@runeditrun/rer 0.2.1 → 0.2.4

package/modules/deploy-kit/prepare.mjs

@@ -6,6 +6,7 @@ import { assert, hash, localPath } from './validation.mjs';
 import { assetsIgnore, collectFiles, regularBytes, validateArtifact, MAX_ARTIFACT } from './artifact.mjs';
 import { collectBuildModules } from './build-modules.mjs';
 import { refuseLocalModels } from './local-only.mjs';
+import { readMigrationRewrites, withRewrites } from './migrations.mjs';
 
 export function assertCredentialFree(env) {
   for (const [key,value] of Object.entries(env)) if (value && /(?:TOKEN|SECRET|PASSWORD|API_KEY|PRIVATE_KEY|AUTHORIZATION|COOKIE|CREDENTIAL)/i.test(key)) throw new Error('prepare-credential-environment-forbidden');
@@ -26,11 +27,12 @@ export async function packageBuild({root,source,runIdentity,productDirectory = '
   const modules = await collectBuildModules(build,config,main);
   const ignored = assetsIgnore(await regularBytes(join(product,'dist/client/.assetsignore'),65536).then(String,error => { if (error.code === 'ENOENT') return ''; throw error; }));
   const assets = (await collectFiles(join(product,'dist/client'))).filter(file => !ignored(file.path));
-  const migrations = [];
+  let migrations = [];
   for (const name of (await readdir(join(product,'migrations/core'))).sort()) {
     assert(/^[0-9]+_[a-zA-Z0-9_-]+\.sql$/.test(name),'unexpected-migration-file');
     const sql = (await regularBytes(join(product,'migrations/core',name),512000)).toString('utf8'); migrations.push({binding:'DB',name,sql,sha256:hash(sql)});
   }
+  migrations = withRewrites(migrations, await readMigrationRewrites(product));
   const artifact = {version:1,source,run:runIdentity,main,modules,assets,migrations}; validateArtifact(artifact);
   return artifact;
 }

package/modules/deploy-kit/provider.mjs

@@ -1,6 +1,10 @@
 import { recordDeployFailure } from './diagnostics.mjs';
+import { importD1, importUploadURL } from './d1-import.mjs';
 import { assert, hexId } from './validation.mjs';
 
+// A gateway/server error can arrive after a write. An explicit API refusal cannot.
+export const definiteProviderRefusal = error => error.status === 200 || error.status >= 400 && error.status < 500;
+
 async function boundedText(response, limit = 4 * 1024 * 1024, onReadError) {
   assert(response.body, 'empty-response');
   const reader = response.body.getReader(); const chunks = []; let length = 0;
@@ -38,7 +42,7 @@ export function cloudflare({ accountId, token, fetch: request = globalThis.fetch
     assert(!assetToken || path === '/workers/assets/upload?base64=true', 'invalid-asset-auth-target');
     // Asset-session credentials are discovered at runtime, outside the CLI env.
     // Preserve complete text for the CLI's remaining redaction before truncation.
-    const redactAuth = text => [accountId,token,assetToken].filter(Boolean).flatMap(value=>[value,encodeURIComponent(value),JSON.stringify(value).slice(1,-1)]).sort((a,b)=>b.length-a.length).reduce((value,secret)=>value.split(secret).join('[REDACTED]'),text);
+    const redactAuth = text => /\/d1\/database\/[^/]+\/import$/.test(path) ? '[D1 import details omitted]' : [accountId,token,assetToken].filter(Boolean).flatMap(value=>[value,encodeURIComponent(value),JSON.stringify(value).slice(1,-1)]).sort((a,b)=>b.length-a.length).reduce((value,secret)=>value.split(secret).join('[REDACTED]'),text);
     const transportFailure = cause => recordDeployFailure(new Error('provider-transport-failed'),{output:redactAuth(transportOutput(cause))});
     const signal = AbortSignal.timeout(timeoutMs);
     let response;
@@ -136,6 +140,18 @@ export function cloudflare({ accountId, token, fetch: request = globalThis.fetch
     }
     throw new Error('provider-pagination-limit');
   }
-  return { accountId, envelope, list, async request(path, options) { return (await envelope(path, options)).result; },
+  async function upload(url, bytes, etag) {
+    const destination = importUploadURL(url);
+    assert(++requests <= maxRequests, 'provider-request-budget');
+    let response;
+    try {
+      response = await request(destination, { method:'PUT', redirect:'error', signal:AbortSignal.timeout(timeoutMs), headers:{'Content-Length':String(bytes.length)}, body:bytes });
+    } catch { throw new Error('d1-import-upload-transport-failed'); }
+    // Upload bodies and signed URLs are never diagnostics, including on failure.
+    await response.body?.cancel().catch(() => {});
+    assert(response.status === 200, 'd1-import-upload-failed');
+    assert(response.headers.get('etag')?.replace(/^"|"$/g, '') === etag, 'd1-import-upload-etag-mismatch');
+  }
+  return { accountId, envelope, list, importSql(id, sql) { return importD1({envelope,upload}, id, sql); }, async request(path, options) { return (await envelope(path, options)).result; },
     async zoneRequest(path, options = {}) { return (await envelope(path, { ...options, zone: true })).result; } };
 }

package/modules/erasure/README.md

@@ -177,9 +177,8 @@ the seed retires them in its own migration.
 ## Adopting
 
 Copy these files byte for byte to a folder the Worker build serves, such as
-`src/modules/erasure/`. A seed made by `rer` export also receives them under
-`scripts/base-cli/modules/erasure/`, but `vite dev` serves only `src`, `public`
-and `node_modules`, so runtime imports must not reach into `scripts/`. The
+`src/modules/erasure/`. `vite dev` serves only `src`, `public` and
+`node_modules`, so runtime imports must not reach into `scripts/`. The
 standalone default seed copies this module and portability into `src/modules/`.
 The files are:
 

package/modules/job-queue/config.mjs

@@ -1,4 +1,4 @@
-import { cpus, totalmem, userInfo } from 'node:os';
+import { cpus, totalmem, homedir } from 'node:os';
 import { readFile } from 'node:fs/promises';
 import { resolve } from 'node:path';
 
@@ -9,8 +9,10 @@ const names = { slots: 'SLOTS', loadThreshold: 'LOAD_THRESHOLD',
   minFreeMemoryBytes: 'MIN_FREE_MEMORY_BYTES', pollMs: 'POLL_MS',
   nice: 'NICE', killGraceMs: 'KILL_GRACE_MS' };
 
+export const jobsDirectory = (env = process.env) => resolve(env.RER_JOBS_DIR ?? `${env.HOME || homedir()}/.rer/jobs`);
+
 export async function configuration({ env = process.env, ...overrides } = {}) {
-  const directory = resolve(overrides.directory ?? env.RER_JOBS_DIR ?? `${userInfo().homedir}/.rer/jobs`);
+  const directory = resolve(overrides.directory ?? jobsDirectory(env));
   let disk = {};
   try { disk = JSON.parse(await readFile(resolve(directory, 'config.json'), 'utf8')); }
   catch (error) { if (error.code !== 'ENOENT') throw error; }

package/modules/operator-auth/accounts/settings-page.mjs

@@ -1,4 +1,9 @@
-import { securityHeaders } from '../http.mjs';
-export function identitySettingsPage({idpSignIn}) {
- return new Response(`<!doctype html><html lang="en"><head><meta charset="utf-8"><meta name="viewport" content="width=device-width,initial-scale=1"><title>Sign-in settings</title><style>body{font:18px system-ui;margin:0;padding:24px;color:#152523}main{max-width:640px;margin:8vh auto}label{display:block;padding:20px 0}button{font:inherit;padding:12px 20px}input{width:20px;height:20px;margin-right:12px}</style></head><body><main><a href="/app">Back to app</a><h1>Sign-in settings</h1><p>Allow invited people to sign in through your linked identity provider. Email links remain available to the owner.</p><form action="/auth/settings/identity" method="post"><input type="hidden" name="setting" value="identity"><label><input type="checkbox" name="idpSignIn" value="true" ${idpSignIn?'checked':''}>Allow provider sign-in</label><button>Save settings</button></form></main></body></html>`,{headers:{...securityHeaders(),'Referrer-Policy':'strict-origin','Content-Type':'text/html; charset=utf-8','Content-Security-Policy':"default-src 'none'; style-src 'unsafe-inline'; form-action 'self'; frame-ancestors 'none'; base-uri 'none'"}});
+import { pageResponse } from '../page.mjs';
+
+// The owner's sign-in settings, in the same frame (and seed theme) as sign-in.
+export function identitySettingsPage({ idpSignIn }, branding) {
+ const content = '<p>Allow invited people to sign in through your linked identity provider. Email links remain available to the owner.</p>'
+  + `<form action="/auth/settings/identity" method="post"><input type="hidden" name="setting" value="identity"><label class="check"><input type="checkbox" name="idpSignIn" value="true"${idpSignIn ? ' checked' : ''}>Allow provider sign-in</label><button>Save settings</button></form>`
+  + '<p class="secondary-link"><a href="/app">Back to app</a></p>';
+ return pageResponse({ branding, title: 'Sign-in settings', heading: 'Sign-in settings', content, referrer: 'strict-origin' });
 }

package/modules/operator-auth/csp.mjs

@@ -0,0 +1,26 @@
+// Inline additions to a document's Content-Security-Policy: the dev badge and
+// the demo bar each add one hashed style without loosening anything else.
+
+/** The CSP source token for an exact inline text. */
+export async function sha256(text) {
+  const bytes = await crypto.subtle.digest('SHA-256', new TextEncoder().encode(text));
+  return `'sha256-${btoa(String.fromCharCode(...new Uint8Array(bytes)))}'`;
+}
+
+// Allow exactly one more inline source in a directive the document already
+// restricts. Inline content an existing directive already permits stays as is.
+export function allow(policy, directive, source) {
+  const parts = policy.split(';').map(part => part.trim()).filter(Boolean);
+  const find = name => parts.findIndex(part => part.split(/\s+/)[0].toLowerCase() === name);
+  let index = find(directive);
+  if (index < 0) {
+    const fallback = find('default-src');
+    if (fallback < 0) return policy;
+    parts.push([directive, ...parts[fallback].split(/\s+/).slice(1)].join(' '));
+    index = parts.length - 1;
+  }
+  const tokens = parts[index].split(/\s+/);
+  if (tokens.includes("'unsafe-inline'") && !tokens.some(token => /^'(?:nonce|sha256|sha384|sha512)-/.test(token))) return parts.join('; ');
+  parts[index] = [...tokens.filter(token => token !== "'none'"), source].join(' ');
+  return parts.join('; ');
+}

package/modules/operator-auth/dev/badge.mjs

@@ -1,5 +1,6 @@
 import { EXCHANGE_SCRIPT, exchangeHashes } from '../dev-gate.mjs';
 import { escapeHtml } from '../http.mjs';
+import { allow, sha256 } from '../csp.mjs';
 
 // A slim bar at the top of the document, in normal flow so the page below it
 // starts after it and nothing is ever covered. A grid body (the frames that
@@ -7,10 +8,6 @@ import { escapeHtml } from '../http.mjs';
 // in the rest.
 const STYLE = 'body:has(>#rer-dev-badge){grid-template-rows:auto 1fr}#rer-dev-badge{grid-column:1/-1;justify-self:stretch;align-self:start;position:relative;z-index:2147483647;box-sizing:border-box;width:100%;margin:0 0 12px;padding:6px 12px;border-radius:8px;background:#111827;color:#f9fafb;font:13px/1.5 system-ui,sans-serif;text-align:left}#rer-dev-badge summary{min-width:24px;min-height:24px;cursor:pointer;overflow-wrap:anywhere}#rer-dev-badge ul{margin:6px 0 0;padding:0;list-style:none;display:flex;flex-wrap:wrap;gap:4px 16px}#rer-dev-badge li{margin:0}#rer-dev-badge a{display:inline-block;min-width:24px;min-height:24px;color:#bfdbfe;text-decoration:underline}#rer-dev-badge a[aria-current]{color:#fff;font-weight:700}#rer-dev-badge a:focus-visible,#rer-dev-badge summary:focus-visible{outline:2px solid #fff;outline-offset:2px}';
 let styleHash;
-async function sha256(text) {
-  const bytes = await crypto.subtle.digest('SHA-256', new TextEncoder().encode(text));
-  return `'sha256-${btoa(String.fromCharCode(...new Uint8Array(bytes)))}'`;
-}
 
 function badgeHtml({ session, choices }) {
   const current = session ? choices.find(choice => choice.email === session.operator.email)?.as : 'signed-out';
@@ -19,24 +16,6 @@ function badgeHtml({ session, choices }) {
   return `<style>${STYLE}</style><aside id="rer-dev-badge" aria-label="Local development identity"><details><summary>${label}</summary><ul>${links}</ul></details></aside>`;
 }
 
-// Allow exactly one more inline source in a directive the document already
-// restricts. Inline content an existing directive already permits stays as is.
-function allow(policy, directive, source) {
-  const parts = policy.split(';').map(part => part.trim()).filter(Boolean);
-  const find = name => parts.findIndex(part => part.split(/\s+/)[0].toLowerCase() === name);
-  let index = find(directive);
-  if (index < 0) {
-    const fallback = find('default-src');
-    if (fallback < 0) return policy;
-    parts.push([directive, ...parts[fallback].split(/\s+/).slice(1)].join(' '));
-    index = parts.length - 1;
-  }
-  const tokens = parts[index].split(/\s+/);
-  if (tokens.includes("'unsafe-inline'") && !tokens.some(token => /^'(?:nonce|sha256|sha384|sha512)-/.test(token))) return parts.join('; ');
-  parts[index] = [...tokens.filter(token => token !== "'none'"), source].join(' ');
-  return parts.join('; ');
-}
-
 /** Adds the fragment key exchange (root only) and the badge to an HTML document. */
 export async function decorate(response, { exchange, badge }) {
   // The Lobby is deliberately script-free. RER_OPEN uses /__dev/key, whose

package/modules/operator-auth/identity/oidc/README.md

@@ -145,6 +145,24 @@ sign-in page, which offers the email link instead of redirecting. A hidden
 provider is checked again at most once a minute, after the page answers
 (`waitUntil`), and shown again once a check succeeds.
 
+Connection health is separate from the pin's `status`. `list().linked` and
+`links().healthy` require a successfully exchanged, signature- and claim-verified
+ID token for the current `linkedAt` generation, with no subsequent provider-side
+exchange or reachability failure. A token endpoint's HTTP 400 `invalid_grant`
+refuses the bad or replayed code without changing connection health. Network
+failures, HTTP 5xx, `invalid_client`, and invalid ID tokens or JWKS still invalidate
+exchange health. A pin created by discovery alone is not healthy. Successful
+discovery or a JWKS probe cannot clear exchange failure; a valid new exchange
+can. Application membership and admission remain separate from provider health.
+The existing health table stores exchange observations under reserved
+`exchange:<id>:<linkedAt>` keys (configured IDs cannot contain colons), so older
+stores need no schema change. Writes fence the current pin and prune obsolete
+exchange generations. Relinking therefore requires fresh exchange proof.
+
+After upgrading, existing provider links show **not linked** until the next
+successful sign-in through **each provider**, because older stores have no
+verified exchange observation for those links.
+
 ## Storage and limits
 
 `oa_oidc_transactions` stores domain-separated HMAC hashes of state, binding and

package/modules/operator-auth/identity/oidc/config.mjs

@@ -1,3 +1,4 @@
+import { configureBranding } from '../../branding.mjs';
 import { normalizeEmail } from '../../policy.mjs';
 import { isLoopbackHost } from '../../http.mjs';
 import { check } from './errors.mjs';
@@ -73,6 +74,7 @@ function provider(input, origin) {
 
 export function configure(input) {
   try {
+    const { signInPath } = configureBranding({ signInPath: input.signInPath });
     const origin = new URL(input.origin);
     check(origin.origin === input.origin && !origin.username && !origin.password);
     const local = input.local === true;
@@ -85,11 +87,11 @@ export function configure(input) {
     check(new Set(callbacks).size === providers.length);
     // Auth routes, owner-claim handlers and the local dev gate retain their
     // handlers even when an edition chooses its own OIDC callback pathname.
-    const reserved = new Set([input.signInPath ?? '/signin', '/auth/owner-claim', '/auth/dev/enter', '/__dev/personas', '/__dev/key', '/auth/bootstrap', '/auth/magic-link', '/auth/confirm', '/auth/signout', '/auth/session', '/auth/invite', '/auth/invite/cancel', '/auth/review-session', '/auth/operators', '/auth/sessions', '/auth/operator/status', '/auth/operator/role', '/auth/session/revoke', '/auth/step-up', '/auth/domain-rules', '/auth/providers', '/auth/providers/unlink', '/auth/providers/relink', '/auth/settings/identity', '/auth/setup-complete']);
+    const reserved = new Set([new URL(signInPath, origin).pathname, '/auth/owner-claim', '/auth/dev/enter', '/__dev/personas', '/__dev/key', '/auth/bootstrap', '/auth/magic-link', '/auth/confirm', '/auth/signout', '/auth/session', '/auth/invite', '/auth/invite/cancel', '/auth/review-session', '/auth/operators', '/auth/sessions', '/auth/operator/status', '/auth/operator/role', '/auth/session/revoke', '/auth/step-up', '/auth/domain-rules', '/auth/providers', '/auth/providers/unlink', '/auth/providers/relink', '/auth/settings/identity', '/auth/setup-complete']);
     check(callbacks.every((path, index) => !reserved.has(path) && !path.startsWith('/.well-known/') && !path.startsWith('/auth/dependencies/') && !providers.some(p => path === p.startPath) && (!path.startsWith('/auth/oidc/') || path === `/auth/oidc/${providers[index].id}/callback`)));
 
     return Object.freeze({ origin: input.origin, local, secure: origin.protocol === 'https:', transactionSecret: input.transactionSecret, providers: Object.freeze(providers),
-      signInPath: input.signInPath ?? '/signin',
+      signInPath,
       transactionSeconds: integer(input.transactionSeconds, 600, 60, 900), timeoutMs: integer(input.timeoutMs, 5000, 100, 15000),
       clockSkewSeconds: integer(input.clockSkewSeconds, 30, 0, 120), maxTokenAgeSeconds: integer(input.maxTokenAgeSeconds, 600, 60, 3600),
       startLimit: integer(input.startLimit, 30, 1, 1000) });

package/modules/operator-auth/identity/oidc/index.d.mts

@@ -29,5 +29,5 @@ export const HIDE_AFTER_MS: number;
 export const MINIMUM_PROVIDER_VERSION: string;
 export const PRESETS: Readonly<Record<'auth' | 'google' | 'microsoft' | 'okta' | 'legacy-rs256', { label: string; algorithms: string[]; methods: string[]; email: 'verified-at' | 'google' | 'subject' | 'legacy-verified' }>>;
 export function createOidcProviders<R extends string>(options: OidcProvidersOptions<R>): IdentityProviders;
-export function createOidcHandler(providers: IdentityProviders): (request: Request) => Promise<Response | null>;
+export function createOidcHandler(providers: IdentityProviders, options?: { signInPath?: string }): (request: Request) => Promise<Response | null>;
 export class OidcError extends Error { constructor(code: string, status?: number); code: string; status: number }

package/modules/operator-auth/identity/oidc/index.mjs

@@ -8,13 +8,23 @@ import { configure } from './config.mjs';
 import { check, OidcError } from './errors.mjs';
 import { random, isRandom, digest, keyedHash, seal, unseal } from './crypto.mjs';
 import { storage } from './store.mjs';
-import { discover, exchange, readJson } from './network.mjs';
+import { discover, exchange, readJson, GrantRejected } from './network.mjs';
 import { parseIdToken, knowsKey, verifyIdToken, principalOf } from './jwt.mjs';
 import { PRESETS, MINIMUM_PROVIDER_VERSION } from './presets.mjs';
 import { refuseInProduction } from '../principal.mjs';
 export { OidcError } from './errors.mjs';
 export { PRESETS, MINIMUM_PROVIDER_VERSION } from './presets.mjs';
 
+// Separate reachability from a verified exchange; discovery must never reset
+// exchange failure or certify a new registration. IDs cannot contain ':'.
+const exchangeKey = link => `exchange:${link.id}:${link.linkedAt}`;
+const working = (link, health) => {
+  const exchange = link && health.get(exchangeKey(link));
+  const reachability = link && health.get(link.id);
+  return link?.status === 'linked' && !!exchange && exchange.failingSince === null && exchange.hardFailureAt === null
+    && (!reachability || reachability.failingSince === null && reachability.hardFailureAt === null);
+};
+
 export const HIDE_AFTER_MS = 5 * 60000;
 const PROBE_EVERY_MS = 60000;
 
@@ -43,7 +53,9 @@ function errorResponse(error, config, request, clearCookie) {
   if (clearCookie) headers.append('Set-Cookie', clearCookie);
   const code = known ? error.code : 'oidc_unavailable';
   if (request && /\btext\/html\b/.test(request.headers.get('accept') ?? '')) {
-    headers.set('Location', `${config.signInPath}?notice=${encodeURIComponent(code)}`);
+    const location = new URL(config.signInPath, 'https://signin.invalid');
+    location.searchParams.set('notice', code);
+    headers.set('Location', location.pathname + location.search + location.hash);
     return new Response(null, { status: 303, headers });
   }
   return Response.json({ error: code }, { status: known ? error.status : 503, headers });
@@ -187,15 +199,20 @@ export function createOidcProviders({ admission, db, config: input, clientIp, fe
       if (url.searchParams.has('error')) { check(!url.searchParams.has('code')); throw new OidcError('oidc_provider_denied', 401); }
       const code = url.searchParams.get('code');
       check(typeof code === 'string' && code.length <= 4096 && /^[\x21-\x7e]+$/.test(code));
-      const tokens = await exchange(fetcher, link, view, config, code, transaction.verifier, clock());
-      let claims;
+      let tokens, claims;
       try {
+        tokens = await exchange(fetcher, link, view, config, code, transaction.verifier, clock());
         const parsed = parseIdToken(tokens.id_token, link);
         const keys = await keysFor(provider, link, parsed.header.kid);
         claims = await verifyIdToken(parsed, keys, link, view, config, transaction, { ...tokens, code }, clock());
-      } catch (error) { if (error instanceof OidcError && error.status !== 400) throw error; throw new OidcError(error instanceof OidcError ? error.code : 'oidc_invalid_response'); }
+      } catch (error) {
+        if (!(error instanceof GrantRejected) && error?.code !== 'oidc_storage_unavailable') await store.exchangeHealth(link, false, error?.hard === true, clock());
+        if (error instanceof OidcError && error.status !== 400) throw error;
+        throw new OidcError(error instanceof OidcError ? error.code : 'oidc_invalid_response');
+      }
       check(clock() < transaction.expiresAt, 'oidc_invalid_correlation');
       check(transaction.policyVersion === await policyVersion() && await enabled(), 'oidc_sign_in_disabled', 403);
+      await store.exchangeHealth(link, true, false, clock());
       const providerPin={id:link.id,issuer:link.issuer,clientId:link.clientId,linkedAt:link.linkedAt};
       if (Object.hasOwn(claims,'install_owner')) {
         check(typeof claim === 'function','oidc_claim_refused',403);
@@ -214,6 +231,7 @@ export function createOidcProviders({ admission, db, config: input, clientIp, fe
   }
   return Object.freeze({
     ids: Object.freeze([...providers.keys()]),
+    signInPath: config.signInPath,
     begin, callback,
     callbackPaths: Object.freeze(Object.fromEntries([...providers.values()].map(p => [new URL(p.redirectUri).pathname, p.id]))),
     /** The sign-in page's list: a provider is hidden while unlinked or unreachable. */
@@ -231,7 +249,7 @@ export function createOidcProviders({ admission, db, config: input, clientIp, fe
         // Where the start route sends the browser: a form posting there needs it in form-action.
         const authorizationOrigins = link ? [new URL(link.authorization).origin] : [...provider.endpointOrigins];
         result.push({ id: provider.id, label: provider.label, preset: provider.preset, startPath: provider.startPath, authorizationOrigins,
-          visible: link?.status !== 'unlinked' && !unreachable, linked: link?.status === 'linked', pendingRelink: !!link?.pendingAt });
+          visible: link?.status !== 'unlinked' && !unreachable, linked: working(link, health), pendingRelink: !!link?.pendingAt });
       }
       // A hidden provider is checked again at most once a minute, after the page answers.
       if (stale.length) { const probes = Promise.all(stale.map(probe)); if (typeof waitUntil === 'function') waitUntil(probes); else await probes; }
@@ -253,13 +271,14 @@ export function createOidcProviders({ admission, db, config: input, clientIp, fe
       await store.unlink(id);
     },
     async links() {
-      return (await store.links()).map(({ keySet: _, keysFetchedAt: __, ...link }) => link);
+      const [links, health] = await Promise.all([store.links(), store.health()]);
+      return links.map(({ keySet: _, keysFetchedAt: __, ...link }) => ({ ...link, healthy: working(link, health) }));
     },
   });
 }
 
 // Exact routes only: /auth/oidc/<id>/start and /auth/oidc/<id>/callback.
-export function createOidcHandler(oidc) {
+export function createOidcHandler(oidc, { signInPath = oidc.signInPath ?? '/signin' } = {}) {
   return async request => {
     const path = new URL(request.url).pathname;
     const callbackId = oidc.callbackPaths?.[path];
@@ -282,6 +301,6 @@ export function createOidcHandler(oidc) {
       else { const form = new URLSearchParams(text); check(form.getAll('returnTo').length <= 1); input = { returnTo: form.get('returnTo') ?? undefined }; }
       check(input && typeof input === 'object' && !Array.isArray(input));
       return oidc.begin(request, match[1], { returnTo: input.returnTo });
-    } catch (e) { return Response.json({ error: e instanceof OidcError ? e.code : 'oidc_invalid_input' }, { status: e instanceof OidcError ? e.status : 400, headers: securityHeaders() }); }
+    } catch (e) { return errorResponse(e instanceof OidcError ? e : new OidcError('oidc_invalid_input'), { signInPath }, request); }
   };
 }

package/modules/operator-auth/identity/oidc/network.mjs

@@ -7,10 +7,13 @@ import { clientAssertion } from './client-auth.mjs';
 // or its name does not resolve (a resolver error, or the 530 a Cloudflare
 // Worker receives for an origin DNS failure).
 export class ProviderUnreachable extends OidcError { constructor() { super('oidc_provider_unavailable', 502); this.hard = true; } }
+// A rejected authorization code says nothing about the registration's health.
+// Only a bounded, valid token-endpoint HTTP 400 response can produce this type.
+export class GrantRejected extends OidcError { constructor() { super('oidc_invalid_response'); } }
 const dnsFailure = error => /\b(?:dns|getaddrinfo|enotfound|eai_again|name not resolved|could not resolve)\b/i.test(String(error?.message ?? error));
 
 // The deadline includes stream consumption; redirects never forward credentials.
-export async function readJson(fetcher, uri, settings, init = {}, maxBytes = 65536) {
+export async function readJson(fetcher, uri, settings, init = {}, maxBytes = 65536, tokenExchange = false) {
   const controller = new AbortController();
   let timer, hard = false;
   const deadline = new Promise((_, reject) => { timer = setTimeout(() => { controller.abort(); reject(new Error('deadline')); }, settings.timeoutMs); });
@@ -22,7 +25,7 @@ export async function readJson(fetcher, uri, settings, init = {}, maxBytes = 655
       catch (error) { hard = dnsFailure(error); throw error; }
       check(response.status < 300 || response.status >= 400, 'oidc_provider_redirect', 502);
       if (response.status === 404 || response.status === 530) hard = true;
-      check(response.status === 200 && !response.redirected && (!response.url || response.url === uri), 'oidc_provider_unavailable', 502);
+      check((response.status === 200 || tokenExchange && response.status === 400) && !response.redirected && (!response.url || response.url === uri), 'oidc_provider_unavailable', 502);
       check(/^application\/(?:[a-z0-9.+-]+\+)?json(?:\s*;|$)/i.test(response.headers.get('content-type') ?? ''), 'oidc_provider_unavailable', 502);
       const length = response.headers.get('content-length');
       check(!length || /^\d+$/.test(length) && Number(length) <= maxBytes, 'oidc_provider_unavailable', 502);
@@ -34,9 +37,11 @@ export async function readJson(fetcher, uri, settings, init = {}, maxBytes = 655
       for (const chunk of chunks) { bytes.set(chunk, offset); offset += chunk.byteLength; }
       const body = JSON.parse(new TextDecoder('utf-8', { fatal: true }).decode(bytes));
       check(body && typeof body === 'object' && !Array.isArray(body), 'oidc_provider_unavailable', 502);
+      if (response.status === 400 && body.error === 'invalid_grant') throw new GrantRejected();
+      check(response.status === 200, 'oidc_provider_unavailable', 502);
       return body;
     })()]);
-  } catch { if (hard) throw new ProviderUnreachable(); fail('oidc_provider_unavailable', 502); }
+  } catch (error) { if (error instanceof GrantRejected) throw error; if (hard) throw new ProviderUnreachable(); fail('oidc_provider_unavailable', 502); }
   finally { clearTimeout(timer); controller.abort(); if (reader) void reader.cancel().catch(() => {}); }
 }
 
@@ -86,7 +91,7 @@ export async function exchange(fetcher, link, provider, settings, code, verifier
     form.set('client_assertion_type', 'urn:ietf:params:oauth:client-assertion-type:jwt-bearer');
     form.set('client_assertion', await clientAssertion(provider, link, now));
   }
-  const response = await readJson(fetcher, link.token, settings, { method: 'POST', headers, body: form.toString() });
+  const response = await readJson(fetcher, link.token, settings, { method: 'POST', headers, body: form.toString() }, 65536, true);
   check(!Object.hasOwn(response, 'error') && typeof response.id_token === 'string' && (response.access_token === undefined || typeof response.access_token === 'string' && /^[\x21-\x7e]+$/.test(response.access_token))
     && (response.token_type === undefined && response.access_token === undefined || typeof response.token_type === 'string' && response.token_type.toLowerCase() === 'bearer'));
   return response;

package/modules/operator-auth/identity/oidc/store.mjs

@@ -10,6 +10,8 @@ function link(row) {
 }
 
 export function storage(db) {
+  const pruneExchange = id => db.prepare(`DELETE FROM oa_identity_provider_health WHERE provider_id LIKE ? AND provider_id NOT IN
+    (SELECT 'exchange:' || provider_id || ':' || linked_at FROM oa_identity_providers WHERE provider_id=? AND status='linked')`).bind(`exchange:${id}:%`, id);
   const guarded = async operation => { try { return await operation(); } catch { fail('oidc_storage_unavailable', 503); } };
   return {
     async limit(bucket, expiresAt, maximum) {
@@ -37,10 +39,10 @@ export function storage(db) {
     },
     // A re-link the owner approved: the configured provider replaces the pin.
     async relink(id, provider, metadata, now) {
-      return guarded(() => db.prepare(`UPDATE oa_identity_providers SET preset=?,status='linked',issuer=?,client_id=?,jwks_uri=?,authorization_endpoint=?,token_endpoint=?,algorithms=?,token_auth_method=?,
+      return guarded(() => db.batch([db.prepare(`UPDATE oa_identity_providers SET preset=?,status='linked',issuer=?,client_id=?,jwks_uri=?,authorization_endpoint=?,token_endpoint=?,algorithms=?,token_auth_method=?,
         response_iss=?,interface_version=?,linked_at=MAX(linked_at+1,?),pending_issuer=NULL,pending_client_id=NULL,pending_preset=NULL,pending_at=NULL,jwks=NULL,jwks_fetched_at=NULL
         WHERE provider_id=?`).bind(provider.preset, metadata.issuer, provider.clientId, metadata.jwks, metadata.authorization, metadata.token, JSON.stringify(metadata.algorithms), provider.tokenAuthMethod,
-        metadata.responseIssuer ? 1 : 0, metadata.interfaceVersion, now, id).run());
+        metadata.responseIssuer ? 1 : 0, metadata.interfaceVersion, now, id), pruneExchange(id)]));
     },
     // A changed configuration only records what a re-link would pin.
     pending(id, provider, now) {
@@ -48,10 +50,24 @@ export function storage(db) {
         WHERE provider_id=? AND (pending_issuer IS NOT ? OR pending_client_id IS NOT ? OR pending_preset IS NOT ?)`).bind(provider.issuer, provider.clientId, provider.preset, now, id, provider.issuer, provider.clientId, provider.preset).run());
     },
     clearPending(id) { return guarded(() => db.prepare('UPDATE oa_identity_providers SET pending_issuer=NULL,pending_client_id=NULL,pending_preset=NULL,pending_at=NULL WHERE provider_id=?').bind(id).run()); },
-    unlink(id) { return guarded(() => db.prepare("UPDATE oa_identity_providers SET status='unlinked' WHERE provider_id=?").bind(id).run()); },
+    unlink(id) { return guarded(() => db.batch([db.prepare("UPDATE oa_identity_providers SET status='unlinked' WHERE provider_id=?").bind(id), pruneExchange(id)])); },
     keys(pin, keySet, now) {
       return guarded(() => db.prepare("UPDATE oa_identity_providers SET jwks=?,jwks_fetched_at=? WHERE provider_id=? AND status='linked' AND issuer=? AND client_id=? AND linked_at=?").bind(JSON.stringify(keySet), now, pin.id, pin.issuer, pin.clientId, pin.linkedAt).run());
     },
+    // Reuse the existing health schema with a reserved phase/generation key.
+    // A late callback can neither overwrite a replacement pin's proof nor retain
+    // stale generations. The pin fence is evaluated by SQL at write time.
+    exchangeHealth(pin, healthy, hard, now) {
+      const key = `exchange:${pin.id}:${pin.linkedAt}`;
+      return guarded(() => db.batch([
+        pruneExchange(pin.id),
+        db.prepare(`INSERT INTO oa_identity_provider_health(provider_id,failing_since,hard_failure_at,checked_at)
+          SELECT ?,?,?,? WHERE EXISTS(SELECT 1 FROM oa_identity_providers WHERE provider_id=? AND status='linked' AND issuer=? AND client_id=? AND linked_at=?)
+          ON CONFLICT(provider_id) DO UPDATE SET failing_since=CASE WHEN ? THEN NULL ELSE COALESCE(failing_since,excluded.failing_since) END,
+          hard_failure_at=CASE WHEN ? THEN NULL ELSE COALESCE(excluded.hard_failure_at,hard_failure_at) END,checked_at=excluded.checked_at`)
+          .bind(key, healthy ? null : now, !healthy && hard ? now : null, now, pin.id, pin.issuer, pin.clientId, pin.linkedAt, Number(healthy), Number(healthy)),
+      ]));
+    },
     async health() {
       return guarded(async () => new Map((await db.prepare('SELECT provider_id AS id,failing_since AS failingSince,hard_failure_at AS hardFailureAt,checked_at AS checkedAt FROM oa_identity_provider_health').all()).results.map(r => [r.id, r])));
     },

package/modules/operator-auth/index.d.mts

@@ -124,10 +124,12 @@ export interface ProviderEntry { id: string; label: string; preset: ProviderPres
 export interface ProviderLink {
   id: string; preset: ProviderPreset; status: 'linked' | 'unlinked'; issuer: string; clientId: string; jwks: string; authorization: string; token: string;
   algorithms: Array<'ES256' | 'RS256'>; tokenAuthMethod: string; responseIssuer: boolean; interfaceVersion: string | null; linkedAt: number;
+  healthy?: boolean;
   pendingIssuer: string | null; pendingClientId: string | null; pendingPreset: string | null; pendingAt: number | null;
 }
 export interface IdentityProviders {
   readonly ids: readonly string[];
+  readonly signInPath?: string;
   readonly callbackPaths?: Readonly<Record<string, string>>;
   begin(request: Request, id: string, input?: { returnTo?: string }): Promise<Response>;
   callback(request: Request, id: string): Promise<Response>;

package/modules/operator-auth/page.mjs

@@ -15,8 +15,8 @@ function stylesheet(accentColor) {
   return `:root{color-scheme:light;font-family:system-ui,-apple-system,BlinkMacSystemFont,"Segoe UI",sans-serif;color:#172033;background:#f3f5f8}*{box-sizing:border-box}body{margin:0;min-height:100vh;padding:32px 20px;display:grid;place-items:center}main{width:100%;max-width:480px;background:#fff;border:1px solid #dce2ea;border-radius:20px;padding:36px;box-shadow:0 12px 40px #1720330a;overflow-wrap:anywhere}.brand{font-size:14px;font-weight:650;line-height:1.5;margin:0 0 32px;color:#475569}.mark{display:block;width:32px;height:6px;border-radius:3px;border:1px solid currentColor;background:${accentColor};margin-bottom:16px}h1,h2{text-wrap:balance}h1{font-size:30px;line-height:1.3;letter-spacing:-.02em;margin:0 0 24px;font-weight:700}p{font-size:16px;line-height:1.6;margin:0 0 24px;color:#475569;text-wrap:pretty}form{margin:0}button,.action{display:block;width:100%;border:1px solid #64748b;border-radius:10px;background:${accentColor};color:${accentInk(accentColor)};padding:13px 18px;font:inherit;font-weight:650;text-align:center;text-decoration:none;cursor:pointer;line-height:1.5}button:hover,.action:hover{box-shadow:inset 0 0 0 2px currentColor}button:focus-visible,.action:focus-visible{outline:3px solid #172033;outline-offset:4px}@media(max-width:480px){body{padding:24px 16px}main{padding:28px 24px}h1{font-size:28px}}@media(prefers-color-scheme:dark){:root{color-scheme:dark;background:#111827;color:#f8fafc}main{background:#1e293b;border-color:#475569;box-shadow:none}.brand,p{color:#cbd5e1}button:focus-visible,.action:focus-visible{outline-color:#f8fafc}}`;
 }
 
-// Form controls and notices used by the sign-in page; part of the same hashed sheet.
-const FORMS = `label{display:block;font-weight:600;margin:0 0 8px}input{display:block;width:100%;margin:0 0 16px;padding:12px 14px;border:1px solid #64748b;border-radius:10px;font:inherit;line-height:1.5;color:inherit;background:transparent}input:focus-visible{outline:3px solid #172033;outline-offset:2px}.stack{display:grid;gap:12px;margin:0 0 24px}button.secondary{background:transparent;color:inherit}.divider{display:flex;align-items:center;gap:12px;margin:0 0 24px;color:#475569;font-size:14px}.divider::before,.divider::after{content:"";flex:1;border-top:1px solid #dce2ea}.notice{border-left:4px solid #64748b;padding:8px 12px;margin:0 0 24px}h2{font-size:20px;line-height:1.4;margin:32px 0 16px}.secondary-link{margin:16px 0 0;text-align:center;font-size:15px}.secondary-link a{display:inline-block;min-width:24px;min-height:24px;color:#334155;font-weight:600;text-decoration:underline;text-decoration-thickness:1px;text-underline-offset:3px}.secondary-link a:hover{text-decoration-thickness:2px}.secondary-link a:focus-visible{outline:3px solid #172033;outline-offset:2px;border-radius:2px}@media(prefers-color-scheme:dark){input:focus-visible,.secondary-link a:focus-visible{outline-color:#f8fafc}.divider{color:#cbd5e1}.divider::before,.divider::after{border-color:#475569}.secondary-link a{color:#cbd5e1}}`;
+// Form controls and notices used by the sign-in and settings pages; part of the same hashed sheet.
+const FORMS = `label{display:block;font-weight:600;margin:0 0 8px}input{display:block;width:100%;margin:0 0 16px;padding:12px 14px;border:1px solid #64748b;border-radius:10px;font:inherit;line-height:1.5;color:inherit;background:transparent}input:focus-visible{outline:3px solid #172033;outline-offset:2px}.stack{display:grid;gap:12px;margin:0 0 24px}.check{display:flex;align-items:center;gap:12px;margin:0 0 24px}.check input{width:20px;height:20px;margin:0;padding:0;flex:none}button.secondary{background:transparent;color:inherit}.divider{display:flex;align-items:center;gap:12px;margin:0 0 24px;color:#475569;font-size:14px}.divider::before,.divider::after{content:"";flex:1;border-top:1px solid #dce2ea}.notice{border-left:4px solid #64748b;padding:8px 12px;margin:0 0 24px}h2{font-size:20px;line-height:1.4;margin:32px 0 16px}.secondary-link{margin:16px 0 0;text-align:center;font-size:15px}.secondary-link a{display:inline-block;min-width:24px;min-height:24px;color:#334155;font-weight:600;text-decoration:underline;text-decoration-thickness:1px;text-underline-offset:3px}.secondary-link a:hover{text-decoration-thickness:2px}.secondary-link a:focus-visible{outline:3px solid #172033;outline-offset:2px;border-radius:2px}@media(prefers-color-scheme:dark){input:focus-visible,.secondary-link a:focus-visible{outline-color:#f8fafc}.divider{color:#cbd5e1}.divider::before,.divider::after{border-color:#475569}.secondary-link a{color:#cbd5e1}}`;
 
 export async function pageResponse({ branding, title, heading, content, status = 200, method = 'GET', referrer, formTargets = [] }) {
   const css = stylesheet(branding.accentColor) + FORMS + (branding.theme ? themed(branding.accentColor) : '');

package/modules/operator-auth/routes.mjs

@@ -19,7 +19,7 @@ function notice(auth, code, extra = {}) {
 
 /** Fetch-compatible optional HTTP adapter. Returns null for paths it does not own. */
 export function createAuthHandler(auth) {
-  const oidc = auth.providers ? createOidcHandler(auth.providers) : null;
+  const oidc = auth.providers ? createOidcHandler(auth.providers, { signInPath: auth.presentation.signInPath }) : null;
   return async function handleAuth(request) {
     const url = new URL(request.url);
     const path = url.pathname;
@@ -42,7 +42,7 @@ export function createAuthHandler(auth) {
       if (path === '/auth/operators' && request.method === 'GET') return json(await auth.listOperators(request));
       if (path === '/auth/sessions' && request.method === 'GET') return json(await auth.listSessions(request, readParameters(url.searchParams).operatorId));
       if (path === '/auth/domain-rules' && request.method === 'GET') return json(await auth.listDomainRules(request));
-      if (path === '/auth/settings/identity' && request.method === 'GET') {const value=await auth.identitySettings(request);return /text\/html/.test(request.headers.get('accept')??'')?identitySettingsPage(value):json(value);}
+      if (path === '/auth/settings/identity' && request.method === 'GET') {const value=await auth.identitySettings(request);return /text\/html/.test(request.headers.get('accept')??'')?await identitySettingsPage(value,auth.presentation):json(value);}
       if (path === '/auth/providers' && request.method === 'GET') return json(await auth.listProviders(request));
       const posts = new Set(['/auth/bootstrap', '/auth/magic-link', '/auth/confirm', '/auth/signout', '/auth/invite', '/auth/invite/cancel', '/auth/review-session',
         '/auth/operator/status', '/auth/operator/role', '/auth/session/revoke', '/auth/step-up', '/auth/domain-rules', '/auth/providers/unlink', '/auth/providers/relink', '/auth/settings/identity', '/auth/setup-complete']);

package/modules/portability/README.md

@@ -32,6 +32,43 @@ schema at construction. Apply the bookkeeping migration first. Policy fields:
 | `extraPayloads` | Named `{produce,consume}` pairs. Producers return bytes or a byte stream. Consumers receive a verified byte stream and descriptor before D1 commit. |
 | `partBytes` | Maximum part size, default 16 MiB, configurable from 1 KiB to 16 MiB. |
 
+Archives always skip Base's own tables: SQLite and Cloudflare internals, the
+migration ledgers (`d1_migrations`, `_rer_deploy_migrations`,
+`_rer_portability_migrations`), portability bookkeeping, development outboxes,
+operator identity and dependency secrets. `excludedTables` lists them (exact
+names, or prefixes ending in `%`), and `excludedTable(name, policy)` says whether
+an archive under that policy skips a table. A seed's own table inventory, which
+refuses tables it does not know, uses the same predicate, so it does not refuse a
+table Base created and never archives.
+
+For native local CLI transfers, declare executable policy through
+`localPortability({database, buckets, policyModule})`. `policyModule` is a
+seed-root-relative path or a `file:` URL (including `new URL('./archive-policy.mjs',
+import.meta.url)` in the seed adapter). Its real path must be a file inside the
+seed root, and its **default export** must be the policy object:
+
+```js
+const allowedDomains = new Set(['example.org']);
+export default {
+  product: 'my-product',
+  validateStaged: async ({read}) =>
+    (await read('contacts')).every(row => allowedDomains.has(row.domain)),
+};
+```
+
+The runner validates the module/export before applying data migrations. The
+native transfer worker imports that same seed-owned entry point, preserving
+functions and module-local closures. Modules should have no top-level effects:
+preflight and transfer each load them in a separate process. Archive metadata
+never selects executable policy. Invalid paths, missing/invalid default exports,
+and declaring both `policy` and `policyModule` fail closed. Serializable object
+`policy` declarations remain supported; inline functions (including nested
+schema-upgrade and payload callbacks) are refused instead of being dropped by
+JSON transport. Container transfer currently refuses `policyModule` explicitly;
+it continues to accept serializable object policies. Malformed primary or later
+journal JSON is reported once as `archive_json` with exit 2, before local data
+migrations, without echoing archive content or parser diagnostics.
+
 Default exclusions are `sqlite_%`, `_cf_%`, `d1_migrations`,
 `rer_portability_%`, `rer_mail_development_outbox`, `oa_%`, `oc_%`,
 `rer_dependency_keys`, `rer_dependency_pending` and `rer_dependency_codes`.

package/modules/portability/bridge.mjs

@@ -3,12 +3,19 @@ import { canonicalJson } from './hash.mjs';
 import { tokens, identifier, folded } from './generated.mjs';
 import { changesData } from './migration-statements.mjs';
 
-// Applied product migrations in the ledger's own order: the deploy ledger when
-// present (it covers any older Wrangler history), else Wrangler's.
+// Applied product migrations in the ledger's own order. A state-bearing D1
+// ledger may hold an unacknowledged migration whose effects are unknown; neither
+// an archive nor a restore can attest its history until that is resolved.
 export async function appliedMigrations(db) {
   const ledgers=(await all(db,"SELECT name FROM sqlite_master WHERE type='table' AND name IN ('_rer_deploy_migrations','d1_migrations')")).map(x=>x.name);
   if(ledgers.includes('_rer_deploy_migrations'))return (await all(db,"SELECT name FROM _rer_deploy_migrations WHERE state='applied' ORDER BY name")).map(x=>x.name);
-  return ledgers.includes('d1_migrations')?(await all(db,'SELECT name FROM d1_migrations ORDER BY id')).map(x=>x.name):undefined;
+  if(!ledgers.includes('d1_migrations'))return;
+  const columns=(await all(db,'PRAGMA table_info(d1_migrations)')).map(x=>x.name);
+  const tracked=columns.includes('state') || columns.includes('sha256');
+  if(tracked)insist(columns.includes('state') && columns.includes('sha256'),'schema_mismatch:migration_history',409);
+  const rows=await all(db,`SELECT name${tracked?',state':''} FROM d1_migrations ORDER BY id`);
+  if(tracked)insist(rows.every(row=>row.state==='applied'),'schema_mismatch:uncertain_migrations',409);
+  return rows.map(row=>row.name);
 }
 // Where an archive sits in the destination's applied migrations: those its
 // rows passed through (earlier) and those applied after it (unapplied).
@@ -47,10 +54,13 @@ async function placement(db,manifest,cat,replay,applied) {
 // migrations that changed only data (a purge or a backfill) or added an index.
 // Those that change restorable data are refused like any other. Without a
 // replayer the statements cannot be read, so an archive whose recorded
-// migrations the destination's ledger has outgrown is refused.
+// migrations the destination's ledger has outgrown is refused. An archive that
+// records a migration the destination never applied is newer than it, even
+// when that migration left the schema as it was (an index, a data change).
 export async function sameSchemaMigrations(db,manifest,cat,migrations) {
   const applied=await appliedMigrations(db);
   if(!applied)return;
+  insist(!manifest.migrations || manifest.migrations.every(name=>applied.includes(name)),'schema_mismatch:migrations');
   if(!migrations){insist(!manifest.migrations || applied.every(name=>manifest.migrations.includes(name)),'schema_mismatch:migrations');return;}
   await placement(db,manifest,cat,await migrations(),applied);
 }