@runeditrun/rer 0.2.1 → 0.2.4

package/modules/demo-host/plan.mjs

@@ -0,0 +1,52 @@
+import { createHash } from 'node:crypto';
+import { assert, resourceName } from '../deploy-kit/validation.mjs';
+import { ownerWorkerName } from '../deploy-kit/owner.mjs';
+import { siteDeclaration } from '../deploy-kit/site.mjs';
+
+/* A seed's hosted demo at demo.<domain>: the Worker `rer deploy --demo` builds
+ * from deploy-demo.json, as `rer deploy --site` builds the run site from
+ * deploy-site.json. It is this folder's front Worker plus a Container class
+ * running the seed's own image (`rer build --platform container`, workerd
+ * engine), deployed by `wrangler deploy` with the image beside it. */
+
+export const DEMO_FILES = ['worker.mjs', 'container.mjs', 'capacity.mjs', 'claim.mjs', 'pages.mjs'];
+const FRONT_SET = /^(?:RER_.*|SESSION_SECRET|SETUP_TOKEN|OWNER_EMAIL)$/;
+const SECRET = /SECRET|TOKEN|PASSWORD|_KEY$/;
+
+/**
+ * deploy-demo.json: `{ "version": 1, "domain": "run-lamp.com", "name": "Lamp" }`, plus optionally
+ * `maxInstances` (concurrent demos, default 10) and `settings`, the seed's plain demo settings
+ * (such as MAIL_PROVIDER: "development"). Settings never carry secrets or what the front sets.
+ */
+export function demoDeclaration(value, originVar) {
+  assert(value && typeof value === 'object' && !Array.isArray(value) && value.version === 1 && Object.keys(value).every(key => ['version', 'domain', 'name', 'maxInstances', 'settings'].includes(key)), 'invalid-demo-declaration');
+  siteDeclaration({ version: 1, domain: value.domain });
+  assert(typeof value.name === 'string' && value.name.trim() === value.name && value.name.length > 0 && value.name.length <= 60 && !/[\p{Cc}\p{Cf}]/u.test(value.name), 'invalid-demo-name');
+  const maxInstances = value.maxInstances ?? 10;
+  assert(Number.isSafeInteger(maxInstances) && maxInstances >= 1 && maxInstances <= 100, 'invalid-demo-max-instances');
+  const settings = value.settings ?? {};
+  assert(settings && typeof settings === 'object' && !Array.isArray(settings) && Object.entries(settings).every(([name, setting]) =>
+    /^[A-Z][A-Z0-9_]{0,63}$/.test(name) && !FRONT_SET.test(name) && !SECRET.test(name) && name !== originVar && typeof setting === 'string' && setting.length <= 1024), 'invalid-demo-settings');
+  return { domain: value.domain, name: value.name, maxInstances, settings };
+}
+
+/** The demo Worker's name and its Wrangler configuration; no provider request. */
+export function demoPlan({ project, environment, compatibilityDate, originVar, declaration, turnstileSiteKey }) {
+  assert(/^\d{4}-\d{2}-\d{2}$/.test(compatibilityDate ?? '') && /^[A-Z][A-Z0-9_]{0,63}$/.test(originVar ?? ''), 'invalid-plan');
+  const { domain, name, maxInstances, settings } = demoDeclaration(declaration, originVar);
+  const worker = `${ownerWorkerName(project, environment)}--demo`, hostname = `demo.${domain}`;
+  assert(resourceName(worker), 'owner-name-too-long');
+  // Rate limit namespaces are account-wide integers: one per demo Worker.
+  const namespace = String(1000 + parseInt(createHash('sha256').update(worker).digest('hex').slice(0, 8), 16) % 1_000_000_000);
+  const wrangler = {
+    name: worker, main: 'worker.mjs', compatibility_date: compatibilityDate, workers_dev: false, preview_urls: false,
+    routes: [{ pattern: hostname, custom_domain: true }],
+    vars: { DEMO_ORIGIN: `https://${hostname}`, DEMO_SITE: `https://${domain}`, DEMO_NAME: name, DEMO_ORIGIN_VAR: originVar, DEMO_MAX_INSTANCES: String(maxInstances), DEMO_SETTINGS: JSON.stringify(settings),
+      ...(turnstileSiteKey ? { TURNSTILE_SITE_KEY: turnstileSiteKey } : {}) },
+    durable_objects: { bindings: [{ name: 'DEMO', class_name: 'DemoContainer' }, { name: 'CAPACITY', class_name: 'DemoCapacity' }] },
+    migrations: [{ tag: 'v1', new_sqlite_classes: ['DemoContainer', 'DemoCapacity'] }],
+    containers: [{ class_name: 'DemoContainer', image: './image/Dockerfile', max_instances: maxInstances, instance_type: 'basic' }],
+    ratelimits: [{ name: 'STARTS', namespace_id: namespace, simple: { limit: 3, period: 60 } }],
+  };
+  return { worker, hostname, origin: `https://${hostname}`, maxInstances, settings: Object.keys(settings), wrangler };
+}

package/modules/demo-host/worker.mjs

@@ -0,0 +1,72 @@
+// A seed's hosted demo at demo.<domain>, generated by `rer deploy --demo`.
+// GET / shows the start page (a Turnstile managed widget that submits itself).
+// POST /__demo/start checks the visitor's IP rate limit, Turnstile and capacity,
+// then starts a container of their own, signs its owner in and sets the
+// rer_demo cookie. Every request with that cookie goes to the visitor's
+// container; nothing else on this host is reachable.
+import { startPage, demoCookie } from './pages.mjs';
+
+export { DemoContainer } from './container.mjs';
+export { DemoCapacity } from './capacity.mjs';
+
+const HOUR = 60 * 60_000;
+const home = () => new Response(null, { status: 303, headers: { location: '/' } });
+
+/** The visitor's demo from its cookie; ids are checked by idFromString, so a forged one is no demo. */
+function demoId(request, env) {
+  const value = (request.headers.get('cookie') ?? '').split(';').map(part => part.trim()).find(part => part.startsWith('rer_demo='))?.slice(9);
+  if (!value) return null;
+  try { return env.DEMO.idFromString(value); } catch { return null; }
+}
+
+// The demo's end in the visitor's time zone, as the Demo bar shows it (HH:MM).
+function localTime(time, timeZone = 'UTC') {
+  const parts = Object.fromEntries(new Intl.DateTimeFormat('en-US', { timeZone, hourCycle: 'h23', year: 'numeric', month: '2-digit', day: '2-digit',
+    hour: '2-digit', minute: '2-digit', second: '2-digit', timeZoneName: 'longOffset' }).formatToParts(time).map(part => [part.type, part.value]));
+  return `${parts.year}-${parts.month}-${parts.day}T${parts.hour}:${parts.minute}:${parts.second}${parts.timeZoneName === 'GMT' ? '+00:00' : parts.timeZoneName.slice(3)}`;
+}
+
+async function human(env, token, ip) {
+  if (typeof token !== 'string' || !token || token.length > 2048) return false;
+  const body = new URLSearchParams({ secret: env.TURNSTILE_SECRET_KEY, response: token });
+  if (ip) body.set('remoteip', ip);
+  const response = await fetch('https://challenges.cloudflare.com/turnstile/v0/siteverify', { method: 'POST', body });
+  const result = response.ok ? await response.json() : {};
+  if (result.success !== true) console.error('Turnstile refused a start:', response.status, JSON.stringify(result['error-codes'] ?? []));
+  return result.success === true;
+}
+
+async function start(request, env) {
+  if (request.headers.get('origin') !== env.DEMO_ORIGIN) return startPage(env, { status: 403, notice: 'Start the demo from this page.' });
+  const ip = request.headers.get('cf-connecting-ip') ?? '';
+  if (!(await env.STARTS.limit({ key: ip })).success) return startPage(env, { status: 429, notice: 'Too many demos started from your network. Try again in a minute.' });
+  const form = await request.formData();
+  if (!await human(env, form.get('cf-turnstile-response'), ip)) return startPage(env, { status: 403, notice: 'The check did not pass. Try again.' });
+  const id = env.DEMO.newUniqueId(), ends = Date.now() + HOUR;
+  if (!await env.CAPACITY.get(env.CAPACITY.idFromName('capacity')).acquire(id.toString(), ends, Number(env.DEMO_MAX_INSTANCES))) {
+    return startPage(env, { status: 503, notice: 'Every demo is in use right now. Try again in a few minutes.' });
+  }
+  const demo = env.DEMO.get(id);
+  try {
+    const signedIn = await demo.start({ origin: env.DEMO_ORIGIN, originVar: env.DEMO_ORIGIN_VAR, ends, endsLocal: localTime(ends, request.cf?.timezone), settings: JSON.parse(env.DEMO_SETTINGS) });
+    const headers = new Headers({ location: signedIn.location, 'cache-control': 'no-store' });
+    for (const cookie of [...signedIn.cookies, demoCookie(env, id.toString())]) headers.append('set-cookie', cookie);
+    return new Response(null, { status: 303, headers });
+  } catch (error) {
+    console.error('Demo start failed:', error.message);
+    await demo.end();
+    return startPage(env, { status: 502, notice: 'The demo did not start. Try again.' });
+  }
+}
+
+export default {
+  async fetch(request, env) {
+    const url = new URL(request.url);
+    if (url.pathname === '/__demo/start') return request.method === 'POST' ? start(request, env) : home();
+    const id = demoId(request, env);
+    if (id) return env.DEMO.get(id).fetch(request);
+    if (!['GET', 'HEAD'].includes(request.method)) return new Response('Start a demo first.', { status: 403 });
+    if (url.pathname !== '/') return home();
+    return startPage(env);
+  },
+};

package/modules/dependencies/auth.mjs

@@ -19,12 +19,13 @@ export function linkedProviders(options) {
    if(!await unclaimed())return null;
    if(native)return native.claimOwner?native.claimOwner({request,token,expectedPin}):null;
    return createIdpOwnerClaimHandler({expectedPin,db,authConfig:config,clientIp:()=>options.clientIp(request),clock:options.clock,fetch:options.fetch})(new Request(config.origin+'/auth/owner-claim',{method:'POST',headers:{Host:new URL(config.origin).host,Origin:config.origin,'Content-Type':'application/json'},body:JSON.stringify({token})}));
-  }, claimScope: unclaimed, config:{origin:config.origin,local:config.local,transactionSecret:config.OIDC_TRANSACTION_SECRET ?? config.SESSION_SECRET+'-oidc',providers:[{
+  }, claimScope: unclaimed, config:{origin:config.origin,local:config.local,signInPath:config.branding.signInPath,transactionSecret:config.OIDC_TRANSACTION_SECRET ?? config.SESSION_SECRET+'-oidc',providers:[{
    id:'auth',preset:'auth',issuer:link.issuer,clientId:link.client_id,privateKey:JSON.parse(row.private_key),
   }]}});
  }
  if(!config.dependencies) return staticProviders;
  return {
+  signInPath:config.branding.signInPath,
   ids:[...new Set(['auth',...(staticProviders?.ids??[])])],
   callbackPaths:{...staticProviders?.callbackPaths,'/auth/oidc/auth/callback':'auth'},
   async begin(...args){const p=args[1]!=='auth'?staticProviders:await current();return p?p.begin(...args):Response.json({error:'provider_unlinked'},{status:403});},

package/modules/deploy-kit/README.md

@@ -56,9 +56,9 @@ D1/Queue/DO account listings fully paginate with bounded page/request budgets. R
 
 The first receipt binds source commit SHA and tree, artifact/config SHA-256, effective deployment fingerprint, account/Worker, actual resource IDs, migration hashes, secret names and active provider deployment/version/etag. It contains no secret value. The CLI creates it exclusively at mode 0600 before the first health request; it is an identity receipt, not a claim that health passed (health attempts are added afterwards, see below). A failed health request still exits nonzero, while the retained identity allows the next explicit invocation to authenticate state without another upload. For the second deployment use the **same artifact, run/attempt and receipt**. Current provider state must match the prior receipt. The kit performs no resource creation, Worker/asset upload, SQL mutation, Cron/consumer update, or secret rewrite when unchanged. Read-only D1 queries use the provider's POST query transport; a POST is not by itself a database mutation. The receipt remains byte-identical on a repeat. Missing resources, drift or stale state fail without repair during this repeat.
 
-Opaque existing secrets are preserved by name and strict binding inheritance; values are never fetched or compared. Missing declared secrets are supplied in the upload metadata in memory only. Rotation is a separate explicit operation; changing an input value does not overwrite a deployed secret. No temporary secret files are used.
+Opaque existing secrets are preserved by name and strict binding inheritance; values are never fetched or compared. Missing declared secrets are supplied in the upload metadata in memory only. Rotation is a separate explicit operation (owner-account mode: `rer deploy --set-secret NAME`); changing an input value does not overwrite a deployed secret. No temporary secret files are used.
 
-Health independently reads current deployment/version/settings, resources, namespaces, schedules, consumers, secret presence and migration history. It requests only the authenticated account-derived `/health`, without credentials, rejects redirects/malformed/unhealthy/stale identity and reads deployment identity again afterward.
+Health independently reads current deployment/version/settings, resources, namespaces, schedules, consumers, secret presence and migration history. It requests only the authenticated account-derived `/health`, without credentials, rejects redirects/malformed/unhealthy/stale identity and reads deployment identity again afterward. A healthy answer naming another Worker version (an edge still serving the version before a secret change) is asked again within the window.
 
 `health.mjs` is Base's one health verifier. `waitForDeploymentHealth(url, options)` (formerly `deployment/health.mjs`) gives a newly published route and its bindings one bounded window, 30 seconds by default: only 404, 503 and network failures are retried, every other status and every redirect is terminal, and the final error states the last result. The standalone `health` command probes `/health` once; transient failures are recorded as failures without a retry. The library `verifyHealth` retains its bounded readiness window. After an upload, `deploy` uses the recorded readiness wait described below.
 
@@ -103,10 +103,20 @@ Ownership lives in a state file, by default `.rer/deploy/<environment>.json` und
 - **Partial failure and resume.** The kit records each create as `pending` before the request and `created` with the provider id after it. A failed create leaves `pending`. On the next run an absent pending name is created again, and a present one is refused as `uncertain-resource-create`, because a lost response cannot prove who created it. Inspect it: if it is the empty resource from the interrupted run, delete it and re-run. A Worker upload is recorded as created when the upload succeeds, so a failure after it resumes with one fresh upload. If the response to the very first upload is lost, the Worker exists but is still `pending`. The kit records the build and its fingerprint before sending an upload. With no prior receipt, the same build may recover its pending Worker only when the live fingerprint matches that intent, then resume with one fresh upload. A different build or fingerprint is refused as `uncertain-resource-create`; recover with the original build first. If the uncertain Worker cannot be authenticated, inspect it and delete it only after confirming that it is the kit-created Worker and that its Durable Object data is disposable. Back up any needed data before deleting it. Migration claims keep the rules under Migration safety.
 - **Drift.** A created resource that has gone is refused as `owned-resource-missing`; one replaced under the same name is refused as `owned-resource-replaced`. The kit never deletes or recreates them. This covers D1, KV, Queues and R2 (a bucket is identified by its creation date; a state file written before that was recorded keeps working and is not checked for that bucket). For the Worker, the live deployment (version id, deployment id and etag) must be the last receipt's before any write; someone else's upload under the same name is refused as `owned-resource-replaced` and never overwritten. Immediately before the Worker PUT, the kit rechecks every saved resource identity, including resources omitted from the current plan, then the Worker identity. A replacement during provisioning or asset upload is refused before the upload intent or receipt is saved. An interrupted successful upload may resume only when the live version id, deployment id and etag match the identity saved immediately after that upload. A historical fingerprint alone never overrides a receipt mismatch.
 - **Lost upgrade response.** If an upgrade response is lost and the live identity no longer matches the receipt, the kit refuses rather than guessing ownership. A [Cloudflare rollback](https://developers.cloudflare.com/workers/versions-and-deployments/rollbacks/) creates a new deployment, so it does not restore the recorded identity. Recover with a new environment and a fresh state path, or back up the state and any needed data, confirm ownership, and follow the cleanup under "If the state file is lost" with a fresh `--state` path.
+- **Settling listings.** Right after a create or delete, an account listing can briefly disagree with its own page counts (`provider-partial-list`: on 13 October 2026 D1's `total_count` lagged its rows by about 7 seconds after a create). Owner-mode deploy, health and removal discard such a snapshot and list again from the start for up to 30 seconds with a short backoff; a partial listing is never accepted.
 - **One run at a time.** A deploy takes an exclusive lock file, `<state file>.lock`, for the whole run and removes it at the end, even after a failure. A second run on the same state file is refused as `owner-state-locked` before any provider request. If a run was killed (power loss, `kill -9`) and no deploy is running, delete the lock file by hand.
 
 The CLI prints JSON: refusal codes and resource names only, never inputs, tokens or provider bodies.
 
+### rer deploy: inputs, the hosted owner, secret changes and removal
+
+`rer deploy` runs these steps for a seed whose adapter uses `ownerDeploy` from `cli/deploy.mjs`.
+
+- **Inputs.** Declared secrets come from the environment, then `--env-file FILE` (an owned 0600 file of `KEY=VALUE` lines), which wins. For a secret the Worker does not hold yet, rer supplies the setup manifest's owner email (`emailField`) from the local setup's private settings, and a fresh random value for each secret field the manifest generates (`generate`), such as the session secret and the setup token; a value the Worker already holds is kept. A still-missing secret stops the run before any write with a message that names it.
+- **Hosted owner.** After deploy and health pass, rer claims the setup owner on the hosted app: it POSTs the setup token to the seed's standard owner step (`hooks.owner`, by default `/auth/bootstrap`). 303 means claimed; `409 already_initialized` means an owner was already claimed and is kept. Then rer deletes the token secret from the Worker, records the new Worker version in the state file, and lists the token in `retiredSecrets`, so later plans no longer declare it. A Worker that still holds a token rer did not upload in this run (an older deploy) first gets a fresh token through the same recorded secret change. Dependency approvals that need the token run before the claim. A seed with an owner step function, an identity-provider claim, or no declared token secret claims its owner its own way.
+- **Secret changes.** `rer deploy --set-secret NAME` (value from the environment or `--env-file`, under the declaration's environment name) and `--unset-secret NAME` change one declared secret of the recorded Worker without a build. A secret change deploys a new Worker version of the same code, so rer checks the build fingerprint is unchanged and records the new version id, deployment id and etag as the receipt's provider identity: the next deploy recognises its own Worker. An unset secret is retired until it is set again. The change is recorded as pending before it is sent, and the secret listing and active deployment are read until they show it (they lag the change by seconds); a change the provider answers with an error clears that record. If a run ends before the change settles (a lost response), the next run adopts the live version only when the Worker's versions list shows exactly one version after the receipt's, it is the live one, and its script etag and build fingerprint are still the receipt's. A change made outside rer (dashboard, Wrangler), including one made after rer's own, still reads as a replacement and is refused.
+- **Removal.** `rer deploy --remove --yes` deletes what the state file says rer created for this environment: the Worker (schedules first; its Durable Objects go with it) and each D1, R2, KV and queue that is still the one rer created, after checking all of them before the first delete. A replaced or uncertain resource refuses the whole removal, except a resource whose create answer was lost: under this environment's derived name it is deleted once it is confirmed empty (a D1 with no tables, a KV namespace with no keys, an R2 bucket, which the provider refuses to delete while it holds objects); one holding data is refused as `uncertain-resource-not-empty`, and a queue, whose backlog rer cannot read, as `uncertain-resource-unverifiable` (delete it by hand if it is the empty one from the interrupted run). It then reads back that none is still listed and deletes the state file. An R2 bucket must be empty; a bucket with objects stays, the state file keeps it, and a later `--remove --yes` finishes. Resources rer did not create are never touched.
+
 ### If the state file is lost
 
 A fresh clone or CI runner has no `.rer/` directory, so the kit can no longer tell its own resources from anyone else's and refuses every later deploy as `resource-name-collision`. It is correct to refuse: the kit never adopts what it cannot prove it created. To recover, do one of these.
@@ -181,7 +191,18 @@ No Single Redirect (dynamic redirect ruleset) permission is needed. Base's refer
 
 ## Migration safety
 
-SQL files have ordered unique names and SHA-256 identities. `_rer_deploy_migrations` is permanent controller-owned history. Applied entries must be an unchanged prefix of the desired set. A new migration gets an `applying` claim before its SQL and completion marker are submitted together to the D1 batch query API. Any interrupted, failed or uncertain outcome remains blocked and must be inspected explicitly; the kit never automatically retries, rolls back user data, or marks an unknown outcome successful. Readback checks every final identity.
+SQL files have ordered unique names and SHA-256 identities. `d1_migrations` holds controller history with ordered IDs, names, timestamps, SHA-256 hashes and states. Native archives already exclude this installation table. Standard Wrangler name-only inserts remain possible, but their missing hashes/states block subsequent Base deployment pending reviewed adoption. Applied entries must be an unchanged prefix of the desired set. A new migration gets an `applying` claim before its SQL and completion marker are submitted together through the [Cloudflare D1 SQL import API](https://developers.cloudflare.com/api/resources/d1/subresources/database/methods/import/), using the same whole-file protocol as Wrangler to preserve compound trigger bodies and atomic SQL/completion. Uploads use bounded HTTPS R2 destinations, without account credentials; polling is bounded and signed URLs and import response text are never diagnostic output. Any interrupted, failed or uncertain outcome remains blocked and must be inspected explicitly; the kit never automatically retries, rolls back user data, or marks an unknown outcome successful. Readback checks every final identity.
+
+A seed that had to rewrite a migration it already released declares the rewrite
+in `migrations/rewrites.json`: `{ "version": 1, "rewrites": [{ "migration":
+"0019_import_custody.sql", "from": "<released SHA-256>", "to": "<current SHA-256>",
+"reason": "...", "reviewed": true }] }`. An applied row holding `from` then counts
+as that migration, so an upgrade past it proceeds; the ledger keeps the released
+digest it applied. A later migration must converge databases that applied the
+released bytes. The record is refused unless `reviewed` is `true`, it names a
+migration in the set, and `to` is that migration's current bytes; every other
+change to applied history is still refused. Keep the record for as long as any
+installation may hold the released digest.
 
 Completion preserves the original SQL bytes and always starts on a new line.
 Comment-only migrations are rejected before any provider request or ledger claim.
@@ -191,7 +212,7 @@ without treating quoted semicolons as terminators or changing migration hashes.
 
 A lexical guard rejects standalone transaction/resource control statements (`BEGIN`, `COMMIT`, `END`, `ROLLBACK`, `SAVEPOINT`, `RELEASE`, `ATTACH`, `DETACH`, `VACUUM`) at statement boundaries, including after a trigger. Bare `ROLLBACK` is also refused in conflict clauses and `RAISE`, which can roll back a batch without a standalone control statement. SQLite `CREATE [TEMP|TEMPORARY] TRIGGER` bodies and nested `CASE ... END` expressions are supported; quoted text and comments cannot create statement boundaries. Both ledger names are reserved in bare, double-quoted, backtick and bracket identifiers, including schema-qualified references. [SQLite also accepts single-quoted identifiers](https://www.sqlite.org/lang_keywords.html), so exact controller ledger names are reserved in every token, including data strings, relation names, virtual-table options and introspection arguments. Comments and longer descriptive strings remain allowed. This intentionally conservative policy does not attempt to authorize arbitrary SQLite name grammars. Incomplete quotes, block comments, parentheses, CASE expressions or trigger bodies and NUL bytes fail closed; trigger header expressions must close before BEGIN and body expressions before their statement semicolon. This guard protects controller custody; SQLite still validates application SQL syntax.
 
-Existing Wrangler `d1_migrations` records lack content hashes. Automatic adoption would fabricate historical certainty, so those installations require separately reviewed history/hash adoption before this kit proceeds. The kit can extend its own previous migrations while retaining existing application rows. Local SQLite tests prove failure rollback in the test transport; the provider's actual failure atomicity, retained data, and two-deploy no-mutation behavior remain live proof obligations. The conservative `applying` claim prevents automatic replay even if a remote batch partially commits.
+The old kit `_rer_deploy_migrations` ledger is moved atomically into `d1_migrations` only after every applied name/hash/state proves an exact desired-history prefix. An ordinary deploy performs this one-time metadata transition even for unchanged code; subsequent redeploys write nothing, and health remains read-only. Existing Wrangler `d1_migrations` records lack content hashes. Automatic adoption would fabricate historical certainty, so those installations require separately reviewed history/hash adoption before this kit proceeds unless their ordered rows exactly match a prefix already attested by the old kit ledger. That transition preserves their IDs and timestamps. The kit can extend its own previous migrations while retaining existing application rows. Local SQLite tests prove failure rollback in the test transport; the provider's actual failure atomicity, retained data, and two-deploy no-mutation behavior remain live proof obligations. The conservative `applying` claim prevents automatic replay even if a remote response is lost.
 
 ## Local operations and source templates
 
@@ -247,12 +268,20 @@ After an upload that changed the Worker, `deploy` gives `/health` a total
 90-second readiness budget (`readiness.totalMs`, never above 90000). Retries wait
 1 second, doubling to a 10-second cap, and never less than the 2-second poll of
 the standalone window: 2, 2, 4, 8, 10, 10 ... seconds. Only transport failures,
-404 and 5xx (including Cloudflare 52x) retry. A redirect, any other status, a
-malformed or unhealthy body and a deployment identity mismatch fail at once.
+404 and 5xx (including Cloudflare 52x) retry, and so does a healthy answer that
+names another Worker version (the edge still serving the previous version just
+after the upload). A redirect, any other status, a malformed or unhealthy body
+and a wrong identity from the uploaded version itself fail at once. The one
+built file then requested must answer 200; after an upload its 404, 5xx and
+transport failures are retried for up to 60 seconds, since an edge still serving
+the previous version does not have the new build's hashed files (seen live on
+13 October 2026).
 Each request is capped by both the 30-second request limit and the remaining
 budget, and no request starts at the deadline. An unchanged repeat uses the
 existing library window and does not record first-upload readiness attempts.
-The standalone CLI `health` command sends a single request. Library `verifyHealth`
+The standalone CLI `health` command sends a single request; only an answer from
+another Worker version (an edge still converging after a secret change) is asked
+again, within 30 seconds. Library `verifyHealth`
 retains the existing window, retrying only 404, 503 and network failures for
 30 seconds by default.
 
@@ -272,6 +301,22 @@ sleep}` selects a smaller bound and deterministic time; `healthOptions.now` and
 replaces the mode-0600 receipt and refuses any change to its identity; the default
 CLI and owner-account state do this. A no-op repeat never rewrites the original receipt.
 
+Owner-account secret changes use the same bounded `waitHealth` after their new
+Worker version has settled and been recorded. This includes explicit
+`--set-secret`/`--unset-secret` commands, a fresh owner setup token, and the
+post-claim retirement performed by standard deploys and custom deploy hooks.
+Readiness checks the receipt source SHA, fingerprint and actual new version;
+it needs neither build output nor clean source for a secret-only command.
+Workers without a public route retain provider-only verification.
+
+A failed readiness check leaves the applied secret change, owner claim and token
+retirement recorded. The public command fails with the last HTTP status and the
+first bounded, redacted response line. Correct the seed/app configuration and
+redeploy; an app that requires an already spent setup token must remove that
+runtime requirement, rather than restoring the token or undoing ownership.
+The ownership receipt records readiness success/failure for the new version;
+untrusted response prefixes are never written into that record.
+
 ## Read-only teardown verification
 
 The kit does not perform deletes. After a seed has validated its receipt and

package/modules/deploy-kit/d1-import.mjs

@@ -0,0 +1,35 @@
+import { createHash } from 'node:crypto';
+import { assert, uuid } from './validation.mjs';
+
+// Wrangler's remote --file protocol. D1 imports execute the whole file atomically,
+// including trigger bodies; the query endpoint's semicolon splitting cannot.
+export async function importD1({ envelope, upload }, id, sql) {
+  assert(uuid(id) && typeof sql === 'string' && Buffer.byteLength(sql) <= 4 * 1024 * 1024, 'invalid-d1-import');
+  const bytes = Buffer.from(sql), etag = createHash('md5').update(bytes).digest('hex');
+  const post = async body => (await envelope(`/d1/database/${id}/import`, { method:'POST', body })).result;
+  let response = await post({ action:'init', etag });
+  if (response && Object.hasOwn(response, 'upload_url')) {
+    assert(typeof response.filename === 'string' && response.filename.length > 0 && response.filename.length <= 1024 && !/[\x00-\x1f\x7f]/.test(response.filename), 'invalid-d1-import-filename');
+    await upload(response.upload_url, bytes, etag);
+    response = await post({ action:'ingest', filename:response.filename, etag });
+  }
+  for (let polls = 0; polls < 100; polls++) {
+    // REST places errors on the envelope; validate nested errors when supplied.
+    assert(response?.success === true && response.type === 'import' && (!Object.hasOwn(response, 'errors') || Array.isArray(response.errors) && !response.errors.length), 'd1-import-failed');
+    if (response.status === 'complete') {
+      assert(Number.isSafeInteger(response.result?.num_queries) && response.result.num_queries > 0 && typeof response.result.final_bookmark === 'string' && response.result.final_bookmark.length > 0, 'd1-import-invalid-result');
+      return;
+    }
+    assert(response.status === 'active' && typeof response.at_bookmark === 'string' && response.at_bookmark.length > 0 && response.at_bookmark.length <= 1024, 'd1-import-uncertain');
+    response = await post({ action:'poll', current_bookmark:response.at_bookmark });
+  }
+  throw new Error('d1-import-poll-limit');
+}
+
+export function importUploadURL(value) {
+  assert(typeof value === 'string' && value.length <= 16384 && !/[\x00-\x20\x7f\\]/.test(value), 'invalid-d1-import-upload-url');
+  let url;
+  try { url = new URL(value); } catch { throw new Error('invalid-d1-import-upload-url'); }
+  assert(url.protocol === 'https:' && /^[a-f0-9]{32}\.r2\.cloudflarestorage\.com$/.test(url.hostname) && !url.port && !url.username && !url.password && !url.hash && url.pathname.length > 1 && url.search.length > 1, 'invalid-d1-import-upload-url');
+  return url.href;
+}

package/modules/deploy-kit/deploy.mjs

@@ -33,13 +33,14 @@ export async function deploy({api,plan,artifact,artifactSha256,previousReceipt,r
   const authenticated = previousReceipt?.fingerprint === fingerprint && previousReceipt.accountId === api.accountId && previousReceipt.worker === plan.worker && previousReceipt.provider?.versionId === existing?.versionId && previousReceipt.provider?.etag === existing?.etag && previousReceipt.provider?.deploymentId === existing?.deploymentId;
   const unchanged = priorFingerprint === fingerprint && secrets.missing.length === 0 && !migration && !(uploadWithoutReceipt && !authenticated);
   if (repeatOnly) assert(unchanged && previousReceipt?.fingerprint === fingerprint && previousReceipt?.provider?.versionId === existing?.versionId && previousReceipt?.provider?.etag === existing?.etag, 'repeat-deployment-drift');
-  const migrations = [];
-  for (const item of plan.d1) migrations.push({binding:item.binding,...await migrate(api,resources.d1.find(x => x.binding === item.binding).id,item.migrations,{apply:!unchanged})});
   if (unchanged) {
     assert(previousReceipt?.fingerprint === fingerprint && previousReceipt.accountId === api.accountId && previousReceipt.worker === plan.worker && previousReceipt.provider?.versionId === existing.versionId && previousReceipt.provider?.etag === existing.etag && previousReceipt.provider?.deploymentId === existing.deploymentId, 'no-op-requires-authenticated-prior-receipt');
     verifyBindings(existing.settings.bindings,bindings);
   }
-  else await uploadWorker(api,{plan,artifact,bindings,secrets,migration,fingerprint});
+  const migrations = [];
+  // A migration failure names its database, so the owner knows which one to inspect.
+  for (const item of plan.d1) migrations.push({binding:item.binding,...await migrate(api,resources.d1.find(x => x.binding === item.binding).id,item.migrations,{apply:!unchanged,upgrade:true}).catch(error => { error.resource ??= `d1:${item.name}`; throw error; })});
+  if (!unchanged) await uploadWorker(api,{plan,artifact,bindings,secrets,migration,fingerprint});
   const published = unchanged ? existing : await activeWorker(api,plan.worker); assert(published,'missing-deployed-worker');
   verifyBindings(published.settings.bindings,bindings);
   verifyScheduledHandler(published,plan);

package/modules/deploy-kit/diagnostics.mjs

@@ -29,6 +29,7 @@ function operation(path, options = {}) {
   if (write && path.startsWith('/workers/')) return 'upload Worker';
   return 'check Worker';
 }
+const CREATED_KINDS = {D1:'d1',R2:'r2',KV:'kv',queue:'queues'};
 export function deploymentDiagnostics(api, {onCreated} = {}) {
   const created = [];
   const recordCreated = resource => { created.push(resource); onCreated?.(resource); };
@@ -40,9 +41,18 @@ export function deploymentDiagnostics(api, {onCreated} = {}) {
       const result = await api[method](path,options);
       if (step.startsWith('create ')) recordCreated(`${step.slice(7)}:${options.body.name ?? options.body.queue_name ?? options.body.title}`);
       return result;
-    } catch (error) { throw recordDeployFailure(error,{step,created:[...created]}); }
+    } catch (error) {
+      // A failed create names the resource it asked for: a lost answer may still have created it.
+      if (step.startsWith('create ') && error.resource === undefined) error.resource = `${CREATED_KINDS[step.slice(7)]}:${options.body.name ?? options.body.queue_name ?? options.body.title}`;
+      throw recordDeployFailure(error,{step,created:[...created]});
+    }
   };
   return {...api,request:guard('request'),list:guard('list'),envelope:guard('envelope'),recordCreated,
+    async importSql(id, sql) {
+      currentStep = 'migrate D1';
+      try { return await api.importSql(id, sql); }
+      catch (error) { throw recordDeployFailure(error,{step:currentStep,created:[...created]}); }
+    },
     annotateFailure(error, step = currentStep) {
       const prior = failures.get(error);
       // Node filesystem/CLI codes are structural; their messages can hold paths

package/modules/deploy-kit/env-file.mjs

@@ -0,0 +1,27 @@
+import { open } from 'node:fs/promises';
+import { constants } from 'node:fs';
+import { resolve } from 'node:path';
+import { LOCAL_ONLY_KEYS } from './owner.mjs';
+
+/** A deploy's private settings file: an owned 0600 regular file of KEY=VALUE lines
+ * (blank lines and # comments allowed, one optional pair of double quotes). */
+export async function readDeployEnvFile(root, envFile, localOnlyKeys = []) {
+  const handle = await open(resolve(root, envFile), constants.O_RDONLY | constants.O_NOFOLLOW);
+  let encoded;
+  try {
+    const status = await handle.stat();
+    if (!status.isFile() || status.nlink !== 1 || (status.mode & 0o077) !== 0 || (process.getuid && status.uid !== process.getuid())) throw new Error('Deploy env file must be an owned private regular file (0600)');
+    encoded = await handle.readFile('utf8');
+  } finally { await handle.close(); }
+  const settings = {};
+  for (const line of encoded.split(/\r?\n/)) {
+    if (!line.trim() || line.trim().startsWith('#')) continue;
+    const match = /^([A-Z][A-Z0-9_]*)=(.*)$/.exec(line);
+    if (!match) throw new Error('Invalid deploy env file');
+    if (Object.hasOwn(settings, match[1])) throw new Error('Repeated deploy env key');
+    settings[match[1]] = match[2].replace(/^"(.*)"$/, '$1');
+  }
+  const local = [...LOCAL_ONLY_KEYS, ...localOnlyKeys].find(key => Object.hasOwn(settings, key));
+  if (local) throw new Error(`Local-only key ${local} is refused for deploy; remove it from the file`);
+  return settings;
+}

package/modules/deploy-kit/health-request.mjs

@@ -1,5 +1,10 @@
+import { StringDecoder } from 'node:string_decoder';
 import { assert } from './validation.mjs';
 
+// Do not flush an incomplete final character: a replacement would corrupt a
+// truncated credential prefix before the caller can redact it.
+const decodePrefix = bytes => new StringDecoder('utf8').write(bytes.subarray(0,256));
+
 async function bodyPrefix(response) {
   if (!response.body) return '';
   const reader = response.body.getReader(); let bytes = Buffer.alloc(0);
@@ -11,7 +16,7 @@ async function bodyPrefix(response) {
     }
   } catch { /* HTTP status remains authoritative if its diagnostic body breaks. */ }
   finally { await reader.cancel().catch(() => {}); }
-  return bytes.toString('utf8');
+  return decodePrefix(bytes);
 }
 
 /** One credential-free, bounded request. Retain only bounded response evidence. */
@@ -41,7 +46,7 @@ export async function healthRequest({origin, receipt, versionId, request, timeou
         const {done,value} = await reader.read();
         if (done) break;
         bytes = Buffer.concat([bytes, value]);
-        attempt.body = bytes.subarray(0,256).toString('utf8');
+        attempt.body = decodePrefix(bytes);
         assert(bytes.length <= 65536,'response-too-large');
       }
     } finally { await reader.cancel().catch(() => {}); }
@@ -55,6 +60,10 @@ export async function healthRequest({origin, receipt, versionId, request, timeou
   catch { attempt.errorClass = 'malformed-response'; return {attempt,transient:false}; }
   if (body?.ok !== true || body.deployment?.sourceSha !== receipt.source.sha || body.deployment?.fingerprint !== receipt.fingerprint || body.deployment?.versionId !== versionId) {
     attempt.errorClass = 'health-identity-mismatch';
+    // Right after an upload the edge can still answer from another version: that
+    // settles within the bound. The expected version answering wrongly does not.
+    const other = body?.ok === true && typeof body.deployment?.versionId === 'string' && body.deployment.versionId !== versionId;
+    return {attempt,transient:other};
   }
   return {attempt,transient:false};
 }
@@ -74,7 +83,8 @@ export async function waitHealth({origin,receipt,versionId,request,timeoutMs=300
     const result = await healthRequest({origin,receipt,versionId,request,timeoutMs:Math.max(1,Math.ceil(Math.min(timeoutMs,remaining))),offsetMs:Math.round(clock()-start)});
     attempts.push(result.attempt); await onAttempt(result.attempt,attempts);
     if (!result.attempt.errorClass) return {ok:true,versionId,attempts};
-    if (single || !result.transient) break;
+    // `single` asks once, except that an edge still answering from the previous version settles within the bound.
+    if (!result.transient || single && result.attempt.errorClass !== 'health-identity-mismatch') break;
     const rest = totalMs - (clock()-start);
     if (rest <= 0) break;
     await sleep(Math.min(Math.max(delay,MIN_DELAY_MS),rest)); delay = Math.min(delay*2,MAX_DELAY_MS);

package/modules/deploy-kit/health.mjs

@@ -46,14 +46,24 @@ export async function waitForDeploymentHealth(url, {
   throw healthError(`Deployment did not become healthy at ${url} within ${timeoutMs}ms; last result: ${lastResult}.`, lastResult === 'network error' ? 'health-transport-failed' : 'health-http-failed', lastResult);
 }
 
-/** One unauthenticated GET of a built file; anything but 200 means the browser gets no assets. */
-async function servedAsset(origin, path, request, timeoutMs) {
-  let response;
-  try { response = await request(`${origin}/${path.split('/').map(encodeURIComponent).join('/')}`,{redirect:'manual',signal:AbortSignal.timeout(timeoutMs),headers:{'Cache-Control':'no-cache'}}); }
-  catch { throw new Error('asset-transport-failed'); }
-  await response.body?.cancel().catch(() => {});
-  assert(response.status === 200 && !response.redirected,'asset-http-failed');
-  return {path,status:response.status};
+/** An unauthenticated GET of a built file; anything but 200 means the browser gets no assets.
+ * After an upload (`windowMs`), an edge still serving the previous version answers 404 for
+ * the new build's hashed files: 404, 5xx and transport failures are retried within the window. */
+async function servedAsset(origin, path, request, timeoutMs, {windowMs = 0, clock = () => performance.now(), sleep = ms => new Promise(resolve => setTimeout(resolve, ms))} = {}) {
+  const start = clock();
+  for (;;) {
+    let response, failure;
+    try { response = await request(`${origin}/${path.split('/').map(encodeURIComponent).join('/')}`,{redirect:'manual',signal:AbortSignal.timeout(timeoutMs),headers:{'Cache-Control':'no-cache'}}); }
+    catch { failure = 'asset-transport-failed'; }
+    if (response) {
+      await response.body?.cancel().catch(() => {});
+      if (response.status === 200 && !response.redirected) return {path,status:response.status};
+      failure = 'asset-http-failed';
+      if (response.redirected || response.status !== 404 && response.status < 500) throw new Error(failure);
+    }
+    if (clock() - start + 2000 > windowMs) throw new Error(failure);
+    await sleep(2000);
+  }
 }
 
 /** Authenticated provider readback, then the unauthenticated account-derived /health.
@@ -82,16 +92,26 @@ export async function verifyHealth({api,plan,receipt,fetch:request=globalThis.fe
   if (plan.workersDev === false) health = {ok:true,versionId:current.versionId,route:'none'};
   else if (readiness) health = await waitHealth({origin,receipt,versionId:current.versionId,request,timeoutMs,...readiness});
   else {
-    let response;
-    try {
-      response = await waitForDeploymentHealth(`${origin}/health`,{timeoutMs,intervalMs,attemptTimeoutMs:timeoutMs,headers:{'Cache-Control':'no-cache','Accept':'application/json'},fetchImpl:request,...(now ? {now} : {}),...(sleep ? {sleep} : {})});
-    } catch (error) { throw new Error(error.code ?? 'health-transport-failed'); }
-    assert(response.ok && response.status === 200 && !response.redirected,'health-http-failed');
-    const body = await boundedJSON(response,65536);
+    // A secret change makes a new version of the same build; until it reaches
+    // every edge, a healthy answer can still name the previous version. Ask again
+    // within the window; any other wrong identity fails at once.
+    const clock = now ?? Date.now, wait = sleep ?? (ms => new Promise(resolve => setTimeout(resolve, ms))), start = clock();
+    let body;
+    for (;;) {
+      let response;
+      try {
+        response = await waitForDeploymentHealth(`${origin}/health`,{timeoutMs,intervalMs,attemptTimeoutMs:timeoutMs,headers:{'Cache-Control':'no-cache','Accept':'application/json'},fetchImpl:request,...(now ? {now} : {}),...(sleep ? {sleep} : {})});
+      } catch (error) { throw new Error(error.code ?? 'health-transport-failed'); }
+      assert(response.ok && response.status === 200 && !response.redirected,'health-http-failed');
+      body = await boundedJSON(response,65536);
+      const other = body?.ok === true && typeof body.deployment?.versionId === 'string' && body.deployment.versionId !== current.versionId;
+      if (!other || clock() - start + intervalMs > timeoutMs) break;
+      await wait(intervalMs);
+    }
     assert(body?.ok === true && body.deployment?.sourceSha === receipt.source.sha && body.deployment?.fingerprint === receipt.fingerprint && body.deployment?.versionId === current.versionId,'health-identity-mismatch');
     health = {ok:true,versionId:current.versionId};
   }
-  if (asset && origin) health.asset = await servedAsset(origin,asset,request,timeoutMs);
+  if (asset && origin) health.asset = await servedAsset(origin,asset,request,timeoutMs,readiness ? {windowMs:60000,...(readiness.clock ? {clock:readiness.clock} : {}),...(readiness.sleep ? {sleep:readiness.sleep} : {})} : {});
   const after = await activeWorker(api,plan.worker);
   assert(after.versionId === current.versionId && after.deploymentId === current.deploymentId && after.etag === current.etag,'deployment-changed-during-health');
   await verifyServiceGrants(api, plan);

package/modules/deploy-kit/migration-ledger.mjs

@@ -0,0 +1,85 @@
+import { assert } from './validation.mjs';
+
+export const ledger = 'd1_migrations';
+const legacy = '_rer_deploy_migrations';
+export const literal = value => `'${value.replaceAll("'","''")}'`;
+export const createLedger = `CREATE TABLE ${ledger} (id INTEGER PRIMARY KEY AUTOINCREMENT, name TEXT NOT NULL UNIQUE, applied_at TEXT NOT NULL DEFAULT CURRENT_TIMESTAMP, sha256 TEXT, state TEXT CHECK(state IN ('applying','applied')))`;
+
+// Every ledger shape a deployment can hold: Wrangler's d1_migrations; that
+// table after the kit adopted it (sha256 and state added); the kit's own
+// d1_migrations, which rer 0.2.2 and later create; and the kit's
+// _rer_deploy_migrations from rer 0.2.1 and earlier, which stays authoritative
+// until the next deploy moves it into d1_migrations. Seed recovery code that
+// checks the ledger before reading or restoring it accepts all four with
+// migrationLedgerShape.
+const shapeColumns = table => `SELECT '${table}' AS ledger,cid,name,upper(type) AS type,"notnull",dflt_value,pk,hidden FROM pragma_table_xinfo('${table}')`;
+export const ledgerShapeQuery = `${shapeColumns(legacy)} UNION ALL ${shapeColumns(ledger)} ORDER BY ledger,cid`;
+const column = (name, type, notnull = 0, dflt_value = null, pk = 0) => ({ name, type, notnull, dflt_value, pk, hidden: 0 });
+const wrangler = [column('id','INTEGER',0,null,1), column('name','TEXT'), column('applied_at','TIMESTAMP',1,'CURRENT_TIMESTAMP')];
+const tracked = [column('sha256','TEXT'), column('state','TEXT')];
+const shapes = {
+  [ledger]: {
+    wrangler,
+    adopted: [...wrangler, ...tracked],
+    kit: [column('id','INTEGER',0,null,1), column('name','TEXT',1), column('applied_at','TEXT',1,'CURRENT_TIMESTAMP'), ...tracked],
+  },
+  [legacy]: { legacy: [column('name','TEXT',0,null,1), column('sha256','TEXT',1), column('state','TEXT',1)] },
+};
+/** The ledger's shape from its ledgerShapeQuery rows (node:sqlite or D1):
+ * { name, columns, shape } where shape is 'wrangler', 'adopted', 'kit' or
+ * 'legacy'. When both tables exist, _rer_deploy_migrations is the history, as
+ * restores read it. Any other shape throws invalid-migration-ledger. */
+export function migrationLedgerShape(rows) {
+  // Rows without a ledger column come from the d1_migrations-only query of rer 0.2.3.
+  const tables = Map.groupBy(rows ?? [], row => row.ledger ?? ledger);
+  const name = tables.has(legacy) ? legacy : ledger;
+  const read = (tables.get(name) ?? []).map(row => ({ name: row.name, type: String(row.type).toUpperCase(), notnull: Number(row.notnull), dflt_value: row.dflt_value ?? null, pk: Number(row.pk), hidden: Number(row.hidden) }));
+  const shape = Object.keys(shapes[name]).find(key => JSON.stringify(read) === JSON.stringify(shapes[name][key]));
+  assert(shape, 'invalid-migration-ledger');
+  return { name, columns: read.map(row => row.name), shape };
+}
+/** An applied row records this migration: its current bytes, or bytes a seed's
+ * reviewed rewrite record says this migration replaced. */
+export const recorded = (row, migration) => row.name === migration?.name && (row.sha256 === migration.sha256 || (migration.rewrites ?? []).some(rewrite => rewrite.from === row.sha256));
+const validPrefix = (rows, migrations) => rows.every((row, index) => recorded(row, migrations[index]) && row.state === 'applied');
+const same = (a, b) => a.length === b.length && a.every((row, index) => row.name === b[index].name && row.sha256 === b[index].sha256 && row.state === b[index].state);
+
+export async function readLedger(api, id, migrations, query) {
+  const read = async sql => (await query(api, id, sql))[0].results;
+  const tables = (await read(`SELECT name FROM sqlite_master WHERE type='table' AND name IN ('${legacy}','${ledger}')`)).map(row => row.name);
+  let old = [], applied = [], transition = '';
+  if (tables.includes(legacy)) {
+    const columns = await read(`SELECT name FROM pragma_table_info('${legacy}')`);
+    assert(columns.length === 3 && columns.every(row => ['name','sha256','state'].includes(row.name)), 'invalid-migration-ledger');
+    old = await read(`SELECT name, sha256, state FROM ${legacy} ORDER BY name`);
+    assert(validPrefix(old, migrations), 'changed-or-uncertain-migration-history');
+  }
+  if (tables.includes(ledger)) {
+    const columns = (await read(`SELECT name FROM pragma_table_info('${ledger}')`)).map(row => row.name);
+    assert(['id','name','applied_at'].every(name => columns.includes(name)), 'invalid-migration-ledger');
+    if (columns.includes('sha256') && columns.includes('state')) {
+      applied = await read(`SELECT name, sha256, state FROM ${ledger} ORDER BY id`);
+      assert(validPrefix(applied, migrations), 'changed-or-uncertain-migration-history');
+      if (tables.includes(legacy)) assert(same(applied, old), 'changed-or-uncertain-migration-history');
+    } else {
+      assert(!columns.includes('sha256') && !columns.includes('state'), 'invalid-migration-ledger');
+      const prior = await read(`SELECT name FROM ${ledger} ORDER BY id`);
+      // Names alone cannot attest historical bytes. Only an already verified kit
+      // prefix can supply hashes; preserve Wrangler row IDs and timestamps.
+      assert(prior.length <= old.length && prior.every((row,index) => row.name === old[index].name), 'legacy-migration-history-needs-reviewed-hash-adoption');
+      transition += `ALTER TABLE ${ledger} ADD COLUMN sha256 TEXT;\nALTER TABLE ${ledger} ADD COLUMN state TEXT;\n`;
+      for (const row of old.slice(0,prior.length)) transition += `UPDATE ${ledger} SET sha256=${literal(row.sha256)}, state='applied' WHERE name=${literal(row.name)};\n`;
+      for (const row of old.slice(prior.length)) transition += insert(row);
+      applied = old;
+    }
+  } else if (tables.includes(legacy)) {
+    transition = `${createLedger};\n`;
+    for (const row of old) transition += insert(row);
+    applied = old;
+  }
+  if (tables.includes(legacy)) transition += `DROP TABLE ${legacy};`;
+  return { applied, transition, exists:tables.includes(ledger) || tables.includes(legacy) };
+}
+function insert(row) {
+  return `INSERT INTO ${ledger}(name,sha256,state) VALUES (${literal(row.name)},${literal(row.sha256)},'applied');\n`;
+}