@runeditrun/rer 0.2.1 → 0.2.4

package/modules/portability/catalogue.mjs

@@ -1,6 +1,10 @@
 import { all, insist, quote, PortabilityError } from './storage.mjs';
 import { canonicalJson, sha256, base64, unbase64, utf8 } from './hash.mjs';
-const defaults=['sqlite_%','_cf_%','d1_migrations','_rer_deploy_migrations','_rer_portability_migrations','rer_portability_%','rer_mail_development_outbox','rer_ai_development_outbox','oa_%','oc_%','rer_dependency_keys','rer_dependency_pending','rer_dependency_codes'];
+/** Tables no archive carries: SQLite/Cloudflare internals, migration ledgers,
+ * portability bookkeeping, development outboxes, operator identity and dependency
+ * secrets. Exact names, or prefixes ending in `%`. Seeds' own table inventories
+ * skip the same tables through `excludedTable`. */
+export const excludedTables=Object.freeze(['sqlite_%','_cf_%','d1_migrations','_rer_deploy_migrations','_rer_portability_migrations','rer_portability_%','rer_mail_development_outbox','rer_ai_development_outbox','oa_%','oc_%','rer_dependency_keys','rer_dependency_pending','rer_dependency_codes']);
 const fields=['product','excludeTables','includeTables','derivedTables','secretColumns','exportRow','replaceableTables','requiredConfiguration','validateStaged','acceptedSchemas','buckets','extraPayloads','partBytes'];
 const name=value=>typeof value==='string' && value.length>0 && value.length<=512 && !/[\x00-\x1f]/.test(value);
 const names=value=>Array.isArray(value) && value.every(name) && new Set(value).size===value.length;
@@ -19,10 +23,13 @@ export function policy(input) {
   }
   for(const [key,entry] of Object.entries(result.extraPayloads)) insist(name(key) && typeof entry.produce==='function' && typeof entry.consume==='function','invalid_extra_payload');
   for(const key of ['secretColumns','acceptedSchemas','buckets','extraPayloads'])result[key]=Object.assign(Object.create(null),result[key]);
-  return {...result,excludeTables:[...defaults,...result.excludeTables]};
+  return {...result,excludeTables:[...excludedTables,...result.excludeTables]};
 }
 const identifier=value=>value.replace(/[A-Z]/g,letter=>letter.toLowerCase());
 const matches=(table,pattern)=>pattern.endsWith('%') ? identifier(table).startsWith(identifier(pattern.slice(0,-1))) : identifier(table)===identifier(pattern);
+/** True when no archive carries `table`: one of Base's `excludedTables`, or one of
+ * the policy's own `excludeTables`, unless the policy includes it explicitly. */
+export const excludedTable=(table,input={})=>!(input.includeTables??[]).includes(table) && [...excludedTables,...(input.excludeTables??[])].some(pattern=>matches(table,pattern));
 async function archived(db,config) {
   const objects=await all(db,"SELECT name,sql,type,tbl_name FROM sqlite_master WHERE sql IS NOT NULL ORDER BY name");
   const kinds=await all(db,'PRAGMA table_list');

package/modules/portability/import.mjs

@@ -8,11 +8,13 @@ import { fence, mergeJournal, tombstone } from './journal.mjs';
 import { writeObject } from './payloads.mjs';
 import { createCopy,sidecar,readCopy,restoreCopy } from './copies.mjs';
 import { excludedDependentGuards } from './restore-safety.mjs';
-import { additiveBridge, sameSchemaMigrations } from './bridge.mjs';
+import { additiveBridge, sameSchemaMigrations, appliedMigrations } from './bridge.mjs';
 import { legacyEmptyGuards, legacyAuditStatements, requireLegacyEmpty } from './legacy-safety.mjs';
 export async function createImport(context,manifest,actor='direct',legacyRecovery) {
-  const {db,config,buckets}=context;await checkManifest(manifest);await state(db);
+  const {db,config,buckets}=context;await checkManifest(manifest);
   insist(manifest.product===config.product,'wrong_product');
+  // Explicit schema upgrades can reconcile rows, but cannot attest an interrupted deployment.
+  await appliedMigrations(db);await state(db);
   const cat=await catalogue(db,config),upgrade=config.acceptedSchemas[manifest.schema];
   const same=manifest.schema===cat.identity;
   const bridge=same || upgrade?undefined:await additiveBridge(db,manifest,cat,context.migrations);

package/modules/portability/index.d.mts

@@ -54,5 +54,9 @@ export function makePart(index:number,items:Item[]):Promise<Part>;
 export function canonicalJson(value:unknown):string;
 export function sha256(value:string|Uint8Array):Promise<string>;
 export const MAX_LINE_BYTES:number;
+/** Tables no archive carries (exact names, or prefixes ending in `%`). */
+export const excludedTables:readonly string[];
+/** True when no archive under this policy carries `table`. */
+export function excludedTable(table:string,policy?:Pick<ArchivePolicy,'excludeTables'|'includeTables'>):boolean;
 export const MAX_PART_BYTES:number;
 export class PortabilityError extends Error {code:string;status:number;constructor(code:string,status?:number)}

package/modules/portability/index.mjs

@@ -4,6 +4,7 @@ import { createExport, advanceExport, exportStatus, downloadExport, abortExport
 import { createImport, uploadPart, finalizeImport, importStatus, abortImport } from './import.mjs';
 import { erasureStatements, redactionStatements, invalidateTransfersStatements } from './journal.mjs';
 export { archiveLines } from './lines.mjs';
+export { excludedTables, excludedTable } from './catalogue.mjs';
 export { readArchive, makePart, MAX_LINE_BYTES, MAX_PART_BYTES } from './format.mjs';
 export { canonicalJson, sha256 } from './hash.mjs';
 export { PortabilityError } from './storage.mjs';

package/modules/portability/lines.mjs

@@ -14,7 +14,9 @@ export async function* archiveLines(source, maxLineBytes) {
     buffer.set(fragment, bytes); bytes = required;
   }
   function line() {
-    const value = decoder.decode(buffer.subarray(0, bytes)); bytes = 0;
+    // Invalid UTF-8 is malformed archive text: the same constant diagnostic as invalid JSON.
+    let value; try { value = decoder.decode(buffer.subarray(0, bytes)); } catch { throw new Error('archive_json'); }
+    bytes = 0;
     return value.endsWith('\r') ? value.slice(0, -1) : value;
   }
   try {

package/modules/release/produce.mjs

@@ -39,7 +39,7 @@ export async function release({ repo, ref = 'HEAD', output, project, repository,
     git(checkout, 'checkout', '--detach', source.commit);
     // Honour the seed's committed install policy. Base's native-build settings
     // are not interchangeable with pnpm 8's locked onlyBuiltDependencies.
-    const install = await command('pnpm', ['install', '--frozen-lockfile'], checkout);
+    const install = await command('pnpm', ['install', '--frozen-lockfile'], checkout, { dependencies: true });
     const verify = install.status === 'PASS' ? await command('pnpm', ['run', 'verify'], checkout) : { status: 'FAIL', reason: 'frozen-install-failed', tests: 0, passed: 0, failed: 0, output: install.output };
     // Release-only scale and capacity cases stay outside routine CI. The
     // committed seed script is an additional gate in previews and releases.

package/modules/release/source.mjs

@@ -68,12 +68,15 @@ function failureTail(logs) {
   return bytes.subarray(Math.max(0, bytes.length - TAIL_BYTES)).toString('utf8').replace(/^\uFFFD+/, '');
 }
 
-export async function command(command, args, cwd) {
+// A dependency install runs code the seed did not write, so it gets the
+// shared credential-free environment; the seed's own verify keeps the caller's.
+export async function command(command, args, cwd, { dependencies = false } = {}) {
  const {createCommands}=await shared('commands.mjs');
+ const inherited=dependencies?(await shared('dependency-environment.mjs')).dependencyEnvironment():process.env;
  const directory=await mkdtemp(resolve(tmpdir(),'rer-release-'));
  const state={logs:[]};
  const store=await createCommands(directory,state,{terminal:()=>{},queue:{verb:'release'}});
- const summary=testSummary(),env={...process.env,FORCE_COLOR:'0'};delete env.NODE_TEST_CONTEXT;
+ const summary=testSummary(),env={...inherited,FORCE_COLOR:'0'};delete env.NODE_TEST_CONTEXT;
  try {
   await store.run('Release verification',command,args,{cwd,env,onChild:child=>child.stdout.on('data',bytes=>summary.write(bytes))});
   return {status:'PASS',exitCode:0,...summary.finish()};

package/onboarding/adapter-labels.mjs

@@ -9,5 +9,6 @@ export const labels = Object.freeze({
  signIn: 'Opening sign-in through the development outbox',
  hosting: 'Deploying to your Cloudflare account',
  complete: 'Your application is running locally',
+ built: 'Your application is built',
 });
 

package/onboarding/adapter.mjs

@@ -7,6 +7,7 @@ import { buildEnvironment } from './local/environment.mjs';
 import { localOperation } from './local/operation.mjs';
 import { recoverInterrupted } from './local/recovery.mjs';
 import { credentialValues } from './redaction.mjs';
+import { dependencyEnvironment } from './dependency-environment.mjs';
 import { labels } from './adapter-labels.mjs';
 import { chooseOrigin, prepareSettings, readSettings } from './adapter-settings.mjs';
 import {listenerPorts} from './process-diagnostics.mjs';
@@ -66,9 +67,12 @@ export function localInstaller(hooks = {}) {
   if (['dev','preview'].includes(verb) && hooks.secrets?.originKey) context.vars[hooks.secrets.originKey] = context.origin;
   store.addSecrets?.(Object.entries(context.vars).filter(([key]) => /secret|token|password/i.test(key)).map(([, value]) => value));
   if (['installer', 'setup', 'build'].includes(verb) && hooks.build) await build(context, hooks);
-  if (['installer', 'setup'].includes(verb) && hooks.migrate) await phase(context, hooks, 'migrate', hooks.migrate);
+  // A demo (dev with options.demo) starts on fresh state in options.demo.state:
+  // migrate it, then claim the saved owner there exactly as setup does.
+  const demo = verb === 'dev' && Boolean(options.demo);
+  if ((['installer', 'setup'].includes(verb) || demo) && hooks.migrate) await phase(context, hooks, 'migrate', hooks.migrate);
   if (['installer', 'setup', 'dev', 'preview'].includes(verb) && hooks.start) await start(context, verb === 'preview' ? {...hooks,start:options.preview} : verb === 'dev' && options.dev ? { ...hooks, start: options.dev } : hooks);
-  if (['installer', 'setup'].includes(verb) && hooks.owner) {
+  if ((['installer', 'setup'].includes(verb) || demo) && hooks.owner) {
    if (typeof hooks.owner === 'function' || Array.isArray(hooks.owner)) await phase(context, hooks, 'owner', hooks.owner);
    else await owner(context, hooks.owner);
   }
@@ -78,7 +82,7 @@ export function localInstaller(hooks = {}) {
   if (verb === 'installer' && hooks.hosting) await hosting(context, hooks.hosting);
   store.state.appUrl = context.appUrl ?? (context.app ? context.origin : context.hostedUrl ?? context.origin);
   if (context.hostedUrl) store.state.hostedUrl = context.hostedUrl;
-  await store.step(labels.complete);
+  await store.step(verb === 'build' ? labels.built : labels.complete);
   await store.phase('complete');
   return context;
  }
@@ -157,7 +161,8 @@ async function commandsFor(context, hook) {
 async function phase(context, hooks, name, hook) {
  await context.store.step(labels[name]);
  for (const [command, args = [], options = {}] of await commandsFor(context, hook)) {
-  await context.run(labels[name], command, args, { step: steps[name], ...options });
+  // Dependency installs run third-party build scripts without credentials.
+  await context.run(labels[name], command, args, { step: steps[name], ...options, ...(name === 'dependencies' ? { env: dependencyEnvironment(options.env ?? process.env) } : {}) });
  }
 }
 

package/onboarding/commands.mjs

@@ -161,6 +161,8 @@ export async function createCommands(directory,state,{terminal=text=>writeSync(1
    const readinessSignal=signal&&options.signal?AbortSignal.any([signal,options.signal]):options.signal||signal;
    return waitForReadiness(label,child,health,{...options,signal:readinessSignal},capture,report,(step,detail)=>failure(step,detail,capture));
   },
-  async closeCommands(){await stopCommands();if(!closed){closed=true;await log.close();await policy.close();}}
+  // The log and the queue policy socket close even when a child's stop fails: an
+  // open policy socket keeps this process alive after its command has finished.
+  async closeCommands(){try{await stopCommands();}finally{if(!closed){closed=true;try{await log.close();}finally{await policy.close();}}}}
  };
 }

package/onboarding/dependency-environment.mjs

@@ -0,0 +1,33 @@
+// A dependency install runs code the seed did not write: the package manager
+// and every build script it allows (esbuild, workerd, sharp, oxide). It gets
+// only the variables an install needs, named below; every other variable,
+// whatever it is called, stays with the caller. The seed's own commands that
+// need credentials, such as deploy, still receive the whole environment.
+import { applicationBindings } from './local/environment.mjs';
+import { credentialName, credentialValue } from './redaction.mjs';
+
+// The shell, locale, terminal and temporary folders, Node's own settings, and
+// the SSH agent a git+ssh dependency is fetched through. Kept whatever their
+// value looks like: a directory may resemble a token.
+const system = /^(PATH|HOME|USER|LOGNAME|SHELL|TMPDIR|TMP|TEMP|TERM|LANG|LANGUAGE|LC_[A-Z]+|TZ|CI|SSH_AUTH_SOCK|NODE_OPTIONS|NODE_EXTRA_CA_CERTS|XDG_[A-Z_]+)$/;
+// The install reaches its registry through these; any user:password is dropped.
+const proxy = /^(https?_proxy|all_proxy|no_proxy)$/i;
+// Package manager settings and rer's control variables, except credentials.
+const settings = /^(npm_config_|PNPM_|COREPACK_|RER_)/i;
+// Credential words inside a name, also run together: NPM_CONFIG__AUTHTOKEN,
+// PNPM_REGISTRY_PASSWORD, RER_PREVIEW_TOKEN, RER_SIGNING_KEY.
+const credentialPart = /TOKEN|SECRET|PASSW(OR)?D|PASSPHRASE|CREDENTIAL|CREDS|JWT|COOKIE|WEBHOOK|SESSION|AUTH(?!OR)|(API|ACCESS|PRIVATE|SIGNING|ENCRYPTION|MASTER|LICENSE)_?KEY/i;
+
+// Up to the last @ of the authority, whatever the password holds (spaces included), after any leading whitespace.
+const withoutUserinfo = value => value.replace(/^\s*([a-z][a-z0-9+.-]*:\/\/)?[^/?#]*@/i, '$1');
+
+export function dependencyEnvironment(env = process.env) {
+ const kept = {};
+ for (const [key, value] of Object.entries(env)) {
+  if (value === undefined) continue;
+  if (system.test(key)) kept[key] = value;
+  else if (proxy.test(key)) kept[key] = withoutUserinfo(value);
+  else if (settings.test(key) && !(credentialName(key) || credentialPart.test(key) || applicationBindings.test(key) || credentialValue(value))) kept[key] = value;
+ }
+ return kept;
+}

package/onboarding/local/owner.mjs

@@ -27,7 +27,7 @@ export async function assertLocalOwner(root,email,failure=message=>Error(message
  if(!Array.isArray(owners)||owners.some(owner=>typeof owner!=='string'))throw failure('The localOwner hook must return existing owner email addresses without changing state.');
  if(owners.length&&!owners.some(owner=>owner.toLowerCase()===email.toLowerCase())){
   const address=safeOwner(owners[0]);
-  throw failure(`Local database already belongs to ${address}. Restore ${setting} to ${address}, then run rer setup --owner-email ${address}; or back up data and run rer reset --yes. Existing data and private settings were kept.`);
+  throw failure(`Local database already belongs to ${address}. Restore ${setting} to ${address}, then run rer setup --owner-email ${address}; or back up data, run rer dev --stop, then rer reset --yes followed by rer setup --owner-email ${safeOwner(email)}. Reset deletes local data. Existing data and private settings were kept.`);
  }
  return owners;
 }

package/onboarding/operator-installer.mjs

@@ -19,13 +19,16 @@ export function operatorInstaller({ database, features, prepare, prepareData })
    values: ({ origin }) => ({ AUTH_LOCAL: 'true', AUTH_ORIGIN: origin, MAIL_PROVIDER: 'development', MAIL_FROM: 'auth@localhost.test' }),
   },
   build: ['pnpm', ['run', 'build:app']],
-  migrate: ['pnpm', ['exec', 'wrangler', 'd1', 'migrations', 'apply', database, '--local', '--persist-to', '.wrangler/state', '--config', 'dist/server/wrangler.json']],
+  // A demo migrates its own fresh state folder, never the checkout's.
+  migrate: ({ demo }) => ['pnpm', ['exec', 'wrangler', 'd1', 'migrations', 'apply', database, '--local', '--persist-to', demo?.state ?? '.wrangler/state', '--config', 'dist/server/wrangler.json']],
   // Setup uses preview's production runtime behind the same public proxy.
   start: previewTarget,
   owner: { existingOwnerViaSignIn: true, displayName: input => input.displayName || 'Owner' },
   signIn: { emailKey: 'OWNER_EMAIL', returnTo: '/setup' },
  });
- return {...lifecycle,localPrerequisites:async({root,vars,email})=>vars.AUTH_LOCAL==='true'&&vars.MAIL_PROVIDER==='development'&&Boolean(vars.SESSION_SECRET)&&await operatorPrerequisites(root,email),install:(root,input,store,onApp,signal)=>installOperator(root,input,store,onApp,signal,lifecycle.hooks)};
+  // A demo migrates and claims the owner in its own state, so it never opens the
+ // checkout's database: even read-only, SQLite rewrites its -shm index.
+ return {...lifecycle,localPrerequisites:async({root,vars,email,demo})=>vars.AUTH_LOCAL==='true'&&vars.MAIL_PROVIDER==='development'&&Boolean(vars.SESSION_SECRET)&&(demo||await operatorPrerequisites(root,email)),install:(root,input,store,onApp,signal)=>installOperator(root,input,store,onApp,signal,lifecycle.hooks)};
 }
 
 // Only local runtimes receive the dev key; vite.config.ts passes it to `vite dev` alone.
@@ -33,7 +36,10 @@ export function operatorInstaller({ database, features, prepare, prepareData })
 // without the key. trafficProxy also refuses /cdn-cgi/* on the public listener.
 const devBindings = (devKey, devLogin) => devKey ? { RER_DEV_KEY: devKey, RER_DEV_IDENTITY: devLogin ? 'off' : 'on' } : {};
 const internalPort = port => { if (!Number.isInteger(port) || port < 1 || port > 65535) throw new Error('A local runtime requires the traffic proxy internal port.'); return String(port); };
-const developmentEnvironment = () => { const { RER_MODELS_SERVICE, RER_MODELS_KEY, ...env } = process.env; return env; };
-export const developmentTarget = ({ root, origin, runtimePort, devKey, devLogin, modelsLive }) => [process.execPath, [projectViteBinary(root), 'dev', '--host', '127.0.0.1', '--port', internalPort(runtimePort), '--strictPort'], { env: { ...developmentEnvironment(), PATH: join(root, 'node_modules', '.bin') + delimiter + (process.env.PATH ?? ''), RER_DEV_ORIGIN: origin, WRANGLER_SEND_METRICS: 'false', X_LOCAL_EXPLORER: 'false', ...devBindings(devKey, devLogin), ...(modelsLive ? { RER_MODELS_SERVICE: modelsLive.baseUrl, RER_MODELS_KEY: modelsLive.apiKey } : {}) } }];
+const developmentEnvironment = () => { const { RER_MODELS_SERVICE, RER_MODELS_KEY, RER_DEMO, RER_DEMO_EXPIRES, RER_STATE_DIR, ...env } = process.env; return env; };
+// A demo's Vite persists to its own folder (the seed's vite.config reads RER_STATE_DIR)
+// and its Worker sees RER_DEMO=1 and the demo's end (modules/demo).
+const demoBindings = demo => demo ? { RER_DEMO: '1', RER_DEMO_EXPIRES: demo.ends, RER_STATE_DIR: demo.state } : {};
+export const developmentTarget = ({ root, origin, runtimePort, devKey, devLogin, modelsLive, demo }) => [process.execPath, [projectViteBinary(root), 'dev', '--host', '127.0.0.1', '--port', internalPort(runtimePort), '--strictPort'], { env: { ...developmentEnvironment(), PATH: join(root, 'node_modules', '.bin') + delimiter + (process.env.PATH ?? ''), RER_DEV_ORIGIN: origin, WRANGLER_SEND_METRICS: 'false', X_LOCAL_EXPLORER: 'false', ...devBindings(devKey, devLogin), ...(modelsLive ? { RER_MODELS_SERVICE: modelsLive.baseUrl, RER_MODELS_KEY: modelsLive.apiKey } : {}), ...demoBindings(demo) } }];
 
 export const previewTarget = ({ origin, runtimePort, devKey, scheduled }) => [process.execPath, [fileURLToPath(new URL('./production-runtime.mjs', import.meta.url))], { env: { ...process.env, RER_DEV_ORIGIN: origin, RER_RUNTIME_HOST: '127.0.0.1', RER_RUNTIME_PORT: internalPort(runtimePort), WRANGLER_SEND_METRICS: 'false', CLOUDFLARE_INCLUDE_PROCESS_ENV: 'false', X_LOCAL_EXPLORER: 'false', RER_RUNTIME_TRIGGERS: scheduled ? '1' : '0', ...(devKey ? { RER_DEV_KEY: devKey } : {}) } }];

package/onboarding/redaction.mjs

@@ -35,7 +35,9 @@ const DOUBLE_QUOTED = /"(?:\\[^\r\n]|[^"\\\r\n])*(?:\\(?=[\r\n]|$))?/.source;
 const SINGLE_QUOTED = /'(?:\\[^\r\n]|[^'\\\r\n])*(?:\\(?=[\r\n]|$))?/.source;
 const PRIVATE_VALUE = `(?:${DOUBLE_QUOTED}(?:"|(?=[\\r\\n]|$))|${SINGLE_QUOTED}(?:'|(?=[\\r\\n]|$))|[^\\s"'<>;&]+)`;
 const FIELD_VALUE = '["\']?\\s*[=:]\\s*' + NOT_FLAG + PRIVATE_VALUE;
-const CLI_PREFIX = '(?<![A-Za-z0-9_-])--(?:[A-Za-z0-9]+[_-])*';
+// These deploy flags take a binding name, never the secret value. Explicitly
+// registered private bytes remain redacted by the exact-value pass.
+const CLI_PREFIX = '(?<![A-Za-z0-9_-])--(?!(?:set|unset)-secret(?:\\s|$))(?:[A-Za-z0-9]+[_-])*';
 const CLI_ARGUMENT = CLI_PREFIX + '(' + FIELD_NAME + ')\\s+' + NOT_FLAG + '(' + PRIVATE_VALUE + ')';
 // A bare Bearer/Basic value must look like a credential, not the next word of
 // prose such as "Basic checks passed"; after Authorization any value is private.
@@ -57,9 +59,12 @@ const COOKIE_HEADER = '(?<![A-Za-z0-9_-])(?:Set-)?Cookie["\']?\\s*:\\s*(?:[^\\s=
 const SCHEME = '(?<![a-z0-9+.-])[a-z][a-z0-9+.-]*://';
 const USERINFO = SCHEME + '([^\\s/?#"<>`]*)@';
 const SLASHED_USERINFO = SCHEME + '([^\\s/?#:@"<>`\\[\\]]*:(?![0-9]*(?:[/?#\\s"<>`]|$))(?=(?<password>[^\\s"<>`@]{0,128}))\\k<password>)@';
+// Provider token formats recognisable by their prefix alone.
+const TOKEN_PREFIX = '(?:gh[pousr]_|github_pat_|sk-(?:proj-)?|sk_live_|sk_test_|rk_live_|rk_test_|pk_live_|whsec_|SG\\.|xox[baprs]-|AKIA|ASIA|AIza|npm_|glpat-|pypi-|hf_|re_)';
+const KNOWN_TOKEN = '(?<![A-Za-z0-9_])' + TOKEN_PREFIX + '[A-Za-z0-9_./+=-]+';
 const PATTERNS = new RegExp('(?:' + [
  AUTH_HEADER, BARE_AUTH,
- '(?<![A-Za-z0-9_])(?:gh[pousr]_|github_pat_|sk-(?:proj-)?|sk_live_|sk_test_|rk_live_|rk_test_|pk_live_|whsec_|SG\\.|xox[baprs]-|AKIA|ASIA|AIza|npm_|glpat-|pypi-|hf_|re_)[A-Za-z0-9_./+=-]+',
+ KNOWN_TOKEN,
  FIELD + FIELD_VALUE, COOKIE_HEADER,
  USERINFO, SLASHED_USERINFO,
 ].join('|') + ')', 'gi');
@@ -287,12 +292,26 @@ export function createRedaction({mask = MASK} = {}) {
  return {addSecrets,redact,stream};
 }
 
+// A variable whose name marks a credential, or whose value is a URL carrying one.
+export const credentialName = key => CREDENTIAL_NAME.test(key) || CAMEL_CREDENTIAL_NAME.test(key);
+export const credentialUrl = value => CREDENTIAL_URL.test(value);
+// A value that carries a credential whatever its variable is called: a known
+// provider token of at least 16 characters, a JWT, or a URL with userinfo or a
+// credential query or connection-string parameter (libsql://db?authToken=...,
+// ...;AccountKey=...), a private key, or an Authorization header value.
+// A token never continues a path or word (/opt/hf_models_cache is a path).
+const TOKEN_VALUE = new RegExp('(?<![A-Za-z0-9_./-])' + TOKEN_PREFIX + '[A-Za-z0-9_./+=-]{12,}');
+const CREDENTIAL_QUERY = /[?&;](?:auth[_-]?token|access[_-]?token|api[_-]?key|account[_-]?key|shared[_-]?access[_-]?key|token|key|secret|password|sig|signature)=[^&#\s]/i;
+const PRIVATE_KEY_VALUE = /-----BEGIN [A-Z0-9 ]{0,64}PRIVATE KEY/;
+const AUTHORIZATION_VALUE = new RegExp(AUTH_HEADER + '|' + BARE_AUTH, 'i');
+export const credentialValue = value => TOKEN_VALUE.test(value) || jwtRanges(value).length > 0 || CREDENTIAL_URL.test(value) || CREDENTIAL_QUERY.test(value) || PRIVATE_KEY_VALUE.test(value) || AUTHORIZATION_VALUE.test(value);
+
 export function credentialValues(input, declared = []) {
  if (!input || typeof input !== 'object') return [];
  return Object.entries(input).flatMap(([key,value]) => {
   // An explicit model declaration remains an exact secret contract, including
   // short values. Environment heuristics must not turn boolean flags into masks.
-  if (typeof value === 'string') return declared.includes(key) || (value.length>=8 && (CREDENTIAL_NAME.test(key) || CAMEL_CREDENTIAL_NAME.test(key) || CREDENTIAL_URL.test(value))) ? [value] : [];
+  if (typeof value === 'string') return declared.includes(key) || (value.length>=8 && (credentialName(key) || credentialUrl(value))) ? [value] : [];
   return value && typeof value==='object' ? credentialValues(value,declared) : [];
  });
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@runeditrun/rer",
-  "version": "0.2.1",
+  "version": "0.2.4",
   "description": "The rer command: install, set up, run and launch Run Edit Run checkouts.",
   "license": "MIT",
   "type": "module",
@@ -63,6 +63,7 @@
     "./modules/portability/migration-history": "./modules/portability/migration-history.mjs",
     "./modules/portability/storage": "./modules/portability/storage.mjs",
     "./modules/erasure/fence": "./modules/erasure/fence.mjs",
+    "./modules/deploy-kit/migration-ledger": "./modules/deploy-kit/migration-ledger.mjs",
     "./modules/deploy-kit/owner": "./modules/deploy-kit/owner.mjs",
     "./modules/deploy-kit/owner-cli": "./modules/deploy-kit/owner-cli.mjs",
     "./modules/deploy-kit/prepare": "./modules/deploy-kit/prepare.mjs",
@@ -84,5 +85,9 @@
   },
   "engines": {
     "node": ">=22"
+  },
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/runeditrun/base.git"
   }
 }

package/scripts/publish-check/README.md

@@ -21,7 +21,20 @@ bounded public coauthor address rule described in the command guide; a file name
 masks only the accepted address for email inspection, leaving names, other
 addresses and every other rule intact.
 
-Binary metadata decoding, Git protocol/object/ref modelling, frozen comparison,
+`png_text.py` separates the fields of framed PNG `tEXt` and uncompressed `iTXt`
+chunks before text hygiene inspection. Container length, type and CRC bytes
+cannot extend a mailbox, and these explicit text fields do not use the binary
+mixed-case host heuristic. Raw-byte hygiene inspection retains the original
+binary classification outside those chunks; checksums do not suppress text
+inspection. Gitleaks still receives the original bytes. Compressed metadata is
+not decoded. `media.py` walks image and video containers to find their
+pixel and sample spans; only those spans skip text hygiene, never
+environment or Gitleaks inspection, and metadata around them is still text.
+`c2pa.py` finds the strictly parsed X.509 certificates inside a PNG's C2PA
+manifest store (`caBX`) and returns their Name and rfc822Name value spans,
+which skip text hygiene the same way.
+
+Other binary metadata decoding, Git protocol/object/ref modelling, frozen comparison,
 resumable inspection and their tests have been removed. Tests live in `tests.py`
 and `coverage_tests.py` and construct disposable repositories with actual Git.
 
@@ -80,3 +93,11 @@ The build that produces the artifacts (`modules/egress-service/tls/build.mjs`)
 regenerates the manifest, and its `--check` mode rejects a stale one. An
 alphabetic top-level domain label ends before a following digit, so a match
 ends at the DER string's boundary rather than absorbing the next tag byte.
+
+`controller_metadata.py` recognizes the standalone controller review manifest by
+its exact four-field structure, immutable source revision, descriptor digest,
+relative directory list and path-to-SHA-256 file map, at any JSON path. Only
+those digest value locations qualify. Extra fields, malformed paths or digests
+retain findings. The live-proof controller still independently checks all copied
+file bytes against the pinned source before execution; the scanner does not claim
+to fetch that source. Provider tokens and known environment values remain findings.

package/scripts/publish-check/c2pa.py

@@ -0,0 +1,121 @@
+"""Certificate metadata inside a PNG's C2PA manifest store (caBX chunk).
+
+Image generators sign a C2PA manifest and embed the signing certificate chain
+in it; a certificate names its holder, often by address. Only values that a
+strict X.509 parse places in an issuer or subject Name, or in a subject or
+issuer alternative name's rfc822Name, are certificate metadata. Every other
+byte of the manifest, assertions included, remains text to inspect.
+"""
+from der import OID, SEQUENCE, BIT_STRING, rdn_values, tlv
+
+INTEGER, OCTET_STRING, VERSION, EXTENSIONS, RFC822_NAME = 0x02, 0x04, 0xA0, 0xA3, 0x81
+ALTERNATIVE_NAMES = (bytes.fromhex('551d11'), bytes.fromhex('551d12'))
+
+
+def manifest_payloads(data):
+    if not data.startswith(b'\x89PNG\r\n\x1a\n'):
+        return
+    offset = 8
+    while offset + 12 <= len(data):
+        length = int.from_bytes(data[offset:offset + 4], 'big')
+        kind, start, end = data[offset + 4:offset + 8], offset + 8, offset + 8 + length
+        if end + 4 > len(data):
+            return
+        if kind == b'caBX':
+            yield start, end
+        if kind == b'IEND':
+            return
+        offset = end + 4
+
+
+def name_values(data, name):
+    # A Name is RDN SETs filling its SEQUENCE exactly.
+    values, cursor = [], name[1]
+    while cursor < name[2]:
+        rdn = rdn_values(data, cursor, name[2])
+        if not rdn:
+            return None
+        cursor, found = rdn
+        values += found
+    return values
+
+
+def alternative_names(data, extensions):
+    spans, outer = [], tlv(data, extensions[1], extensions[2])
+    if not outer or outer[0] != SEQUENCE or outer[2] != extensions[2]:
+        return None
+    cursor = outer[1]
+    while cursor < outer[2]:
+        extension = tlv(data, cursor, outer[2])
+        oid = extension and extension[0] == SEQUENCE and tlv(data, extension[1], extension[2])
+        if not oid or oid[0] != OID:
+            return None
+        value = tlv(data, oid[2], extension[2])
+        if value and value[0] == 0x01:
+            value = tlv(data, value[2], extension[2])
+        if not value or value[0] != OCTET_STRING or value[2] != extension[2]:
+            return None
+        if data[oid[1]:oid[2]] in ALTERNATIVE_NAMES:
+            general = tlv(data, value[1], value[2])
+            if not general or general[0] != SEQUENCE:
+                return None
+            entry = general[1]
+            while entry < general[2]:
+                item = tlv(data, entry, general[2])
+                if not item:
+                    return None
+                if item[0] == RFC822_NAME:
+                    spans.append((item[1], item[2]))
+                entry = item[2]
+        cursor = extension[2]
+    return spans
+
+
+def certificate(data, offset, end):
+    """Name and alternative-name value spans of one X.509 Certificate, or None."""
+    outer = tlv(data, offset, end)
+    if not outer or outer[0] != SEQUENCE:
+        return None
+    tbs = tlv(data, outer[1], outer[2])
+    algorithm = tbs and tbs[0] == SEQUENCE and tlv(data, tbs[2], outer[2])
+    signature = algorithm and algorithm[0] == SEQUENCE and tlv(data, algorithm[2], outer[2])
+    if not signature or signature[0] != BIT_STRING or signature[2] != outer[2]:
+        return None
+    fields, cursor = [], tbs[1]
+    while cursor < tbs[2]:
+        field = tlv(data, cursor, tbs[2])
+        if not field:
+            return None
+        fields.append(field)
+        cursor = field[2]
+    if fields and fields[0][0] == VERSION:
+        fields = fields[1:]
+    # serialNumber, signature, issuer, validity, subject, subjectPublicKeyInfo.
+    if len(fields) < 6 or [field[0] for field in fields[:6]] != [INTEGER] + [SEQUENCE] * 5:
+        return None
+    issuer, subject = name_values(data, fields[2]), name_values(data, fields[4])
+    if issuer is None or subject is None:
+        return None
+    spans = issuer + subject
+    for field in fields[6:]:
+        if field[0] == EXTENSIONS:
+            names = alternative_names(data, field)
+            if names is None:
+                return None
+            spans += names
+    return spans
+
+
+def certificate_spans(data):
+    """Value spans of the certificates a PNG's C2PA manifest store carries."""
+    spans = []
+    for start, end in manifest_payloads(data):
+        offset = data.find(SEQUENCE.to_bytes(1, 'big'), start, end)
+        while 0 <= offset < end:
+            found = certificate(data, offset, end)
+            if found is None:
+                offset = data.find(SEQUENCE.to_bytes(1, 'big'), offset + 1, end)
+                continue
+            spans += found
+            offset = data.find(SEQUENCE.to_bytes(1, 'big'), tlv(data, offset, end)[2], end)
+    return spans

package/scripts/publish-check/content_identities.py

@@ -2,11 +2,12 @@
 from json_identity import Document
 from provenance_pins import module_pins
 from copy_identities import copy_pointers
+from controller_metadata import controller_pointers
 from source_metadata import ARCHIVE, source_pointers
 
 
 def candidate(path):
-    return path in ('edition.json', 'sources.lock.json', 'base-copies.json', 'base/PROVENANCE.json') or bool(ARCHIVE.fullmatch(path))
+    return path in ('edition.json', 'sources.lock.json', 'base-copies.json', 'base/PROVENANCE.json') or bool(ARCHIVE.fullmatch(path)) or path.endswith('.json')
 
 
 class ContentIdentities:
@@ -22,6 +23,7 @@ class ContentIdentities:
             self.documents[path] = document
             pointers = set(module_pins(path, document.value))
             pointers.update(source_pointers(path, document.value))
+            pointers.update(controller_pointers(document.value))
             if path in ('base-copies.json', 'base/PROVENANCE.json') and read_regular is not None:
                 pointers.update(copy_pointers(document.value, read_regular))
             self.allowed[path] = pointers

package/scripts/publish-check/controller_metadata.py

@@ -0,0 +1,31 @@
+"""Exact digest locations in immutable standalone-controller review manifests.
+
+The live-proof controller verifies these digests against its pinned Git source
+before executing any copied file. This identifies the documented format; it does
+not claim to perform that remote integrity check during publication inspection.
+"""
+from copy_identities import relative_path
+from json_identity import HEX, GIT_REVISION
+
+
+def controller_pointers(value):
+    if not isinstance(value, dict) or set(value) != {
+            'sourceSha', 'descriptorSha256', 'controllerDirectories', 'controllerFiles'}:
+        return
+    if (not isinstance(value['sourceSha'], str) or not GIT_REVISION.fullmatch(value['sourceSha'])
+            or not isinstance(value['descriptorSha256'], str)
+            or not HEX.fullmatch(value['descriptorSha256'])):
+        return
+    directories, files = value['controllerDirectories'], value['controllerFiles']
+    if (not isinstance(directories, list) or not all(relative_path(p) for p in directories)
+            or len(set(directories)) != len(directories)
+            or not isinstance(files, dict) or not files
+            or not all(relative_path(p) and isinstance(digest, str) and HEX.fullmatch(digest)
+                       for p, digest in files.items())
+            or any(directory == path or directory.startswith(path + '/')
+                   for directory in directories for path in files)):
+        return
+    yield ('sourceSha',)
+    yield ('descriptorSha256',)
+    for path in files:
+        yield ('controllerFiles', path)

package/scripts/publish-check/history_scan.py

@@ -38,6 +38,9 @@ def scan(repo, ref='HEAD', public_base=None, env_file=None, project=None, reposi
         recorded = registry() + exceptions(history.selected(EXCEPTIONS))
         resolver = GitHubResolver()
         public_blobs = {e['oid'] for c in history.public_commits for e in history.entries(c)}
+        # A file byte-identical to the same path on the public base is already public.
+        public_paths = {e['path']: e['oid'] for e in history.entries(history.public_commit)
+                        if e['kind'] == 'blob'} if history.public_commit else {}
         report['history']['preExistingCommits'] = sorted(history.public_commits)
         report['history']['newlyPublicCommits'] = [c for c in history.commits if c not in history.public_commits]
         seen_trees, seen_blobs, inspected = set(), set(), {}
@@ -73,7 +76,7 @@ def scan(repo, ref='HEAD', public_base=None, env_file=None, project=None, reposi
                 if key not in inspected:
                     inspected[key] = text_rules(history.blob(oid), path, config_tree, resolver, hashes)
                 rules, provenance = inspected[key]
-                entry_scope = 'pre-existing' if scope != 'release-tree' and oid in public_blobs else scope
+                entry_scope = 'pre-existing' if (scope != 'release-tree' and oid in public_blobs) or public_paths.get(path) == oid else scope
                 for rule in rules:
                     add(rule, path, commit, oid, entry_scope)
                 if provenance:
@@ -92,8 +95,10 @@ def scan(repo, ref='HEAD', public_base=None, env_file=None, project=None, reposi
             entry = entries_by_commit[history.commit].get(path)
             oid = entry['oid'] if entry and entry['kind'] == 'blob' and history.blob(entry['oid']) == data else None
             rules, _ = text_rules(data, path, selected_context, resolver, hashes)
+            public_oid = public_paths.get(path)
+            scope = 'pre-existing' if public_oid and (public_oid == oid or history.blob(public_oid) == data) else 'working-tree'
             for rule in rules:
-                add(rule, path, history.commit, oid, 'working-tree')
+                add(rule, path, history.commit, oid, scope)
             if path == 'LICENSE':
                 for rule in license_rules(data, recorded):
                     add(rule, path, history.commit, oid, 'working-tree')
@@ -109,7 +114,12 @@ def scan(repo, ref='HEAD', public_base=None, env_file=None, project=None, reposi
                     path = Path(path).resolve().relative_to(Path(history.repo).resolve()).as_posix()
                 entry = entries_by_commit.get(commit, {}).get(path)
                 oid = entry['oid'] if entry and entry['kind'] == 'blob' else None
-                scope = 'working-tree' if mode == 'dir' else 'release-tree' if commit == history.commit else 'pre-existing' if oid in public_blobs else 'newly-public'
+                if mode == 'dir':
+                    public_oid = public_paths.get(path)
+                    held = working_regular(Path(history.repo), path) if public_oid else None
+                    scope = 'pre-existing' if held and history.blob(public_oid) == held[0] else 'working-tree'
+                else:
+                    scope = 'pre-existing' if (oid and public_paths.get(path) == oid) or (commit != history.commit and oid in public_blobs) else 'release-tree' if commit == history.commit else 'newly-public'
                 if hit['RuleID'] in ('generic-api-key', 'hex-api-key'):
                     identity_scope = 'working-tree' if mode == 'dir' else commit
                     scoped_entries = entries_by_commit.get(commit, {})