MINIMUM_PROVIDER_VERSION } from './presets.mjs';
 
+// Separate reachability from a verified exchange; discovery must never reset
+// exchange failure or certify a new registration. IDs cannot contain ':'.
+const exchangeKey = link => `exchange:${link.id}:${link.linkedAt}`;
+const working = (link, health) => {
+  const exchange = link && health.get(exchangeKey(link));
+  const reachability = link && health.get(link.id);
+  return link?.status === 'linked' && !!exchange && exchange.failingSince === null && exchange.hardFailureAt === null
+    && (!reachability || reachability.failingSince === null && reachability.hardFailureAt === null);
+};
+
 export const HIDE_AFTER_MS = 5 * 60000;
 const PROBE_EVERY_MS = 60000;
 
@@ -43,7 +53,9 @@ function errorResponse(error, config, request, clearCookie) {
   if (clearCookie) headers.append('Set-Cookie', clearCookie);
   const code = known ? error.code : 'oidc_unavailable';
   if (request && /\btext\/html\b/.test(request.headers.get('accept') ?? '')) {
-    headers.set('Location', `${config.signInPath}?notice=${encodeURIComponent(code)}`);
+    const location = new URL(config.signInPath, 'https://signin.invalid');
+    location.searchParams.set('notice', code);
+    headers.set('Location', location.pathname + location.search + location.hash);
     return new Response(null, { status: 303, headers });
   }
   return Response.json({ error: code }, { status: known ? error.status : 503, headers });
@@ -187,15 +199,20 @@ export function createOidcProviders({ admission, db, config: input, clientIp, fe
       if (url.searchParams.has('error')) { check(!url.searchParams.has('code')); throw new OidcError('oidc_provider_denied', 401); }
       const code = url.searchParams.get('code');
       check(typeof code === 'string' && code.length <= 4096 && /^[\x21-\x7e]+$/.test(code));
-      const tokens = await exchange(fetcher, link, view, config, code, transaction.verifier, clock());
-      let claims;
+      let tokens, claims;
       try {
+        tokens = await exchange(fetcher, link, view, config, code, transaction.verifier, clock());
         const parsed = parseIdToken(tokens.id_token, link);
         const keys = await keysFor(provider, link, parsed.header.kid);
         claims = await verifyIdToken(parsed, keys, link, view, config, transaction, { ...tokens, code }, clock());
-      } catch (error) { if (error instanceof OidcError && error.status !== 400) throw error; throw new OidcError(error instanceof OidcError ? error.code : 'oidc_invalid_response'); }
+      } catch (error) {
+        if (!(error instanceof GrantRejected) && error?.code !== 'oidc_storage_unavailable') await store.exchangeHealth(link, false, error?.hard === true, clock());
+        if (error instanceof OidcError && error.status !== 400) throw error;
+        throw new OidcError(error instanceof OidcError ? error.code : 'oidc_invalid_response');
+      }
       check(clock() < transaction.expiresAt, 'oidc_invalid_correlation');
       check(transaction.policyVersion === await policyVersion() && await enabled(), 'oidc_sign_in_disabled', 403);
+      await store.exchangeHealth(link, true, false, clock());
       const providerPin={id:link.id,issuer:link.issuer,clientId:link.clientId,linkedAt:link.linkedAt};
       if (Object.hasOwn(claims,'install_owner')) {
         check(typeof claim === 'function','oidc_claim_refused',403);
@@ -214,6 +231,7 @@ export function createOidcProviders({ admission, db, config: input, clientIp, fe
   }
   return Object.freeze({
     ids: Object.freeze([...providers.keys()]),
+    signInPath: config.signInPath,
     begin, callback,
     callbackPaths: Object.freeze(Object.fromEntries([...providers.values()].map(p => [new URL(p.redirectUri).pathname, p.id]))),
     /** The sign-in page's list: a provider is hidden while unlinked or unreachable. */
@@ -231,7 +249,7 @@ export function createOidcProviders({ admission, db, config: input, clientIp, fe
         // Where the start route sends the browser: a form posting there needs it in form-action.
         const authorizationOrigins = link ? [new URL(link.authorization).origin] : [...provider.endpointOrigins];
         result.push({ id: provider.id, label: provider.label, preset: provider.preset, startPath: provider.startPath, authorizationOrigins,
-          visible: link?.status !== 'unlinked' && !unreachable, linked: link?.status === 'linked', pendingRelink: !!link?.pendingAt });
+          visible: link?.status !== 'unlinked' && !unreachable, linked: working(link, health), pendingRelink: !!link?.pendingAt });
       }
       // A hidden provider is checked again at most once a minute, after the page answers.
       if (stale.length) { const probes = Promise.all(stale.map(probe)); if (typeof waitUntil === 'function') waitUntil(probes); else await probes; }
@@ -253,13 +271,14 @@ export function createOidcProviders({ admission, db, config: input, clientIp, fe
       await store.unlink(id);
     },
     async links() {
-      return (await store.links()).map(({ keySet: _, keysFetchedAt: __, ...link }) => link);
+      const [links, health] = await Promise.all([store.links(), store.health()]);
+      return links.map(({ keySet: _, keysFetchedAt: __, ...link }) => ({ ...link, healthy: working(link, health) }));
     },
   });
 }
 
 // Exact routes only: /auth/oidc/<id>/start and /auth/oidc/<id>/callback.
-export function createOidcHandler(oidc) {
+export function createOidcHandler(oidc, { signInPath = oidc.signInPath ?? '/signin' } = {}) {
   return async request => {
     const path = new URL(request.url).pathname;
     const callbackId = oidc.callbackPaths?.[path];
@@ -282,6 +301,6 @@ export function createOidcHandler(oidc) {
       else { const form = new URLSearchParams(text); check(form.getAll('returnTo').length <= 1); input = { returnTo: form.get('returnTo') ?? undefined }; }
       check(input && typeof input === 'object' && !Array.isArray(input));
       return oidc.begin(request, match[1], { returnTo: input.returnTo });
-    } catch (e) { return Response.json({ error: e instanceof OidcError ? e.code : 'oidc_invalid_input' }, { status: e instanceof OidcError ? e.status : 400, headers: securityHeaders() }); }
+    } catch (e) { return errorResponse(e instanceof OidcError ? e : new OidcError('oidc_invalid_input'), { signInPath }, request); }
   };
 }

package/modules/operator-auth/identity/oidc/network.mjs

@@ -7,10 +7,13 @@ import { clientAssertion } from './client-auth.mjs';
 // or its name does not resolve (a resolver error, or the 530 a Cloudflare
 // Worker receives for an origin DNS failure).
 export class ProviderUnreachable extends OidcError { constructor() { super('oidc_provider_unavailable', 502); this.hard = true; } }
+// A rejected authorization code says nothing about the registration's health.
+// Only a bounded, valid token-endpoint HTTP 400 response can produce this type.
+export class GrantRejected extends OidcError { constructor() { super('oidc_invalid_response'); } }
 const dnsFailure = error => /\b(?:dns|getaddrinfo|enotfound|eai_again|name not resolved|could not resolve)\b/i.test(String(error?.message ?? error));
 
 // The deadline includes stream consumption; redirects never forward credentials.
-export async function readJson(fetcher, uri, settings, init = {}, maxBytes = 65536) {
+export async function readJson(fetcher, uri, settings, init = {}, maxBytes = 65536, tokenExchange = false) {
   const controller = new AbortController();
   let timer, hard = false;
   const deadline = new Promise((_, reject) => { timer = setTimeout(() => { controller.abort(); reject(new Error('deadline')); }, settings.timeoutMs); });
@@ -22,7 +25,7 @@ export async function readJson(fetcher, uri, settings, init = {}, maxBytes = 655
       catch (error) { hard = dnsFailure(error); throw error; }
       check(response.status < 300 || response.status >= 400, 'oidc_provider_redirect', 502);
       if (response.status === 404 || response.status === 530) hard = true;
-      check(response.status === 200 && !response.redirected && (!response.url || response.url === uri), 'oidc_provider_unavailable', 502);
+      check((response.status === 200 || tokenExchange && response.status === 400) && !response.redirected && (!response.url || response.url === uri), 'oidc_provider_unavailable', 502);
       check(/^application\/(?:[a-z0-9.+-]+\+)?json(?:\s*;|$)/i.test(response.headers.get('content-type') ?? ''), 'oidc_provider_unavailable', 502);
       const length = response.headers.get('content-length');
       check(!length || /^\d+$/.test(length) && Number(length) <= maxBytes, 'oidc_provider_unavailable', 502);
@@ -34,9 +37,11 @@ export async function readJson(fetcher, uri, settings, init = {}, maxBytes = 655
       for (const chunk of chunks) { bytes.set(chunk, offset); offset += chunk.byteLength; }
       const body = JSON.parse(new TextDecoder('utf-8', { fatal: true }).decode(bytes));
       check(body && typeof body === 'object' && !Array.isArray(body), 'oidc_provider_unavailable', 502);
+      if (response.status === 400 && body.error === 'invalid_grant') throw new GrantRejected();
+      check(response.status === 200, 'oidc_provider_unavailable', 502);
       return body;
     })()]);
-  } catch { if (hard) throw new ProviderUnreachable(); fail('oidc_provider_unavailable', 502); }
+  } catch (error) { if (error instanceof GrantRejected) throw error; if (hard) throw new ProviderUnreachable(); fail('oidc_provider_unavailable', 502); }
   finally { clearTimeout(timer); controller.abort(); if (reader) void reader.cancel().catch(() => {}); }
 }
 
@@ -86,7 +91,7 @@ export async function exchange(fetcher, link, provider, settings, code, verifier
     form.set('client_assertion_type', 'urn:ietf:params:oauth:client-assertion-type:jwt-bearer');
     form.set('client_assertion', await clientAssertion(provider, link, now));
   }
-  const response = await readJson(fetcher, link.token, settings, { method: 'POST', headers, body: form.toString() });
+  const response = await readJson(fetcher, link.token, settings, { method: 'POST', headers, body: form.toString() }, 65536, true);
   check(!Object.hasOwn(response, 'error') && typeof response.id_token === 'string' && (response.access_token === undefined || typeof response.access_token === 'string' && /^[\x21-\x7e]+$/.test(response.access_token))
     && (response.token_type === undefined && response.access_token === undefined || typeof response.token_type === 'string' && response.token_type.toLowerCase() === 'bearer'));
   return response;

package/modules/operator-auth/identity/oidc/store.mjs

@@ -10,6 +10,8 @@ function link(row) {
 }
 
 export function storage(db) {
+  const pruneExchange = id => db.prepare(`DELETE FROM oa_identity_provider_health WHERE provider_id LIKE ? AND provider_id NOT IN
+    (SELECT 'exchange:' || provider_id || ':' || linked_at FROM oa_identity_providers WHERE provider_id=? AND status='linked')`).bind(`exchange:${id}:%`, id);
   const guarded = async operation => { try { return await operation(); } catch { fail('oidc_storage_unavailable', 503); } };
   return {
     async limit(bucket, expiresAt, maximum) {
@@ -37,10 +39,10 @@ export function storage(db) {
     },
     // A re-link the owner approved: the configured provider replaces the pin.
     async relink(id, provider, metadata, now) {
-      return guarded(() => db.prepare(`UPDATE oa_identity_providers SET preset=?,status='linked',issuer=?,client_id=?,jwks_uri=?,authorization_endpoint=?,token_endpoint=?,algorithms=?,token_auth_method=?,
+      return guarded(() => db.batch([db.prepare(`UPDATE oa_identity_providers SET preset=?,status='linked',issuer=?,client_id=?,jwks_uri=?,authorization_endpoint=?,token_endpoint=?,algorithms=?,token_auth_method=?,
         response_iss=?,interface_version=?,linked_at=MAX(linked_at+1,?),pending_issuer=NULL,pending_client_id=NULL,pending_preset=NULL,pending_at=NULL,jwks=NULL,jwks_fetched_at=NULL
         WHERE provider_id=?`).bind(provider.preset, metadata.issuer, provider.clientId, metadata.jwks, metadata.authorization, metadata.token, JSON.stringify(metadata.algorithms), provider.tokenAuthMethod,
-        metadata.responseIssuer ? 1 : 0, metadata.interfaceVersion, now, id).run());
+        metadata.responseIssuer ? 1 : 0, metadata.interfaceVersion, now, id), pruneExchange(id)]));
     },
     // A changed configuration only records what a re-link would pin.
     pending(id, provider, now) {
@@ -48,10 +50,24 @@ export function storage(db) {
         WHERE provider_id=? AND (pending_issuer IS NOT ? OR pending_client_id IS NOT ? OR pending_preset IS NOT ?)`).bind(provider.issuer, provider.clientId, provider.preset, now, id, provider.issuer, provider.clientId, provider.preset).run());
     },
     clearPending(id) { return guarded(() => db.prepare('UPDATE oa_identity_providers SET pending_issuer=NULL,pending_client_id=NULL,pending_preset=NULL,pending_at=NULL WHERE provider_id=?').bind(id).run()); },
-    unlink(id) { return guarded(() => db.prepare("UPDATE oa_identity_providers SET status='unlinked' WHERE provider_id=?").bind(id).run()); },
+    unlink(id) { return guarded(() => db.batch([db.prepare("UPDATE oa_identity_providers SET status='unlinked' WHERE provider_id=?").bind(id), pruneExchange(id)])); },
     keys(pin, keySet, now) {
       return guarded(() => db.prepare("UPDATE oa_identity_providers SET jwks=?,jwks_fetched_at=? WHERE provider_id=? AND status='linked' AND issuer=? AND client_id=? AND linked_at=?").bind(JSON.stringify(keySet), now, pin.id, pin.issuer, pin.clientId, pin.linkedAt).run());
     },
+    // Reuse the existing health schema with a reserved phase/generation key.
+    // A late callback can neither overwrite a replacement pin's proof nor retain
+    // stale generations. The pin fence is evaluated by SQL at write time.
+    exchangeHealth(pin, healthy, hard, now) {
+      const key = `exchange:${pin.id}:${pin.linkedAt}`;
+      return guarded(() => db.batch([
+        pruneExchange(pin.id),
+        db.prepare(`INSERT INTO oa_identity_provider_health(provider_id,failing_since,hard_failure_at,checked_at)
+          SELECT ?,?,?,? WHERE EXISTS(SELECT 1 FROM oa_identity_providers WHERE provider_id=? AND status='linked' AND issuer=? AND client_id=? AND linked_at=?)
+          ON CONFLICT(provider_id) DO UPDATE SET failing_since=CASE WHEN ? THEN NULL ELSE COALESCE(failing_since,excluded.failing_since) END,
+          hard_failure_at=CASE WHEN ? THEN NULL ELSE COALESCE(excluded.hard_failure_at,hard_failure_at) END,checked_at=excluded.checked_at`)
+          .bind(key, healthy ? null : now, !healthy && hard ? now : null, now, pin.id, pin.issuer, pin.clientId, pin.linkedAt, Number(healthy), Number(healthy)),
+      ]));
+    },
     async health() {
       return guarded(async () => new Map((await db.prepare('SELECT provider_id AS id,failing_since AS failingSince,hard_failure_at AS hardFailureAt,checked_at AS checkedAt FROM oa_identity_provider_health').all()).results.map(r => [r.id, r])));
     },

package/modules/operator-auth/index.d.mts

@@ -124,10 +124,12 @@ export interface ProviderEntry { id: string; label: string; preset: ProviderPres
 export interface ProviderLink {
   id: string; preset: ProviderPreset; status: 'linked' | 'unlinked'; issuer: string; clientId: string; jwks: string; authorization: string; token: string;
   algorithms: Array<'ES256' | 'RS256'>; tokenAuthMethod: string; responseIssuer: boolean; interfaceVersion: string | null; linkedAt: number;
+  healthy?: boolean;
   pendingIssuer: string | null; pendingClientId: string | null; pendingPreset: string | null; pendingAt: number | null;
 }
 export interface IdentityProviders {
   readonly ids: readonly string[];
+  readonly signInPath?: string;
   readonly callbackPaths?: Readonly<Record<string, string>>;
   begin(request: Request, id: string, input?: { returnTo?: string }): Promise<Response>;
   callback(request: Request, id: string): Promise<Response>;

package/modules/operator-auth/routes.mjs

@@ -19,7 +19,7 @@ function notice(auth, code, extra = {}) {
 
 /** Fetch-compatible optional HTTP adapter. Returns null for paths it does not own. */
 export function createAuthHandler(auth) {
-  const oidc = auth.providers ? createOidcHandler(auth.providers) : null;
+  const oidc = auth.providers ? createOidcHandler(auth.providers, { signInPath: auth.presentation.signInPath }) : null;
   return async function handleAuth(request) {
     const url = new URL(request.url);
     const path = url.pathname;

package/modules/portability/README.md

@@ -32,6 +32,34 @@ schema at construction. Apply the bookkeeping migration first. Policy fields:
 | `extraPayloads` | Named `{produce,consume}` pairs. Producers return bytes or a byte stream. Consumers receive a verified byte stream and descriptor before D1 commit. |
 | `partBytes` | Maximum part size, default 16 MiB, configurable from 1 KiB to 16 MiB. |
 
+For native local CLI transfers, declare executable policy through
+`localPortability({database, buckets, policyModule})`. `policyModule` is a
+seed-root-relative path or a `file:` URL (including `new URL('./archive-policy.mjs',
+import.meta.url)` in the seed adapter). Its real path must be a file inside the
+seed root, and its **default export** must be the policy object:
+
+```js
+const allowedDomains = new Set(['example.org']);
+export default {
+  product: 'my-product',
+  validateStaged: async ({read}) =>
+    (await read('contacts')).every(row => allowedDomains.has(row.domain)),
+};
+```
+
+The runner validates the module/export before applying data migrations. The
+native transfer worker imports that same seed-owned entry point, preserving
+functions and module-local closures. Modules should have no top-level effects:
+preflight and transfer each load them in a separate process. Archive metadata
+never selects executable policy. Invalid paths, missing/invalid default exports,
+and declaring both `policy` and `policyModule` fail closed. Serializable object
+`policy` declarations remain supported; inline functions (including nested
+schema-upgrade and payload callbacks) are refused instead of being dropped by
+JSON transport. Container transfer currently refuses `policyModule` explicitly;
+it continues to accept serializable object policies. Malformed primary or later
+journal JSON is reported once as `archive_json` with exit 2, before local data
+migrations, without echoing archive content or parser diagnostics.
+
 Default exclusions are `sqlite_%`, `_cf_%`, `d1_migrations`,
 `rer_portability_%`, `rer_mail_development_outbox`, `oa_%`, `oc_%`,
 `rer_dependency_keys`, `rer_dependency_pending` and `rer_dependency_codes`.

package/modules/portability/bridge.mjs

@@ -3,12 +3,19 @@ import { canonicalJson } from './hash.mjs';
 import { tokens, identifier, folded } from './generated.mjs';
 import { changesData } from './migration-statements.mjs';
 
-// Applied product migrations in the ledger's own order: the deploy ledger when
-// present (it covers any older Wrangler history), else Wrangler's.
+// Applied product migrations in the ledger's own order. A state-bearing D1
+// ledger may hold an unacknowledged migration whose effects are unknown; neither
+// an archive nor a restore can attest its history until that is resolved.
 export async function appliedMigrations(db) {
   const ledgers=(await all(db,"SELECT name FROM sqlite_master WHERE type='table' AND name IN ('_rer_deploy_migrations','d1_migrations')")).map(x=>x.name);
   if(ledgers.includes('_rer_deploy_migrations'))return (await all(db,"SELECT name FROM _rer_deploy_migrations WHERE state='applied' ORDER BY name")).map(x=>x.name);
-  return ledgers.includes('d1_migrations')?(await all(db,'SELECT name FROM d1_migrations ORDER BY id')).map(x=>x.name):undefined;
+  if(!ledgers.includes('d1_migrations'))return;
+  const columns=(await all(db,'PRAGMA table_info(d1_migrations)')).map(x=>x.name);
+  const tracked=columns.includes('state') || columns.includes('sha256');
+  if(tracked)insist(columns.includes('state') && columns.includes('sha256'),'schema_mismatch:migration_history',409);
+  const rows=await all(db,`SELECT name${tracked?',state':''} FROM d1_migrations ORDER BY id`);
+  if(tracked)insist(rows.every(row=>row.state==='applied'),'schema_mismatch:uncertain_migrations',409);
+  return rows.map(row=>row.name);
 }
 // Where an archive sits in the destination's applied migrations: those its
 // rows passed through (earlier) and those applied after it (unapplied).

package/modules/portability/import.mjs

@@ -8,11 +8,13 @@ import { fence, mergeJournal, tombstone } from './journal.mjs';
 import { writeObject } from './payloads.mjs';
 import { createCopy,sidecar,readCopy,restoreCopy } from './copies.mjs';
 import { excludedDependentGuards } from './restore-safety.mjs';
-import { additiveBridge, sameSchemaMigrations } from './bridge.mjs';
+import { additiveBridge, sameSchemaMigrations, appliedMigrations } from './bridge.mjs';
 import { legacyEmptyGuards, legacyAuditStatements, requireLegacyEmpty } from './legacy-safety.mjs';
 export async function createImport(context,manifest,actor='direct',legacyRecovery) {
-  const {db,config,buckets}=context;await checkManifest(manifest);await state(db);
+  const {db,config,buckets}=context;await checkManifest(manifest);
   insist(manifest.product===config.product,'wrong_product');
+  // Explicit schema upgrades can reconcile rows, but cannot attest an interrupted deployment.
+  await appliedMigrations(db);await state(db);
   const cat=await catalogue(db,config),upgrade=config.acceptedSchemas[manifest.schema];
   const same=manifest.schema===cat.identity;
   const bridge=same || upgrade?undefined:await additiveBridge(db,manifest,cat,context.migrations);

package/onboarding/commands.mjs

@@ -161,6 +161,8 @@ export async function createCommands(directory,state,{terminal=text=>writeSync(1
    const readinessSignal=signal&&options.signal?AbortSignal.any([signal,options.signal]):options.signal||signal;
    return waitForReadiness(label,child,health,{...options,signal:readinessSignal},capture,report,(step,detail)=>failure(step,detail,capture));
   },
-  async closeCommands(){await stopCommands();if(!closed){closed=true;await log.close();await policy.close();}}
+  // The log and the queue policy socket close even when a child's stop fails: an
+  // open policy socket keeps this process alive after its command has finished.
+  async closeCommands(){try{await stopCommands();}finally{if(!closed){closed=true;try{await log.close();}finally{await policy.close();}}}}
  };
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@runeditrun/rer",
-  "version": "0.2.1",
+  "version": "0.2.2",
   "description": "The rer command: install, set up, run and launch Run Edit Run checkouts.",
   "license": "MIT",
   "type": "module",

package/scripts/publish-check/publication-config.json

@@ -22,6 +22,12 @@
     { "repository": "just-every/run-oncall", "reason": "Owner-proposed public name (13 Oct 2026), accepted ahead of the rename; created by clean-history export at the first public tag." },
     { "repository": "just-every/run-spool", "reason": "Owner-proposed public name (13 Oct 2026), accepted ahead of the rename; created by clean-history export at the first public tag." },
     { "repository": "just-every/run-happytohelp", "reason": "Owner-proposed public name (13 Oct 2026), accepted ahead of the rename; created by clean-history export at the first public tag." },
-    { "repository": "just-every/run-auth", "reason": "Owner-proposed public name (13 Oct 2026), accepted ahead of the rename; created by clean-history export at the first public tag." }
+    { "repository": "just-every/run-auth", "reason": "Owner-proposed public name (13 Oct 2026), accepted ahead of the rename; created by clean-history export at the first public tag." },
+    { "repository": "just-every/run-chest", "reason": "Owner-proposed public name (13 Oct 2026), accepted ahead of the rename; created by clean-history export at the first public tag." },
+    { "repository": "just-every/run-purse", "reason": "Owner-proposed public name (13 Oct 2026), accepted ahead of the rename; created by clean-history export at the first public tag." },
+    { "repository": "just-every/run-easel", "reason": "Owner-proposed public name (13 Oct 2026), accepted ahead of the rename; created by clean-history export at the first public tag." },
+    { "repository": "just-every/run-willow", "reason": "Owner-proposed public name (13 Oct 2026), accepted ahead of the rename; created by clean-history export at the first public tag." },
+    { "repository": "just-every/run-pier", "reason": "Owner-proposed public name (13 Oct 2026), accepted ahead of the rename; created by clean-history export at the first public tag." },
+    { "repository": "just-every/run-linen", "reason": "Owner-proposed public name (13 Oct 2026), accepted ahead of the rename; created by clean-history export at the first public tag." }
   ]
 }