@runeditrun/rer 0.2.2 → 0.2.4

package/modules/deploy-kit/owner.mjs

@@ -1,7 +1,8 @@
 import { ingressBindings } from './container-config.mjs';
 import { mkdir, open, rename, rm, writeFile } from 'node:fs/promises';
 import { dirname } from 'node:path';
-import { assert, hash, identifier, resourceName, validatePlan } from './validation.mjs';
+import { assert, hash, identifier, resourceName, uuid, validatePlan } from './validation.mjs';
+import { definiteProviderRefusal } from './provider.mjs';
 import { regularBytes } from './artifact.mjs';
 import { resourceKinds, findResource, checkCronOwnership } from './resources.mjs';
 import { secretBindings, activeWorker, deployedFingerprint } from './worker.mjs';
@@ -50,22 +51,35 @@ export function withScopeHints(api) {
   return {...api, scopeHints:true, request:guard('request'), envelope:guard('envelope'), list:guard('list')};
 }
 /** Right after a create, an account listing can disagree with its own page counts
- * (D1's total_count lagged its rows by about 7 seconds, measured 13 October 2026).
- * Owner mode discards such a snapshot and lists again from the start for up to
- * `windowMs`; a partial listing is never accepted. */
-export function withSettledLists(api, {windowMs = 30000, clock = () => performance.now(), sleep = ms => new Promise(resolve => setTimeout(resolve, ms))} = {}) {
+ * (D1's total_count lagged its rows by about 7 seconds, measured 13 October 2026) or
+ * not show the new resource yet. Owner mode discards a partial snapshot and lists
+ * again from the start for up to `windowMs`; a partial listing is never accepted. */
+export const LIST_WINDOW_MS = 120000;
+const settleable = error => ['provider-partial-list','provider-pagination-changed'].includes(error.message);
+export function withSettledLists(api, {windowMs = LIST_WINDOW_MS, clock = () => performance.now(), sleep = ms => new Promise(resolve => setTimeout(resolve, ms))} = {}) {
   if (api.settledLists) return api;
   const list = async (...args) => {
     const start = clock();
     for (let delay = 500; ; delay = Math.min(delay * 2, 4000)) {
       try { return await api.list(...args); }
       catch (error) {
-        if (!['provider-partial-list','provider-pagination-changed'].includes(error.message) || clock() - start + delay > windowMs) throw error;
+        if (!settleable(error) || clock() - start + delay > windowMs) throw error;
         await sleep(delay);
       }
     }
   };
-  return {...api, settledLists:true, list};
+  return {...api, settledLists:true, unsettled:api, list};
+}
+/** Waits until the account's listing shows a resource this run just created, so no later
+ * read mistakes it for a missing or replaced one. One that never appears is named. */
+async function listedAfterCreate(api, kind, item, {windowMs = LIST_WINDOW_MS, clock = () => performance.now(), sleep = ms => new Promise(resolve => setTimeout(resolve, ms))} = {}) {
+  const start = clock();
+  for (let delay = 500; ; delay = Math.min(delay * 2, 4000)) {
+    try { if (findResource(await resourceKinds[kind].list(api.unsettled ?? api),kind,item.name)) return; }
+    catch (error) { if (!settleable(error)) throw error; }
+    if (clock() - start + delay > windowMs) throw refuse('resource-not-listed',kind,item.name);
+    await sleep(delay);
+  }
 }
 /** Reads the account's workers.dev subdomain; no other provider request. */
 export async function ownerTarget(provider, {project, environment}) {
@@ -84,9 +98,10 @@ function entries(declaration, key) {
   assert(Array.isArray(list) && list.every(item => item && typeof item === 'object' && !Array.isArray(item) && Object.keys(item).every(k => ENTRY_KEYS[key].includes(k))), 'invalid-owner-declaration');
   return list;
 }
-/* RER_DEV_KEY opens local dev identity; it and every key a seed adapter declares
- * local-only never become a deployed binding, secret or secret source. */
-export const LOCAL_ONLY_KEYS = Object.freeze(['RER_DEV_KEY', 'RER_MODELS_KEY', 'RER_MODELS_SERVICE', '.rer/local/models.json']);
+/* RER_DEV_KEY opens local dev identity and RER_DEMO turns on demo mode (nothing
+ * sent, throwaway data); they and every key a seed adapter declares local-only
+ * never become a deployed binding, secret or secret source. */
+export const LOCAL_ONLY_KEYS = Object.freeze(['RER_DEV_KEY', 'RER_DEMO', 'RER_MODELS_KEY', 'RER_MODELS_SERVICE', '.rer/local/models.json']);
 export function localOnlyBinding(declaration, localOnlyKeys = []) {
   const refused = new Set([...LOCAL_ONLY_KEYS, ...localOnlyKeys]);
   const names = [...Object.keys(declaration?.vars ?? {}), declaration?.originVar, ...(Array.isArray(declaration?.secrets) ? declaration.secrets.flatMap(item => [item?.binding, item?.environment]) : [])];
@@ -153,7 +168,10 @@ export async function readOwnerState(path, target) {
     && KINDS.every(kind => state.owned[kind] && typeof state.owned[kind] === 'object' && Object.values(state.owned[kind]).every(entry => ['pending','created'].includes(entry?.status))), 'invalid-owner-state');
   assert(state.pendingUpload === undefined || typeof state.pendingUpload?.fingerprint === 'string' && typeof state.pendingUpload?.build === 'string', 'invalid-owner-state');
   // Declared secrets rer removed on purpose (the spent setup token): later plans omit them.
-  assert(state.pendingSecret === undefined || identifier(state.pendingSecret?.binding) && typeof state.pendingSecret?.present === 'boolean', 'invalid-owner-state');
+  assert(state.pendingSecret === undefined || identifier(state.pendingSecret?.binding) && typeof state.pendingSecret?.present === 'boolean'
+    && (state.pendingSecret.versionId === undefined || uuid(state.pendingSecret.versionId))
+    && (state.pendingSecret.repeatVersionId === undefined || uuid(state.pendingSecret.repeatVersionId)), 'invalid-owner-state');
+  assert(state.ownerClaim === undefined || ['claimed','kept'].includes(state.ownerClaim?.outcome), 'invalid-owner-state');
   assert(state.retiredSecrets === undefined || Array.isArray(state.retiredSecrets) && state.retiredSecrets.every(identifier), 'invalid-owner-state');
   assert(state.accountId === target.accountId && state.project === target.project && state.environment === target.environment && state.worker === target.worker, 'owner-state-target-mismatch');
   return state;
@@ -226,19 +244,41 @@ export function recordSecretChange(state, current, {binding, present}) {
 }
 /** A secret change rer recorded as pending but never confirmed (a lost response, or a run that
  * ended before the change settled). It is that change only when the Worker's versions list shows
- * exactly one version after the receipt's and it is the live one, still running the receipt's
- * exact script and build fingerprint: adopt its version. Anything else, such as a later change
- * someone made after rer's, is left to the identity check, which refuses it. */
-export async function settlePendingSecret(api, worker, state) {
+ * exactly one version after the recorded starting version and it is the live one, still running the receipt's
+ * exact script and build fingerprint: adopt its version. A confirming PUT also records its
+ * own starting version before it writes; its immediate successor can be recovered by the
+ * same checks. Anything later is left to the identity check, which refuses it. */
+export async function settlePendingSecret(api, worker, state, {preflight = false, observe, confirm} = {}) {
   if (!state.pendingSecret || !state.receipt) return false;
   const live = await activeWorker(api, worker);
-  if (!live || sameDeployment(live, state.receipt.provider) || live.etag !== state.receipt.provider.etag || deployedFingerprint(live.settings) !== state.receipt.fingerprint) return false;
+  if (sameDeployment(live, state.receipt.provider)) {
+    // A new command sees that the abandoned write made no live version change.
+    // During the write's own readback this can still be propagation delay.
+    if (!preflight) {
+      // Deployment propagation can lag a secret write's version. Only a
+      // matching newest version corroborates that the write was unapplied.
+      const versions = (await api.request(`/workers/scripts/${worker}/versions`))?.items;
+      observe?.(Array.isArray(versions) && versions[0]?.id === live.versionId ? live : null);
+      return false;
+    }
+    delete state.pendingSecret;
+    return true;
+  }
+  observe?.(live);
+  if (state.pendingSecret.versionId !== state.receipt.provider.versionId || !live || live.etag !== state.receipt.provider.etag || deployedFingerprint(live.settings) !== state.receipt.fingerprint) return false;
   // Newest first, as the provider lists them.
   const versions = (await api.request(`/workers/scripts/${worker}/versions`))?.items;
   const ids = Array.isArray(versions) ? versions.map(item => item?.id) : [];
-  if (ids[0] !== live.versionId || ids.indexOf(state.receipt.provider.versionId) !== 1) return false;
+  const {versionId, repeatVersionId} = state.pendingSecret;
+  const immediate = ids.indexOf(versionId) === 1;
+  const repeated = repeatVersionId && ids[1] === repeatVersionId && ids.indexOf(versionId) === 2;
+  // A rotation's ambiguous first answer requires a second PUT before success.
+  // Its starting version is saved before that PUT, so interruption can recover
+  // either the original immediate successor or the second write's successor.
+  if (ids[0] !== live.versionId || !(repeatVersionId ? repeated || preflight && immediate && live.versionId === repeatVersionId : immediate)) return false;
   const rows = await api.request(`/workers/scripts/${worker}/secrets`);
   if (!Array.isArray(rows) || rows.some(row => row.name === state.pendingSecret.binding) !== state.pendingSecret.present) return false;
+  if (confirm && !repeatVersionId) { await confirm(live); return false; }
   recordSecretChange(state, live, state.pendingSecret);
   return true;
 }
@@ -247,7 +287,7 @@ export async function settleOwnerState({api: provider, target, statePath}) {
   const api = withScopeHints(provider);
   return withStateLock(statePath, async () => {
     const state = await readOwnerState(statePath, target);
-    if (await settlePendingSecret(api, target.worker, state)) await writeOwnerState(statePath, state);
+    if (await settlePendingSecret(api, target.worker, state, {preflight:true})) await writeOwnerState(statePath, state);
     return state;
   });
 }
@@ -293,17 +333,18 @@ export async function withStateLock(path, run) {
 
 /** Find or create every declared resource under the owner's account, migrate, upload and check health.
  * Ownership preflight precedes provider writes. A re-run of the same build writes nothing. */
-export async function ownerDeploy({api: provider, target, plan, artifact, statePath, env = {}, fetch = globalThis.fetch, healthOptions = {}, readiness = {}}) {
+export async function ownerDeploy({api: provider, target, plan, artifact, statePath, env = {}, fetch = globalThis.fetch, healthOptions = {}, readiness = {}, settle = {}}) {
   assert(typeof statePath === 'string' && statePath.length, 'missing-owner-state-path');
-  const api = withSettledLists(withScopeHints(provider));
+  const api = withSettledLists(withScopeHints(provider),settle);
   assert(target?.accountId === api.accountId, 'owner-account-mismatch');
   validatePlan(plan); assertOwnerNames(target, plan);
   for (const item of plan.d1) validateMigrations(item.migrations);
-  return withStateLock(statePath, () => deployLocked({api, target, plan, artifact, statePath, env, fetch, healthOptions, readiness}));
+  return withStateLock(statePath, () => deployLocked({api, target, plan, artifact, statePath, env, fetch, healthOptions, readiness, settle}));
 }
-async function deployLocked({api, target, plan, artifact, statePath, env, fetch, healthOptions, readiness}) {
+async function deployLocked({api, target, plan, artifact, statePath, env, fetch, healthOptions, readiness, settle}) {
   const state = await readOwnerState(statePath, target);
   const save = () => writeOwnerState(statePath, state);
+  if (await settlePendingSecret(api, target.worker, state, {preflight:true})) await save();
   await checkServiceWorkers(api, plan);
   const priorWorker = await checkOwnedWorker(api, plan, artifact, state);
   const exists = priorWorker !== null;
@@ -315,9 +356,15 @@ async function deployLocked({api, target, plan, artifact, statePath, env, fetch,
   // absent on resume means create again; present means an uncertain outcome to inspect.
   for (const {kind,item} of create) {
     state.owned[kind][item.name] = {status:'pending'}; await save();
-    const row = await resourceKinds[kind].create(api,item);
+    let row;
+    try { row = await resourceKinds[kind].create(api,item); }
+    catch (error) {
+      if (definiteProviderRefusal(error)) { delete state.owned[kind][item.name]; await save(); }
+      throw error;
+    }
     assert(findResource([row],kind,item.name) === row, 'invalid-created-resource');
     state.owned[kind][item.name] = {status:'created',...(resourceId(kind,row) === undefined ? {} : {id:resourceId(kind,row)})}; await save();
+    await listedAfterCreate(api,kind,item,settle);
   }
   if (!exists && !state.owned.worker) { state.owned.worker = {status:'pending'}; await save(); }
   const upload = `/workers/scripts/${plan.worker}?bindings_inherit=strict`;
@@ -343,7 +390,7 @@ async function deployLocked({api, target, plan, artifact, statePath, env, fetch,
   }};
   const receipt = await deploy({api:observed, plan, artifact, artifactSha256:hash(artifact), previousReceipt:state.receipt ?? undefined,
     createResources:false, uploadWithoutReceipt:true, env, fetch, healthOptions, readiness,
-    onReceipt: async candidate => { if (candidate.changed || !state.receipt) { state.receipt = candidate; delete state.pendingUpload; await save(); } },
+    onReceipt: async candidate => { if (candidate.changed || !state.receipt) { state.receipt = candidate; delete state.pendingUpload; delete state.pendingSecret; await save(); } },
     // Keep each first-health attempt beside the identity it belongs to.
     onHealth: async candidate => { if (candidate.changed) { state.receipt = candidate; await save(); } }});
   return {receipt, created:create.map(({kind,item}) => `${kind}:${item.name}`), sentSecrets};

package/modules/deploy-kit/prepare.mjs

@@ -6,6 +6,7 @@ import { assert, hash, localPath } from './validation.mjs';
 import { assetsIgnore, collectFiles, regularBytes, validateArtifact, MAX_ARTIFACT } from './artifact.mjs';
 import { collectBuildModules } from './build-modules.mjs';
 import { refuseLocalModels } from './local-only.mjs';
+import { readMigrationRewrites, withRewrites } from './migrations.mjs';
 
 export function assertCredentialFree(env) {
   for (const [key,value] of Object.entries(env)) if (value && /(?:TOKEN|SECRET|PASSWORD|API_KEY|PRIVATE_KEY|AUTHORIZATION|COOKIE|CREDENTIAL)/i.test(key)) throw new Error('prepare-credential-environment-forbidden');
@@ -26,11 +27,12 @@ export async function packageBuild({root,source,runIdentity,productDirectory = '
   const modules = await collectBuildModules(build,config,main);
   const ignored = assetsIgnore(await regularBytes(join(product,'dist/client/.assetsignore'),65536).then(String,error => { if (error.code === 'ENOENT') return ''; throw error; }));
   const assets = (await collectFiles(join(product,'dist/client'))).filter(file => !ignored(file.path));
-  const migrations = [];
+  let migrations = [];
   for (const name of (await readdir(join(product,'migrations/core'))).sort()) {
     assert(/^[0-9]+_[a-zA-Z0-9_-]+\.sql$/.test(name),'unexpected-migration-file');
     const sql = (await regularBytes(join(product,'migrations/core',name),512000)).toString('utf8'); migrations.push({binding:'DB',name,sql,sha256:hash(sql)});
   }
+  migrations = withRewrites(migrations, await readMigrationRewrites(product));
   const artifact = {version:1,source,run:runIdentity,main,modules,assets,migrations}; validateArtifact(artifact);
   return artifact;
 }

package/modules/deploy-kit/provider.mjs

@@ -2,6 +2,9 @@ import { recordDeployFailure } from './diagnostics.mjs';
 import { importD1, importUploadURL } from './d1-import.mjs';
 import { assert, hexId } from './validation.mjs';
 
+// A gateway/server error can arrive after a write. An explicit API refusal cannot.
+export const definiteProviderRefusal = error => error.status === 200 || error.status >= 400 && error.status < 500;
+
 async function boundedText(response, limit = 4 * 1024 * 1024, onReadError) {
   assert(response.body, 'empty-response');
   const reader = response.body.getReader(); const chunks = []; let length = 0;

package/modules/erasure/README.md

@@ -177,9 +177,8 @@ the seed retires them in its own migration.
 ## Adopting
 
 Copy these files byte for byte to a folder the Worker build serves, such as
-`src/modules/erasure/`. A seed made by `rer` export also receives them under
-`scripts/base-cli/modules/erasure/`, but `vite dev` serves only `src`, `public`
-and `node_modules`, so runtime imports must not reach into `scripts/`. The
+`src/modules/erasure/`. `vite dev` serves only `src`, `public` and
+`node_modules`, so runtime imports must not reach into `scripts/`. The
 standalone default seed copies this module and portability into `src/modules/`.
 The files are:
 

package/modules/operator-auth/accounts/settings-page.mjs

@@ -1,4 +1,9 @@
-import { securityHeaders } from '../http.mjs';
-export function identitySettingsPage({idpSignIn}) {
- return new Response(`<!doctype html><html lang="en"><head><meta charset="utf-8"><meta name="viewport" content="width=device-width,initial-scale=1"><title>Sign-in settings</title><style>body{font:18px system-ui;margin:0;padding:24px;color:#152523}main{max-width:640px;margin:8vh auto}label{display:block;padding:20px 0}button{font:inherit;padding:12px 20px}input{width:20px;height:20px;margin-right:12px}</style></head><body><main><a href="/app">Back to app</a><h1>Sign-in settings</h1><p>Allow invited people to sign in through your linked identity provider. Email links remain available to the owner.</p><form action="/auth/settings/identity" method="post"><input type="hidden" name="setting" value="identity"><label><input type="checkbox" name="idpSignIn" value="true" ${idpSignIn?'checked':''}>Allow provider sign-in</label><button>Save settings</button></form></main></body></html>`,{headers:{...securityHeaders(),'Referrer-Policy':'strict-origin','Content-Type':'text/html; charset=utf-8','Content-Security-Policy':"default-src 'none'; style-src 'unsafe-inline'; form-action 'self'; frame-ancestors 'none'; base-uri 'none'"}});
+import { pageResponse } from '../page.mjs';
+
+// The owner's sign-in settings, in the same frame (and seed theme) as sign-in.
+export function identitySettingsPage({ idpSignIn }, branding) {
+ const content = '<p>Allow invited people to sign in through your linked identity provider. Email links remain available to the owner.</p>'
+  + `<form action="/auth/settings/identity" method="post"><input type="hidden" name="setting" value="identity"><label class="check"><input type="checkbox" name="idpSignIn" value="true"${idpSignIn ? ' checked' : ''}>Allow provider sign-in</label><button>Save settings</button></form>`
+  + '<p class="secondary-link"><a href="/app">Back to app</a></p>';
+ return pageResponse({ branding, title: 'Sign-in settings', heading: 'Sign-in settings', content, referrer: 'strict-origin' });
 }

package/modules/operator-auth/csp.mjs

@@ -0,0 +1,26 @@
+// Inline additions to a document's Content-Security-Policy: the dev badge and
+// the demo bar each add one hashed style without loosening anything else.
+
+/** The CSP source token for an exact inline text. */
+export async function sha256(text) {
+  const bytes = await crypto.subtle.digest('SHA-256', new TextEncoder().encode(text));
+  return `'sha256-${btoa(String.fromCharCode(...new Uint8Array(bytes)))}'`;
+}
+
+// Allow exactly one more inline source in a directive the document already
+// restricts. Inline content an existing directive already permits stays as is.
+export function allow(policy, directive, source) {
+  const parts = policy.split(';').map(part => part.trim()).filter(Boolean);
+  const find = name => parts.findIndex(part => part.split(/\s+/)[0].toLowerCase() === name);
+  let index = find(directive);
+  if (index < 0) {
+    const fallback = find('default-src');
+    if (fallback < 0) return policy;
+    parts.push([directive, ...parts[fallback].split(/\s+/).slice(1)].join(' '));
+    index = parts.length - 1;
+  }
+  const tokens = parts[index].split(/\s+/);
+  if (tokens.includes("'unsafe-inline'") && !tokens.some(token => /^'(?:nonce|sha256|sha384|sha512)-/.test(token))) return parts.join('; ');
+  parts[index] = [...tokens.filter(token => token !== "'none'"), source].join(' ');
+  return parts.join('; ');
+}

package/modules/operator-auth/dev/badge.mjs

@@ -1,5 +1,6 @@
 import { EXCHANGE_SCRIPT, exchangeHashes } from '../dev-gate.mjs';
 import { escapeHtml } from '../http.mjs';
+import { allow, sha256 } from '../csp.mjs';
 
 // A slim bar at the top of the document, in normal flow so the page below it
 // starts after it and nothing is ever covered. A grid body (the frames that
@@ -7,10 +8,6 @@ import { escapeHtml } from '../http.mjs';
 // in the rest.
 const STYLE = 'body:has(>#rer-dev-badge){grid-template-rows:auto 1fr}#rer-dev-badge{grid-column:1/-1;justify-self:stretch;align-self:start;position:relative;z-index:2147483647;box-sizing:border-box;width:100%;margin:0 0 12px;padding:6px 12px;border-radius:8px;background:#111827;color:#f9fafb;font:13px/1.5 system-ui,sans-serif;text-align:left}#rer-dev-badge summary{min-width:24px;min-height:24px;cursor:pointer;overflow-wrap:anywhere}#rer-dev-badge ul{margin:6px 0 0;padding:0;list-style:none;display:flex;flex-wrap:wrap;gap:4px 16px}#rer-dev-badge li{margin:0}#rer-dev-badge a{display:inline-block;min-width:24px;min-height:24px;color:#bfdbfe;text-decoration:underline}#rer-dev-badge a[aria-current]{color:#fff;font-weight:700}#rer-dev-badge a:focus-visible,#rer-dev-badge summary:focus-visible{outline:2px solid #fff;outline-offset:2px}';
 let styleHash;
-async function sha256(text) {
-  const bytes = await crypto.subtle.digest('SHA-256', new TextEncoder().encode(text));
-  return `'sha256-${btoa(String.fromCharCode(...new Uint8Array(bytes)))}'`;
-}
 
 function badgeHtml({ session, choices }) {
   const current = session ? choices.find(choice => choice.email === session.operator.email)?.as : 'signed-out';
@@ -19,24 +16,6 @@ function badgeHtml({ session, choices }) {
   return `<style>${STYLE}</style><aside id="rer-dev-badge" aria-label="Local development identity"><details><summary>${label}</summary><ul>${links}</ul></details></aside>`;
 }
 
-// Allow exactly one more inline source in a directive the document already
-// restricts. Inline content an existing directive already permits stays as is.
-function allow(policy, directive, source) {
-  const parts = policy.split(';').map(part => part.trim()).filter(Boolean);
-  const find = name => parts.findIndex(part => part.split(/\s+/)[0].toLowerCase() === name);
-  let index = find(directive);
-  if (index < 0) {
-    const fallback = find('default-src');
-    if (fallback < 0) return policy;
-    parts.push([directive, ...parts[fallback].split(/\s+/).slice(1)].join(' '));
-    index = parts.length - 1;
-  }
-  const tokens = parts[index].split(/\s+/);
-  if (tokens.includes("'unsafe-inline'") && !tokens.some(token => /^'(?:nonce|sha256|sha384|sha512)-/.test(token))) return parts.join('; ');
-  parts[index] = [...tokens.filter(token => token !== "'none'"), source].join(' ');
-  return parts.join('; ');
-}
-
 /** Adds the fragment key exchange (root only) and the badge to an HTML document. */
 export async function decorate(response, { exchange, badge }) {
   // The Lobby is deliberately script-free. RER_OPEN uses /__dev/key, whose

package/modules/operator-auth/page.mjs

@@ -15,8 +15,8 @@ function stylesheet(accentColor) {
   return `:root{color-scheme:light;font-family:system-ui,-apple-system,BlinkMacSystemFont,"Segoe UI",sans-serif;color:#172033;background:#f3f5f8}*{box-sizing:border-box}body{margin:0;min-height:100vh;padding:32px 20px;display:grid;place-items:center}main{width:100%;max-width:480px;background:#fff;border:1px solid #dce2ea;border-radius:20px;padding:36px;box-shadow:0 12px 40px #1720330a;overflow-wrap:anywhere}.brand{font-size:14px;font-weight:650;line-height:1.5;margin:0 0 32px;color:#475569}.mark{display:block;width:32px;height:6px;border-radius:3px;border:1px solid currentColor;background:${accentColor};margin-bottom:16px}h1,h2{text-wrap:balance}h1{font-size:30px;line-height:1.3;letter-spacing:-.02em;margin:0 0 24px;font-weight:700}p{font-size:16px;line-height:1.6;margin:0 0 24px;color:#475569;text-wrap:pretty}form{margin:0}button,.action{display:block;width:100%;border:1px solid #64748b;border-radius:10px;background:${accentColor};color:${accentInk(accentColor)};padding:13px 18px;font:inherit;font-weight:650;text-align:center;text-decoration:none;cursor:pointer;line-height:1.5}button:hover,.action:hover{box-shadow:inset 0 0 0 2px currentColor}button:focus-visible,.action:focus-visible{outline:3px solid #172033;outline-offset:4px}@media(max-width:480px){body{padding:24px 16px}main{padding:28px 24px}h1{font-size:28px}}@media(prefers-color-scheme:dark){:root{color-scheme:dark;background:#111827;color:#f8fafc}main{background:#1e293b;border-color:#475569;box-shadow:none}.brand,p{color:#cbd5e1}button:focus-visible,.action:focus-visible{outline-color:#f8fafc}}`;
 }
 
-// Form controls and notices used by the sign-in page; part of the same hashed sheet.
-const FORMS = `label{display:block;font-weight:600;margin:0 0 8px}input{display:block;width:100%;margin:0 0 16px;padding:12px 14px;border:1px solid #64748b;border-radius:10px;font:inherit;line-height:1.5;color:inherit;background:transparent}input:focus-visible{outline:3px solid #172033;outline-offset:2px}.stack{display:grid;gap:12px;margin:0 0 24px}button.secondary{background:transparent;color:inherit}.divider{display:flex;align-items:center;gap:12px;margin:0 0 24px;color:#475569;font-size:14px}.divider::before,.divider::after{content:"";flex:1;border-top:1px solid #dce2ea}.notice{border-left:4px solid #64748b;padding:8px 12px;margin:0 0 24px}h2{font-size:20px;line-height:1.4;margin:32px 0 16px}.secondary-link{margin:16px 0 0;text-align:center;font-size:15px}.secondary-link a{display:inline-block;min-width:24px;min-height:24px;color:#334155;font-weight:600;text-decoration:underline;text-decoration-thickness:1px;text-underline-offset:3px}.secondary-link a:hover{text-decoration-thickness:2px}.secondary-link a:focus-visible{outline:3px solid #172033;outline-offset:2px;border-radius:2px}@media(prefers-color-scheme:dark){input:focus-visible,.secondary-link a:focus-visible{outline-color:#f8fafc}.divider{color:#cbd5e1}.divider::before,.divider::after{border-color:#475569}.secondary-link a{color:#cbd5e1}}`;
+// Form controls and notices used by the sign-in and settings pages; part of the same hashed sheet.
+const FORMS = `label{display:block;font-weight:600;margin:0 0 8px}input{display:block;width:100%;margin:0 0 16px;padding:12px 14px;border:1px solid #64748b;border-radius:10px;font:inherit;line-height:1.5;color:inherit;background:transparent}input:focus-visible{outline:3px solid #172033;outline-offset:2px}.stack{display:grid;gap:12px;margin:0 0 24px}.check{display:flex;align-items:center;gap:12px;margin:0 0 24px}.check input{width:20px;height:20px;margin:0;padding:0;flex:none}button.secondary{background:transparent;color:inherit}.divider{display:flex;align-items:center;gap:12px;margin:0 0 24px;color:#475569;font-size:14px}.divider::before,.divider::after{content:"";flex:1;border-top:1px solid #dce2ea}.notice{border-left:4px solid #64748b;padding:8px 12px;margin:0 0 24px}h2{font-size:20px;line-height:1.4;margin:32px 0 16px}.secondary-link{margin:16px 0 0;text-align:center;font-size:15px}.secondary-link a{display:inline-block;min-width:24px;min-height:24px;color:#334155;font-weight:600;text-decoration:underline;text-decoration-thickness:1px;text-underline-offset:3px}.secondary-link a:hover{text-decoration-thickness:2px}.secondary-link a:focus-visible{outline:3px solid #172033;outline-offset:2px;border-radius:2px}@media(prefers-color-scheme:dark){input:focus-visible,.secondary-link a:focus-visible{outline-color:#f8fafc}.divider{color:#cbd5e1}.divider::before,.divider::after{border-color:#475569}.secondary-link a{color:#cbd5e1}}`;
 
 export async function pageResponse({ branding, title, heading, content, status = 200, method = 'GET', referrer, formTargets = [] }) {
   const css = stylesheet(branding.accentColor) + FORMS + (branding.theme ? themed(branding.accentColor) : '');

package/modules/operator-auth/routes.mjs

@@ -42,7 +42,7 @@ export function createAuthHandler(auth) {
       if (path === '/auth/operators' && request.method === 'GET') return json(await auth.listOperators(request));
       if (path === '/auth/sessions' && request.method === 'GET') return json(await auth.listSessions(request, readParameters(url.searchParams).operatorId));
       if (path === '/auth/domain-rules' && request.method === 'GET') return json(await auth.listDomainRules(request));
-      if (path === '/auth/settings/identity' && request.method === 'GET') {const value=await auth.identitySettings(request);return /text\/html/.test(request.headers.get('accept')??'')?identitySettingsPage(value):json(value);}
+      if (path === '/auth/settings/identity' && request.method === 'GET') {const value=await auth.identitySettings(request);return /text\/html/.test(request.headers.get('accept')??'')?await identitySettingsPage(value,auth.presentation):json(value);}
       if (path === '/auth/providers' && request.method === 'GET') return json(await auth.listProviders(request));
       const posts = new Set(['/auth/bootstrap', '/auth/magic-link', '/auth/confirm', '/auth/signout', '/auth/invite', '/auth/invite/cancel', '/auth/review-session',
         '/auth/operator/status', '/auth/operator/role', '/auth/session/revoke', '/auth/step-up', '/auth/domain-rules', '/auth/providers/unlink', '/auth/providers/relink', '/auth/settings/identity', '/auth/setup-complete']);

package/modules/portability/README.md

@@ -32,6 +32,15 @@ schema at construction. Apply the bookkeeping migration first. Policy fields:
 | `extraPayloads` | Named `{produce,consume}` pairs. Producers return bytes or a byte stream. Consumers receive a verified byte stream and descriptor before D1 commit. |
 | `partBytes` | Maximum part size, default 16 MiB, configurable from 1 KiB to 16 MiB. |
 
+Archives always skip Base's own tables: SQLite and Cloudflare internals, the
+migration ledgers (`d1_migrations`, `_rer_deploy_migrations`,
+`_rer_portability_migrations`), portability bookkeeping, development outboxes,
+operator identity and dependency secrets. `excludedTables` lists them (exact
+names, or prefixes ending in `%`), and `excludedTable(name, policy)` says whether
+an archive under that policy skips a table. A seed's own table inventory, which
+refuses tables it does not know, uses the same predicate, so it does not refuse a
+table Base created and never archives.
+
 For native local CLI transfers, declare executable policy through
 `localPortability({database, buckets, policyModule})`. `policyModule` is a
 seed-root-relative path or a `file:` URL (including `new URL('./archive-policy.mjs',

package/modules/portability/bridge.mjs

@@ -54,10 +54,13 @@ async function placement(db,manifest,cat,replay,applied) {
 // migrations that changed only data (a purge or a backfill) or added an index.
 // Those that change restorable data are refused like any other. Without a
 // replayer the statements cannot be read, so an archive whose recorded
-// migrations the destination's ledger has outgrown is refused.
+// migrations the destination's ledger has outgrown is refused. An archive that
+// records a migration the destination never applied is newer than it, even
+// when that migration left the schema as it was (an index, a data change).
 export async function sameSchemaMigrations(db,manifest,cat,migrations) {
   const applied=await appliedMigrations(db);
   if(!applied)return;
+  insist(!manifest.migrations || manifest.migrations.every(name=>applied.includes(name)),'schema_mismatch:migrations');
   if(!migrations){insist(!manifest.migrations || applied.every(name=>manifest.migrations.includes(name)),'schema_mismatch:migrations');return;}
   await placement(db,manifest,cat,await migrations(),applied);
 }

package/modules/portability/catalogue.mjs

@@ -1,6 +1,10 @@
 import { all, insist, quote, PortabilityError } from './storage.mjs';
 import { canonicalJson, sha256, base64, unbase64, utf8 } from './hash.mjs';
-const defaults=['sqlite_%','_cf_%','d1_migrations','_rer_deploy_migrations','_rer_portability_migrations','rer_portability_%','rer_mail_development_outbox','rer_ai_development_outbox','oa_%','oc_%','rer_dependency_keys','rer_dependency_pending','rer_dependency_codes'];
+/** Tables no archive carries: SQLite/Cloudflare internals, migration ledgers,
+ * portability bookkeeping, development outboxes, operator identity and dependency
+ * secrets. Exact names, or prefixes ending in `%`. Seeds' own table inventories
+ * skip the same tables through `excludedTable`. */
+export const excludedTables=Object.freeze(['sqlite_%','_cf_%','d1_migrations','_rer_deploy_migrations','_rer_portability_migrations','rer_portability_%','rer_mail_development_outbox','rer_ai_development_outbox','oa_%','oc_%','rer_dependency_keys','rer_dependency_pending','rer_dependency_codes']);
 const fields=['product','excludeTables','includeTables','derivedTables','secretColumns','exportRow','replaceableTables','requiredConfiguration','validateStaged','acceptedSchemas','buckets','extraPayloads','partBytes'];
 const name=value=>typeof value==='string' && value.length>0 && value.length<=512 && !/[\x00-\x1f]/.test(value);
 const names=value=>Array.isArray(value) && value.every(name) && new Set(value).size===value.length;
@@ -19,10 +23,13 @@ export function policy(input) {
   }
   for(const [key,entry] of Object.entries(result.extraPayloads)) insist(name(key) && typeof entry.produce==='function' && typeof entry.consume==='function','invalid_extra_payload');
   for(const key of ['secretColumns','acceptedSchemas','buckets','extraPayloads'])result[key]=Object.assign(Object.create(null),result[key]);
-  return {...result,excludeTables:[...defaults,...result.excludeTables]};
+  return {...result,excludeTables:[...excludedTables,...result.excludeTables]};
 }
 const identifier=value=>value.replace(/[A-Z]/g,letter=>letter.toLowerCase());
 const matches=(table,pattern)=>pattern.endsWith('%') ? identifier(table).startsWith(identifier(pattern.slice(0,-1))) : identifier(table)===identifier(pattern);
+/** True when no archive carries `table`: one of Base's `excludedTables`, or one of
+ * the policy's own `excludeTables`, unless the policy includes it explicitly. */
+export const excludedTable=(table,input={})=>!(input.includeTables??[]).includes(table) && [...excludedTables,...(input.excludeTables??[])].some(pattern=>matches(table,pattern));
 async function archived(db,config) {
   const objects=await all(db,"SELECT name,sql,type,tbl_name FROM sqlite_master WHERE sql IS NOT NULL ORDER BY name");
   const kinds=await all(db,'PRAGMA table_list');

package/modules/portability/index.d.mts

@@ -54,5 +54,9 @@ export function makePart(index:number,items:Item[]):Promise<Part>;
 export function canonicalJson(value:unknown):string;
 export function sha256(value:string|Uint8Array):Promise<string>;
 export const MAX_LINE_BYTES:number;
+/** Tables no archive carries (exact names, or prefixes ending in `%`). */
+export const excludedTables:readonly string[];
+/** True when no archive under this policy carries `table`. */
+export function excludedTable(table:string,policy?:Pick<ArchivePolicy,'excludeTables'|'includeTables'>):boolean;
 export const MAX_PART_BYTES:number;
 export class PortabilityError extends Error {code:string;status:number;constructor(code:string,status?:number)}

package/modules/portability/index.mjs

@@ -4,6 +4,7 @@ import { createExport, advanceExport, exportStatus, downloadExport, abortExport
 import { createImport, uploadPart, finalizeImport, importStatus, abortImport } from './import.mjs';
 import { erasureStatements, redactionStatements, invalidateTransfersStatements } from './journal.mjs';
 export { archiveLines } from './lines.mjs';
+export { excludedTables, excludedTable } from './catalogue.mjs';
 export { readArchive, makePart, MAX_LINE_BYTES, MAX_PART_BYTES } from './format.mjs';
 export { canonicalJson, sha256 } from './hash.mjs';
 export { PortabilityError } from './storage.mjs';

package/modules/portability/lines.mjs

@@ -14,7 +14,9 @@ export async function* archiveLines(source, maxLineBytes) {
     buffer.set(fragment, bytes); bytes = required;
   }
   function line() {
-    const value = decoder.decode(buffer.subarray(0, bytes)); bytes = 0;
+    // Invalid UTF-8 is malformed archive text: the same constant diagnostic as invalid JSON.
+    let value; try { value = decoder.decode(buffer.subarray(0, bytes)); } catch { throw new Error('archive_json'); }
+    bytes = 0;
     return value.endsWith('\r') ? value.slice(0, -1) : value;
   }
   try {

package/modules/release/produce.mjs

@@ -39,7 +39,7 @@ export async function release({ repo, ref = 'HEAD', output, project, repository,
     git(checkout, 'checkout', '--detach', source.commit);
     // Honour the seed's committed install policy. Base's native-build settings
     // are not interchangeable with pnpm 8's locked onlyBuiltDependencies.
-    const install = await command('pnpm', ['install', '--frozen-lockfile'], checkout);
+    const install = await command('pnpm', ['install', '--frozen-lockfile'], checkout, { dependencies: true });
     const verify = install.status === 'PASS' ? await command('pnpm', ['run', 'verify'], checkout) : { status: 'FAIL', reason: 'frozen-install-failed', tests: 0, passed: 0, failed: 0, output: install.output };
     // Release-only scale and capacity cases stay outside routine CI. The
     // committed seed script is an additional gate in previews and releases.

package/modules/release/source.mjs

@@ -68,12 +68,15 @@ function failureTail(logs) {
   return bytes.subarray(Math.max(0, bytes.length - TAIL_BYTES)).toString('utf8').replace(/^\uFFFD+/, '');
 }
 
-export async function command(command, args, cwd) {
+// A dependency install runs code the seed did not write, so it gets the
+// shared credential-free environment; the seed's own verify keeps the caller's.
+export async function command(command, args, cwd, { dependencies = false } = {}) {
  const {createCommands}=await shared('commands.mjs');
+ const inherited=dependencies?(await shared('dependency-environment.mjs')).dependencyEnvironment():process.env;
  const directory=await mkdtemp(resolve(tmpdir(),'rer-release-'));
  const state={logs:[]};
  const store=await createCommands(directory,state,{terminal:()=>{},queue:{verb:'release'}});
- const summary=testSummary(),env={...process.env,FORCE_COLOR:'0'};delete env.NODE_TEST_CONTEXT;
+ const summary=testSummary(),env={...inherited,FORCE_COLOR:'0'};delete env.NODE_TEST_CONTEXT;
  try {
   await store.run('Release verification',command,args,{cwd,env,onChild:child=>child.stdout.on('data',bytes=>summary.write(bytes))});
   return {status:'PASS',exitCode:0,...summary.finish()};

package/onboarding/adapter-labels.mjs

@@ -9,5 +9,6 @@ export const labels = Object.freeze({
  signIn: 'Opening sign-in through the development outbox',
  hosting: 'Deploying to your Cloudflare account',
  complete: 'Your application is running locally',
+ built: 'Your application is built',
 });
 

package/onboarding/adapter.mjs

@@ -7,6 +7,7 @@ import { buildEnvironment } from './local/environment.mjs';
 import { localOperation } from './local/operation.mjs';
 import { recoverInterrupted } from './local/recovery.mjs';
 import { credentialValues } from './redaction.mjs';
+import { dependencyEnvironment } from './dependency-environment.mjs';
 import { labels } from './adapter-labels.mjs';
 import { chooseOrigin, prepareSettings, readSettings } from './adapter-settings.mjs';
 import {listenerPorts} from './process-diagnostics.mjs';
@@ -66,9 +67,12 @@ export function localInstaller(hooks = {}) {
   if (['dev','preview'].includes(verb) && hooks.secrets?.originKey) context.vars[hooks.secrets.originKey] = context.origin;
   store.addSecrets?.(Object.entries(context.vars).filter(([key]) => /secret|token|password/i.test(key)).map(([, value]) => value));
   if (['installer', 'setup', 'build'].includes(verb) && hooks.build) await build(context, hooks);
-  if (['installer', 'setup'].includes(verb) && hooks.migrate) await phase(context, hooks, 'migrate', hooks.migrate);
+  // A demo (dev with options.demo) starts on fresh state in options.demo.state:
+  // migrate it, then claim the saved owner there exactly as setup does.
+  const demo = verb === 'dev' && Boolean(options.demo);
+  if ((['installer', 'setup'].includes(verb) || demo) && hooks.migrate) await phase(context, hooks, 'migrate', hooks.migrate);
   if (['installer', 'setup', 'dev', 'preview'].includes(verb) && hooks.start) await start(context, verb === 'preview' ? {...hooks,start:options.preview} : verb === 'dev' && options.dev ? { ...hooks, start: options.dev } : hooks);
-  if (['installer', 'setup'].includes(verb) && hooks.owner) {
+  if ((['installer', 'setup'].includes(verb) || demo) && hooks.owner) {
    if (typeof hooks.owner === 'function' || Array.isArray(hooks.owner)) await phase(context, hooks, 'owner', hooks.owner);
    else await owner(context, hooks.owner);
   }
@@ -78,7 +82,7 @@ export function localInstaller(hooks = {}) {
   if (verb === 'installer' && hooks.hosting) await hosting(context, hooks.hosting);
   store.state.appUrl = context.appUrl ?? (context.app ? context.origin : context.hostedUrl ?? context.origin);
   if (context.hostedUrl) store.state.hostedUrl = context.hostedUrl;
-  await store.step(labels.complete);
+  await store.step(verb === 'build' ? labels.built : labels.complete);
   await store.phase('complete');
   return context;
  }
@@ -157,7 +161,8 @@ async function commandsFor(context, hook) {
 async function phase(context, hooks, name, hook) {
  await context.store.step(labels[name]);
  for (const [command, args = [], options = {}] of await commandsFor(context, hook)) {
-  await context.run(labels[name], command, args, { step: steps[name], ...options });
+  // Dependency installs run third-party build scripts without credentials.
+  await context.run(labels[name], command, args, { step: steps[name], ...options, ...(name === 'dependencies' ? { env: dependencyEnvironment(options.env ?? process.env) } : {}) });
  }
 }
 

package/onboarding/dependency-environment.mjs

@@ -0,0 +1,33 @@
+// A dependency install runs code the seed did not write: the package manager
+// and every build script it allows (esbuild, workerd, sharp, oxide). It gets
+// only the variables an install needs, named below; every other variable,
+// whatever it is called, stays with the caller. The seed's own commands that
+// need credentials, such as deploy, still receive the whole environment.
+import { applicationBindings } from './local/environment.mjs';
+import { credentialName, credentialValue } from './redaction.mjs';
+
+// The shell, locale, terminal and temporary folders, Node's own settings, and
+// the SSH agent a git+ssh dependency is fetched through. Kept whatever their
+// value looks like: a directory may resemble a token.
+const system = /^(PATH|HOME|USER|LOGNAME|SHELL|TMPDIR|TMP|TEMP|TERM|LANG|LANGUAGE|LC_[A-Z]+|TZ|CI|SSH_AUTH_SOCK|NODE_OPTIONS|NODE_EXTRA_CA_CERTS|XDG_[A-Z_]+)$/;
+// The install reaches its registry through these; any user:password is dropped.
+const proxy = /^(https?_proxy|all_proxy|no_proxy)$/i;
+// Package manager settings and rer's control variables, except credentials.
+const settings = /^(npm_config_|PNPM_|COREPACK_|RER_)/i;
+// Credential words inside a name, also run together: NPM_CONFIG__AUTHTOKEN,
+// PNPM_REGISTRY_PASSWORD, RER_PREVIEW_TOKEN, RER_SIGNING_KEY.
+const credentialPart = /TOKEN|SECRET|PASSW(OR)?D|PASSPHRASE|CREDENTIAL|CREDS|JWT|COOKIE|WEBHOOK|SESSION|AUTH(?!OR)|(API|ACCESS|PRIVATE|SIGNING|ENCRYPTION|MASTER|LICENSE)_?KEY/i;
+
+// Up to the last @ of the authority, whatever the password holds (spaces included), after any leading whitespace.
+const withoutUserinfo = value => value.replace(/^\s*([a-z][a-z0-9+.-]*:\/\/)?[^/?#]*@/i, '$1');
+
+export function dependencyEnvironment(env = process.env) {
+ const kept = {};
+ for (const [key, value] of Object.entries(env)) {
+  if (value === undefined) continue;
+  if (system.test(key)) kept[key] = value;
+  else if (proxy.test(key)) kept[key] = withoutUserinfo(value);
+  else if (settings.test(key) && !(credentialName(key) || credentialPart.test(key) || applicationBindings.test(key) || credentialValue(value))) kept[key] = value;
+ }
+ return kept;
+}

package/onboarding/local/owner.mjs

@@ -27,7 +27,7 @@ export async function assertLocalOwner(root,email,failure=message=>Error(message
  if(!Array.isArray(owners)||owners.some(owner=>typeof owner!=='string'))throw failure('The localOwner hook must return existing owner email addresses without changing state.');
  if(owners.length&&!owners.some(owner=>owner.toLowerCase()===email.toLowerCase())){
   const address=safeOwner(owners[0]);
-  throw failure(`Local database already belongs to ${address}. Restore ${setting} to ${address}, then run rer setup --owner-email ${address}; or back up data and run rer reset --yes. Existing data and private settings were kept.`);
+  throw failure(`Local database already belongs to ${address}. Restore ${setting} to ${address}, then run rer setup --owner-email ${address}; or back up data, run rer dev --stop, then rer reset --yes followed by rer setup --owner-email ${safeOwner(email)}. Reset deletes local data. Existing data and private settings were kept.`);
  }
  return owners;
 }