@runeditrun/rer 0.2.1 → 0.2.4

package/cli/setup-input.mjs

@@ -87,7 +87,7 @@ export async function setupInput(project, options, vars, signal, { origin } = {}
  if(savedEmail&&!mailbox(savedEmail))throw refuse('Saved owner is malformed. Restore private settings or run rer reset --yes.');
  if(savedEmail&&savedEmail.toLowerCase()!==answers[names.email]){
   if(owners.length)throw refuse(`Private setting ${names.email} differs from the retained database owner. Restore ${names.email} in ${project.adapter.hooks?.secrets?.file??'.dev.vars'} to ${answers[names.email]}, then run rer setup --owner-email ${answers[names.email]}; or back up data and run rer reset --yes. Private bytes were kept.`);
-  throw refuse(`Owner conflicts with the saved installation (${savedEmail}). Run rer setup --owner-email ${savedEmail}, or back up data and run rer reset --yes.`);
+  throw refuse(`Owner conflicts with the saved installation (${savedEmail}). Run rer setup --owner-email ${savedEmail}, or back up data, run rer dev --stop, then rer reset --yes followed by rer setup --owner-email ${answers[names.email]}. Reset deletes local data.`);
  }
 
  try{return seed.model.validateInput(answers,known);}catch{throw missing('Installer answers are incomplete. Supply the active manifest fields using rer setup --answers answers.json --non-interactive.');}

package/cli/site-check.mjs

@@ -3,7 +3,7 @@ import { join, posix } from 'node:path';
 import { createRequire } from 'node:module';
 import { pathToFileURL } from 'node:url';
 import { privateDataScanner, decodedText } from './site-data.mjs';
-import { javascriptContent } from './site-references.mjs';
+import { javascriptContent, javascriptContext } from './site-references.mjs';
 import { javascriptStrings } from './site-syntax.mjs';
 import { markupReferences, markupStrings, htmlElements, cssStrings } from './site-markup.mjs';
 import { refuse, RerError } from './errors.mjs';
@@ -77,15 +77,24 @@ export async function checkSite(folder, { privateValues = [], privateIdentities
   const require = createRequire(join(root, 'package.json'));
   ({parseAst:parse} = await import(pathToFileURL(require.resolve('vite')).href));
  }
+ const documents = [], treesByFile = new Map();
+ for (const [site, bytes] of all) {
+  const text = bytes.toString('utf8'), trees = /\.[cm]?js$/.test(site) && parse ? [parse(text)] : [];
+  if (/\.(?:html|svg)$/.test(site)) {
+   documents.push(text);
+   for (const {tag, attributes, content} of htmlElements(text)) {
+    if (tag === 'script' && !attributes.has('src') && parse && /^(?:|module|(?:text|application)\/(?:java|ecma)script)$/i.test(attributes.get('type') ?? '')) trees.push(parse(content));
+   }
+  }
+  treesByFile.set(site, trees);
+ }
+ const context = javascriptContext(documents, [...treesByFile.values()].flat());
  const problems = [], unresolved = [];
  for (const [site, bytes] of all) {
   if (markers.some(marker => bytes.includes(marker))) throw refuse(`The run site file ${site} contains the local-only dev layer.`);
   const html = /\.(?:html|svg)$/.test(site), css = site.endsWith('.css'), js = /\.[cm]?js$/.test(site);
-  const text = bytes.toString('utf8'), trees = js && parse ? [parse(text)] : [], literals = css ? cssStrings(text) : html ? markupStrings(text) : [];
-  if (html) for (const {tag, attributes, content} of htmlElements(text)) {
-   if (tag === 'script' && !attributes.has('src') && parse && /^(?:|module|(?:text|application)\/(?:java|ecma)script)$/i.test(attributes.get('type') ?? '')) trees.push(parse(content));
-  }
-  const scripts = trees.map(javascriptContent), strings = trees.flatMap(javascriptStrings);
+  const text = bytes.toString('utf8'), trees = treesByFile.get(site), literals = css ? cssStrings(text) : html ? markupStrings(text) : [];
+  const scripts = trees.map(tree => javascriptContent(tree, context)), strings = trees.flatMap(javascriptStrings);
   if (containsPrivateData(bytes, [...literals, ...strings, ...strings.flatMap(markupStrings), ...scripts.flatMap(script => script.literals)])) throw new RerError('site_private_data', `The run site file ${site} contains this installation's private data (owner identity or a secret). The run site renders only edition identity.`, 4);
   if (!html && !css && !js) continue;
   const refs = [...(js ? [] : markupReferences(text, html)), ...scripts.flatMap(script => script.references)];

package/cli/site-data.mjs

@@ -22,8 +22,9 @@ export function decodedText(text) {
 export function privateDataScanner(values, identities) {
  const secrets = values.filter(value => typeof value === 'string' && value.length);
  const owners = identities.filter(value => typeof value === 'string' && value.length).map(value => ({value, ...identityPattern(value)}));
- const encodedValues = [...secrets, ...owners.map(item => item.value)].flatMap(value => [Buffer.from(value).toString('base64'), Buffer.from(value).toString('base64').replace(/=+$/, ''), Buffer.from(value).toString('base64url')]);
- const base64 = encodedValues.map(value => new RegExp(`(?<![A-Za-z0-9+/_-])${value.replace(/[.*+?^${}()|[\]\\]/g, '\\$&')}(?![A-Za-z0-9+/_=-])`));
+ const encodings = value => [Buffer.from(value).toString('base64'), Buffer.from(value).toString('base64').replace(/=+$/, ''), Buffer.from(value).toString('base64url')];
+ const encodedSecrets = secrets.flatMap(encodings);
+ const encodedOwners = owners.flatMap(({value}) => encodings(value)).map(value => new RegExp(`(?<![A-Za-z0-9+/_-])${value.replace(/[.*+?^${}()|[\]\\]/g, '\\$&')}(?![A-Za-z0-9+/_=-])`));
  return (bytes, literalValues = []) => {
   if (secrets.some(value => bytes.includes(Buffer.from(value)))) return true;
   const raw = bytes.toString('utf8');
@@ -42,10 +43,10 @@ export function privateDataScanner(values, identities) {
     forms.add(plain); forms.add(decodedText(plain));
    }
    if (secrets.some(value => form.includes(value)) || owners.some(({pattern}) => pattern.test(form))) return true;
-   if (base64.some(pattern => pattern.test(form))) return true;
+   if (encodedSecrets.some(value => form.includes(value)) || encodedOwners.some(pattern => pattern.test(form))) return true;
    // A base64 payload may include surrounding text, changing its alignment.
-   for (const match of form.matchAll(/[A-Za-z0-9+/_-]{8,}={0,2}/g)) {
-    const plain = Buffer.from(match[0], 'base64').toString('utf8');
+   for (const match of form.matchAll(/[A-Za-z0-9+/_-]{8,}={0,2}/g)) for (let offset = 0; offset < 4; offset++) {
+    const plain = Buffer.from(match[0].slice(offset), 'base64').toString('utf8');
     if (secrets.some(value => plain.includes(value)) || owners.some(({pattern}) => pattern.test(plain))) return true;
    }
   }

package/cli/site-references.mjs

@@ -1,12 +1,162 @@
 import { memberName, stringValue, walkSyntax } from './site-syntax.mjs';
 import { localValues } from './site-bindings.mjs';
 import { browserObjects } from './site-browser-objects.mjs';
-import { markupReferences, cssReferences, markupStrings, cssStrings } from './site-markup.mjs';
+import { markupReferences, cssReferences, markupStrings, cssStrings, htmlElements } from './site-markup.mjs';
 
-export function javascriptContent(tree) {
+// A firstChild expression is not a type proof: its parent may contain an
+// object element. Admit CharacterData only from an unambiguous emitted text
+// child, consistent across all pages, with no script that can replace it.
+export function javascriptContext(documents, trees) {
+ const children = new Map();
+ // Recognize a balanced subset of ordinary HTML, rather than guessing at
+ // browser repair rules. Tables, foreign content, templates and formatting
+ // reconstruction leave every node unknown. Common page links, headings and
+ // buttons are safe when explicitly closed in their ordinary insertion mode.
+ const containers = new Set('p div span section article aside nav header footer main object a button h1 h2 h3 h4 h5 h6 ul ol li dl dt dd figure figcaption details summary'.split(' '));
+ const voids = new Set('br hr img input link meta wbr'.split(' '));
+ const raw = new Set(['script','style','title','textarea']);
+ const ordinary = new Set([...containers, ...voids, ...raw, 'html','head','body']);
+ const blocks = new Set('p div section article aside nav header footer main h1 h2 h3 h4 h5 h6 ul ol li dl dt dd figure figcaption details summary hr'.split(' '));
+ const unknown = () => ({textParents:new Set()});
+ for (const text of documents) {
+  const seen = new Set(), structure = new Set(), stack = [];
+  const tags = /<!--[\s\S]*?(?:-->|$)|<!doctype\s+html\s*>|<\/?([a-z][a-z0-9:-]*)\b((?:[^"'<>]|"[^"]*"|'[^']*')*)>|[^<]+|</gi;
+  for (let match; (match = tags.exec(text));) {
+   if (match[0] === '<') return unknown();
+   if (match[0].startsWith('<!--') && !/^<!--(?:[^<>-]|-(?!-))*-->$/.test(match[0])) return unknown();
+   if (!match[1]) continue;
+   const tag = match[1].toLowerCase();
+   if (!ordinary.has(tag)) return unknown();
+   if (match[0].startsWith('</')) {
+    if (match[2].trim() || stack.pop() !== tag) return unknown();
+    continue;
+   }
+   // Reject malformed attributes and non-void self-closing tags, which HTML
+   // parses differently from XML. Never infer text from the repaired tree.
+   if (!/^(?:\s+[^\s"'<>/=]+(?:\s*=\s*(?:"[^"]*"|'[^']*'|[^\s"'=<>`]+))?)*\s*\/?$/.test(match[2]) || (!voids.has(tag) && /\/\s*$/.test(match[2]))) return unknown();
+   if (stack.includes('head') && !['meta','link','title','style','script'].includes(tag)) return unknown();
+   if ((blocks.has(tag) && stack.includes('p')) || (['a','button','li'].includes(tag) && stack.includes(tag)) || (/^h[1-6]$/.test(tag) && stack.some(parent => /^h[1-6]$/.test(parent))) || (['dt','dd'].includes(tag) && stack.some(parent => ['dt','dd'].includes(parent)))) return unknown();
+   if (['html','head','body'].includes(tag)) {
+    if (structure.has(tag) || stack.some(parent => parent !== 'html') || (tag === 'html' && stack.length) || (tag === 'head' && structure.has('body'))) return unknown();
+    structure.add(tag);
+   }
+   const {attributes} = htmlElements(match[0])[0];
+   if ([...attributes.keys()].some(name => name.startsWith('on'))) return unknown();
+   const id = attributes.get('id');
+   if (id !== undefined) {
+    const firstText = /^[^<]*/.exec(text.slice(tags.lastIndex))[0].replace(/\0/g, '');
+    const textChild = containers.has(tag) && firstText.length > 0;
+    children.set(id, textChild && !seen.has(id) && children.get(id) !== false);
+    seen.add(id);
+   }
+   if (raw.has(tag)) {
+    if (tag === 'script' && !/^(?:|module|(?:text|application)\/(?:java|ecma)script|application\/(?:ld\+)?json)$/i.test(attributes.get('type') ?? '')) return unknown();
+    const closing = new RegExp('</' + tag + '(?=[\\s/>])[^>]*>', 'ig'); closing.lastIndex = tags.lastIndex;
+    const end = closing.exec(text);
+    if (!end || !new RegExp('^</' + tag + '\\s*>$', 'i').test(end[0])) return unknown();
+    if (tag === 'script' && /<!--|<script\b/i.test(text.slice(tags.lastIndex, end.index))) return unknown();
+    tags.lastIndex = closing.lastIndex;
+   } else if (!voids.has(tag)) stack.push(tag);
+  }
+  if (stack.length) return unknown();
+ }
+ // Include every emitted script: a different island can change the selected
+ // element, its id or its children before this assignment runs.
+ const nativeMethods = new Set(['querySelector','querySelectorAll','getElementById','getElementsByTagName','getElementsByClassName','getElementsByName','createElement','createElementNS','getAttribute','hasAttribute','addEventListener','removeEventListener','setAttribute','setAttributeNS','removeAttribute','removeAttributeNS']);
+ const reflectiveMethods = new Set(['assign','defineProperty','defineProperties','setPrototypeOf','set','deleteProperty']);
+ const writes = new Set(['id','innerHTML','outerHTML','textContent','innerText','outerText','srcdoc','document','head','firstChild','__proto__',...nativeMethods,...reflectiveMethods]);
+ const changes = new Set(['before','after','append','prepend','appendChild','removeChild','replaceChild','replaceChildren','insertBefore','insertAdjacentHTML','insertAdjacentElement','insertAdjacentText','replaceWith','remove','write','writeln','setHTML','setHTMLUnsafe','normalize','insertNode','surroundContents','extractContents','deleteContents','adoptNode','execCommand','setAttributeNode','setAttributeNodeNS','__defineGetter__','__defineSetter__']);
+ let stable = true;
+ for (const tree of trees) {
+  const values = localValues(tree), browser = browserObjects(values);
+  // A newly created metadata link appended to the head cannot replace a
+  // selected text child in the body. Its resource URLs still get checked.
+  // Requiring fresh native nodes also excludes moving an existing child out
+  // of a text parent. Any id write above still invalidates this proof.
+  const documentObject = node => {
+   const alternatives = values.origins(node);
+   return alternatives.length > 0 && alternatives.every(browser.document);
+  };
+  const plainObject = node => {
+   const receivers = values.origins(node);
+   return receivers.length > 0 && receivers.every(value => value.type === 'ObjectExpression' && value.properties.every(property => property.type === 'Property' && property.kind === 'init'));
+  };
+  // Selector, traversal and head-link proofs depend on native DOM methods.
+  // Writes to those members, including prototype mutation through reflection,
+  // remove the proof across all emitted scripts. A known fresh plain object
+  // can still receive ordinary metadata without changing the native APIs.
+  const reflectiveMutation = node => values.names(node).some(name => reflectiveMethods.has(name))
+   && ['Object','Reflect'].some(name => values.global(node.object, name));
+  const writeTargets = node => {
+   if (!node) return [];
+   if (node.type === 'ObjectPattern') return node.properties.flatMap(property => writeTargets(property.value ?? property.argument));
+   if (node.type === 'ArrayPattern') return node.elements.flatMap(writeTargets);
+   if (node.type === 'AssignmentPattern') return writeTargets(node.left);
+   if (node.type === 'RestElement') return writeTargets(node.argument);
+   return [node];
+  };
+  const headLink = node => {
+   if (node?.type !== 'CallExpression' || memberName(node.callee) !== 'appendChild' || node.arguments.length !== 1) return false;
+   const receivers = values.origins(node.callee.object), arguments_ = values.origins(node.arguments[0]);
+   return receivers.length > 0 && receivers.every(receiver => memberName(receiver) === 'head' && documentObject(receiver.object))
+    && arguments_.length > 0 && arguments_.every(value => value.type === 'CallExpression' && memberName(value.callee) === 'createElement' && value.arguments.length === 1
+     && documentObject(value.callee.object) && values.resources(value.arguments[0]).every(tag => tag.complete && tag.value.toLowerCase() === 'link'));
+  };
+  walkSyntax(tree, (node, parents) => {
+   const target = node.type === 'AssignmentExpression' ? node.left : node.type === 'UpdateExpression' || (node.type === 'UnaryExpression' && node.operator === 'delete') ? node.argument : undefined;
+   for (const write of writeTargets(target)) {
+    if (write.type === 'Identifier' && values.global(write, 'document')) stable = false;
+    if (write.type !== 'MemberExpression') continue;
+    const fields = values.names(write);
+    if ((!fields.length && !plainObject(write.object)) || fields.some(name => writes.has(name))) stable = false;
+   }
+   if (node.type === 'Property' && values.names(node).some(name => writes.has(name) || changes.has(name))) stable = false;
+   if (node.type === 'MemberExpression' && values.names(node).some(name => name === 'attributes' || changes.has(name)) && !headLink(parents.at(-1))) stable = false;
+   if (node.type === 'MemberExpression' && reflectiveMutation(node)) {
+    const call = parents.at(-1);
+    if (call?.type !== 'CallExpression' || call.callee !== node || !plainObject(call.arguments[0])) stable = false;
+   }
+   if (!['CallExpression','NewExpression'].includes(node.type)) return;
+   if (values.global(node.callee, 'eval') || values.global(node.callee, 'Function')) stable = false;
+   const appendsHeadLink = headLink(node);
+   for (const callee of values.origins(node.callee)) {
+    const methods = values.names(callee);
+    if (reflectiveMutation(callee) && !plainObject(node.arguments[0])) stable = false;
+    if (methods.some(name => changes.has(name)) && !appendsHeadLink) stable = false;
+    if (methods.some(name => ['setAttribute','setAttributeNS','removeAttribute','removeAttributeNS'].includes(name))) {
+     const index = methods.some(name => name.endsWith('NS')) ? 1 : 0, attributes = values.resources(node.arguments[index]);
+     if (attributes.some(({value, complete}) => !complete || /^(?:id|on.*)$/i.test(value))) stable = false;
+    } else if (!appendsHeadLink && node.arguments.some(argument => browser.dom(argument))) stable = false;
+    if (!appendsHeadLink && callee.type === 'MemberExpression' && (!methods.length || (browser.dom(callee.object) && methods.some(name => !nativeMethods.has(name))))) stable = false;
+   }
+  });
+ }
+ return {textParents:new Set(stable ? [...children].filter(([,text]) => text).map(([id]) => id) : [])};
+}
+
+export function javascriptContent(tree, {textParents = new Set()} = {}) {
  const values = localValues(tree), {strings, names, resources, origins, global, localClass} = values;
  const browser = browserObjects(values), found = [], literals = [], unresolved = [];
  const properties = new Set(['src','href','srcset','action','formaction','poster','data']);
+ // Unknown DOM nodes retain the data URL check. A selector or traversal
+ // alone cannot distinguish HTMLObjectElement from CharacterData.
+ const characterData = node => {
+  const alternatives = origins(node);
+  return alternatives.length > 0 && alternatives.every(value => {
+   if (value.type !== 'MemberExpression' || memberName(value) !== 'firstChild') return false;
+   const parents = origins(value.object);
+   return parents.length > 0 && parents.every(parent => {
+    if (parent.type !== 'CallExpression') return false;
+    const receivers = origins(parent.callee.object);
+    if (!receivers.length || !receivers.every(browser.document)) return false;
+    const method = memberName(parent.callee), selectors = resources(parent.arguments[0]);
+    return ['querySelector','getElementById'].includes(method) && selectors.length > 0 && selectors.every(({value, complete}) => {
+     const id = method === 'getElementById' ? value : /^#([a-z_][\w-]*)$/i.exec(value)?.[1];
+     return complete && id !== undefined && textParents.has(id);
+    });
+   });
+  });
+ };
  const elementFactory = callee => {
   const methods = names(callee);
   if (!methods.some(name => ['createElement','jsx','jsxs','jsxDEV'].includes(name)) || localClass(callee.object)) return false;
@@ -38,7 +188,7 @@ export function javascriptContent(tree) {
    if (browser.location(node.left)) add(node.right, 'location.href');
    for (const property of fields) {
     const name = property.toLowerCase();
-    if (properties.has(name) && browser.dom(object)) add(node.right, `DOM.${property}`, name === 'href' && browser.anchor(object), true, name === 'srcset');
+    if (properties.has(name) && browser.dom(object) && (name !== 'data' || !characterData(object))) add(node.right, `DOM.${property}`, name === 'href' && browser.anchor(object), true, name === 'srcset');
     if (property === 'href' && browser.location(object)) add(node.right, 'location.href');
     if (['innerHTML','outerHTML','srcdoc'].includes(property)) markup(node.right, browser.dom(object));
    }

package/global/CHANGELOG.md

@@ -1,5 +1,65 @@
 # Changelog
 
+## 0.2.4
+
+0.2.3 was tagged but not published; its changes are in 0.2.4.
+
+- A first `rer deploy` waits up to two minutes (it was 30 seconds) for Cloudflare's account listing to show a database, bucket, namespace or queue it has just created, whether the listing disagrees with its own page counts or leaves the new resource out; one that never appears stops the deploy before any upload, names the resource, and the same command resumes with it.
+- A first `rer dev` no longer chooses the port another, stopped checkout was set up on, so both checkouts keep working origins.
+- Seed recovery code can check the deploy migration ledger with one call: `migrationLedgerShape(rows)` from `@runeditrun/rer/modules/deploy-kit/migration-ledger`, given the rows of its `ledgerShapeQuery`, accepts all four ledger shapes a deployment can hold (Wrangler's `d1_migrations`, that table after a kit deploy adopted it, the kit's own `d1_migrations` since 0.2.2, and the `_rer_deploy_migrations` ledger a 0.2.1 or earlier deploy left, shape `legacy`, which wins when both tables exist) and refuses any other. A seed whose recovery checks that the ledger is exactly Wrangler's three columns refuses ledgers from 0.2.2 on (`MIGRATION_MISMATCH`); replace that check with this call.
+- `rer import` and hosted restores refuse an archive that records a migration this installation has not applied (`schema_mismatch`), even when that migration left the schema unchanged (an index or a data-only change); such an archive is newer than the installation.
+- After a pulled change to a checkout's `@runeditrun/rer` pin, every verb (`rer deploy` included) installs the pinned version with the frozen lockfile before it runs, instead of asking you to run `rer install` first.
+- Two verbs started at the same moment after a pulled pin change share one install of the new pin: the second waits for the first's install, then runs, instead of racing it and failing with "The declared adapter could not be loaded".
+- The publication scan accepts AI-generated PNGs whose C2PA manifest carries the signing certificate's email address (certificate names are metadata) and phone JPEGs that store more images after the first (every image's pixels are skipped as pixels), while an address in the rest of the manifest, XMP or EXIF is still flagged.
+- Dependency installs receive only the environment an install needs, never your credentials: the frozen `pnpm install` that `rer install`, a fresh clone's first verb, `rer dev`, the installer and `rer release` run, the pnpm version check, `rer update`'s npm install and local data migrations get `PATH`, `HOME`, `USER`, `LOGNAME`, `SHELL`, `TMPDIR`/`TMP`/`TEMP`, `TERM`, `LANG`/`LANGUAGE`/`LC_*`, `TZ`, `CI`, `SSH_AUTH_SOCK` (git+ssh dependencies), `NODE_OPTIONS`, `NODE_EXTRA_CA_CERTS`, `XDG_*`, proxy settings without their user:password, and `npm_config_*`, `PNPM_*`, `COREPACK_*` and `RER_*` settings except credentials (by name, such as `_authToken` or `*_SESSION`, or by value: a URL with a password, a credential query or connection-string parameter, a JWT, a private key, an Authorization header or a provider token). Every other variable stays with you, so dependency build scripts (esbuild, workerd, sharp, oxide) never see vault sessions (`BW_SESSION`, `OP_SESSION_*`), connection strings, keys or tokens under any name. `rer deploy` and the seed's own `verify` still receive everything.
+- A proxy setting reaches a dependency install without its user:password even when the password contains spaces, an extra `@` or the value starts with whitespace.
+- `rer deploy` setting or removing a secret whose answer was lost settles against the Worker version it recorded, so a later deploy recognises the change instead of refusing it.
+- A secret change whose answer was lost while the read-back also failed stays recorded as pending, so the next `rer deploy` recognises it instead of locking you out; replacing an existing secret after a lost answer writes it again and confirms it before reporting success.
+- After it claims the hosted owner, retires the setup token or sets or removes a secret, `rer deploy` checks the app's health on the new Worker version and fails with the HTTP status and the response's first line, instead of reporting success, when the app is not healthy.
+- `rer setup` finishes provider-free when a seed declares an optional dependency that you leave unconnected.
+- A seed adapter can declare `resetPreflight`; `rer reset` runs it before listing or deleting anything, and `--yes` cannot skip it.
+- A first `rer dev` whose chosen port is taken by another program before setup can use it moves to the next free port and says which.
+- `rer deploy` says it is deploying to your Cloudflare account and names the live address, instead of saying the application is running locally; `rer build` ends with "Your application is built".
+- `rer describe` in the default seed and new foundations names the release keygen, sign and receipt subcommands again.
+- Importing an archive whose bytes are not valid UTF-8 is refused with the same `archive_json` diagnostic (exit 2) as invalid JSON.
+- Converting a seed to package mode no longer leaves a broken queue sentence in its README or `scripts/base-cli` paths in its operations guide and erasure README.
+- The owner's sign-in settings page (`/auth/settings/identity`) wears the seed's declared theme, like sign-in and setup.
+- `rer demo` (the same as `rer dev --demo`) runs a seed as a throwaway local demo: signed in as the saved owner, filled with the seed's demo data, marked by a Demo bar, unable to send anything, and deleted on `--stop`, Ctrl-C or after an hour; the checkout's own state is never written.
+- Under `rer demo`, `fetch`, redirects, `WebSocket`, `navigator.sendBeacon`, `EventSource`, `node:net`/`node:tls` and `cloudflare:sockets` reach loopback hosts only, and every refused send is listed in the Demo bar.
+- `rer demo` refuses a seed that has not adopted it (no `withDemo` guard, no `demoSockets()` or a state path that ignores `RER_STATE_DIR`), and `rer deploy`, including `--dry-run`, refuses a deploy declaration or `--env-file` that carries `RER_DEMO` and names the key.
+- `rer deploy --demo` hosts a seed's demo at `demo.<domain>`: each visitor passes a Turnstile check and gets their own signed-in, throwaway container of the seed that can send nothing, ended after an hour or 15 idle minutes. `export/run-demo.yml` deploys it when `RUN_DEMO_DEPLOY` is on.
+- `rer deploy` claims the hosted owner after every deploy, including seeds whose own deploy hooks run, retires the setup token, keeps an existing native identity-provider owner and keeps a live owner token you supply.
+- Container images built by `rer build --platform container` start again; they exited at start.
+- The default seed's sign-in serves the signed owner claim whenever its public keys are configured.
+- A seed can declare a reviewed rewrite of an already released migration in `migrations/rewrites.json`; deploys and local builds accept the released bytes for that migration only and still refuse every undeclared change.
+- Seed table inventories can use the exported portability exclusion list, so native ZIP and remote export no longer refuse the deploy controller's migration ledger table.
+- The publication scan skips only the compressed pixel and sample data of recognised images and videos; their comments, XMP, EXIF and tags are checked, and a text file behind a fake media header is checked whole.
+- With `--public-base`, the publication scan reports a file identical to the public base's copy as pre-existing instead of a finding.
+- Base's default seed and source import kit (outside the rer npm package) prepare and verify 100,000-row imports across requests within the Worker CPU limit and resume after a killed step; a changed re-upload under a published key is refused.
+- Base's default seed and source import kit erase a person named in other people's imported records at seed scale, across requests, and when they never became a native record; an interrupted erasure is finished by a cron sweep within about 10 minutes.
+
+### Upgrade notes
+
+- Existing OIDC provider links show **not linked** until the next successful sign-in through each provider, because older stores have no verified token-exchange observation for them.
+- The default seed's erasure queue message is now `{ redact, chain }` instead of `{ redact, operator, continuation }`; a message still queued in the old shape when you deploy is refused, so let the erasure queue drain first. Default-seed migrations 0021 to 0023 add the import-step, stream-source and erasure-progress tables, and its cron trigger sweeps erasures every 10 minutes.
+- A seed adopting `rer demo` adds `src/demo.ts` (exporting an idempotent `seedDemo`), copies Base's `modules/demo/` and wraps its Worker entry's default export in `withDemo` as the entry's first import, and makes three `vite.config` changes: the state path reads `RER_STATE_DIR`, the dev entry's vars pass `RER_DEMO` and `RER_DEMO_EXPIRES`, and `demoSockets()` comes first in `plugins`; add `.rer/demo/` to `.gitignore`. `export/DEMO.md` has the steps.
+- A private registry's auth must be in `~/.npmrc` (or the registry config your package manager reads from `HOME`): dependency installs now get only an allowlisted environment, so a token passed as an environment variable no longer reaches them.
+- A seed with custom recovery code that checks the deploy migration ledger is exactly Wrangler's three columns uses `migrationLedgerShape` instead; the old check refuses ledgers from 0.2.2 on (`MIGRATION_MISMATCH`).
+
+## 0.2.2
+
+- `rer deploy` claims the hosted owner, exits cleanly when it finishes, changes and removes secrets safely, and removes the resources it created when you ask it to.
+- Local restore runs the seed's own restore-validation policies, so a seed no longer needs its own patch or adapter for them.
+- Hosted exports stay portable: the deploy kit's migration ledger is kept out of seed archives, compound D1 migrations such as triggers apply, and an archive or import target with uncertain migration history is refused.
+- Package-mode guidance in the exported docs names the commands a package-mode seed actually runs, and the local-run docs describe the sign-in outbox.
+- `rer release --help` and the job-queue help print their usage.
+- `rer describe` reports the effects a seed declares for each command instead of generic account effects.
+- Linked OIDC providers report health from the token exchange, stay healthy when one authorization code is rejected, and send failures to the configured sign-in path.
+- The run-site privacy check catches registered secrets inside prefixed base64 and accepts constant text that a client island imports.
+- Fresh rer launches provision pnpm, prefer the provisioned pnpm, keep state under your HOME, and clean up their probe processes.
+- Base can export a seed Verify workflow with source freshness checks for manual adoption.
+- Base's default seed and source import kit erase a person in bounded steps after retiring their imported custody; this kit is outside the rer npm package.
+
 ## 0.2.1
 
 - `rer release keygen` prepares publisher keys and anchor entries; `rer release sign` writes a detached signature for a completed tagged release.

package/global/README.md

@@ -22,8 +22,11 @@ refuses archives with absolute paths, `..` entries, links or devices, then runs
 the package's own `rer cli install`. A failed or refused download leaves the
 version you had selected.
 
-No installer edits shell profiles. When `~/.local/bin` is not on your PATH, the
-install prints the exact line to add for your shell. The launcher runs `node` from
+No installer edits shell profiles. The canonical launcher is `~/.local/bin/rer`.
+When that directory is absent from PATH, installation also links it into an
+existing writable, user-owned PATH directory if available, preserving foreign
+commands. Otherwise it prints one activation line to run in the current shell:
+`export PATH="$HOME/.local/bin:$PATH"` (with fish syntax for fish). The launcher runs `node` from
 PATH, so a Node upgrade does not break it. A re-run with the same build changes
 nothing; a different build is installed beside the current one, the previous one
 is kept and older ones are removed. It refuses to replace a `~/.local/bin/rer`
@@ -179,8 +182,15 @@ as an exact devDependency instead (`"@runeditrun/rer": "0.2.0"`, locked in
 which inside `pnpm run` is the pinned copy in `node_modules/.bin`, so
 `pnpm install --frozen-lockfile && pnpm run build` needs no global `rer`. A global
 `rer` hands every verb to the pinned package, launching included. Until
-`node_modules` holds the pinned version, `rer install` and `rer dev` install it
-first (the frozen `pnpm install`) and every other verb says to run `rer install`.
+`node_modules` holds the pinned version (a fresh clone, or a pulled pin change),
+every verb installs it first (the frozen `pnpm install`), then runs it; verbs
+started at once share that one install.
+Every dependency install, `rer release`'s included, receives an allowlisted
+environment: the shell, locale, terminal and temporary-folder variables, `CI`,
+`TZ`, `SSH_AUTH_SOCK`, `NODE_OPTIONS`, `NODE_EXTRA_CA_CERTS`, `XDG_*`, proxy
+settings without their user:password, and `npm_config_*`, `PNPM_*`,
+`COREPACK_*` and `RER_*` settings that carry no credential by name or value.
+No other variable reaches the package manager or a dependency's build script.
 
 Heavy package scripts wait for this computer's job queue with
 `rer queue NAME -- COMMAND [ARGS]` (in vendored mode,
@@ -267,3 +277,10 @@ Anywhere: `rer list [DIR]`, `rer cli status|install|uninstall`, `rer update`,
 `rer queue NAME -- COMMAND`, `rer --version` and `rer --help`.
 
 Licence: MIT.
+
+First-party commands acquire the exact `packageManager` pnpm pin when PATH lacks
+it, verify its registry sha512 integrity and cache it under `$HOME/.rer/pnpm`.
+No global package manager installation or sudo is needed. Independent projects
+continue to run their declared commands with their own tools. Server and job
+state default to `$HOME/.rer/servers` and `$HOME/.rer/jobs`; supplied
+`RER_SERVERS_DIR` and `RER_JOBS_DIR` take precedence and are passed to older pins.

package/global/cli/install.mjs

@@ -2,10 +2,12 @@
 // version directory, switch `current` atomically, keep the previous version,
 // prune older ones and write the launcher. Never edits shell profiles.
 import { randomUUID } from 'node:crypto';
-import { chmod, cp, mkdir, readdir, readlink, realpath, rename, rm, symlink, writeFile } from 'node:fs/promises';
+import { access, constants, chmod, cp, mkdir, readdir, readlink, realpath, rename, rm, symlink, writeFile } from 'node:fs/promises';
 import { basename, join, resolve } from 'node:path';
 import { ownManifest, ownRoot, packageDigest, packageFileList } from '../package-info.mjs';
 import { installRecord, launcherOwner, launcherScript, layout } from './layout.mjs';
+import { exposeLauncher } from './path-link.mjs';
+import { shellQuote } from '../../cli/node-runtime-cache.mjs';
 import { runningDoor } from '../../cli/door.mjs';
 
 async function readLink(path) { try { return await readlink(path); } catch (error) { if (['ENOENT', 'EINVAL'].includes(error.code)) return undefined; throw error; } }
@@ -38,13 +40,20 @@ async function writeLauncher(paths) {
  await rename(temporary, paths.launcher);
 }
 
-export function pathAdvice(paths, env = process.env) {
+export async function pathAdvice(paths, env = process.env) {
  const entries = (env.PATH ?? '').split(':').filter(Boolean).map(entry => resolve(entry));
- if (entries.includes(resolve(paths.bin))) return undefined;
- const shell = basename(env.SHELL ?? '');
- if (shell === 'fish') return `${paths.bin} is not on your PATH. Run this once in fish, then open a new terminal:\n  fish_add_path $HOME/.local/bin`;
- const profile = shell === 'zsh' ? '~/.zshrc' : shell === 'bash' ? (process.platform === 'darwin' ? '~/.bash_profile' : '~/.bashrc') : '~/.profile';
- return `${paths.bin} is not on your PATH. Add this line to ${profile}, then open a new terminal:\n  export PATH="$HOME/.local/bin:$PATH"`;
+ for (const directory of entries) {
+  if (directory === resolve(paths.bin)) return undefined;
+  const candidate = join(directory, 'rer');
+  try {
+   await access(candidate, constants.X_OK);
+   const found = await launcherOwner(await realpath(candidate));
+   if (found.state === 'ours' && found.root === paths.data) return undefined;
+   break; // This command shadows the canonical launcher, even if it is later on PATH.
+  } catch (error) { if (!['ENOENT', 'EACCES', 'ENOTDIR'].includes(error.code)) throw error; }
+ }
+ if (basename(env.SHELL ?? '') === 'fish') return `Activate rer in this shell:\n  set -gx PATH ${shellQuote(paths.bin)} $PATH`;
+ return `Activate rer in this shell:\n  export PATH=${shellQuote(paths.bin)}:"$PATH"`;
 }
 
 export async function install() {
@@ -59,8 +68,8 @@ export async function install() {
  const script = launcherScript(paths.data);
  let present = false;
  try { present = await packageDigest(join(paths.versions, name)) === digest; } catch (error) { if (error.code !== 'ENOENT') throw error; }
- const advice = pathAdvice(paths);
  if (present && current === join('versions', name) && launcher.text === script && record?.channel === channel) {
+  const advice = await activation(paths, record);
   process.stdout.write(`rer ${manifest.version} is already current (${join(paths.versions, name)}). Nothing changed.\n${advice ? advice + '\n' : ''}`);
   return 0;
  }
@@ -72,8 +81,16 @@ export async function install() {
  const doorVersion = door?.versionDir && resolve(door.versionDir, '..') === await realpath(paths.versions).catch(() => resolve(paths.versions)) ? basename(door.versionDir) : undefined;
  const keep = new Set([name, previousName, doorVersion].filter(Boolean));
  for (const entry of await readdir(paths.versions)) if (!keep.has(entry) && !entry.startsWith('.staging-')) await rm(join(paths.versions, entry), { recursive: true, force: true });
- await writeFile(paths.record, JSON.stringify({ channel, previous: previousName && keep.has(previousName) ? previousName : null }, null, 2) + '\n', { mode: 0o644 });
+ await writeFile(paths.record, JSON.stringify({ channel, links: record?.links ?? [], previous: previousName && keep.has(previousName) ? previousName : null }, null, 2) + '\n', { mode: 0o644 });
  if (launcher.text !== script) await writeLauncher(paths);
+ const advice = await activation(paths, await installRecord(paths));
  process.stdout.write(`Installed rer ${manifest.version} in ${join(paths.versions, name)}.\n${paths.launcher} runs it.${previousName ? ` The previous version (${previousName}) is kept.` : ''}\n${advice ? advice + '\n' : ''}`);
  return 0;
 }
+
+async function activation(paths, record) {
+ const link = await exposeLauncher(paths);
+ const links = [...new Set([...(record?.links ?? []), ...(link ? [link] : [])])];
+ if (JSON.stringify(record?.links ?? []) !== JSON.stringify(links)) await writeFile(paths.record, JSON.stringify({ ...record, links }, null, 2) + '\n', { mode: 0o644 });
+ return link ? undefined : await pathAdvice(paths);
+}

package/global/cli/path-link.mjs

@@ -0,0 +1,30 @@
+// Offer the canonical launcher through an existing user-owned PATH directory.
+// Foreign commands and links are never replaced, including during uninstall.
+import { access, constants, lstat, readlink, symlink } from 'node:fs/promises';
+import { delimiter, isAbsolute, join, resolve } from 'node:path';
+
+export async function ownedPathLink(path, launcher) {
+ try { return (await lstat(path)).isSymbolicLink() && (await readlink(path)) === resolve(launcher); }
+ catch (error) { if (error.code === 'ENOENT' || error.code === 'EINVAL') return false; throw error; }
+}
+export async function exposeLauncher(paths, env = process.env) {
+ for (const entry of (env.PATH ?? '').split(delimiter).filter(Boolean)) {
+  const directory = resolve(entry), candidate = join(directory, 'rer');
+  if (directory === resolve(paths.bin)) return undefined;
+  try {
+   try {
+    await lstat(candidate);
+    if (await ownedPathLink(candidate, paths.launcher)) return candidate;
+    await access(candidate, constants.X_OK);
+    return undefined;
+   } catch (error) { if (error.code !== 'ENOENT') continue; }
+   // npm/npx add transient command directories; never install into them.
+   if (!isAbsolute(entry) || directory.split('/').includes('node_modules') || directory.split('/').includes('_npx')) continue;
+   const info = await lstat(directory);
+   if (!info.isDirectory() || !process.getuid || info.uid !== process.getuid() || (!(info.mode & 0o200) || (info.mode & 0o022))) continue;
+   await access(directory, constants.W_OK | constants.X_OK);
+   try { await symlink(paths.launcher, candidate); return candidate; }
+   catch (error) { if (error.code !== 'EEXIST' && error.code !== 'EACCES' && error.code !== 'EPERM') throw error; }
+  } catch (error) { if (!['ENOENT', 'EACCES', 'ENOTDIR'].includes(error.code)) throw error; }
+ }
+}

package/global/cli/status.mjs

@@ -24,7 +24,7 @@ export async function pathCommands(installRoot, env = process.env) {
   seen.add(candidate);
   try { await access(candidate, constants.X_OK); } catch { continue; }
   const target = await real(candidate);
-  const launcher = await launcherOwner(candidate);
+  const launcher = await launcherOwner(target ?? candidate);
   if (target && inside(target, ownRoot) || launcher.state === 'ours' && launcher.root && await real(launcher.root) === installRoot) self.push(candidate);
   else others.push(candidate);
  }

package/global/cli/uninstall.mjs

@@ -4,7 +4,8 @@
 // root. An npm global rer leaves other channels' installs alone.
 import { lstat, readlink, rm } from 'node:fs/promises';
 import { join } from 'node:path';
-import { launcherOwner, layout } from './layout.mjs';
+import { installRecord, launcherOwner, layout } from './layout.mjs';
+import { ownedPathLink } from './path-link.mjs';
 import { channelOf } from './status.mjs';
 
 // A folder `rer cli install` made: a versions/ directory and a `current` link into it.
@@ -26,6 +27,9 @@ export async function uninstall() {
   process.stdout.write(lines.join('\n') + '\n');
   return 0;
  }
+ for (const link of (await installRecord(paths))?.links ?? []) {
+  if (await ownedPathLink(link, paths.launcher)) { await rm(link); lines.push(`Removed ${link}.`); }
+ }
  if (launcher.state === 'ours') { await rm(paths.launcher); lines.push(`Removed ${paths.launcher}.`); }
  else if (launcher.state === 'foreign') lines.push(`Left ${paths.launcher} in place: rer cli install did not write it.`);
  if (await installRoot(root)) { await rm(root, { recursive: true, force: true }); lines.push(`Removed ${root}.`); }

package/global/launch/capacity.mjs

@@ -13,7 +13,7 @@ import { LaunchFailure } from './failure.mjs';
 export const personDefaults = { limit: 10, idleSeconds: 43200 };
 const unboundedLoad = '1000000';
 // The verbs that start a server or enter the job queue on every pin.
-export const personVerbs = new Set(['dev', 'preview', 'install', 'setup', 'build', 'verify', 'deploy', 'export', 'import']);
+export const personVerbs = new Set(['dev', 'demo', 'preview', 'install', 'setup', 'build', 'verify', 'deploy', 'export', 'import']);
 
 // How the pinned dispatcher counts servers, and which person defaults it lacks.
 // describe's `defaults` (from rer-cli-2) is authoritative: the launcher supplies

package/global/launch/facts.mjs

@@ -76,14 +76,20 @@ async function bindable(host, port) {
  finally { if (socket.listening) await new Promise(resolve => socket.close(resolve)); }
 }
 
-// The first port from 8787 (RER_DEV_PORT_FROM moves the start) that no
-// registered server holds, nothing listens on, binds on both 127.0.0.1 and ::1
-// (a browser that tries ::1 first never reaches another server) and that
-// `claim` secures against another launch choosing it at the same time.
-export async function freePort(servers, claim, env = process.env) {
+// Whether something now listens on a port or keeps it from binding.
+export async function portTaken(port) {
+ return (await listeningPorts()).has(port) || !await bindable('127.0.0.1', port) || !await bindable('::1', port);
+}
+
+// The first port from 8787 (RER_DEV_PORT_FROM moves the start) that is not
+// `held` (by a registered server, or saved by another checkout that is stopped),
+// nothing listens on, binds on both 127.0.0.1 and ::1 (a browser that tries
+// ::1 first never reaches another server) and that `claim` secures against
+// another launch choosing it at the same time.
+export async function freePort(ports, claim, env = process.env) {
  const from = Number(env.RER_DEV_PORT_FROM ?? 8787);
  if (!Number.isInteger(from) || from < 1 || from > 65535) throw new LaunchFailure(2, 'RER_DEV_PORT_FROM must be a port number.');
- const held = new Set(servers.map(record => record.port).filter(Boolean)), busy = await listeningPorts();
+ const held = new Set(ports.filter(Boolean)), busy = await listeningPorts();
  for (let port = from; port <= 65535; port++) {
   if (held.has(port) || busy.has(port)) continue;
   if (!await bindable('127.0.0.1', port) || !await bindable('::1', port)) continue;

package/global/launch/install-pinned.mjs

@@ -1,15 +1,43 @@
 // A checkout that pins the @runeditrun/rer package runs its own rer once
 // node_modules holds the pinned version; until then none of it can run (its
 // adapter imports the package). So its first dependency install is this
-// launcher's: the frozen pnpm install that `rer install` runs.
+// launcher's: the frozen pnpm install that `rer install` runs. Like every
+// dependency install, it runs with an allowlisted environment. Verbs started
+// at once share one install: each takes the checkout's install claim and
+// installs only if the pin is still missing once it holds it.
 import { spawn } from 'node:child_process';
+import { realpath } from 'node:fs/promises';
+import { dependencyEnvironment } from '../../onboarding/dependency-environment.mjs';
 import { pinnedPackage } from '../checkout.mjs';
 import { packageName } from '../package-info.mjs';
+import { ensureProjectPnpm } from '../../cli/project-pnpm.mjs';
+import { RerError } from '../../cli/errors.mjs';
 import { LaunchFailure } from './failure.mjs';
+import { claimPinInstall, settledPinInstall } from './state.mjs';
+
+const waiting = (root, output) => pid => output(`Another rer (PID ${pid}) is installing ${root}'s pinned ${packageName}; waiting for it.\n`);
 
 export async function installPinned(root, { env = process.env, output = text => process.stderr.write(text), children, signal } = {}) {
  signal?.throwIfAborted();
- const child = spawn('pnpm', ['install', '--frozen-lockfile'], { cwd: root, env: { ...env, CI: 'true' }, stdio: ['ignore', 'pipe', 'pipe'] });
+ const release = await claimPinInstall(await realpath(root), { env, signal, onWait: waiting(root, output) });
+ try {
+  const pinned = pinnedPackage(root);
+  if (pinned?.ready) return;
+  if (pinned?.installed) output(`${root} pins ${packageName} ${pinned.declared}, but node_modules holds ${pinned.installed}; installing the pinned version first.\n`);
+  await install(root, { env, output, children, signal });
+ } finally { await release(); }
+}
+
+// A verb on a checkout whose pin looks installed still waits for an install
+// another verb is running there: node_modules is not complete until it ends.
+export async function settledPin(root, { env = process.env, output = text => process.stderr.write(text), signal } = {}) {
+ await settledPinInstall(await realpath(root), { env, signal, onWait: waiting(root, output) });
+}
+
+async function install(root, { env, output, children, signal }) {
+ try { await ensureProjectPnpm(root, { env, signal, report: text => output(text + '\n') }); }
+ catch (error) { if (error instanceof RerError) throw new LaunchFailure(error.exitCode, error.message); throw error; }
+ const child = spawn('pnpm', ['install', '--frozen-lockfile'], { cwd: root, env: { ...dependencyEnvironment(env), CI: 'true' }, stdio: ['ignore', 'pipe', 'pipe'] });
  children?.add(child);
  if (signal?.aborted) child.kill('SIGTERM');
  let tail = '';