@runeditrun/rer 0.2.2 → 0.2.5

package/modules/deploy-kit/owner-cli.mjs

@@ -7,13 +7,14 @@ import { assert, hexId } from './validation.mjs';
 import { regularBytes } from './artifact.mjs';
 import { packageBuild } from './prepare.mjs';
 import { cloudflare } from './provider.mjs';
-import { ownerTarget, ownerPlan, ownerDeploy, ownerHealth, settleOwnerState } from './owner.mjs';
+import { ownerTarget, ownerPlan, ownerDeploy, ownerHealth, settleOwnerState, sameDeployment, localOnlyBinding, withStateLock, readOwnerState, writeOwnerState } from './owner.mjs';
+import { activeWorker } from './worker.mjs';
 import { ownerSecret } from './owner-secret.mjs';
 import { ownerRemove } from './owner-remove.mjs';
 import { refuseLocalModels } from './local-only.mjs';
 
 export const cronNotice = 'This Worker has a Cron Trigger. Cloudflare may take up to about two hours to start its first scheduled run on some accounts.';
-const usage = 'usage: owner-cli.mjs deploy|health|remove --declaration <file> --environment <name> [--product <dir>] [--state <file>] | secret ... --set NAME|--unset NAME';
+const usage = 'usage: owner-cli.mjs deploy|health|remove|inspect|record-owner --declaration <file> --environment <name> [--product <dir>] [--state <file>] [--outcome claimed|kept] | secret ... --set NAME|--unset NAME';
 
 /** The owner's committed source and existing local build. Run the seed's build first. */
 async function ownerArtifact(root, product) {
@@ -24,13 +25,14 @@ async function ownerArtifact(root, product) {
 }
 
 /** Inputs: CLOUDFLARE_ACCOUNT_ID and CLOUDFLARE_API_TOKEN, plus the secrets the declaration names on first deploy. */
-export async function main(argv = process.argv.slice(2), env = process.env, {fetch = globalThis.fetch, cwd = process.cwd(), healthOptions, localOnlyKeys = [], notice = line => console.error(line), onCreated} = {}) {
+export async function main(argv = process.argv.slice(2), env = process.env, {fetch = globalThis.fetch, cwd = process.cwd(), healthOptions, settle, localOnlyKeys = [], notice = line => console.error(line), onCreated} = {}) {
   let parsed;
-  try { parsed = parseArgs({args:argv,allowPositionals:true,strict:true,options:{declaration:{type:'string'},environment:{type:'string'},product:{type:'string',default:''},state:{type:'string'},set:{type:'string'},unset:{type:'string'}}}); }
+  try { parsed = parseArgs({args:argv,allowPositionals:true,strict:true,options:{declaration:{type:'string'},environment:{type:'string'},product:{type:'string',default:''},state:{type:'string'},set:{type:'string'},unset:{type:'string'},outcome:{type:'string'}}}); }
   catch { throw new Error('usage'); }
   const {positionals:[command,...rest],values} = parsed;
-  if (!['deploy','health','secret','remove'].includes(command) || rest.length || !values.declaration || !values.environment) throw new Error('usage');
+  if (!['deploy','health','secret','remove','inspect','record-owner'].includes(command) || rest.length || !values.declaration || !values.environment) throw new Error('usage');
   if ((command === 'secret') !== (values.set !== undefined || values.unset !== undefined) || values.set !== undefined && values.unset !== undefined) throw new Error('usage');
+  if (values.outcome !== undefined && command !== 'record-owner' || command === 'record-owner' && !['claimed','kept'].includes(values.outcome)) throw new Error('usage');
   await refuseLocalModels(resolve(cwd));
   const missing = ['CLOUDFLARE_ACCOUNT_ID','CLOUDFLARE_API_TOKEN'].filter(key => typeof env[key] !== 'string' || !env[key].trim());
   if (missing.length) { const error = new Error('missing-input'); error.inputs = missing; throw error; }
@@ -48,10 +50,29 @@ export async function main(argv = process.argv.slice(2), env = process.env, {fet
     const binding = values.set ?? values.unset, item = (Array.isArray(declaration.secrets) ? declaration.secrets : []).find(entry => entry?.binding === binding);
     if (!item) { const error = new Error('undeclared-secret'); error.resource = `secret:${binding}`; throw error; }
     const value = values.set === undefined ? undefined : env[item.environment];
-    return {ok:true,...await ownerSecret({api,target,statePath,binding,value}).catch(error => { throw api.annotateFailure(error,'secrets'); })};
+    return {ok:true,...await ownerSecret({api,target,statePath,binding,value,fetch,healthOptions}).catch(error => { throw api.annotateFailure(error,'secrets'); })};
   }
   // A secret rer retired (the spent setup token) is no longer part of the plan.
-  const {retiredSecrets = []} = await settleOwnerState({api,target,statePath});
+  const state = await settleOwnerState({api,target,statePath});
+  const {retiredSecrets = []} = state;
+  if (command === 'record-owner') return withStateLock(statePath, async () => {
+    const current = await readOwnerState(statePath, target);
+    assert(current.receipt && !current.pendingUpload && !current.pendingSecret, 'missing-owner-receipt');
+    const live = await activeWorker(api, target.worker);
+    assert(live && sameDeployment(live, current.receipt.provider), 'owned-resource-replaced');
+    current.ownerClaim = { outcome: values.outcome };
+    await writeOwnerState(statePath, current);
+    return {ok:true, owner:values.outcome};
+  });
+  if (command === 'inspect') {
+    assert(!localOnlyBinding(declaration, localOnlyKeys), 'local-only-binding');
+    assert(state.receipt && !state.pendingUpload && !state.pendingSecret, 'missing-owner-receipt');
+    const live = await activeWorker(api, target.worker);
+    assert(live && sameDeployment(live, state.receipt.provider), 'owned-resource-replaced');
+    const rows = await api.request(`/workers/scripts/${target.worker}/secrets`);
+    assert(Array.isArray(rows), 'invalid-secret-list');
+    return {ok:true, origin:target.origin, versionId:live.versionId, retiredSecrets, ownerClaim:state.ownerClaim, liveSecrets:rows.map(row => row.name)};
+  }
   const current = retiredSecrets.length && Array.isArray(declaration.secrets) ? {...declaration,secrets:declaration.secrets.filter(item => !retiredSecrets.includes(item?.binding))} : declaration;
   const artifact = await ownerArtifact(root,values.product);
   const plan = ownerPlan(target,current,artifact,{localOnlyKeys});
@@ -61,11 +82,11 @@ export async function main(argv = process.argv.slice(2), env = process.env, {fet
   }
   // Dispatch is the provider's: on some accounts a new Cron starts only at the account scheduler's next refresh.
   if (plan.crons.length) notice(cronNotice);
-  const {receipt,created,sentSecrets} = await ownerDeploy({api,target,plan,artifact,statePath,env,fetch,healthOptions}).catch(error => {
+  const {receipt,created,sentSecrets} = await ownerDeploy({api,target,plan,artifact,statePath,env,fetch,healthOptions,settle}).catch(error => {
     api.annotateFailure(error,error.message.startsWith('missing-secret-') ? 'secrets' : undefined);
     throw error;
   });
-  return {ok:true,changed:receipt.changed,worker:target.worker,origin:receipt.origin,versionId:receipt.provider.versionId,created,sentSecrets,retiredSecrets,state:statePath};
+  return {ok:true,changed:receipt.changed,worker:target.worker,origin:receipt.origin,versionId:receipt.provider.versionId,created,sentSecrets,retiredSecrets,...(state.ownerClaim ? {ownerClaim:state.ownerClaim} : {}),state:statePath};
 }
 
 /** Prints refusal codes and resource names only; never inputs, tokens or provider bodies. */

package/modules/deploy-kit/owner-remove.mjs

@@ -43,7 +43,7 @@ export async function ownerRemove({api: provider, target, statePath, clock, slee
   const api = withSettledLists(withScopeHints(provider));
   return withStateLock(statePath, async () => {
     const state = await readOwnerState(statePath, target);
-    if (await settlePendingSecret(api, target.worker, state)) await writeOwnerState(statePath, state);
+    if (await settlePendingSecret(api, target.worker, state, {preflight:true})) await writeOwnerState(statePath, state);
     const owned = KINDS.flatMap(kind => Object.entries(state.owned[kind]).map(([name, entry]) => ({kind, name, entry})));
     assert(state.owned.worker || owned.length, 'nothing-to-remove');
     // Preflight, read-only.
@@ -56,6 +56,7 @@ export async function ownerRemove({api: provider, target, statePath, clock, slee
       if (!sameDeployment(live, expected)) throw refuse('owned-resource-replaced', 'worker', target.worker);
       worker = target.worker;
     }
+    assert(!state.pendingSecret, 'secret-change-unsettled');
     const listed = {}, doomed = [];
     for (const kind of KINDS) {
       if (!owned.some(item => item.kind === kind)) continue;
@@ -94,7 +95,10 @@ export async function ownerRemove({api: provider, target, statePath, clock, slee
     if (remaining.length) {
       // Keep the record of what is left, so a later --remove finishes it.
       for (const kind of KINDS) for (const name of Object.keys(state.owned[kind])) if (!remaining.includes(`${kind}:${name}`)) delete state.owned[kind][name];
-      if (!remaining.includes(`worker:${target.worker}`)) { state.owned.worker = null; state.receipt = null; delete state.pendingUpload; }
+      if (!remaining.includes(`worker:${target.worker}`)) {
+        state.owned.worker = null; state.receipt = null; delete state.pendingUpload;
+        delete state.ownerClaim; delete state.retiredSecrets;
+      }
       await writeOwnerState(statePath, state);
       const error = new Error('remove-incomplete'); error.remaining = remaining; error.failed = failed; error.removed = removed;
       throw error;

package/modules/deploy-kit/owner-secret-names.mjs

@@ -0,0 +1,31 @@
+import { identifier } from './validation.mjs';
+import { deployedFingerprint } from './worker.mjs';
+
+// Materialized binding families emitted by bindingsFor and secretBindings. Upload
+// directives such as inherit, and unrecognized types, cannot classify history.
+const historicalBindingTypes = new Set(['assets','plain_text','version_metadata','d1','r2_bucket','kv_namespace','queue','durable_object_namespace','service','secret_text']);
+
+export const validSecretNames = names => Array.isArray(names) && names.every(identifier) && new Set(names).size === names.length;
+
+/** Provider secret listings contain names and types, never values to persist. */
+export function secretNames(rows) {
+  if (!Array.isArray(rows) || !rows.every(row => row?.type === 'secret_text')) return null;
+  const names = rows.map(row => row.name);
+  return validSecretNames(names) ? names : null;
+}
+
+/** Older intents lack a name snapshot. Only the exact historical starting version
+ * can supply it: neither the plan nor today's successor proves yesterday's names.
+ * Version resources.bindings is optional in the provider API. Absent, malformed or
+ * mismatched historical evidence cannot authorize adoption. */
+export async function pendingSecretNames(api, worker, {pendingSecret, receipt}) {
+  if (pendingSecret.names !== undefined) return pendingSecret.names;
+  let anchor;
+  try { anchor = await api.request(`/workers/scripts/${worker}/versions/${pendingSecret.versionId}`); }
+  catch (error) { if (error.status === 404) return null; throw error; }
+  const bindings = anchor?.resources?.bindings;
+  if (anchor?.id !== pendingSecret.versionId || anchor?.resources?.script?.etag !== receipt.provider.etag
+    || !Array.isArray(bindings) || !bindings.every(row => row && typeof row === 'object' && !Array.isArray(row) && historicalBindingTypes.has(row.type))
+    || !validSecretNames(bindings.map(row => row.name)) || deployedFingerprint({bindings}) !== receipt.fingerprint) return null;
+  return bindings.filter(row => row.type === 'secret_text' && row.name !== pendingSecret.binding).map(row => row.name);
+}

package/modules/deploy-kit/owner-secret.mjs

@@ -1,49 +1,97 @@
 import { assert, identifier } from './validation.mjs';
-import { activeWorker, deployedFingerprint } from './worker.mjs';
+import { activeWorker } from './worker.mjs';
+import { secretNames } from './owner-secret-names.mjs';
+import { waitHealth } from './health-request.mjs';
+import { definiteProviderRefusal } from './provider.mjs';
 import { readOwnerState, writeOwnerState, withStateLock, withScopeHints, sameDeployment, refuse, recordSecretChange, settlePendingSecret } from './owner.mjs';
 
 /** Set (`value` given) or remove one Worker secret of the owner's last deployment, then
  * record the Worker version the change made in the state file, so the next deploy
  * recognises its own Worker. A Worker someone else replaced is refused untouched.
  * The change is recorded as pending first: if the provider applies it but rer never
- * sees it settle, a later run adopts it (see settlePendingSecret). A change the provider
- * answered with an error clears the pending record. The secret listing
- * and active deployment lag a change, so they are read until they show it, up to `windowMs`.
+ * sees it settle, a later run can recognise its immediate successor (see settlePendingSecret).
+ * Both success and ambiguous failure read back for up to `windowMs`. An explicit refusal
+ * clears the pending record. An accepted write keeps its intent until confirmed.
+ * An ambiguous failure clears it only when readback corroborates that the receipt's
+ * deployment is still live. An ambiguous rotation
+ * re-PUTs the value before accepting its successor as proof of the rotation.
  * A removed declared secret is retired: later plans omit it until it is set again. */
-export async function ownerSecret({api: provider, target, statePath, binding, value, windowMs = 30000, clock = () => performance.now(), sleep = ms => new Promise(resolve => setTimeout(resolve, ms))}) {
+export async function ownerSecret({api: provider, target, statePath, binding, value, fetch = globalThis.fetch, healthOptions = {}, windowMs = 30000, clock = () => performance.now(), sleep = ms => new Promise(resolve => setTimeout(resolve, ms))}) {
   const api = withScopeHints(provider);
   assert(identifier(binding), 'invalid-secret-name');
   assert(value === undefined || typeof value === 'string' && value.trim(), `missing-secret-${binding}`);
   return withStateLock(statePath, async () => {
     const state = await readOwnerState(statePath, target);
     assert(state.receipt && !state.pendingUpload, 'missing-owner-receipt');
-    if (await settlePendingSecret(api, target.worker, state)) await writeOwnerState(statePath, state);
+    if (await settlePendingSecret(api, target.worker, state, {preflight:true})) await writeOwnerState(statePath, state);
     const live = await activeWorker(api, target.worker);
     if (!live) throw refuse('owned-resource-missing', 'worker', target.worker);
     if (!sameDeployment(live, state.receipt.provider)) throw refuse('owned-resource-replaced', 'worker', target.worker);
+    assert(!state.pendingSecret, 'secret-change-unsettled');
     const path = `/workers/scripts/${target.worker}/secrets`, present = value !== undefined;
-    const names = async () => { const rows = await api.request(path); assert(Array.isArray(rows), 'invalid-secret-list'); return rows.map(row => row.name); };
-    const changed = present || (await names()).includes(binding);
-    state.pendingSecret = {binding, present}; await writeOwnerState(statePath, state);
+    const names = secretNames(await api.request(path));
+    assert(names, 'invalid-secret-list');
+    const existed = names.includes(binding), changed = present || existed;
+    state.pendingSecret = {binding, present, versionId:state.receipt.provider.versionId, names:names.filter(name => name !== binding).sort()}; await writeOwnerState(statePath, state);
+    let failure, unchanged = false, confirming = false;
+    const put = () => api.request(path, {method:'PUT', body:{name:binding, text:value, type:'secret_text'}});
     try {
-      if (present) await api.request(path, {method:'PUT', body:{name:binding, text:value, type:'secret_text'}});
+      if (present) await put();
       else if (changed) await api.request(`${path}/${binding}`, {method:'DELETE'});
     } catch (error) {
-      // The provider answered and refused: nothing changed, so nothing is pending. Only a lost
-      // response (no answer at all) may have applied the change.
-      if (error.status !== undefined) { delete state.pendingSecret; await writeOwnerState(statePath, state); }
-      throw error;
+      if (definiteProviderRefusal(error)) { delete state.pendingSecret; await writeOwnerState(statePath, state); throw error; }
+      failure = error;
     }
-    let current;
-    for (const start = clock(); ; await sleep(2000)) {
-      current = await activeWorker(api, target.worker);
-      if (current && (!changed || !sameDeployment(current, live)) && (await names()).includes(binding) === present) break;
-      if (clock() - start + 2000 > windowMs) throw new Error('secret-change-unsettled');
+    try {
+      if (!changed) recordSecretChange(state, live, state.pendingSecret);
+      else for (const start = clock(); ; await sleep(2000)) {
+        try {
+          if (await settlePendingSecret(api, target.worker, state, {
+            observe: current => { unchanged = sameDeployment(current, state.receipt.provider); },
+            ...(failure && present && existed ? {confirm: async current => {
+              confirming = true;
+              state.pendingSecret.repeatVersionId = current.versionId;
+              await writeOwnerState(statePath, state);
+              await put();
+              confirming = false;
+            }} : {})
+          })) break;
+        }
+        catch (error) {
+          unchanged = false;
+          // Another ambiguous PUT cannot prove a rotation by presence either.
+          // Keep both starting versions for recovery; do not report it done.
+          if (confirming) throw error;
+          if (error.message !== 'provider-transport-failed' && !(error.status >= 500 && error.status < 600)) throw error;
+        }
+        if (clock() - start + 2000 > windowMs) throw failure ?? new Error('secret-change-unsettled');
+      }
+    } catch (error) {
+      if (unchanged && failure) delete state.pendingSecret;
+      await writeOwnerState(statePath, state);
+      throw failure ?? error;
     }
-    // A secret change makes a new version of the same code: the script and build fingerprint must not move.
-    assert(current.etag === live.etag && deployedFingerprint(current.settings) === deployedFingerprint(live.settings), 'secret-change-drift');
-    recordSecretChange(state, current, {binding, present});
+    const result = {worker:target.worker, binding, present, versionId:state.receipt.provider.versionId};
+    // Settlement is durable before readiness: a failed hosted check must never
+    // erase the applied mutation or cause the next command to reject our version.
+    state.receipt.health = {ok:false,versionId:result.versionId};
     await writeOwnerState(statePath, state);
-    return {worker:target.worker, binding, present, versionId:current.versionId};
+    try {
+      if (state.receipt.origin) await waitHealth({
+        origin:state.receipt.origin, receipt:state.receipt, versionId:result.versionId, request:fetch,
+        timeoutMs:healthOptions.timeoutMs,
+        clock:healthOptions.now, sleep:healthOptions.sleep, ...healthOptions.readiness,
+      });
+      const after = await activeWorker(api, target.worker);
+      assert(after && sameDeployment(after, state.receipt.provider), 'deployment-changed-during-health');
+      // Response prefixes belong only in the caller's redacted diagnostic, never
+      // in the ownership record: an unhealthy app may accidentally echo a secret.
+      state.receipt.health = {ok:true,versionId:result.versionId};
+      await writeOwnerState(statePath, state);
+      return result;
+    } catch (error) {
+      error.secretChange = result;
+      throw error;
+    }
   });
 }

package/modules/deploy-kit/owner.mjs

@@ -1,13 +1,15 @@
 import { ingressBindings } from './container-config.mjs';
 import { mkdir, open, rename, rm, writeFile } from 'node:fs/promises';
 import { dirname } from 'node:path';
-import { assert, hash, identifier, resourceName, validatePlan } from './validation.mjs';
+import { assert, hash, identifier, resourceName, uuid, validatePlan } from './validation.mjs';
+import { definiteProviderRefusal } from './provider.mjs';
 import { regularBytes } from './artifact.mjs';
 import { resourceKinds, findResource, checkCronOwnership } from './resources.mjs';
 import { secretBindings, activeWorker, deployedFingerprint } from './worker.mjs';
 import { validateMigrations } from './migrations.mjs';
 import { deploy } from './deploy.mjs';
 import { verifyHealth } from './health.mjs';
+import { validSecretNames, secretNames, pendingSecretNames } from './owner-secret-names.mjs';
 
 /* Owner-account mode: the owner's own Cloudflare account, token and account id.
  * Names are derived from the project id and the owner's environment. A local
@@ -50,22 +52,35 @@ export function withScopeHints(api) {
   return {...api, scopeHints:true, request:guard('request'), envelope:guard('envelope'), list:guard('list')};
 }
 /** Right after a create, an account listing can disagree with its own page counts
- * (D1's total_count lagged its rows by about 7 seconds, measured 13 October 2026).
- * Owner mode discards such a snapshot and lists again from the start for up to
- * `windowMs`; a partial listing is never accepted. */
-export function withSettledLists(api, {windowMs = 30000, clock = () => performance.now(), sleep = ms => new Promise(resolve => setTimeout(resolve, ms))} = {}) {
+ * (D1's total_count lagged its rows by about 7 seconds, measured 13 October 2026) or
+ * not show the new resource yet. Owner mode discards a partial snapshot and lists
+ * again from the start for up to `windowMs`; a partial listing is never accepted. */
+export const LIST_WINDOW_MS = 120000;
+const settleable = error => ['provider-partial-list','provider-pagination-changed'].includes(error.message);
+export function withSettledLists(api, {windowMs = LIST_WINDOW_MS, clock = () => performance.now(), sleep = ms => new Promise(resolve => setTimeout(resolve, ms))} = {}) {
   if (api.settledLists) return api;
   const list = async (...args) => {
     const start = clock();
     for (let delay = 500; ; delay = Math.min(delay * 2, 4000)) {
       try { return await api.list(...args); }
       catch (error) {
-        if (!['provider-partial-list','provider-pagination-changed'].includes(error.message) || clock() - start + delay > windowMs) throw error;
+        if (!settleable(error) || clock() - start + delay > windowMs) throw error;
         await sleep(delay);
       }
     }
   };
-  return {...api, settledLists:true, list};
+  return {...api, settledLists:true, unsettled:api, list};
+}
+/** Waits until the account's listing shows a resource this run just created, so no later
+ * read mistakes it for a missing or replaced one. One that never appears is named. */
+async function listedAfterCreate(api, kind, item, {windowMs = LIST_WINDOW_MS, clock = () => performance.now(), sleep = ms => new Promise(resolve => setTimeout(resolve, ms))} = {}) {
+  const start = clock();
+  for (let delay = 500; ; delay = Math.min(delay * 2, 4000)) {
+    try { if (findResource(await resourceKinds[kind].list(api.unsettled ?? api),kind,item.name)) return; }
+    catch (error) { if (!settleable(error)) throw error; }
+    if (clock() - start + delay > windowMs) throw refuse('resource-not-listed',kind,item.name);
+    await sleep(delay);
+  }
 }
 /** Reads the account's workers.dev subdomain; no other provider request. */
 export async function ownerTarget(provider, {project, environment}) {
@@ -84,9 +99,10 @@ function entries(declaration, key) {
   assert(Array.isArray(list) && list.every(item => item && typeof item === 'object' && !Array.isArray(item) && Object.keys(item).every(k => ENTRY_KEYS[key].includes(k))), 'invalid-owner-declaration');
   return list;
 }
-/* RER_DEV_KEY opens local dev identity; it and every key a seed adapter declares
- * local-only never become a deployed binding, secret or secret source. */
-export const LOCAL_ONLY_KEYS = Object.freeze(['RER_DEV_KEY', 'RER_MODELS_KEY', 'RER_MODELS_SERVICE', '.rer/local/models.json']);
+/* RER_DEV_KEY opens local dev identity and RER_DEMO turns on demo mode (nothing
+ * sent, throwaway data); they and every key a seed adapter declares local-only
+ * never become a deployed binding, secret or secret source. */
+export const LOCAL_ONLY_KEYS = Object.freeze(['RER_DEV_KEY', 'RER_DEMO', 'RER_MODELS_KEY', 'RER_MODELS_SERVICE', '.rer/local/models.json']);
 export function localOnlyBinding(declaration, localOnlyKeys = []) {
   const refused = new Set([...LOCAL_ONLY_KEYS, ...localOnlyKeys]);
   const names = [...Object.keys(declaration?.vars ?? {}), declaration?.originVar, ...(Array.isArray(declaration?.secrets) ? declaration.secrets.flatMap(item => [item?.binding, item?.environment]) : [])];
@@ -153,7 +169,11 @@ export async function readOwnerState(path, target) {
     && KINDS.every(kind => state.owned[kind] && typeof state.owned[kind] === 'object' && Object.values(state.owned[kind]).every(entry => ['pending','created'].includes(entry?.status))), 'invalid-owner-state');
   assert(state.pendingUpload === undefined || typeof state.pendingUpload?.fingerprint === 'string' && typeof state.pendingUpload?.build === 'string', 'invalid-owner-state');
   // Declared secrets rer removed on purpose (the spent setup token): later plans omit them.
-  assert(state.pendingSecret === undefined || identifier(state.pendingSecret?.binding) && typeof state.pendingSecret?.present === 'boolean', 'invalid-owner-state');
+  assert(state.pendingSecret === undefined || identifier(state.pendingSecret?.binding) && typeof state.pendingSecret?.present === 'boolean'
+    && (state.pendingSecret.versionId === undefined || uuid(state.pendingSecret.versionId))
+    && (state.pendingSecret.repeatVersionId === undefined || uuid(state.pendingSecret.repeatVersionId))
+    && (state.pendingSecret.names === undefined || validSecretNames(state.pendingSecret.names) && !state.pendingSecret.names.includes(state.pendingSecret.binding)), 'invalid-owner-state');
+  assert(state.ownerClaim === undefined || ['claimed','kept'].includes(state.ownerClaim?.outcome), 'invalid-owner-state');
   assert(state.retiredSecrets === undefined || Array.isArray(state.retiredSecrets) && state.retiredSecrets.every(identifier), 'invalid-owner-state');
   assert(state.accountId === target.accountId && state.project === target.project && state.environment === target.environment && state.worker === target.worker, 'owner-state-target-mismatch');
   return state;
@@ -226,19 +246,44 @@ export function recordSecretChange(state, current, {binding, present}) {
 }
 /** A secret change rer recorded as pending but never confirmed (a lost response, or a run that
  * ended before the change settled). It is that change only when the Worker's versions list shows
- * exactly one version after the receipt's and it is the live one, still running the receipt's
- * exact script and build fingerprint: adopt its version. Anything else, such as a later change
- * someone made after rer's, is left to the identity check, which refuses it. */
-export async function settlePendingSecret(api, worker, state) {
+ * exactly one version after the recorded starting version and it is the live one, still running the receipt's
+ * exact script and build fingerprint, with the other secret names unchanged: adopt its version. A confirming PUT also records its
+ * own starting version before it writes; its immediate successor can be recovered by the
+ * same checks. Anything later is left to the identity check, which refuses it. */
+export async function settlePendingSecret(api, worker, state, {preflight = false, observe, confirm} = {}) {
   if (!state.pendingSecret || !state.receipt) return false;
   const live = await activeWorker(api, worker);
-  if (!live || sameDeployment(live, state.receipt.provider) || live.etag !== state.receipt.provider.etag || deployedFingerprint(live.settings) !== state.receipt.fingerprint) return false;
+  if (sameDeployment(live, state.receipt.provider)) {
+    // Both deployment and newest version must corroborate an unapplied write.
+    // A stale deployment alone must not erase an accepted but unsettled intent.
+    const versions = (await api.request(`/workers/scripts/${worker}/versions`))?.items;
+    const unchanged = Array.isArray(versions) && versions.every(item => uuid(item?.id))
+      && new Set(versions.map(item => item.id)).size === versions.length && versions[0]?.id === live.versionId;
+    observe?.(unchanged ? live : null);
+    if (!preflight || !unchanged) return false;
+    delete state.pendingSecret;
+    return true;
+  }
+  observe?.(live);
+  if (state.pendingSecret.versionId !== state.receipt.provider.versionId || !live || live.etag !== state.receipt.provider.etag || deployedFingerprint(live.settings) !== state.receipt.fingerprint) return false;
   // Newest first, as the provider lists them.
   const versions = (await api.request(`/workers/scripts/${worker}/versions`))?.items;
   const ids = Array.isArray(versions) ? versions.map(item => item?.id) : [];
-  if (ids[0] !== live.versionId || ids.indexOf(state.receipt.provider.versionId) !== 1) return false;
+  if (!ids.every(uuid) || new Set(ids).size !== ids.length) return false;
+  const {versionId, repeatVersionId} = state.pendingSecret;
+  const immediate = ids.indexOf(versionId) === 1;
+  const repeated = repeatVersionId && ids[1] === repeatVersionId && ids.indexOf(versionId) === 2;
+  // A rotation's ambiguous first answer requires a second PUT before success.
+  // Its starting version is saved before that PUT, so interruption can recover
+  // either the original immediate successor or the second write's successor.
+  if (ids[0] !== live.versionId || !(repeatVersionId ? repeated || preflight && immediate && live.versionId === repeatVersionId : immediate)) return false;
   const rows = await api.request(`/workers/scripts/${worker}/secrets`);
-  if (!Array.isArray(rows) || rows.some(row => row.name === state.pendingSecret.binding) !== state.pendingSecret.present) return false;
+  const names = secretNames(rows);
+  if (!names || names.includes(state.pendingSecret.binding) !== state.pendingSecret.present) return false;
+  const priorNames = await pendingSecretNames(api, worker, state);
+  const otherNames = names.filter(name => name !== state.pendingSecret.binding);
+  if (!priorNames || priorNames.length !== otherNames.length || !priorNames.every(name => otherNames.includes(name))) return false;
+  if (confirm && !repeatVersionId) { await confirm(live); return false; }
   recordSecretChange(state, live, state.pendingSecret);
   return true;
 }
@@ -247,7 +292,7 @@ export async function settleOwnerState({api: provider, target, statePath}) {
   const api = withScopeHints(provider);
   return withStateLock(statePath, async () => {
     const state = await readOwnerState(statePath, target);
-    if (await settlePendingSecret(api, target.worker, state)) await writeOwnerState(statePath, state);
+    if (await settlePendingSecret(api, target.worker, state, {preflight:true})) await writeOwnerState(statePath, state);
     return state;
   });
 }
@@ -293,19 +338,21 @@ export async function withStateLock(path, run) {
 
 /** Find or create every declared resource under the owner's account, migrate, upload and check health.
  * Ownership preflight precedes provider writes. A re-run of the same build writes nothing. */
-export async function ownerDeploy({api: provider, target, plan, artifact, statePath, env = {}, fetch = globalThis.fetch, healthOptions = {}, readiness = {}}) {
+export async function ownerDeploy({api: provider, target, plan, artifact, statePath, env = {}, fetch = globalThis.fetch, healthOptions = {}, readiness = {}, settle = {}}) {
   assert(typeof statePath === 'string' && statePath.length, 'missing-owner-state-path');
-  const api = withSettledLists(withScopeHints(provider));
+  const api = withSettledLists(withScopeHints(provider),settle);
   assert(target?.accountId === api.accountId, 'owner-account-mismatch');
   validatePlan(plan); assertOwnerNames(target, plan);
   for (const item of plan.d1) validateMigrations(item.migrations);
-  return withStateLock(statePath, () => deployLocked({api, target, plan, artifact, statePath, env, fetch, healthOptions, readiness}));
+  return withStateLock(statePath, () => deployLocked({api, target, plan, artifact, statePath, env, fetch, healthOptions, readiness, settle}));
 }
-async function deployLocked({api, target, plan, artifact, statePath, env, fetch, healthOptions, readiness}) {
+async function deployLocked({api, target, plan, artifact, statePath, env, fetch, healthOptions, readiness, settle}) {
   const state = await readOwnerState(statePath, target);
   const save = () => writeOwnerState(statePath, state);
+  if (await settlePendingSecret(api, target.worker, state, {preflight:true})) await save();
   await checkServiceWorkers(api, plan);
   const priorWorker = await checkOwnedWorker(api, plan, artifact, state);
+  assert(!state.pendingSecret, 'secret-change-unsettled');
   const exists = priorWorker !== null;
   const create = await ownedResourcesToCreate(api, plan, state);
   if (exists) await checkCronOwnership(api, plan);
@@ -315,9 +362,15 @@ async function deployLocked({api, target, plan, artifact, statePath, env, fetch,
   // absent on resume means create again; present means an uncertain outcome to inspect.
   for (const {kind,item} of create) {
     state.owned[kind][item.name] = {status:'pending'}; await save();
-    const row = await resourceKinds[kind].create(api,item);
+    let row;
+    try { row = await resourceKinds[kind].create(api,item); }
+    catch (error) {
+      if (definiteProviderRefusal(error)) { delete state.owned[kind][item.name]; await save(); }
+      throw error;
+    }
     assert(findResource([row],kind,item.name) === row, 'invalid-created-resource');
     state.owned[kind][item.name] = {status:'created',...(resourceId(kind,row) === undefined ? {} : {id:resourceId(kind,row)})}; await save();
+    await listedAfterCreate(api,kind,item,settle);
   }
   if (!exists && !state.owned.worker) { state.owned.worker = {status:'pending'}; await save(); }
   const upload = `/workers/scripts/${plan.worker}?bindings_inherit=strict`;
@@ -343,7 +396,7 @@ async function deployLocked({api, target, plan, artifact, statePath, env, fetch,
   }};
   const receipt = await deploy({api:observed, plan, artifact, artifactSha256:hash(artifact), previousReceipt:state.receipt ?? undefined,
     createResources:false, uploadWithoutReceipt:true, env, fetch, healthOptions, readiness,
-    onReceipt: async candidate => { if (candidate.changed || !state.receipt) { state.receipt = candidate; delete state.pendingUpload; await save(); } },
+    onReceipt: async candidate => { if (candidate.changed || !state.receipt) { state.receipt = candidate; delete state.pendingUpload; delete state.pendingSecret; await save(); } },
     // Keep each first-health attempt beside the identity it belongs to.
     onHealth: async candidate => { if (candidate.changed) { state.receipt = candidate; await save(); } }});
   return {receipt, created:create.map(({kind,item}) => `${kind}:${item.name}`), sentSecrets};

package/modules/deploy-kit/prepare.mjs

@@ -6,6 +6,7 @@ import { assert, hash, localPath } from './validation.mjs';
 import { assetsIgnore, collectFiles, regularBytes, validateArtifact, MAX_ARTIFACT } from './artifact.mjs';
 import { collectBuildModules } from './build-modules.mjs';
 import { refuseLocalModels } from './local-only.mjs';
+import { readMigrationRewrites, withRewrites } from './migrations.mjs';
 
 export function assertCredentialFree(env) {
   for (const [key,value] of Object.entries(env)) if (value && /(?:TOKEN|SECRET|PASSWORD|API_KEY|PRIVATE_KEY|AUTHORIZATION|COOKIE|CREDENTIAL)/i.test(key)) throw new Error('prepare-credential-environment-forbidden');
@@ -26,11 +27,12 @@ export async function packageBuild({root,source,runIdentity,productDirectory = '
   const modules = await collectBuildModules(build,config,main);
   const ignored = assetsIgnore(await regularBytes(join(product,'dist/client/.assetsignore'),65536).then(String,error => { if (error.code === 'ENOENT') return ''; throw error; }));
   const assets = (await collectFiles(join(product,'dist/client'))).filter(file => !ignored(file.path));
-  const migrations = [];
+  let migrations = [];
   for (const name of (await readdir(join(product,'migrations/core'))).sort()) {
     assert(/^[0-9]+_[a-zA-Z0-9_-]+\.sql$/.test(name),'unexpected-migration-file');
     const sql = (await regularBytes(join(product,'migrations/core',name),512000)).toString('utf8'); migrations.push({binding:'DB',name,sql,sha256:hash(sql)});
   }
+  migrations = withRewrites(migrations, await readMigrationRewrites(product));
   const artifact = {version:1,source,run:runIdentity,main,modules,assets,migrations}; validateArtifact(artifact);
   return artifact;
 }

package/modules/deploy-kit/provider.mjs

@@ -2,6 +2,9 @@ import { recordDeployFailure } from './diagnostics.mjs';
 import { importD1, importUploadURL } from './d1-import.mjs';
 import { assert, hexId } from './validation.mjs';
 
+// A gateway/server error can arrive after a write. An explicit API refusal cannot.
+export const definiteProviderRefusal = error => error.status === 200 || error.status >= 400 && error.status < 500;
+
 async function boundedText(response, limit = 4 * 1024 * 1024, onReadError) {
   assert(response.body, 'empty-response');
   const reader = response.body.getReader(); const chunks = []; let length = 0;

package/modules/erasure/README.md

@@ -177,9 +177,8 @@ the seed retires them in its own migration.
 ## Adopting
 
 Copy these files byte for byte to a folder the Worker build serves, such as
-`src/modules/erasure/`. A seed made by `rer` export also receives them under
-`scripts/base-cli/modules/erasure/`, but `vite dev` serves only `src`, `public`
-and `node_modules`, so runtime imports must not reach into `scripts/`. The
+`src/modules/erasure/`. `vite dev` serves only `src`, `public` and
+`node_modules`, so runtime imports must not reach into `scripts/`. The
 standalone default seed copies this module and portability into `src/modules/`.
 The files are:
 

package/modules/operator-auth/accounts/settings-page.mjs

@@ -1,4 +1,9 @@
-import { securityHeaders } from '../http.mjs';
-export function identitySettingsPage({idpSignIn}) {
- return new Response(`<!doctype html><html lang="en"><head><meta charset="utf-8"><meta name="viewport" content="width=device-width,initial-scale=1"><title>Sign-in settings</title><style>body{font:18px system-ui;margin:0;padding:24px;color:#152523}main{max-width:640px;margin:8vh auto}label{display:block;padding:20px 0}button{font:inherit;padding:12px 20px}input{width:20px;height:20px;margin-right:12px}</style></head><body><main><a href="/app">Back to app</a><h1>Sign-in settings</h1><p>Allow invited people to sign in through your linked identity provider. Email links remain available to the owner.</p><form action="/auth/settings/identity" method="post"><input type="hidden" name="setting" value="identity"><label><input type="checkbox" name="idpSignIn" value="true" ${idpSignIn?'checked':''}>Allow provider sign-in</label><button>Save settings</button></form></main></body></html>`,{headers:{...securityHeaders(),'Referrer-Policy':'strict-origin','Content-Type':'text/html; charset=utf-8','Content-Security-Policy':"default-src 'none'; style-src 'unsafe-inline'; form-action 'self'; frame-ancestors 'none'; base-uri 'none'"}});
+import { pageResponse } from '../page.mjs';
+
+// The owner's sign-in settings, in the same frame (and seed theme) as sign-in.
+export function identitySettingsPage({ idpSignIn }, branding) {
+ const content = '<p>Allow invited people to sign in through your linked identity provider. Email links remain available to the owner.</p>'
+  + `<form action="/auth/settings/identity" method="post"><input type="hidden" name="setting" value="identity"><label class="check"><input type="checkbox" name="idpSignIn" value="true"${idpSignIn ? ' checked' : ''}>Allow provider sign-in</label><button>Save settings</button></form>`
+  + '<p class="secondary-link"><a href="/app">Back to app</a></p>';
+ return pageResponse({ branding, title: 'Sign-in settings', heading: 'Sign-in settings', content, referrer: 'strict-origin' });
 }

package/modules/operator-auth/csp.mjs

@@ -0,0 +1,26 @@
+// Inline additions to a document's Content-Security-Policy: the dev badge and
+// the demo bar each add one hashed style without loosening anything else.
+
+/** The CSP source token for an exact inline text. */
+export async function sha256(text) {
+  const bytes = await crypto.subtle.digest('SHA-256', new TextEncoder().encode(text));
+  return `'sha256-${btoa(String.fromCharCode(...new Uint8Array(bytes)))}'`;
+}
+
+// Allow exactly one more inline source in a directive the document already
+// restricts. Inline content an existing directive already permits stays as is.
+export function allow(policy, directive, source) {
+  const parts = policy.split(';').map(part => part.trim()).filter(Boolean);
+  const find = name => parts.findIndex(part => part.split(/\s+/)[0].toLowerCase() === name);
+  let index = find(directive);
+  if (index < 0) {
+    const fallback = find('default-src');
+    if (fallback < 0) return policy;
+    parts.push([directive, ...parts[fallback].split(/\s+/).slice(1)].join(' '));
+    index = parts.length - 1;
+  }
+  const tokens = parts[index].split(/\s+/);
+  if (tokens.includes("'unsafe-inline'") && !tokens.some(token => /^'(?:nonce|sha256|sha384|sha512)-/.test(token))) return parts.join('; ');
+  parts[index] = [...tokens.filter(token => token !== "'none'"), source].join(' ');
+  return parts.join('; ');
+}

package/modules/operator-auth/dev/badge.mjs

@@ -1,5 +1,6 @@
 import { EXCHANGE_SCRIPT, exchangeHashes } from '../dev-gate.mjs';
 import { escapeHtml } from '../http.mjs';
+import { allow, sha256 } from '../csp.mjs';
 
 // A slim bar at the top of the document, in normal flow so the page below it
 // starts after it and nothing is ever covered. A grid body (the frames that
@@ -7,10 +8,6 @@ import { escapeHtml } from '../http.mjs';
 // in the rest.
 const STYLE = 'body:has(>#rer-dev-badge){grid-template-rows:auto 1fr}#rer-dev-badge{grid-column:1/-1;justify-self:stretch;align-self:start;position:relative;z-index:2147483647;box-sizing:border-box;width:100%;margin:0 0 12px;padding:6px 12px;border-radius:8px;background:#111827;color:#f9fafb;font:13px/1.5 system-ui,sans-serif;text-align:left}#rer-dev-badge summary{min-width:24px;min-height:24px;cursor:pointer;overflow-wrap:anywhere}#rer-dev-badge ul{margin:6px 0 0;padding:0;list-style:none;display:flex;flex-wrap:wrap;gap:4px 16px}#rer-dev-badge li{margin:0}#rer-dev-badge a{display:inline-block;min-width:24px;min-height:24px;color:#bfdbfe;text-decoration:underline}#rer-dev-badge a[aria-current]{color:#fff;font-weight:700}#rer-dev-badge a:focus-visible,#rer-dev-badge summary:focus-visible{outline:2px solid #fff;outline-offset:2px}';
 let styleHash;
-async function sha256(text) {
-  const bytes = await crypto.subtle.digest('SHA-256', new TextEncoder().encode(text));
-  return `'sha256-${btoa(String.fromCharCode(...new Uint8Array(bytes)))}'`;
-}
 
 function badgeHtml({ session, choices }) {
   const current = session ? choices.find(choice => choice.email === session.operator.email)?.as : 'signed-out';
@@ -19,24 +16,6 @@ function badgeHtml({ session, choices }) {
   return `<style>${STYLE}</style><aside id="rer-dev-badge" aria-label="Local development identity"><details><summary>${label}</summary><ul>${links}</ul></details></aside>`;
 }
 
-// Allow exactly one more inline source in a directive the document already
-// restricts. Inline content an existing directive already permits stays as is.
-function allow(policy, directive, source) {
-  const parts = policy.split(';').map(part => part.trim()).filter(Boolean);
-  const find = name => parts.findIndex(part => part.split(/\s+/)[0].toLowerCase() === name);
-  let index = find(directive);
-  if (index < 0) {
-    const fallback = find('default-src');
-    if (fallback < 0) return policy;
-    parts.push([directive, ...parts[fallback].split(/\s+/).slice(1)].join(' '));
-    index = parts.length - 1;
-  }
-  const tokens = parts[index].split(/\s+/);
-  if (tokens.includes("'unsafe-inline'") && !tokens.some(token => /^'(?:nonce|sha256|sha384|sha512)-/.test(token))) return parts.join('; ');
-  parts[index] = [...tokens.filter(token => token !== "'none'"), source].join(' ');
-  return parts.join('; ');
-}
-
 /** Adds the fragment key exchange (root only) and the badge to an HTML document. */
 export async function decorate(response, { exchange, badge }) {
   // The Lobby is deliberately script-free. RER_OPEN uses /__dev/key, whose