@runeditrun/rer 0.2.2 → 0.2.5

package/modules/demo-host/capacity.mjs

@@ -0,0 +1,19 @@
+import { DurableObject } from 'cloudflare:workers';
+
+// One per demo Worker (idFromName('capacity')): the running demos and their
+// ends. A start is admitted while fewer than max_instances demos are live; a
+// demo releases its place when it ends, and a place past its end is free anyway.
+export class DemoCapacity extends DurableObject {
+  async acquire(id, ends, max) {
+    const now = Date.now(), places = await this.ctx.storage.list();
+    const over = [...places].filter(([, until]) => until <= now).map(([key]) => key);
+    if (over.length) await this.ctx.storage.delete(over);
+    if (places.size - over.length >= max) return false;
+    await this.ctx.storage.put(id, ends);
+    return true;
+  }
+
+  async release(id) {
+    await this.ctx.storage.delete(id);
+  }
+}

package/modules/demo-host/claim.mjs

@@ -0,0 +1,21 @@
+// The signed owner claim (modules/owner-claim) a demo's front Worker makes for
+// its container: one ES256 key pair per container, its public JWK given to the
+// container at start, and one five-minute claim signed with the private key,
+// which is never stored.
+const base64url = bytes => btoa(String.fromCharCode(...new Uint8Array(bytes))).replaceAll('+', '-').replaceAll('/', '_').replace(/=+$/, '');
+const segment = value => base64url(new TextEncoder().encode(JSON.stringify(value)));
+
+export async function claimKeys() {
+  const pair = await crypto.subtle.generateKey({ name: 'ECDSA', namedCurve: 'P-256' }, true, ['sign', 'verify']);
+  const { kty, crv, x, y } = await crypto.subtle.exportKey('jwk', pair.publicKey);
+  const kid = crypto.randomUUID().replaceAll('-', '');
+  return { kid, privateKey: pair.privateKey, publicKeys: { [kid]: { kty, crv, x, y, kid, alg: 'ES256', use: 'sig' } } };
+}
+
+/** The compact JWS /auth/owner-claim verifies: issuer and audience are the demo's own origin. */
+export async function signClaim({ kid, privateKey }, { origin, installationId, email, now }) {
+  const iat = Math.floor(now / 1000);
+  const signed = `${segment({ alg: 'ES256', typ: 'rer-owner-claim+jwt', kid })}.${segment({ v: 1, iss: origin, aud: origin, installationId, email, jti: crypto.randomUUID(), iat, exp: iat + 300 })}`;
+  const signature = await crypto.subtle.sign({ name: 'ECDSA', hash: 'SHA-256' }, privateKey, new TextEncoder().encode(signed));
+  return `${signed}.${base64url(signature)}`;
+}

package/modules/demo-host/container.mjs

@@ -0,0 +1,74 @@
+import { DurableObject } from 'cloudflare:workers';
+import { claimKeys, signClaim } from './claim.mjs';
+import { endedPage, clearCookie } from './pages.mjs';
+
+// One visitor's demo: a Durable Object (newUniqueId) and its container, the
+// seed's image from `rer build --platform container` on the workerd engine.
+// The container starts with no internet and in demo mode, so withDemo and the
+// engine's egress worker refuse every send. The front signs the owner in
+// through the existing signed owner claim. The demo ends at its hour or after
+// 15 idle minutes: the alarm destroys the container and deletes everything.
+const PORT = 8080, IDLE = 15 * 60_000, OWNER = 'owner@demo.invalid';
+// The container's port speaks plain HTTP; the app takes its public origin from RER_INGRESS_ORIGIN.
+const inside = url => `http://container${url.pathname}${url.search}`;
+const random = () => [...crypto.getRandomValues(new Uint8Array(32))].map(byte => byte.toString(16).padStart(2, '0')).join('');
+
+export class DemoContainer extends DurableObject {
+  idle = IDLE;
+  get container() { return this.ctx.container; }
+  port() { return this.container.getTcpPort(PORT); }
+
+  /** Start the container, wait for /health, claim the owner; returns the claim's 303. */
+  async start({ origin, originVar, ends, endsLocal, settings }) {
+    const id = this.ctx.id.toString(), keys = await claimKeys(), now = Date.now();
+    await this.ctx.storage.put({ ends, seen: now });
+    await this.ctx.storage.setAlarm(Math.min(ends, now + this.idle));
+    this.container.start({ enableInternet: false, env: { ...settings, RER_DEMO: '1', [originVar]: origin, RER_INGRESS_ORIGIN: origin,
+      SESSION_SECRET: random(), SETUP_TOKEN: random(), OWNER_EMAIL: OWNER, RER_OWNER_CLAIM_ISSUER: origin, RER_OWNER_CLAIM_INSTALLATION_ID: id,
+      RER_OWNER_CLAIM_PUBLIC_KEYS: JSON.stringify(keys.publicKeys), RER_DEMO_EXPIRES: endsLocal } });
+    // A container that stops by itself ends the demo too.
+    this.container.monitor().then(() => this.end(), () => this.end());
+    await this.healthy();
+    const token = await signClaim(keys, { origin, installationId: id, email: OWNER, now: Date.now() });
+    const claimed = await this.port().fetch('http://container/auth/owner-claim', { method: 'POST', redirect: 'manual',
+      headers: { origin, 'content-type': 'application/x-www-form-urlencoded' }, body: new URLSearchParams({ token }) });
+    await claimed.body?.cancel();
+    if (claimed.status !== 303) throw new Error(`owner claim answered ${claimed.status}`);
+    return { location: claimed.headers.get('location'), cookies: claimed.headers.getSetCookie() };
+  }
+
+  async healthy() {
+    for (const deadline = Date.now() + 120_000; ;) {
+      try {
+        const response = await this.port().fetch('http://container/health');
+        await response.body?.cancel();
+        if (response.ok) return;
+      } catch { /* The container is still starting. */ }
+      if (Date.now() > deadline) throw new Error('demo container never became healthy');
+      await new Promise(resolve => setTimeout(resolve, 250));
+    }
+  }
+
+  /** Every request carrying this demo's cookie: proxied while the demo lives, else the ended page. */
+  async fetch(request) {
+    const state = await this.ctx.storage.get(['ends', 'seen']), now = Date.now();
+    if (!(state.get('ends') > now)) return endedPage(this.env, { status: 410, headers: { 'set-cookie': clearCookie(this.env) } });
+    if (now - state.get('seen') > 60_000) await this.ctx.storage.put('seen', now);
+    return this.port().fetch(new Request(inside(new URL(request.url)), request));
+  }
+
+  async alarm() {
+    const state = await this.ctx.storage.get(['ends', 'seen']), now = Date.now();
+    if (!state.get('ends')) return;
+    if (now >= state.get('ends') || now - state.get('seen') >= this.idle) return this.end();
+    await this.ctx.storage.setAlarm(Math.min(state.get('ends'), state.get('seen') + this.idle));
+  }
+
+  /** Destroy the container and delete this demo's state and place; safe to repeat. */
+  async end() {
+    if (this.container.running) await this.container.destroy().catch(() => { /* Already stopping. */ });
+    await this.ctx.storage.deleteAlarm();
+    await this.ctx.storage.deleteAll();
+    await this.env.CAPACITY.get(this.env.CAPACITY.idFromName('capacity')).release(this.ctx.id.toString());
+  }
+}

package/modules/demo-host/pages.mjs

@@ -0,0 +1,56 @@
+// The demo host's two pages, from their 12ui designs: the start page (the
+// Turnstile managed widget submits the form by itself) and the ended page.
+// Both are one card in the family's quiet sign-in style.
+const escape = value => String(value).replace(/[&<>"']/g, character => `&#${character.charCodeAt(0)};`);
+
+const STYLE = `*{box-sizing:border-box}body{margin:0;background:#f2f5f7;color:#192333;font-family:system-ui,-apple-system,'Segoe UI',Arial,sans-serif;-webkit-font-smoothing:antialiased}
+main{width:666px;margin:clamp(32px,18vh,184px) auto 48px}.card{padding:40px 42px 44px;background:#fff;border:1px solid #d6dfe9;border-radius:18px;box-shadow:0 12px 45px rgba(42,65,86,.05)}
+.mark{width:35px;height:6px;border-radius:4px;background:#20574d;margin:0 0 20px}.brand{font-size:18px;line-height:22px;font-weight:600;color:#527875;margin:0 0 14px}
+h1{font-size:42px;line-height:50px;letter-spacing:-1.3px;margin:0 0 14px;font-weight:700}.intro{font-size:20px;line-height:28px;color:#41516a;margin:0}
+ul{padding:0;margin:23px 0 35px;list-style:none;color:#31415a;font-size:18px;line-height:33px}li{position:relative;padding-left:33px}li:before{content:'';position:absolute;left:7px;top:14px;width:7px;height:7px;background:#2b7864;border-radius:50%}
+.notice{margin:0 0 16px;padding:12px 16px;border-radius:8px;background:#fdf6ec;color:#6b3d0f;font-size:16px;line-height:22px}
+.cf-turnstile{min-height:65px}.button{display:block;width:100%;margin-top:28px;min-height:58px;border:1px solid #86a49f;border-radius:11px;background:linear-gradient(110deg,#225b51,#1e5148 60%,#20584d);color:#fff;font:inherit;font-size:20px;font-weight:700;line-height:26px;padding:15px;text-align:center;text-decoration:none;cursor:pointer}
+.button:disabled{opacity:.7;cursor:progress}.button:focus-visible,a:focus-visible{outline:3px solid #388c77;outline-offset:4px}
+.note{font-size:15px;line-height:21px;color:#50617e;text-align:center;margin:21px 0 0}.secondary{text-align:center;margin:22px 0 0;font-size:18px;line-height:24px;font-weight:600}.secondary a{color:#1b554e;text-underline-offset:3px}
+.back{text-align:center;margin:32px 0 0;font-size:15px;line-height:22px}.back a{color:#1b554e;text-underline-offset:3px}
+.ended main{width:min(560px,calc(100% - 32px));margin-top:clamp(32px,26vh,262px)}.ended .card{padding:28px 36px 42px}.ended .brand{font-size:16px;margin-bottom:26px}.ended h1{font-size:36px;line-height:44px;margin-bottom:22px}.ended .intro{margin-bottom:36px}.ended .button{margin-top:0;font-size:18px}
+@media(min-width:600px) and (max-width:1023px){main{width:calc(100% - 64px);max-width:666px;margin:100px auto 48px}.card{padding:36px}h1{font-size:38px;line-height:46px}.intro{font-size:18px;line-height:27px}}
+@media(max-width:599px){main,.ended main{width:calc(100% - 32px);margin:32px auto}.ended .card{padding:26px 22px}.ended h1{font-size:29px;line-height:36px}.ended .intro{font-size:17px;line-height:25px;margin-bottom:28px}.card{padding:26px 22px;border-radius:16px}.brand{font-size:16px}h1{font-size:34px;line-height:41px;letter-spacing:-.8px}.intro{font-size:17px;line-height:25px}ul{font-size:16px;line-height:25px;margin:22px 0 26px}li{padding-left:22px;margin-bottom:9px}li:before{left:2px;top:9px}.button{font-size:18px;margin-top:22px}.note{font-size:13px;line-height:20px}.back{margin-top:24px;font-size:14px}}`;
+
+// Starts the demo once Turnstile has passed: the widget put its token in the form.
+// After a refused start the page waits for the visitor's own click instead.
+const SCRIPT = `function rerDemoBusy(){document.querySelector('#start button').disabled=true;document.getElementById('status').textContent='Starting your demo…'}
+function rerDemoStart(){rerDemoBusy();document.getElementById('start').submit()}
+function rerDemoReady(){document.querySelector('#start button').disabled=false}
+addEventListener('DOMContentLoaded',()=>document.getElementById('start').addEventListener('submit',rerDemoBusy))`;
+
+function html(env, { page, title, body, status = 200, headers = {}, turnstile = false }) {
+  const nonce = crypto.randomUUID().replaceAll('-', ''), site = new URL(env.DEMO_SITE);
+  const policy = `default-src 'none'; style-src 'nonce-${nonce}'; img-src 'self'; form-action 'self'; base-uri 'none'; frame-ancestors 'none'${turnstile ? `; script-src 'nonce-${nonce}' https://challenges.cloudflare.com; frame-src https://challenges.cloudflare.com; connect-src https://challenges.cloudflare.com` : ''}`;
+  return new Response(`<!DOCTYPE html><html lang="en"><head><meta charset="utf-8"><meta name="viewport" content="width=device-width,initial-scale=1"><meta name="robots" content="noindex"><title>${escape(title)}</title><style nonce="${nonce}">${STYLE}</style>${turnstile ? `<script nonce="${nonce}">${SCRIPT}</script><script nonce="${nonce}" src="https://challenges.cloudflare.com/turnstile/v0/api.js" async defer></script>` : ''}</head>
+<body class="${page}"><main><section class="card" aria-labelledby="title"><div class="mark" aria-hidden="true"></div><p class="brand">${escape(env.DEMO_NAME)}</p>${body}</section><nav class="back" aria-label="Return"><a href="${escape(site.origin)}/">Back to ${escape(site.host)}</a></nav></main></body></html>`,
+  { status, headers: { 'content-type': 'text/html; charset=utf-8', 'cache-control': 'no-store', 'content-security-policy': policy, 'referrer-policy': 'strict-origin', 'x-content-type-options': 'nosniff', ...headers } });
+}
+
+/** GET /: the visitor proves they are human and their demo starts. `notice` explains a refused start. */
+export function startPage(env, { status = 200, notice } = {}) {
+  const name = escape(env.DEMO_NAME);
+  return html(env, { page: 'start', title: `Try ${env.DEMO_NAME}`, status, turnstile: true, body: `<h1 id="title">Try ${name}</h1>
+<p class="intro">Your own copy of ${name}, signed in as its owner, with sample data.</p>
+<ul><li>Nothing is sent: mail stays in an outbox.</li><li>It ends after an hour, or 15 idle minutes.</li><li>Then it is deleted. Nobody else can see it.</li></ul>
+${notice ? `<p class="notice" role="alert">${escape(notice)}</p>` : ''}<form id="start" method="post" action="/__demo/start"><div class="cf-turnstile" data-sitekey="${escape(env.TURNSTILE_SITE_KEY)}" data-size="flexible" data-callback="${notice ? 'rerDemoReady' : 'rerDemoStart'}"></div>
+<button class="button" type="submit" disabled>Start the demo</button><p class="note" id="status" role="status">Starts by itself once the check passes. Takes about ten seconds.</p></form>` });
+}
+
+/** A demo whose hour or idle time is up: its container and data are gone. */
+export function endedPage(env, { status = 410, headers = {} } = {}) {
+  const name = escape(env.DEMO_NAME);
+  return html(env, { page: 'ended', title: 'This demo has ended', status, headers, body: `<h1 id="title">This demo has ended</h1>
+<p class="intro">Demos last an hour, or until 15 minutes pass with nothing happening. Its copy of ${name} and everything in it have been deleted.</p>
+<a class="button" href="/">Start a new demo</a><p class="secondary"><a href="${escape(new URL(env.DEMO_SITE).origin)}/run">Run ${name} yourself</a></p>` });
+}
+
+const cookie = (env, value, seconds) => `rer_demo=${value}; Domain=${new URL(env.DEMO_ORIGIN).hostname}; Path=/; Max-Age=${seconds}; HttpOnly; Secure; SameSite=Lax`;
+/** The visitor's demo: HttpOnly, Secure, SameSite=Lax, for demo.<domain> and its subdomains, one hour. */
+export const demoCookie = (env, id) => cookie(env, id, 3600);
+export const clearCookie = env => cookie(env, '', 0);

package/modules/demo-host/plan.mjs

@@ -0,0 +1,52 @@
+import { createHash } from 'node:crypto';
+import { assert, resourceName } from '../deploy-kit/validation.mjs';
+import { ownerWorkerName } from '../deploy-kit/owner.mjs';
+import { siteDeclaration } from '../deploy-kit/site.mjs';
+
+/* A seed's hosted demo at demo.<domain>: the Worker `rer deploy --demo` builds
+ * from deploy-demo.json, as `rer deploy --site` builds the run site from
+ * deploy-site.json. It is this folder's front Worker plus a Container class
+ * running the seed's own image (`rer build --platform container`, workerd
+ * engine), deployed by `wrangler deploy` with the image beside it. */
+
+export const DEMO_FILES = ['worker.mjs', 'container.mjs', 'capacity.mjs', 'claim.mjs', 'pages.mjs'];
+const FRONT_SET = /^(?:RER_.*|SESSION_SECRET|SETUP_TOKEN|OWNER_EMAIL)$/;
+const SECRET = /SECRET|TOKEN|PASSWORD|_KEY$/;
+
+/**
+ * deploy-demo.json: `{ "version": 1, "domain": "run-lamp.com", "name": "Lamp" }`, plus optionally
+ * `maxInstances` (concurrent demos, default 10) and `settings`, the seed's plain demo settings
+ * (such as MAIL_PROVIDER: "development"). Settings never carry secrets or what the front sets.
+ */
+export function demoDeclaration(value, originVar) {
+  assert(value && typeof value === 'object' && !Array.isArray(value) && value.version === 1 && Object.keys(value).every(key => ['version', 'domain', 'name', 'maxInstances', 'settings'].includes(key)), 'invalid-demo-declaration');
+  siteDeclaration({ version: 1, domain: value.domain });
+  assert(typeof value.name === 'string' && value.name.trim() === value.name && value.name.length > 0 && value.name.length <= 60 && !/[\p{Cc}\p{Cf}]/u.test(value.name), 'invalid-demo-name');
+  const maxInstances = value.maxInstances ?? 10;
+  assert(Number.isSafeInteger(maxInstances) && maxInstances >= 1 && maxInstances <= 100, 'invalid-demo-max-instances');
+  const settings = value.settings ?? {};
+  assert(settings && typeof settings === 'object' && !Array.isArray(settings) && Object.entries(settings).every(([name, setting]) =>
+    /^[A-Z][A-Z0-9_]{0,63}$/.test(name) && !FRONT_SET.test(name) && !SECRET.test(name) && name !== originVar && typeof setting === 'string' && setting.length <= 1024), 'invalid-demo-settings');
+  return { domain: value.domain, name: value.name, maxInstances, settings };
+}
+
+/** The demo Worker's name and its Wrangler configuration; no provider request. */
+export function demoPlan({ project, environment, compatibilityDate, originVar, declaration, turnstileSiteKey }) {
+  assert(/^\d{4}-\d{2}-\d{2}$/.test(compatibilityDate ?? '') && /^[A-Z][A-Z0-9_]{0,63}$/.test(originVar ?? ''), 'invalid-plan');
+  const { domain, name, maxInstances, settings } = demoDeclaration(declaration, originVar);
+  const worker = `${ownerWorkerName(project, environment)}--demo`, hostname = `demo.${domain}`;
+  assert(resourceName(worker), 'owner-name-too-long');
+  // Rate limit namespaces are account-wide integers: one per demo Worker.
+  const namespace = String(1000 + parseInt(createHash('sha256').update(worker).digest('hex').slice(0, 8), 16) % 1_000_000_000);
+  const wrangler = {
+    name: worker, main: 'worker.mjs', compatibility_date: compatibilityDate, workers_dev: false, preview_urls: false,
+    routes: [{ pattern: hostname, custom_domain: true }],
+    vars: { DEMO_ORIGIN: `https://${hostname}`, DEMO_SITE: `https://${domain}`, DEMO_NAME: name, DEMO_ORIGIN_VAR: originVar, DEMO_MAX_INSTANCES: String(maxInstances), DEMO_SETTINGS: JSON.stringify(settings),
+      ...(turnstileSiteKey ? { TURNSTILE_SITE_KEY: turnstileSiteKey } : {}) },
+    durable_objects: { bindings: [{ name: 'DEMO', class_name: 'DemoContainer' }, { name: 'CAPACITY', class_name: 'DemoCapacity' }] },
+    migrations: [{ tag: 'v1', new_sqlite_classes: ['DemoContainer', 'DemoCapacity'] }],
+    containers: [{ class_name: 'DemoContainer', image: './image/Dockerfile', max_instances: maxInstances, instance_type: 'basic' }],
+    ratelimits: [{ name: 'STARTS', namespace_id: namespace, simple: { limit: 3, period: 60 } }],
+  };
+  return { worker, hostname, origin: `https://${hostname}`, maxInstances, settings: Object.keys(settings), wrangler };
+}

package/modules/demo-host/worker.mjs

@@ -0,0 +1,72 @@
+// A seed's hosted demo at demo.<domain>, generated by `rer deploy --demo`.
+// GET / shows the start page (a Turnstile managed widget that submits itself).
+// POST /__demo/start checks the visitor's IP rate limit, Turnstile and capacity,
+// then starts a container of their own, signs its owner in and sets the
+// rer_demo cookie. Every request with that cookie goes to the visitor's
+// container; nothing else on this host is reachable.
+import { startPage, demoCookie } from './pages.mjs';
+
+export { DemoContainer } from './container.mjs';
+export { DemoCapacity } from './capacity.mjs';
+
+const HOUR = 60 * 60_000;
+const home = () => new Response(null, { status: 303, headers: { location: '/' } });
+
+/** The visitor's demo from its cookie; ids are checked by idFromString, so a forged one is no demo. */
+function demoId(request, env) {
+  const value = (request.headers.get('cookie') ?? '').split(';').map(part => part.trim()).find(part => part.startsWith('rer_demo='))?.slice(9);
+  if (!value) return null;
+  try { return env.DEMO.idFromString(value); } catch { return null; }
+}
+
+// The demo's end in the visitor's time zone, as the Demo bar shows it (HH:MM).
+function localTime(time, timeZone = 'UTC') {
+  const parts = Object.fromEntries(new Intl.DateTimeFormat('en-US', { timeZone, hourCycle: 'h23', year: 'numeric', month: '2-digit', day: '2-digit',
+    hour: '2-digit', minute: '2-digit', second: '2-digit', timeZoneName: 'longOffset' }).formatToParts(time).map(part => [part.type, part.value]));
+  return `${parts.year}-${parts.month}-${parts.day}T${parts.hour}:${parts.minute}:${parts.second}${parts.timeZoneName === 'GMT' ? '+00:00' : parts.timeZoneName.slice(3)}`;
+}
+
+async function human(env, token, ip) {
+  if (typeof token !== 'string' || !token || token.length > 2048) return false;
+  const body = new URLSearchParams({ secret: env.TURNSTILE_SECRET_KEY, response: token });
+  if (ip) body.set('remoteip', ip);
+  const response = await fetch('https://challenges.cloudflare.com/turnstile/v0/siteverify', { method: 'POST', body });
+  const result = response.ok ? await response.json() : {};
+  if (result.success !== true) console.error('Turnstile refused a start:', response.status, JSON.stringify(result['error-codes'] ?? []));
+  return result.success === true;
+}
+
+async function start(request, env) {
+  if (request.headers.get('origin') !== env.DEMO_ORIGIN) return startPage(env, { status: 403, notice: 'Start the demo from this page.' });
+  const ip = request.headers.get('cf-connecting-ip') ?? '';
+  if (!(await env.STARTS.limit({ key: ip })).success) return startPage(env, { status: 429, notice: 'Too many demos started from your network. Try again in a minute.' });
+  const form = await request.formData();
+  if (!await human(env, form.get('cf-turnstile-response'), ip)) return startPage(env, { status: 403, notice: 'The check did not pass. Try again.' });
+  const id = env.DEMO.newUniqueId(), ends = Date.now() + HOUR;
+  if (!await env.CAPACITY.get(env.CAPACITY.idFromName('capacity')).acquire(id.toString(), ends, Number(env.DEMO_MAX_INSTANCES))) {
+    return startPage(env, { status: 503, notice: 'Every demo is in use right now. Try again in a few minutes.' });
+  }
+  const demo = env.DEMO.get(id);
+  try {
+    const signedIn = await demo.start({ origin: env.DEMO_ORIGIN, originVar: env.DEMO_ORIGIN_VAR, ends, endsLocal: localTime(ends, request.cf?.timezone), settings: JSON.parse(env.DEMO_SETTINGS) });
+    const headers = new Headers({ location: signedIn.location, 'cache-control': 'no-store' });
+    for (const cookie of [...signedIn.cookies, demoCookie(env, id.toString())]) headers.append('set-cookie', cookie);
+    return new Response(null, { status: 303, headers });
+  } catch (error) {
+    console.error('Demo start failed:', error.message);
+    await demo.end();
+    return startPage(env, { status: 502, notice: 'The demo did not start. Try again.' });
+  }
+}
+
+export default {
+  async fetch(request, env) {
+    const url = new URL(request.url);
+    if (url.pathname === '/__demo/start') return request.method === 'POST' ? start(request, env) : home();
+    const id = demoId(request, env);
+    if (id) return env.DEMO.get(id).fetch(request);
+    if (!['GET', 'HEAD'].includes(request.method)) return new Response('Start a demo first.', { status: 403 });
+    if (url.pathname !== '/') return home();
+    return startPage(env);
+  },
+};

package/modules/deploy-kit/README.md

@@ -114,7 +114,7 @@ The CLI prints JSON: refusal codes and resource names only, never inputs, tokens
 
 - **Inputs.** Declared secrets come from the environment, then `--env-file FILE` (an owned 0600 file of `KEY=VALUE` lines), which wins. For a secret the Worker does not hold yet, rer supplies the setup manifest's owner email (`emailField`) from the local setup's private settings, and a fresh random value for each secret field the manifest generates (`generate`), such as the session secret and the setup token; a value the Worker already holds is kept. A still-missing secret stops the run before any write with a message that names it.
 - **Hosted owner.** After deploy and health pass, rer claims the setup owner on the hosted app: it POSTs the setup token to the seed's standard owner step (`hooks.owner`, by default `/auth/bootstrap`). 303 means claimed; `409 already_initialized` means an owner was already claimed and is kept. Then rer deletes the token secret from the Worker, records the new Worker version in the state file, and lists the token in `retiredSecrets`, so later plans no longer declare it. A Worker that still holds a token rer did not upload in this run (an older deploy) first gets a fresh token through the same recorded secret change. Dependency approvals that need the token run before the claim. A seed with an owner step function, an identity-provider claim, or no declared token secret claims its owner its own way.
-- **Secret changes.** `rer deploy --set-secret NAME` (value from the environment or `--env-file`, under the declaration's environment name) and `--unset-secret NAME` change one declared secret of the recorded Worker without a build. A secret change deploys a new Worker version of the same code, so rer checks the build fingerprint is unchanged and records the new version id, deployment id and etag as the receipt's provider identity: the next deploy recognises its own Worker. An unset secret is retired until it is set again. The change is recorded as pending before it is sent, and the secret listing and active deployment are read until they show it (they lag the change by seconds); a change the provider answers with an error clears that record. If a run ends before the change settles (a lost response), the next run adopts the live version only when the Worker's versions list shows exactly one version after the receipt's, it is the live one, and its script etag and build fingerprint are still the receipt's. A change made outside rer (dashboard, Wrangler), including one made after rer's own, still reads as a replacement and is refused.
+- **Secret changes.** `rer deploy --set-secret NAME` (value from the environment or `--env-file`, under the declaration's environment name) and `--unset-secret NAME` change one declared secret of the recorded Worker without a build. Before writing, rer records the starting version and the exact live names of all other secrets, never their values. Accepted or ambiguous writes retain that intent until readback confirms the change; explicit refusals clear it. An ambiguous failure, or a later command's preflight, can clear an unapplied intent only when the live deployment still matches the receipt and the newest listed version matches it too. A surviving intent blocks further mutations until consistency returns; retry the same command then. Recovery requires the recorded immediate successor (or the recorded confirming rotation's successor), the receipt's script etag and fingerprint, the intended binding's presence, and an unchanged set of other secret names. Ambiguous rotations require a confirming PUT before reporting success. Older intents without names may recover only from the exact starting version's historical bindings, with its id, etag and fingerprint verified; unavailable or malformed historical bindings refuse adoption. Each historical binding must have an exact provider type supported by this kit; unrecognized types cannot prove that a name was not a secret. Added, removed or renamed other secrets refuse deploy and removal before writes. Values remain opaque: these checks cannot distinguish an otherwise identical outside change to the pending binding.
 - **Removal.** `rer deploy --remove --yes` deletes what the state file says rer created for this environment: the Worker (schedules first; its Durable Objects go with it) and each D1, R2, KV and queue that is still the one rer created, after checking all of them before the first delete. A replaced or uncertain resource refuses the whole removal, except a resource whose create answer was lost: under this environment's derived name it is deleted once it is confirmed empty (a D1 with no tables, a KV namespace with no keys, an R2 bucket, which the provider refuses to delete while it holds objects); one holding data is refused as `uncertain-resource-not-empty`, and a queue, whose backlog rer cannot read, as `uncertain-resource-unverifiable` (delete it by hand if it is the empty one from the interrupted run). It then reads back that none is still listed and deletes the state file. An R2 bucket must be empty; a bucket with objects stays, the state file keeps it, and a later `--remove --yes` finishes. Resources rer did not create are never touched.
 
 ### If the state file is lost
@@ -193,6 +193,17 @@ No Single Redirect (dynamic redirect ruleset) permission is needed. Base's refer
 
 SQL files have ordered unique names and SHA-256 identities. `d1_migrations` holds controller history with ordered IDs, names, timestamps, SHA-256 hashes and states. Native archives already exclude this installation table. Standard Wrangler name-only inserts remain possible, but their missing hashes/states block subsequent Base deployment pending reviewed adoption. Applied entries must be an unchanged prefix of the desired set. A new migration gets an `applying` claim before its SQL and completion marker are submitted together through the [Cloudflare D1 SQL import API](https://developers.cloudflare.com/api/resources/d1/subresources/database/methods/import/), using the same whole-file protocol as Wrangler to preserve compound trigger bodies and atomic SQL/completion. Uploads use bounded HTTPS R2 destinations, without account credentials; polling is bounded and signed URLs and import response text are never diagnostic output. Any interrupted, failed or uncertain outcome remains blocked and must be inspected explicitly; the kit never automatically retries, rolls back user data, or marks an unknown outcome successful. Readback checks every final identity.
 
+A seed that had to rewrite a migration it already released declares the rewrite
+in `migrations/rewrites.json`: `{ "version": 1, "rewrites": [{ "migration":
+"0019_import_custody.sql", "from": "<released SHA-256>", "to": "<current SHA-256>",
+"reason": "...", "reviewed": true }] }`. An applied row holding `from` then counts
+as that migration, so an upgrade past it proceeds; the ledger keeps the released
+digest it applied. A later migration must converge databases that applied the
+released bytes. The record is refused unless `reviewed` is `true`, it names a
+migration in the set, and `to` is that migration's current bytes; every other
+change to applied history is still refused. Keep the record for as long as any
+installation may hold the released digest.
+
 Completion preserves the original SQL bytes and always starts on a new line.
 Comment-only migrations are rejected before any provider request or ledger claim.
 The controller adds a separator only when the final non-comment token is not a
@@ -275,12 +286,14 @@ retains the existing window, retrying only 404, 503 and network failures for
 30 seconds by default.
 
 The returned receipt carries `health: {ok, versionId, attempts}`. Each attempt is
-`{offsetMs, status, cfRay, contentType, body, errorClass}`: `status` is null for
-a transport failure, `body` is the first 256 response bytes decoded as UTF-8 and
-`errorClass` is null for the passing attempt. A failed wait throws an error whose
-message names the class and the last status (for example
-`health-http-failed-last-status-503`) and which carries `attempts`, `status` and
-the identity `receipt` (with `health.ok` false). Provider diagnostics are never
+`{offsetMs, status, cfRay, contentType, errorClass}`: `status` is null for
+a transport failure and `errorClass` is null for the passing attempt. The receipt
+and owner state keep no response text, since an unhealthy app may echo a secret.
+A failed wait throws an error whose message names the class and the last status
+(for example `health-http-failed-last-status-503`) and which carries `attempts`
+(each with `body`, the first 256 response bytes decoded as UTF-8, for the
+caller's redacted diagnostic), `status` and the identity `receipt` (with
+`health.ok` false). Provider diagnostics are never
 retained; the endpoint must not return credentials. `readiness: {totalMs, clock,
 sleep}` selects a smaller bound and deterministic time; `healthOptions.now` and
 `healthOptions.sleep` act as `clock` and `sleep` for the same purpose.
@@ -290,6 +303,22 @@ sleep}` selects a smaller bound and deterministic time; `healthOptions.now` and
 replaces the mode-0600 receipt and refuses any change to its identity; the default
 CLI and owner-account state do this. A no-op repeat never rewrites the original receipt.
 
+Owner-account secret changes use the same bounded `waitHealth` after their new
+Worker version has settled and been recorded. This includes explicit
+`--set-secret`/`--unset-secret` commands, a fresh owner setup token, and the
+post-claim retirement performed by standard deploys and custom deploy hooks.
+Readiness checks the receipt source SHA, fingerprint and actual new version;
+it needs neither build output nor clean source for a secret-only command.
+Workers without a public route retain provider-only verification.
+
+A failed readiness check leaves the applied secret change, owner claim and token
+retirement recorded. The public command fails with the last HTTP status and the
+first bounded, redacted response line. Correct the seed/app configuration and
+redeploy; an app that requires an already spent setup token must remove that
+runtime requirement, rather than restoring the token or undoing ownership.
+The ownership receipt records readiness success/failure for the new version;
+untrusted response prefixes are never written into that record.
+
 ## Read-only teardown verification
 
 The kit does not perform deletes. After a seed has validated its receipt and

package/modules/deploy-kit/deploy.mjs

@@ -64,16 +64,23 @@ export async function deploy({api,plan,artifact,artifactSha256,previousReceipt,r
   return receipt;
 }
 
+// Response prefixes belong only in the caller's redacted diagnostic, never in
+// the ownership record: an unhealthy app may echo a secret, as the secret command also keeps.
+const recorded = attempts => attempts.map(({body:_,...attempt}) => attempt);
+
 /** After an upload the route may take a while to appear: wait for /health with a bound and
  * record every attempt in `receipt.health`. `onHealth(receipt)` runs after each attempt and at the end. */
 async function firstHealth({api,plan,receipt,fetch,healthOptions,readiness,onHealth,asset}) {
   receipt.health = {ok:false,attempts:[]};
   const {now,sleep,...options} = healthOptions;
   const wait = {...(now ? {clock:now} : {}),...(sleep ? {sleep} : {}),...readiness,onAttempt:async (_attempt,attempts) => {
-    receipt.health.attempts = [...attempts];
+    receipt.health.attempts = recorded(attempts);
     if (onHealth) await onHealth(receipt);
   }};
-  try { receipt.health = await verifyHealth({...options,api,plan,receipt,fetch,readiness:wait,asset}); }
+  try {
+    const health = await verifyHealth({...options,api,plan,receipt,fetch,readiness:wait,asset});
+    receipt.health = health.attempts ? {...health,attempts:recorded(health.attempts)} : health;
+  }
   catch (error) {
     receipt.health.ok = false; receipt.health.errorClass = error.message;
     if (onHealth) await onHealth(receipt);

package/modules/deploy-kit/env-file.mjs

@@ -21,6 +21,7 @@ export async function readDeployEnvFile(root, envFile, localOnlyKeys = []) {
     if (Object.hasOwn(settings, match[1])) throw new Error('Repeated deploy env key');
     settings[match[1]] = match[2].replace(/^"(.*)"$/, '$1');
   }
-  if ([...LOCAL_ONLY_KEYS, ...localOnlyKeys].some(key => Object.hasOwn(settings, key))) throw new Error('Local-only keys are refused for deploy');
+  const local = [...LOCAL_ONLY_KEYS, ...localOnlyKeys].find(key => Object.hasOwn(settings, key));
+  if (local) throw new Error(`Local-only key ${local} is refused for deploy; remove it from the file`);
   return settings;
 }

package/modules/deploy-kit/health-request.mjs

@@ -1,5 +1,10 @@
+import { StringDecoder } from 'node:string_decoder';
 import { assert } from './validation.mjs';
 
+// Do not flush an incomplete final character: a replacement would corrupt a
+// truncated credential prefix before the caller can redact it.
+const decodePrefix = bytes => new StringDecoder('utf8').write(bytes.subarray(0,256));
+
 async function bodyPrefix(response) {
   if (!response.body) return '';
   const reader = response.body.getReader(); let bytes = Buffer.alloc(0);
@@ -11,11 +16,12 @@ async function bodyPrefix(response) {
     }
   } catch { /* HTTP status remains authoritative if its diagnostic body breaks. */ }
   finally { await reader.cancel().catch(() => {}); }
-  return bytes.toString('utf8');
+  return decodePrefix(bytes);
 }
 
 /** One credential-free, bounded request. Retain only bounded response evidence. */
-export async function healthRequest({origin, receipt, versionId, request, timeoutMs, offsetMs}) {
+/** `expected` holds the deploy identity fields the caller knows; each must match. */
+export async function healthRequest({origin, expected, request, timeoutMs, offsetMs}) {
   const attempt = {offsetMs,status:null,cfRay:null,contentType:null,body:'',errorClass:null};
   let response;
   try {
@@ -41,7 +47,7 @@ export async function healthRequest({origin, receipt, versionId, request, timeou
         const {done,value} = await reader.read();
         if (done) break;
         bytes = Buffer.concat([bytes, value]);
-        attempt.body = bytes.subarray(0,256).toString('utf8');
+        attempt.body = decodePrefix(bytes);
         assert(bytes.length <= 65536,'response-too-large');
       }
     } finally { await reader.cancel().catch(() => {}); }
@@ -53,11 +59,12 @@ export async function healthRequest({origin, receipt, versionId, request, timeou
   let body;
   try { body = JSON.parse(bytes.toString('utf8')); }
   catch { attempt.errorClass = 'malformed-response'; return {attempt,transient:false}; }
-  if (body?.ok !== true || body.deployment?.sourceSha !== receipt.source.sha || body.deployment?.fingerprint !== receipt.fingerprint || body.deployment?.versionId !== versionId) {
+  if (body?.ok !== true || Object.entries(expected).some(([key, value]) => body.deployment?.[key] !== value)) {
     attempt.errorClass = 'health-identity-mismatch';
     // Right after an upload the edge can still answer from another version: that
     // settles within the bound. The expected version answering wrongly does not.
-    const other = body?.ok === true && typeof body.deployment?.versionId === 'string' && body.deployment.versionId !== versionId;
+    const key = expected.versionId ? 'versionId' : 'sourceSha';
+    const other = body?.ok === true && typeof body.deployment?.[key] === 'string' && body.deployment[key] !== expected[key];
     return {attempt,transient:other};
   }
   return {attempt,transient:false};
@@ -69,13 +76,13 @@ const MIN_DELAY_MS = 2000, MAX_DELAY_MS = 10000;
 
 /** The total bound includes requests, body reads and backoff; no request starts at the deadline.
  * Only a transient outcome is retried. Every attempt is recorded, in order, whatever the end. */
-export async function waitHealth({origin,receipt,versionId,request,timeoutMs=30000,totalMs=90000,clock=()=>performance.now(),sleep=ms=>new Promise(resolve=>setTimeout(resolve,ms)),onAttempt=()=>{},single=false}) {
+export async function waitHealth({origin,receipt,versionId,expected={sourceSha:receipt.source.sha,fingerprint:receipt.fingerprint,versionId},request,timeoutMs=30000,totalMs=90000,clock=()=>performance.now(),sleep=ms=>new Promise(resolve=>setTimeout(resolve,ms)),onAttempt=()=>{},single=false}) {
   assert(Number.isFinite(totalMs) && totalMs > 0 && totalMs <= 90000 && Number.isFinite(timeoutMs) && timeoutMs > 0,'invalid-health-bound');
   const start = clock(); const attempts = []; let delay = 1000;
   while (true) {
     const remaining = totalMs - (clock()-start);
     if (remaining <= 0) break;
-    const result = await healthRequest({origin,receipt,versionId,request,timeoutMs:Math.max(1,Math.ceil(Math.min(timeoutMs,remaining))),offsetMs:Math.round(clock()-start)});
+    const result = await healthRequest({origin,expected,request,timeoutMs:Math.max(1,Math.ceil(Math.min(timeoutMs,remaining))),offsetMs:Math.round(clock()-start)});
     attempts.push(result.attempt); await onAttempt(result.attempt,attempts);
     if (!result.attempt.errorClass) return {ok:true,versionId,attempts};
     // `single` asks once, except that an edge still answering from the previous version settles within the bound.

package/modules/deploy-kit/migration-ledger.mjs

@@ -4,7 +4,44 @@ export const ledger = 'd1_migrations';
 const legacy = '_rer_deploy_migrations';
 export const literal = value => `'${value.replaceAll("'","''")}'`;
 export const createLedger = `CREATE TABLE ${ledger} (id INTEGER PRIMARY KEY AUTOINCREMENT, name TEXT NOT NULL UNIQUE, applied_at TEXT NOT NULL DEFAULT CURRENT_TIMESTAMP, sha256 TEXT, state TEXT CHECK(state IN ('applying','applied')))`;
-const validPrefix = (rows, migrations) => rows.every((row, index) => row.name === migrations[index]?.name && row.sha256 === migrations[index]?.sha256 && row.state === 'applied');
+
+// Every ledger shape a deployment can hold: Wrangler's d1_migrations; that
+// table after the kit adopted it (sha256 and state added); the kit's own
+// d1_migrations, which rer 0.2.2 and later create; and the kit's
+// _rer_deploy_migrations from rer 0.2.1 and earlier, which stays authoritative
+// until the next deploy moves it into d1_migrations. Seed recovery code that
+// checks the ledger before reading or restoring it accepts all four with
+// migrationLedgerShape.
+const shapeColumns = table => `SELECT '${table}' AS ledger,cid,name,upper(type) AS type,"notnull",dflt_value,pk,hidden FROM pragma_table_xinfo('${table}')`;
+export const ledgerShapeQuery = `${shapeColumns(legacy)} UNION ALL ${shapeColumns(ledger)} ORDER BY ledger,cid`;
+const column = (name, type, notnull = 0, dflt_value = null, pk = 0) => ({ name, type, notnull, dflt_value, pk, hidden: 0 });
+const wrangler = [column('id','INTEGER',0,null,1), column('name','TEXT'), column('applied_at','TIMESTAMP',1,'CURRENT_TIMESTAMP')];
+const tracked = [column('sha256','TEXT'), column('state','TEXT')];
+const shapes = {
+  [ledger]: {
+    wrangler,
+    adopted: [...wrangler, ...tracked],
+    kit: [column('id','INTEGER',0,null,1), column('name','TEXT',1), column('applied_at','TEXT',1,'CURRENT_TIMESTAMP'), ...tracked],
+  },
+  [legacy]: { legacy: [column('name','TEXT',0,null,1), column('sha256','TEXT',1), column('state','TEXT',1)] },
+};
+/** The ledger's shape from its ledgerShapeQuery rows (node:sqlite or D1):
+ * { name, columns, shape } where shape is 'wrangler', 'adopted', 'kit' or
+ * 'legacy'. When both tables exist, _rer_deploy_migrations is the history, as
+ * restores read it. Any other shape throws invalid-migration-ledger. */
+export function migrationLedgerShape(rows) {
+  // Rows without a ledger column come from the d1_migrations-only query of rer 0.2.3.
+  const tables = Map.groupBy(rows ?? [], row => row.ledger ?? ledger);
+  const name = tables.has(legacy) ? legacy : ledger;
+  const read = (tables.get(name) ?? []).map(row => ({ name: row.name, type: String(row.type).toUpperCase(), notnull: Number(row.notnull), dflt_value: row.dflt_value ?? null, pk: Number(row.pk), hidden: Number(row.hidden) }));
+  const shape = Object.keys(shapes[name]).find(key => JSON.stringify(read) === JSON.stringify(shapes[name][key]));
+  assert(shape, 'invalid-migration-ledger');
+  return { name, columns: read.map(row => row.name), shape };
+}
+/** An applied row records this migration: its current bytes, or bytes a seed's
+ * reviewed rewrite record says this migration replaced. */
+export const recorded = (row, migration) => row.name === migration?.name && (row.sha256 === migration.sha256 || (migration.rewrites ?? []).some(rewrite => rewrite.from === row.sha256));
+const validPrefix = (rows, migrations) => rows.every((row, index) => recorded(row, migrations[index]) && row.state === 'applied');
 const same = (a, b) => a.length === b.length && a.every((row, index) => row.name === b[index].name && row.sha256 === b[index].sha256 && row.state === b[index].state);
 
 export async function readLedger(api, id, migrations, query) {

package/modules/deploy-kit/migrations.mjs

@@ -1,7 +1,9 @@
+import { join } from 'node:path';
 import { assert, hash } from './validation.mjs';
+import { regularBytes } from './artifact.mjs';
 import { assertMigrationSqlSafe } from './sql-safety.mjs';
 import { sqlTokens } from './sql-tokens.mjs';
-import { ledger, literal, createLedger, readLedger } from './migration-ledger.mjs';
+import { ledger, literal, createLedger, readLedger, recorded } from './migration-ledger.mjs';
 export function validateMigrations(migrations) {
   let previous = '';
   for (const migration of migrations) {
@@ -9,8 +11,42 @@ export function validateMigrations(migrations) {
     assert(typeof migration.sql === 'string' && migration.sql.trim() && hash(migration.sql) === migration.sha256 && migration.sql.length <= 512000, 'invalid-migration-bytes');
     assertMigrationSqlSafe(migration.sql);
     assert(sqlTokens(migration.sql).length > 0, 'invalid-migration-bytes');
+    assert(migration.rewrites === undefined || Array.isArray(migration.rewrites) && migration.rewrites.every(rewrite => /^[a-f0-9]{64}$/.test(rewrite?.from ?? '') && rewrite.from !== migration.sha256 && typeof rewrite.reason === 'string' && rewrite.reason.trim()), 'invalid-migration-rewrite');
   }
 }
+const rewriteKeys = ['migration','from','to','reason','reviewed'];
+/** A seed's reviewed rewrites of already released migrations, from
+ * migrations/rewrites.json: { version: 1, rewrites: [{ migration, from, to,
+ * reason, reviewed: true }] }. `from` is the released bytes' SHA-256, `to` the
+ * current bytes'. Each named migration then also accepts an applied row holding
+ * `from`; the ledger keeps that row as applied. Any other change stays refused. */
+export async function readMigrationRewrites(product) {
+  const text = await regularBytes(join(product,'migrations/rewrites.json'),1024*1024).then(String,error => { if (error.code === 'ENOENT') return undefined; throw error; });
+  if (text === undefined) return [];
+  let declaration; try { declaration = JSON.parse(text); } catch { throw new Error('invalid-migration-rewrites'); }
+  assert(declaration?.version === 1 && Object.keys(declaration).every(key => ['version','rewrites'].includes(key)) && Array.isArray(declaration.rewrites) && declaration.rewrites.length <= 1000, 'invalid-migration-rewrites');
+  for (const item of declaration.rewrites) {
+    assert(item && Object.keys(item).every(key => rewriteKeys.includes(key)) && /^[0-9]+_[a-zA-Z0-9_-]+\.sql$/.test(item.migration ?? '') && /^[a-f0-9]{64}$/.test(item.from ?? '') && /^[a-f0-9]{64}$/.test(item.to ?? '') && item.from !== item.to
+      && typeof item.reason === 'string' && item.reason.trim() && item.reason.length <= 1000, 'invalid-migration-rewrites');
+    assert(item.reviewed === true, 'unreviewed-migration-rewrite');
+  }
+  assert(new Set(declaration.rewrites.map(item => `${item.migration} ${item.from}`)).size === declaration.rewrites.length, 'invalid-migration-rewrites');
+  return declaration.rewrites;
+}
+/** Attach declared rewrites to the migrations they name. A record must name a
+ * migration in the list (unless `partial`, for a list that is one of several)
+ * and its `to` must be that migration's current bytes. */
+export function withRewrites(migrations, rewrites, { partial = false } = {}) {
+  for (const item of rewrites) {
+    const migration = migrations.find(x => x.name === item.migration);
+    assert(migration || partial, 'unknown-migration-rewrite');
+    if (migration) assert(migration.sha256 === item.to, 'migration-rewrite-mismatch');
+  }
+  return migrations.map(migration => {
+    const declared = rewrites.filter(item => item.migration === migration.name);
+    return declared.length ? { ...migration, rewrites: declared.map(({ from, reason }) => ({ from, reason })) } : migration;
+  });
+}
 export async function query(api, id, sql) {
   const rows = await api.request(`/d1/database/${id}/query`,{method:'POST',body:{sql}});
   assert(Array.isArray(rows) && rows.length > 0 && rows.every(x => x.success === true && Array.isArray(x.results)), 'd1-query-failed');
@@ -38,7 +74,7 @@ export async function migrate(api, id, migrations, { apply = true, upgrade = app
   }
   if (pending.length) {
     const final = (await query(api,id,`SELECT name, sha256, state FROM ${ledger} ORDER BY id`))[0].results;
-    assert(final.length === migrations.length && final.every((x,i) => x.state === 'applied' && x.name === migrations[i].name && x.sha256 === migrations[i].sha256), 'migration-readback-mismatch');
+    assert(final.length === migrations.length && final.every((x,i) => x.state === 'applied' && recorded(x, migrations[i])), 'migration-readback-mismatch');
   }
   return { applied:pending.map(x => x.name), history:migrations.map(({name,sha256}) => ({name,sha256})) };
 }