@runeditrun/rer 0.2.1 → 0.2.4

package/modules/deploy-kit/migrations.mjs

@@ -1,8 +1,9 @@
+import { join } from 'node:path';
 import { assert, hash } from './validation.mjs';
+import { regularBytes } from './artifact.mjs';
 import { assertMigrationSqlSafe } from './sql-safety.mjs';
 import { sqlTokens } from './sql-tokens.mjs';
-const ledger = '_rer_deploy_migrations';
-const literal = value => `'${value.replaceAll("'","''")}'`;
+import { ledger, literal, createLedger, readLedger, recorded } from './migration-ledger.mjs';
 export function validateMigrations(migrations) {
   let previous = '';
   for (const migration of migrations) {
@@ -10,27 +11,58 @@ export function validateMigrations(migrations) {
     assert(typeof migration.sql === 'string' && migration.sql.trim() && hash(migration.sql) === migration.sha256 && migration.sql.length <= 512000, 'invalid-migration-bytes');
     assertMigrationSqlSafe(migration.sql);
     assert(sqlTokens(migration.sql).length > 0, 'invalid-migration-bytes');
+    assert(migration.rewrites === undefined || Array.isArray(migration.rewrites) && migration.rewrites.every(rewrite => /^[a-f0-9]{64}$/.test(rewrite?.from ?? '') && rewrite.from !== migration.sha256 && typeof rewrite.reason === 'string' && rewrite.reason.trim()), 'invalid-migration-rewrite');
   }
 }
+const rewriteKeys = ['migration','from','to','reason','reviewed'];
+/** A seed's reviewed rewrites of already released migrations, from
+ * migrations/rewrites.json: { version: 1, rewrites: [{ migration, from, to,
+ * reason, reviewed: true }] }. `from` is the released bytes' SHA-256, `to` the
+ * current bytes'. Each named migration then also accepts an applied row holding
+ * `from`; the ledger keeps that row as applied. Any other change stays refused. */
+export async function readMigrationRewrites(product) {
+  const text = await regularBytes(join(product,'migrations/rewrites.json'),1024*1024).then(String,error => { if (error.code === 'ENOENT') return undefined; throw error; });
+  if (text === undefined) return [];
+  let declaration; try { declaration = JSON.parse(text); } catch { throw new Error('invalid-migration-rewrites'); }
+  assert(declaration?.version === 1 && Object.keys(declaration).every(key => ['version','rewrites'].includes(key)) && Array.isArray(declaration.rewrites) && declaration.rewrites.length <= 1000, 'invalid-migration-rewrites');
+  for (const item of declaration.rewrites) {
+    assert(item && Object.keys(item).every(key => rewriteKeys.includes(key)) && /^[0-9]+_[a-zA-Z0-9_-]+\.sql$/.test(item.migration ?? '') && /^[a-f0-9]{64}$/.test(item.from ?? '') && /^[a-f0-9]{64}$/.test(item.to ?? '') && item.from !== item.to
+      && typeof item.reason === 'string' && item.reason.trim() && item.reason.length <= 1000, 'invalid-migration-rewrites');
+    assert(item.reviewed === true, 'unreviewed-migration-rewrite');
+  }
+  assert(new Set(declaration.rewrites.map(item => `${item.migration} ${item.from}`)).size === declaration.rewrites.length, 'invalid-migration-rewrites');
+  return declaration.rewrites;
+}
+/** Attach declared rewrites to the migrations they name. A record must name a
+ * migration in the list (unless `partial`, for a list that is one of several)
+ * and its `to` must be that migration's current bytes. */
+export function withRewrites(migrations, rewrites, { partial = false } = {}) {
+  for (const item of rewrites) {
+    const migration = migrations.find(x => x.name === item.migration);
+    assert(migration || partial, 'unknown-migration-rewrite');
+    if (migration) assert(migration.sha256 === item.to, 'migration-rewrite-mismatch');
+  }
+  return migrations.map(migration => {
+    const declared = rewrites.filter(item => item.migration === migration.name);
+    return declared.length ? { ...migration, rewrites: declared.map(({ from, reason }) => ({ from, reason })) } : migration;
+  });
+}
 export async function query(api, id, sql) {
   const rows = await api.request(`/d1/database/${id}/query`,{method:'POST',body:{sql}});
   assert(Array.isArray(rows) && rows.length > 0 && rows.every(x => x.success === true && Array.isArray(x.results)), 'd1-query-failed');
   return rows;
 }
-export async function migrate(api, id, migrations, { apply = true } = {}) {
+export async function migrate(api, id, migrations, { apply = true, upgrade = apply } = {}) {
   validateMigrations(migrations);
-  const tables = (await query(api,id,"SELECT name FROM sqlite_master WHERE type='table' AND name IN ('_rer_deploy_migrations','d1_migrations')"))[0].results.map(x => x.name);
-  let applied = [];
-  if (tables.includes(ledger)) applied = (await query(api,id,`SELECT name, sha256, state FROM ${ledger} ORDER BY name`))[0].results;
-  // Wrangler history has no hashes. Never assume old SQL bytes from its names alone.
-  if (tables.includes('d1_migrations')) {
-    const prior = (await query(api,id,'SELECT name FROM d1_migrations ORDER BY id'))[0].results;
-    assert(prior.every(x => applied.some(y => x.name === y.name && y.state === 'applied')), 'legacy-migration-history-needs-reviewed-hash-adoption');
-  }
-  assert(applied.every((row,index) => row.name === migrations[index]?.name && row.sha256 === migrations[index]?.sha256 && row.state === 'applied'), 'changed-or-uncertain-migration-history');
+  const { applied, transition, exists } = await readLedger(api, id, migrations, query);
   const pending = migrations.slice(applied.length);
   assert(apply || pending.length === 0,'pending-migrations');
-  if (pending.length && !tables.includes(ledger)) await query(api,id,`CREATE TABLE ${ledger} (name TEXT PRIMARY KEY, sha256 TEXT NOT NULL, state TEXT NOT NULL CHECK(state IN ('applying','applied')))`);
+  if (transition && upgrade) {
+    await api.importSql(id, transition);
+    const verified = await readLedger(api, id, migrations, query);
+    assert(!verified.transition && verified.applied.length === applied.length, 'migration-readback-mismatch');
+  }
+  if (pending.length && !exists) await query(api,id,createLedger);
   for (const migration of pending) {
     // Claim before execution. A lost response/partial provider failure is never automatically replayed.
     await query(api,id,`INSERT INTO ${ledger}(name,sha256,state) VALUES (${literal(migration.name)},${literal(migration.sha256)},'applying')`);
@@ -38,11 +70,11 @@ export async function migrate(api, id, migrations, { apply = true } = {}) {
     // A second terminator after trailing comments creates an empty D1 statement.
     // Keep the newline even when terminated: a final line comment must end.
     const separator = last?.kind === 'symbol' && last.value === ';' ? '' : '; ';
-    await query(api,id,`${migration.sql}\n${separator}UPDATE ${ledger} SET state='applied' WHERE name=${literal(migration.name)} AND sha256=${literal(migration.sha256)};`);
+    await api.importSql(id,`${migration.sql}\n${separator}UPDATE ${ledger} SET state='applied' WHERE name=${literal(migration.name)} AND sha256=${literal(migration.sha256)};`);
   }
   if (pending.length) {
-    const final = (await query(api,id,`SELECT name, sha256, state FROM ${ledger} ORDER BY name`))[0].results;
-    assert(final.length === migrations.length && final.every((x,i) => x.state === 'applied' && x.name === migrations[i].name && x.sha256 === migrations[i].sha256), 'migration-readback-mismatch');
+    const final = (await query(api,id,`SELECT name, sha256, state FROM ${ledger} ORDER BY id`))[0].results;
+    assert(final.length === migrations.length && final.every((x,i) => x.state === 'applied' && recorded(x, migrations[i])), 'migration-readback-mismatch');
   }
   return { applied:pending.map(x => x.name), history:migrations.map(({name,sha256}) => ({name,sha256})) };
 }

package/modules/deploy-kit/owner-cli.mjs

@@ -7,11 +7,14 @@ import { assert, hexId } from './validation.mjs';
 import { regularBytes } from './artifact.mjs';
 import { packageBuild } from './prepare.mjs';
 import { cloudflare } from './provider.mjs';
-import { ownerTarget, ownerPlan, ownerDeploy, ownerHealth } from './owner.mjs';
+import { ownerTarget, ownerPlan, ownerDeploy, ownerHealth, settleOwnerState, sameDeployment, localOnlyBinding, withStateLock, readOwnerState, writeOwnerState } from './owner.mjs';
+import { activeWorker } from './worker.mjs';
+import { ownerSecret } from './owner-secret.mjs';
+import { ownerRemove } from './owner-remove.mjs';
 import { refuseLocalModels } from './local-only.mjs';
 
 export const cronNotice = 'This Worker has a Cron Trigger. Cloudflare may take up to about two hours to start its first scheduled run on some accounts.';
-const usage = 'usage: owner-cli.mjs deploy|health --declaration <file> --environment <name> [--product <dir>] [--state <file>]';
+const usage = 'usage: owner-cli.mjs deploy|health|remove|inspect|record-owner --declaration <file> --environment <name> [--product <dir>] [--state <file>] [--outcome claimed|kept] | secret ... --set NAME|--unset NAME';
 
 /** The owner's committed source and existing local build. Run the seed's build first. */
 async function ownerArtifact(root, product) {
@@ -22,12 +25,14 @@ async function ownerArtifact(root, product) {
 }
 
 /** Inputs: CLOUDFLARE_ACCOUNT_ID and CLOUDFLARE_API_TOKEN, plus the secrets the declaration names on first deploy. */
-export async function main(argv = process.argv.slice(2), env = process.env, {fetch = globalThis.fetch, cwd = process.cwd(), healthOptions, localOnlyKeys = [], notice = line => console.error(line), onCreated} = {}) {
+export async function main(argv = process.argv.slice(2), env = process.env, {fetch = globalThis.fetch, cwd = process.cwd(), healthOptions, settle, localOnlyKeys = [], notice = line => console.error(line), onCreated} = {}) {
   let parsed;
-  try { parsed = parseArgs({args:argv,allowPositionals:true,strict:true,options:{declaration:{type:'string'},environment:{type:'string'},product:{type:'string',default:''},state:{type:'string'}}}); }
+  try { parsed = parseArgs({args:argv,allowPositionals:true,strict:true,options:{declaration:{type:'string'},environment:{type:'string'},product:{type:'string',default:''},state:{type:'string'},set:{type:'string'},unset:{type:'string'},outcome:{type:'string'}}}); }
   catch { throw new Error('usage'); }
   const {positionals:[command,...rest],values} = parsed;
-  if (!['deploy','health'].includes(command) || rest.length || !values.declaration || !values.environment) throw new Error('usage');
+  if (!['deploy','health','secret','remove','inspect','record-owner'].includes(command) || rest.length || !values.declaration || !values.environment) throw new Error('usage');
+  if ((command === 'secret') !== (values.set !== undefined || values.unset !== undefined) || values.set !== undefined && values.unset !== undefined) throw new Error('usage');
+  if (values.outcome !== undefined && command !== 'record-owner' || command === 'record-owner' && !['claimed','kept'].includes(values.outcome)) throw new Error('usage');
   await refuseLocalModels(resolve(cwd));
   const missing = ['CLOUDFLARE_ACCOUNT_ID','CLOUDFLARE_API_TOKEN'].filter(key => typeof env[key] !== 'string' || !env[key].trim());
   if (missing.length) { const error = new Error('missing-input'); error.inputs = missing; throw error; }
@@ -40,19 +45,48 @@ export async function main(argv = process.argv.slice(2), env = process.env, {fet
   const api = deploymentDiagnostics(cloudflare({accountId:env.CLOUDFLARE_ACCOUNT_ID,token:env.CLOUDFLARE_API_TOKEN,fetch}),{onCreated});
   const target = await ownerTarget(api,{project:declaration.project,environment:values.environment});
   const statePath = values.state ? resolve(root,values.state) : join(root,'.rer','deploy',`${target.environment}.json`);
+  if (command === 'remove') return {ok:true,...await ownerRemove({api,target,statePath}).catch(error => { throw api.annotateFailure(error,'remove'); })};
+  if (command === 'secret') {
+    const binding = values.set ?? values.unset, item = (Array.isArray(declaration.secrets) ? declaration.secrets : []).find(entry => entry?.binding === binding);
+    if (!item) { const error = new Error('undeclared-secret'); error.resource = `secret:${binding}`; throw error; }
+    const value = values.set === undefined ? undefined : env[item.environment];
+    return {ok:true,...await ownerSecret({api,target,statePath,binding,value,fetch,healthOptions}).catch(error => { throw api.annotateFailure(error,'secrets'); })};
+  }
+  // A secret rer retired (the spent setup token) is no longer part of the plan.
+  const state = await settleOwnerState({api,target,statePath});
+  const {retiredSecrets = []} = state;
+  if (command === 'record-owner') return withStateLock(statePath, async () => {
+    const current = await readOwnerState(statePath, target);
+    assert(current.receipt && !current.pendingUpload && !current.pendingSecret, 'missing-owner-receipt');
+    const live = await activeWorker(api, target.worker);
+    assert(live && sameDeployment(live, current.receipt.provider), 'owned-resource-replaced');
+    current.ownerClaim = { outcome: values.outcome };
+    await writeOwnerState(statePath, current);
+    return {ok:true, owner:values.outcome};
+  });
+  if (command === 'inspect') {
+    assert(!localOnlyBinding(declaration, localOnlyKeys), 'local-only-binding');
+    assert(state.receipt && !state.pendingUpload && !state.pendingSecret, 'missing-owner-receipt');
+    const live = await activeWorker(api, target.worker);
+    assert(live && sameDeployment(live, state.receipt.provider), 'owned-resource-replaced');
+    const rows = await api.request(`/workers/scripts/${target.worker}/secrets`);
+    assert(Array.isArray(rows), 'invalid-secret-list');
+    return {ok:true, origin:target.origin, versionId:live.versionId, retiredSecrets, ownerClaim:state.ownerClaim, liveSecrets:rows.map(row => row.name)};
+  }
+  const current = retiredSecrets.length && Array.isArray(declaration.secrets) ? {...declaration,secrets:declaration.secrets.filter(item => !retiredSecrets.includes(item?.binding))} : declaration;
   const artifact = await ownerArtifact(root,values.product);
-  const plan = ownerPlan(target,declaration,artifact,{localOnlyKeys});
+  const plan = ownerPlan(target,current,artifact,{localOnlyKeys});
   if (command === 'health') {
     await ownerHealth({api,target,plan,statePath,fetch,healthOptions:{...healthOptions,readiness:{single:true,totalMs:30000}}}).catch(error=>{throw api.annotateFailure(error,'health');});
     return {ok:true,worker:target.worker,origin:target.origin};
   }
   // Dispatch is the provider's: on some accounts a new Cron starts only at the account scheduler's next refresh.
   if (plan.crons.length) notice(cronNotice);
-  const {receipt,created} = await ownerDeploy({api,target,plan,artifact,statePath,env,fetch,healthOptions}).catch(error => {
+  const {receipt,created,sentSecrets} = await ownerDeploy({api,target,plan,artifact,statePath,env,fetch,healthOptions,settle}).catch(error => {
     api.annotateFailure(error,error.message.startsWith('missing-secret-') ? 'secrets' : undefined);
     throw error;
   });
-  return {ok:true,changed:receipt.changed,worker:target.worker,origin:receipt.origin,versionId:receipt.provider.versionId,created,state:statePath};
+  return {ok:true,changed:receipt.changed,worker:target.worker,origin:receipt.origin,versionId:receipt.provider.versionId,created,sentSecrets,retiredSecrets,...(state.ownerClaim ? {ownerClaim:state.ownerClaim} : {}),state:statePath};
 }
 
 /** Prints refusal codes and resource names only; never inputs, tokens or provider bodies. */

package/modules/deploy-kit/owner-remove.mjs

@@ -0,0 +1,108 @@
+import { rm } from 'node:fs/promises';
+import { assert } from './validation.mjs';
+import { resourceKinds, findResource } from './resources.mjs';
+import { activeWorker } from './worker.mjs';
+import { deleteWorker } from './teardown.mjs';
+import { workerConsumerScript } from './queue-consumer.mjs';
+import { query } from './migrations.mjs';
+import { KINDS, readOwnerState, writeOwnerState, withStateLock, withScopeHints, withSettledLists, workerSettings, sameDeployment, resourceId, checkResourceIdentity, refuse, settlePendingSecret } from './owner.mjs';
+
+const remove = {
+  d1: (api, id) => api.request(`/d1/database/${id}`, {method:'DELETE'}),
+  r2: (api, _id, name) => api.request(`/r2/buckets/${name}`, {method:'DELETE'}),
+  kv: (api, id) => api.request(`/storage/kv/namespaces/${id}`, {method:'DELETE'}),
+  queues: (api, id) => api.request(`/queues/${id}`, {method:'DELETE'}),
+};
+
+/** A resource whose create response was lost (still `pending` in the state file) may be
+ * rer's or someone else's. It is removed only under this environment's derived name and
+ * once it is confirmed empty: a D1 with no tables, a KV namespace with no keys, an R2
+ * bucket (the provider refuses to delete one holding objects). A queue's backlog cannot
+ * be read, so an uncertain queue refuses with its own code. */
+async function confirmEmpty(api, worker, kind, name, id) {
+  if (!name.startsWith(`${worker}-`)) throw refuse('uncertain-resource-create', kind, name);
+  if (kind === 'queues') throw refuse('uncertain-resource-unverifiable', kind, name);
+  if (kind === 'd1') {
+    const [{results}] = await query(api, id, "SELECT name FROM sqlite_master WHERE type='table' AND name NOT LIKE 'sqlite~_%' ESCAPE '~' AND name NOT LIKE '~_cf~_%' ESCAPE '~'");
+    if (results.length) throw refuse('uncertain-resource-not-empty', kind, name);
+  }
+  if (kind === 'kv') {
+    const keys = await api.request(`/storage/kv/namespaces/${id}/keys?limit=10`);
+    assert(Array.isArray(keys), 'invalid-kv-key-list');
+    if (keys.length) throw refuse('uncertain-resource-not-empty', kind, name);
+  }
+}
+
+/** Delete exactly what this environment's state file says rer created: the Worker (its
+ * schedules first; its Durable Objects go with it), then each D1, R2, KV and queue,
+ * each only while it is still the one rer created. Read back that each is gone, then
+ * drop the state file. Nothing else in the account is touched. Ownership is checked for
+ * everything before the first delete; a replaced or uncertain resource refuses it all,
+ * except an uncertain one confirmed empty (see confirmEmpty). */
+export async function ownerRemove({api: provider, target, statePath, clock, sleep}) {
+  const api = withSettledLists(withScopeHints(provider));
+  return withStateLock(statePath, async () => {
+    const state = await readOwnerState(statePath, target);
+    if (await settlePendingSecret(api, target.worker, state, {preflight:true})) await writeOwnerState(statePath, state);
+    const owned = KINDS.flatMap(kind => Object.entries(state.owned[kind]).map(([name, entry]) => ({kind, name, entry})));
+    assert(state.owned.worker || owned.length, 'nothing-to-remove');
+    // Preflight, read-only.
+    let worker = null;
+    if (await workerSettings(api, target.worker) !== null) {
+      if (!state.owned.worker) throw refuse('resource-name-collision', 'worker', target.worker);
+      const expected = state.pendingUpload?.provider ?? state.receipt?.provider;
+      if (!expected) throw refuse('uncertain-resource-create', 'worker', target.worker);
+      const live = await activeWorker(api, target.worker);
+      if (!sameDeployment(live, expected)) throw refuse('owned-resource-replaced', 'worker', target.worker);
+      worker = target.worker;
+    }
+    const listed = {}, doomed = [];
+    for (const kind of KINDS) {
+      if (!owned.some(item => item.kind === kind)) continue;
+      listed[kind] = await resourceKinds[kind].list(api);
+      for (const {name, entry} of owned.filter(item => item.kind === kind)) {
+        const row = findResource(listed[kind], kind, name);
+        if (!row) continue;
+        if (entry.status === 'pending') await confirmEmpty(api, target.worker, kind, name, resourceId(kind, row));
+        else checkResourceIdentity(kind, name, row, entry);
+        doomed.push({kind, name, id:resourceId(kind, row)});
+      }
+    }
+    const removed = [];
+    // A Worker that consumes one of these queues is released first.
+    for (const queue of doomed.filter(item => item.kind === 'queues')) {
+      for (const consumer of await api.list(`/queues/${queue.id}/consumers`, {pagination:'single'})) {
+        if (workerConsumerScript(consumer) === target.worker) await api.request(`/queues/${queue.id}/consumers/${consumer.consumer_id}`, {method:'DELETE'});
+      }
+    }
+    if (worker) { await deleteWorker({api, worker, ...(clock ? {clock} : {}), ...(sleep ? {sleep} : {})}); removed.push(`worker:${worker}`); }
+    const failed = [];
+    for (const item of doomed) {
+      try { await remove[item.kind](api, item.id, item.name); removed.push(`${item.kind}:${item.name}`); }
+      catch (error) { failed.push({resource:`${item.kind}:${item.name}`, code:error.message}); }
+    }
+    // Read back: nothing this environment created is still listed.
+    const remaining = [];
+    if (await workerSettings(api, target.worker) !== null) remaining.push(`worker:${target.worker}`);
+    const namespaces = await api.list('/workers/durable_objects/namespaces');
+    for (const row of namespaces) if (row.script === target.worker) remaining.push(`durable-object:${row.class}`);
+    for (const kind of KINDS) {
+      if (!listed[kind]) continue;
+      const rows = await resourceKinds[kind].list(api);
+      for (const {name} of owned.filter(item => item.kind === kind)) if (findResource(rows, kind, name)) remaining.push(`${kind}:${name}`);
+    }
+    if (remaining.length) {
+      // Keep the record of what is left, so a later --remove finishes it.
+      for (const kind of KINDS) for (const name of Object.keys(state.owned[kind])) if (!remaining.includes(`${kind}:${name}`)) delete state.owned[kind][name];
+      if (!remaining.includes(`worker:${target.worker}`)) {
+        state.owned.worker = null; state.receipt = null; delete state.pendingUpload;
+        delete state.ownerClaim; delete state.retiredSecrets;
+      }
+      await writeOwnerState(statePath, state);
+      const error = new Error('remove-incomplete'); error.remaining = remaining; error.failed = failed; error.removed = removed;
+      throw error;
+    }
+    await rm(statePath, {force:true});
+    return {worker:target.worker, removed, remaining:[]};
+  });
+}

package/modules/deploy-kit/owner-secret.mjs

@@ -0,0 +1,94 @@
+import { assert, identifier } from './validation.mjs';
+import { activeWorker } from './worker.mjs';
+import { waitHealth } from './health-request.mjs';
+import { definiteProviderRefusal } from './provider.mjs';
+import { readOwnerState, writeOwnerState, withStateLock, withScopeHints, sameDeployment, refuse, recordSecretChange, settlePendingSecret } from './owner.mjs';
+
+/** Set (`value` given) or remove one Worker secret of the owner's last deployment, then
+ * record the Worker version the change made in the state file, so the next deploy
+ * recognises its own Worker. A Worker someone else replaced is refused untouched.
+ * The change is recorded as pending first: if the provider applies it but rer never
+ * sees it settle, a later run can recognise its immediate successor (see settlePendingSecret).
+ * Both success and ambiguous failure read back for up to `windowMs`. An explicit refusal
+ * clears the pending record. An accepted write keeps its intent until confirmed.
+ * An ambiguous failure clears it only when readback corroborates that the receipt's
+ * deployment is still live. An ambiguous rotation
+ * re-PUTs the value before accepting its successor as proof of the rotation.
+ * A removed declared secret is retired: later plans omit it until it is set again. */
+export async function ownerSecret({api: provider, target, statePath, binding, value, fetch = globalThis.fetch, healthOptions = {}, windowMs = 30000, clock = () => performance.now(), sleep = ms => new Promise(resolve => setTimeout(resolve, ms))}) {
+  const api = withScopeHints(provider);
+  assert(identifier(binding), 'invalid-secret-name');
+  assert(value === undefined || typeof value === 'string' && value.trim(), `missing-secret-${binding}`);
+  return withStateLock(statePath, async () => {
+    const state = await readOwnerState(statePath, target);
+    assert(state.receipt && !state.pendingUpload, 'missing-owner-receipt');
+    if (await settlePendingSecret(api, target.worker, state, {preflight:true})) await writeOwnerState(statePath, state);
+    const live = await activeWorker(api, target.worker);
+    if (!live) throw refuse('owned-resource-missing', 'worker', target.worker);
+    if (!sameDeployment(live, state.receipt.provider)) throw refuse('owned-resource-replaced', 'worker', target.worker);
+    const path = `/workers/scripts/${target.worker}/secrets`, present = value !== undefined;
+    const names = async () => { const rows = await api.request(path); assert(Array.isArray(rows), 'invalid-secret-list'); return rows.map(row => row.name); };
+    const existed = (await names()).includes(binding), changed = present || existed;
+    state.pendingSecret = {binding, present, versionId:state.receipt.provider.versionId}; await writeOwnerState(statePath, state);
+    let failure, unchanged = false, confirming = false;
+    const put = () => api.request(path, {method:'PUT', body:{name:binding, text:value, type:'secret_text'}});
+    try {
+      if (present) await put();
+      else if (changed) await api.request(`${path}/${binding}`, {method:'DELETE'});
+    } catch (error) {
+      if (definiteProviderRefusal(error)) { delete state.pendingSecret; await writeOwnerState(statePath, state); throw error; }
+      failure = error;
+    }
+    try {
+      if (!changed) recordSecretChange(state, live, state.pendingSecret);
+      else for (const start = clock(); ; await sleep(2000)) {
+        try {
+          if (await settlePendingSecret(api, target.worker, state, {
+            observe: current => { unchanged = sameDeployment(current, state.receipt.provider); },
+            ...(failure && present && existed ? {confirm: async current => {
+              confirming = true;
+              state.pendingSecret.repeatVersionId = current.versionId;
+              await writeOwnerState(statePath, state);
+              await put();
+              confirming = false;
+            }} : {})
+          })) break;
+        }
+        catch (error) {
+          unchanged = false;
+          // Another ambiguous PUT cannot prove a rotation by presence either.
+          // Keep both starting versions for recovery; do not report it done.
+          if (confirming) throw error;
+          if (error.message !== 'provider-transport-failed' && !(error.status >= 500 && error.status < 600)) throw error;
+        }
+        if (clock() - start + 2000 > windowMs) throw failure ?? new Error('secret-change-unsettled');
+      }
+    } catch (error) {
+      if (unchanged && failure) delete state.pendingSecret;
+      await writeOwnerState(statePath, state);
+      throw failure ?? error;
+    }
+    const result = {worker:target.worker, binding, present, versionId:state.receipt.provider.versionId};
+    // Settlement is durable before readiness: a failed hosted check must never
+    // erase the applied mutation or cause the next command to reject our version.
+    state.receipt.health = {ok:false,versionId:result.versionId};
+    await writeOwnerState(statePath, state);
+    try {
+      if (state.receipt.origin) await waitHealth({
+        origin:state.receipt.origin, receipt:state.receipt, versionId:result.versionId, request:fetch,
+        timeoutMs:healthOptions.timeoutMs,
+        clock:healthOptions.now, sleep:healthOptions.sleep, ...healthOptions.readiness,
+      });
+      const after = await activeWorker(api, target.worker);
+      assert(after && sameDeployment(after, state.receipt.provider), 'deployment-changed-during-health');
+      // Response prefixes belong only in the caller's redacted diagnostic, never
+      // in the ownership record: an unhealthy app may accidentally echo a secret.
+      state.receipt.health = {ok:true,versionId:result.versionId};
+      await writeOwnerState(statePath, state);
+      return result;
+    } catch (error) {
+      error.secretChange = result;
+      throw error;
+    }
+  });
+}

package/modules/deploy-kit/owner.mjs

@@ -1,7 +1,8 @@
 import { ingressBindings } from './container-config.mjs';
 import { mkdir, open, rename, rm, writeFile } from 'node:fs/promises';
 import { dirname } from 'node:path';
-import { assert, hash, identifier, resourceName, validatePlan } from './validation.mjs';
+import { assert, hash, identifier, resourceName, uuid, validatePlan } from './validation.mjs';
+import { definiteProviderRefusal } from './provider.mjs';
 import { regularBytes } from './artifact.mjs';
 import { resourceKinds, findResource, checkCronOwnership } from './resources.mjs';
 import { secretBindings, activeWorker, deployedFingerprint } from './worker.mjs';
@@ -16,11 +17,11 @@ import { verifyHealth } from './health.mjs';
 
 const segment = /^[a-z][a-z0-9]*(?:-[a-z0-9]+)*$/;
 const STATE_KIND = 'rer-deploy-owner-state';
-const KINDS = ['d1','r2','kv','queues'];
+export const KINDS = ['d1','r2','kv','queues'];
 const DECLARATION_KEYS = ['version','project','compatibilityDate','compatibilityFlags','d1','r2','kv','queues','durableObjects','secrets','crons','vars','originVar','services','workersDev','platforms','container'];
 const ENTRY_KEYS = {d1:['binding'],r2:['binding','locationHint'],kv:['binding'],queues:['binding','consumer','deadLetterQueue'],durableObjects:['binding','className','storage'],secrets:['binding','environment','verifyStandIn'],services:['binding','project','entrypoint','allowedHosts','grant']};
 
-function refuse(code, kind, name) { const error = new Error(code); error.resource = `${kind}:${name}`; return error; }
+export function refuse(code, kind, name) { const error = new Error(code); error.resource = `${kind}:${name}`; return error; }
 
 export function ownerWorkerName(project, environment) {
   assert(typeof project === 'string' && /^(?:[a-z0-9][a-z0-9-]*\/)?[a-z0-9-]+$/.test(project) && segment.test(project.split('/').at(-1)), 'invalid-owner-project');
@@ -49,6 +50,37 @@ export function withScopeHints(api) {
   const guard = method => async (path, ...rest) => { try { return await api[method](path, ...rest); } catch (error) { return hint(path, error); } };
   return {...api, scopeHints:true, request:guard('request'), envelope:guard('envelope'), list:guard('list')};
 }
+/** Right after a create, an account listing can disagree with its own page counts
+ * (D1's total_count lagged its rows by about 7 seconds, measured 13 October 2026) or
+ * not show the new resource yet. Owner mode discards a partial snapshot and lists
+ * again from the start for up to `windowMs`; a partial listing is never accepted. */
+export const LIST_WINDOW_MS = 120000;
+const settleable = error => ['provider-partial-list','provider-pagination-changed'].includes(error.message);
+export function withSettledLists(api, {windowMs = LIST_WINDOW_MS, clock = () => performance.now(), sleep = ms => new Promise(resolve => setTimeout(resolve, ms))} = {}) {
+  if (api.settledLists) return api;
+  const list = async (...args) => {
+    const start = clock();
+    for (let delay = 500; ; delay = Math.min(delay * 2, 4000)) {
+      try { return await api.list(...args); }
+      catch (error) {
+        if (!settleable(error) || clock() - start + delay > windowMs) throw error;
+        await sleep(delay);
+      }
+    }
+  };
+  return {...api, settledLists:true, unsettled:api, list};
+}
+/** Waits until the account's listing shows a resource this run just created, so no later
+ * read mistakes it for a missing or replaced one. One that never appears is named. */
+async function listedAfterCreate(api, kind, item, {windowMs = LIST_WINDOW_MS, clock = () => performance.now(), sleep = ms => new Promise(resolve => setTimeout(resolve, ms))} = {}) {
+  const start = clock();
+  for (let delay = 500; ; delay = Math.min(delay * 2, 4000)) {
+    try { if (findResource(await resourceKinds[kind].list(api.unsettled ?? api),kind,item.name)) return; }
+    catch (error) { if (!settleable(error)) throw error; }
+    if (clock() - start + delay > windowMs) throw refuse('resource-not-listed',kind,item.name);
+    await sleep(delay);
+  }
+}
 /** Reads the account's workers.dev subdomain; no other provider request. */
 export async function ownerTarget(provider, {project, environment}) {
   const api = withScopeHints(provider);
@@ -66,9 +98,10 @@ function entries(declaration, key) {
   assert(Array.isArray(list) && list.every(item => item && typeof item === 'object' && !Array.isArray(item) && Object.keys(item).every(k => ENTRY_KEYS[key].includes(k))), 'invalid-owner-declaration');
   return list;
 }
-/* RER_DEV_KEY opens local dev identity; it and every key a seed adapter declares
- * local-only never become a deployed binding, secret or secret source. */
-export const LOCAL_ONLY_KEYS = Object.freeze(['RER_DEV_KEY', 'RER_MODELS_KEY', 'RER_MODELS_SERVICE', '.rer/local/models.json']);
+/* RER_DEV_KEY opens local dev identity and RER_DEMO turns on demo mode (nothing
+ * sent, throwaway data); they and every key a seed adapter declares local-only
+ * never become a deployed binding, secret or secret source. */
+export const LOCAL_ONLY_KEYS = Object.freeze(['RER_DEV_KEY', 'RER_DEMO', 'RER_MODELS_KEY', 'RER_MODELS_SERVICE', '.rer/local/models.json']);
 export function localOnlyBinding(declaration, localOnlyKeys = []) {
   const refused = new Set([...LOCAL_ONLY_KEYS, ...localOnlyKeys]);
   const names = [...Object.keys(declaration?.vars ?? {}), declaration?.originVar, ...(Array.isArray(declaration?.secrets) ? declaration.secrets.flatMap(item => [item?.binding, item?.environment]) : [])];
@@ -134,18 +167,24 @@ export async function readOwnerState(path, target) {
     && (state.owned.worker === null || ['pending','created'].includes(state.owned.worker?.status))
     && KINDS.every(kind => state.owned[kind] && typeof state.owned[kind] === 'object' && Object.values(state.owned[kind]).every(entry => ['pending','created'].includes(entry?.status))), 'invalid-owner-state');
   assert(state.pendingUpload === undefined || typeof state.pendingUpload?.fingerprint === 'string' && typeof state.pendingUpload?.build === 'string', 'invalid-owner-state');
+  // Declared secrets rer removed on purpose (the spent setup token): later plans omit them.
+  assert(state.pendingSecret === undefined || identifier(state.pendingSecret?.binding) && typeof state.pendingSecret?.present === 'boolean'
+    && (state.pendingSecret.versionId === undefined || uuid(state.pendingSecret.versionId))
+    && (state.pendingSecret.repeatVersionId === undefined || uuid(state.pendingSecret.repeatVersionId)), 'invalid-owner-state');
+  assert(state.ownerClaim === undefined || ['claimed','kept'].includes(state.ownerClaim?.outcome), 'invalid-owner-state');
+  assert(state.retiredSecrets === undefined || Array.isArray(state.retiredSecrets) && state.retiredSecrets.every(identifier), 'invalid-owner-state');
   assert(state.accountId === target.accountId && state.project === target.project && state.environment === target.environment && state.worker === target.worker, 'owner-state-target-mismatch');
   return state;
 }
-async function writeOwnerState(path, state) {
+export async function writeOwnerState(path, state) {
   await mkdir(dirname(path),{recursive:true,mode:0o700});
   const temporary = `${path}.${process.pid}.tmp`;
   await writeFile(temporary,JSON.stringify(state,null,2)+'\n',{flag:'wx',mode:0o600});
   await rename(temporary,path);
 }
-const resourceId = (kind, row) => ({d1:row.uuid,r2:row.creation_date,kv:row.id,queues:row.queue_id})[kind];
+export const resourceId = (kind, row) => ({d1:row.uuid,r2:row.creation_date,kv:row.id,queues:row.queue_id})[kind];
 
-function checkResourceIdentity(kind, name, row, entry) {
+export function checkResourceIdentity(kind, name, row, entry) {
   if (row) {
     if (!entry) throw refuse('resource-name-collision',kind,name);
     if (entry.status !== 'created') throw refuse('uncertain-resource-create',kind,name);
@@ -194,7 +233,65 @@ async function uploadFingerprint(body) {
   assert(typeof fingerprint === 'string' && fingerprint, 'invalid-upload-metadata');
   return fingerprint;
 }
-const sameDeployment = (a, b) => a?.versionId === b?.versionId && a?.deploymentId === b?.deploymentId && a?.etag === b?.etag;
+/** Record a secret change's outcome on the receipt: the Worker version it made, and whether
+ * the secret is now retired (a removed declared secret stays out of later plans). */
+export function recordSecretChange(state, current, {binding, present}) {
+  state.receipt.provider = {versionId:current.versionId, deploymentId:current.deploymentId, etag:current.etag};
+  const retired = new Set(state.retiredSecrets ?? []);
+  if (present) retired.delete(binding); else retired.add(binding);
+  if (retired.size) state.retiredSecrets = [...retired].sort(); else delete state.retiredSecrets;
+  delete state.pendingSecret;
+}
+/** A secret change rer recorded as pending but never confirmed (a lost response, or a run that
+ * ended before the change settled). It is that change only when the Worker's versions list shows
+ * exactly one version after the recorded starting version and it is the live one, still running the receipt's
+ * exact script and build fingerprint: adopt its version. A confirming PUT also records its
+ * own starting version before it writes; its immediate successor can be recovered by the
+ * same checks. Anything later is left to the identity check, which refuses it. */
+export async function settlePendingSecret(api, worker, state, {preflight = false, observe, confirm} = {}) {
+  if (!state.pendingSecret || !state.receipt) return false;
+  const live = await activeWorker(api, worker);
+  if (sameDeployment(live, state.receipt.provider)) {
+    // A new command sees that the abandoned write made no live version change.
+    // During the write's own readback this can still be propagation delay.
+    if (!preflight) {
+      // Deployment propagation can lag a secret write's version. Only a
+      // matching newest version corroborates that the write was unapplied.
+      const versions = (await api.request(`/workers/scripts/${worker}/versions`))?.items;
+      observe?.(Array.isArray(versions) && versions[0]?.id === live.versionId ? live : null);
+      return false;
+    }
+    delete state.pendingSecret;
+    return true;
+  }
+  observe?.(live);
+  if (state.pendingSecret.versionId !== state.receipt.provider.versionId || !live || live.etag !== state.receipt.provider.etag || deployedFingerprint(live.settings) !== state.receipt.fingerprint) return false;
+  // Newest first, as the provider lists them.
+  const versions = (await api.request(`/workers/scripts/${worker}/versions`))?.items;
+  const ids = Array.isArray(versions) ? versions.map(item => item?.id) : [];
+  const {versionId, repeatVersionId} = state.pendingSecret;
+  const immediate = ids.indexOf(versionId) === 1;
+  const repeated = repeatVersionId && ids[1] === repeatVersionId && ids.indexOf(versionId) === 2;
+  // A rotation's ambiguous first answer requires a second PUT before success.
+  // Its starting version is saved before that PUT, so interruption can recover
+  // either the original immediate successor or the second write's successor.
+  if (ids[0] !== live.versionId || !(repeatVersionId ? repeated || preflight && immediate && live.versionId === repeatVersionId : immediate)) return false;
+  const rows = await api.request(`/workers/scripts/${worker}/secrets`);
+  if (!Array.isArray(rows) || rows.some(row => row.name === state.pendingSecret.binding) !== state.pendingSecret.present) return false;
+  if (confirm && !repeatVersionId) { await confirm(live); return false; }
+  recordSecretChange(state, live, state.pendingSecret);
+  return true;
+}
+/** Settle a pending secret change under the state lock, before a plan reads the retired list. */
+export async function settleOwnerState({api: provider, target, statePath}) {
+  const api = withScopeHints(provider);
+  return withStateLock(statePath, async () => {
+    const state = await readOwnerState(statePath, target);
+    if (await settlePendingSecret(api, target.worker, state, {preflight:true})) await writeOwnerState(statePath, state);
+    return state;
+  });
+}
+export const sameDeployment = (a, b) => a?.versionId === b?.versionId && a?.deploymentId === b?.deploymentId && a?.etag === b?.etag;
 
 /** A completed receipt or the exact identity of an interrupted successful upload proves ownership.
  * Only the first upload, with no receipt, may recover a lost response by its pending build. */
@@ -236,30 +333,38 @@ export async function withStateLock(path, run) {
 
 /** Find or create every declared resource under the owner's account, migrate, upload and check health.
  * Ownership preflight precedes provider writes. A re-run of the same build writes nothing. */
-export async function ownerDeploy({api: provider, target, plan, artifact, statePath, env = {}, fetch = globalThis.fetch, healthOptions = {}, readiness = {}}) {
+export async function ownerDeploy({api: provider, target, plan, artifact, statePath, env = {}, fetch = globalThis.fetch, healthOptions = {}, readiness = {}, settle = {}}) {
   assert(typeof statePath === 'string' && statePath.length, 'missing-owner-state-path');
-  const api = withScopeHints(provider);
+  const api = withSettledLists(withScopeHints(provider),settle);
   assert(target?.accountId === api.accountId, 'owner-account-mismatch');
   validatePlan(plan); assertOwnerNames(target, plan);
   for (const item of plan.d1) validateMigrations(item.migrations);
-  return withStateLock(statePath, () => deployLocked({api, target, plan, artifact, statePath, env, fetch, healthOptions, readiness}));
+  return withStateLock(statePath, () => deployLocked({api, target, plan, artifact, statePath, env, fetch, healthOptions, readiness, settle}));
 }
-async function deployLocked({api, target, plan, artifact, statePath, env, fetch, healthOptions, readiness}) {
+async function deployLocked({api, target, plan, artifact, statePath, env, fetch, healthOptions, readiness, settle}) {
   const state = await readOwnerState(statePath, target);
   const save = () => writeOwnerState(statePath, state);
+  if (await settlePendingSecret(api, target.worker, state, {preflight:true})) await save();
   await checkServiceWorkers(api, plan);
   const priorWorker = await checkOwnedWorker(api, plan, artifact, state);
   const exists = priorWorker !== null;
   const create = await ownedResourcesToCreate(api, plan, state);
   if (exists) await checkCronOwnership(api, plan);
-  await secretBindings(api, plan.worker, plan, env, exists);
+  // The declared secrets this run uploads; every other one is inherited unchanged.
+  const {missing:sentSecrets} = await secretBindings(api, plan.worker, plan, env, exists);
   // Record intent before each create. A failed or lost response leaves it pending:
   // absent on resume means create again; present means an uncertain outcome to inspect.
   for (const {kind,item} of create) {
     state.owned[kind][item.name] = {status:'pending'}; await save();
-    const row = await resourceKinds[kind].create(api,item);
+    let row;
+    try { row = await resourceKinds[kind].create(api,item); }
+    catch (error) {
+      if (definiteProviderRefusal(error)) { delete state.owned[kind][item.name]; await save(); }
+      throw error;
+    }
     assert(findResource([row],kind,item.name) === row, 'invalid-created-resource');
     state.owned[kind][item.name] = {status:'created',...(resourceId(kind,row) === undefined ? {} : {id:resourceId(kind,row)})}; await save();
+    await listedAfterCreate(api,kind,item,settle);
   }
   if (!exists && !state.owned.worker) { state.owned.worker = {status:'pending'}; await save(); }
   const upload = `/workers/scripts/${plan.worker}?bindings_inherit=strict`;
@@ -285,15 +390,15 @@ async function deployLocked({api, target, plan, artifact, statePath, env, fetch,
   }};
   const receipt = await deploy({api:observed, plan, artifact, artifactSha256:hash(artifact), previousReceipt:state.receipt ?? undefined,
     createResources:false, uploadWithoutReceipt:true, env, fetch, healthOptions, readiness,
-    onReceipt: async candidate => { if (candidate.changed || !state.receipt) { state.receipt = candidate; delete state.pendingUpload; await save(); } },
+    onReceipt: async candidate => { if (candidate.changed || !state.receipt) { state.receipt = candidate; delete state.pendingUpload; delete state.pendingSecret; await save(); } },
     // Keep each first-health attempt beside the identity it belongs to.
     onHealth: async candidate => { if (candidate.changed) { state.receipt = candidate; await save(); } }});
-  return {receipt, created:create.map(({kind,item}) => `${kind}:${item.name}`)};
+  return {receipt, created:create.map(({kind,item}) => `${kind}:${item.name}`), sentSecrets};
 }
 
 /** Independent read-only health of the last owner deployment recorded in the state file. */
 export async function ownerHealth({api: provider, target, plan, statePath, fetch = globalThis.fetch, healthOptions = {}}) {
-  const api = withScopeHints(provider);
+  const api = withSettledLists(withScopeHints(provider));
   validatePlan(plan); assertOwnerNames(target, plan);
   const state = await readOwnerState(statePath, target);
   assert(state.receipt, 'missing-owner-receipt');