@runeditrun/rer 0.2.4 → 0.2.5

package/cli/README.md

@@ -273,13 +273,22 @@ against that registry.
 Owner-account application deploy completion is shared across standard and custom
 hooks. An adapter can declare `deployDeclaration` (or `deploy.declaration`);
 legacy hooks with one root owner deployment declaration are supported too. A
-custom hook may return only `{ deployed: true, origin }`: rer verifies the
-recorded Worker, runs the adapter's actual owner bootstrap, records successful
-ownership separately from retired secrets, and removes the setup token before
-returning success. An owner already claimed by the hook is kept without another
-bootstrap. An existing owner is explicitly reported as kept. Function owner
-hooks run their complete bootstrap flow; setup manifest paths do not replace it.
-A missing or ambiguous declaration or deployment receipt refuses completion.
+custom hook returns `{ deployed: true, origin }` once its upload is live (an
+https origin; http only on a loopback host, or rer sends it nothing), plus
+`setupToken` when its Worker holds a setup token other than the `SETUP_TOKEN`
+rer passed it. rer waits until the origin's `/health` names the checkout's commit,
+then runs the adapter's actual owner bootstrap with that token and prints the
+sign-in address; a hook that reports no deployment, or whose app never names
+the commit, fails with what happened and claims nothing. When the hook deployed
+through the kit's standard deployment record, rer also records successful
+ownership separately from retired secrets and removes the setup token before
+returning success; a hook that keeps its own record keeps its token. An owner
+already claimed by the hook is kept without another bootstrap. An existing owner
+is explicitly reported as kept. Function owner hooks run their complete
+bootstrap flow; setup manifest paths do not replace it. A missing or ambiguous
+declaration refuses completion. A kit or custom-hook deploy, except `--dry-run`,
+first refuses uncommitted tracked source, naming the files, before any build or
+upload.
 
 `--env-file` values are available in the command's preflight, custom hook and
 child build environment and are redacted; the caller environment is restored

package/cli/contract.mjs

@@ -20,6 +20,9 @@ const definitions = {
  check: [['--profile'], 'Read-only structural command contract and operations validation.'],
 };
 export const verbs = Object.fromEntries(Object.entries(definitions).map(([name, [flags, effects]]) => [name, { flags: [...commonFlags, ...flags, ...(['build','deploy','dev','preview','export','import'].includes(name)?['--platform']:[]), ...(['install','setup','dev','preview','build','verify','deploy','export','import'].includes(name)?['--no-queue']:[])], effects }]));
+// `rer demo` is `rer dev --demo`; describe lists it as a verb with the dev
+// flags a demo takes whenever the seed's dev takes --demo.
+export const demoVerb = Object.freeze({ flags: [...commonFlags, '--port', '--host', '--idle-timeout', '--stop', '--detach', '--foreground', '--no-queue'], effects: 'A throwaway demo of this seed (rer dev --demo): fresh data in .rer/demo/START (deleted when it stops: --stop, Ctrl-C or its end, one hour by default or --idle-timeout), the saved owner signed in, the seed\'s demo data, a Demo bar, and nothing sent (RER_DEMO=1; the checkout\'s own data is never touched).' });
 export const aliases = Object.fromEntries([...Object.keys(verbs).filter(v => v !== 'install'), 'release', 'deps', 'rer'].map(name => [name, name === 'deps' ? 'install' : name === 'rer' ? null : name]));
 export const releaseFlags = ['--repo', '--project', '--repository', '--output', '--ref', '--dry-run', '--tag', '--clean-history', '--onto', '--env-file', '--no-queue'];
 export const requiredHooks = ['preview', 'dependencies', 'build', 'migrate', 'start', 'health', 'owner', 'signIn', 'verify', 'deploy', 'portability', 'state', 'settings', 'input'];

package/cli/deploy-command.mjs

@@ -6,6 +6,8 @@ import { deployEnvironment, deployAgain } from './deploy-inputs.mjs';
 import { claimHostedOwner } from './deploy-owner.mjs';
 import { mutationReadinessFailure } from './deploy-readiness.mjs';
 import { observeOwner } from './deploy-observation.mjs';
+import { committedSource } from './deploy-source.mjs';
+import { hookOrigin, waitForSource } from './deploy-hook.mjs';
 import { main as owner } from '../modules/deploy-kit/owner-cli.mjs';
 import { localOnlyBinding, ownerWorkerName } from '../modules/deploy-kit/owner.mjs';
 import { refuseLocalModels } from '../modules/deploy-kit/local-only.mjs';
@@ -45,50 +47,62 @@ export async function deployCommand(context) {
  // may perform them; neither a build nor a custom upload runs here.
  if (options.remove || options.setSecret || options.unsetSecret) return ownerDeploy(path, adapter)(context);
  if (adapter.deploy.managesHostedOwner) return adapter.deploy(context);
+ const sourceSha = options.dryRun ? undefined : committedSource(root, options);
  const { env, supplied } = await deployEnvironment({ root, options, declaration, setupManifest, settings: adapter.settings, localOnlyKeys });
  const { createRedaction, credentialValues } = await shared('redaction.mjs');
  const redaction = createRedaction();
  const addSecret = value => { redaction.addSecrets([value]); store.addSecrets?.([value]); };
  for (const value of [...credentialValues(env), env.CLOUDFLARE_ACCOUNT_ID, ...(declaration.secrets ?? []).map(item => env[item.environment])].filter(Boolean)) addSecret(value);
  const command = (verb, extra = [], values = env) => owner([verb, '--declaration', path, '--environment', options.environment ?? 'production', ...extra], values, { cwd: root, localOnlyKeys });
+ // A hook that deployed through the kit's standard record lets rer issue and
+ // retire the setup token; a hook keeping its own record keeps its token.
  let recorded;
- const inspect = async () => (recorded = await command('inspect'));
+ const inspect = async () => {
+  try { return recorded = await command('inspect'); }
+  catch (error) { if (error.message !== 'missing-owner-receipt') throw error; }
+ };
  let observedClaims = [];
  let deployed, claimed, linked = false, linkResult, step = 'custom deploy';
- const link = async token => { if (!linked) { const state = await inspect(); linkResult = await linkDependencies?.(state.origin, token); linked = true; } return linkResult; };
+ const link = async (token, origin) => { if (!linked) { const state = await inspect(); linkResult = await linkDependencies?.(state?.origin ?? origin, token); linked = true; } return linkResult; };
  try {
   return await observeOwner({ paths: ['/auth/bootstrap', adapter.hooks?.owner?.path, setupManifest?.steps?.find(item => item.type === 'owner-claim')?.path].filter(Boolean), inspect, beforeClaim: link, addSecret }, async claims => {
    observedClaims = claims;
    const saved = { ...process.env };
    try {
     Object.assign(process.env, env);
-    deployed = await adapter.deploy({ ...context, linkDependencies: async (_origin, token) => link(token) });
+    deployed = await adapter.deploy({ ...context, linkDependencies: async (origin, token) => link(token, origin) });
    } finally {
     for (const key of Object.keys(process.env)) if (!Object.hasOwn(saved, key)) delete process.env[key];
     Object.assign(process.env, saved);
    }
    if (options.dryRun) return deployed;
-   if (!deployed?.deployed) throw new Error('custom-deploy-did-not-confirm-deployment');
+   const origin = hookOrigin(deployed, deployAgain(options));
+   step = 'wait for the deployed source';
+   await waitForSource({ origin, sourceSha, again: deployAgain(options) });
    step = 'verify recorded deployment';
    const state = await inspect();
-   if (state.origin !== deployed.origin) throw new Error('owner-claim-origin-mismatch');
+   if ((state?.origin ?? origin) !== origin || claims.some(item => item.origin !== origin)) throw new Error('owner-claim-origin-mismatch');
    if (claims.some(item => !item.outcome)) throw new Error('owner-claim-failed');
    claimed = claims.at(-1)?.outcome;
    step = 'claim owner';
-   claimed = await claimHostedOwner({ hook: adapter.hooks?.owner, setupManifest, declaration, deployed: { ...state, owner: claimed, observedOwner: () => claims.at(-1)?.outcome }, env, supplied, secret: (extra, values) => command('secret', extra, values), addSecret, beforeClaim: link, recordClaim: outcome => command('record-owner', ['--outcome', outcome]), store, signal: context.signal });
-   if (!linked) await linkDependencies?.(state.origin);
-   if (claimed) store.report(`${claimed === 'claimed' ? 'Claimed the hosted owner' : 'The hosted owner was already claimed and was kept'}; the one-time setup token was removed. Sign in by email at ${state.origin}.`);
-   return { ...deployed, ...(claimed ? { owner: claimed } : {}), dependenciesLinked: true };
+   if (typeof deployed.setupToken === 'string' && deployed.setupToken) addSecret(deployed.setupToken);
+   const kit = state ? { secret: (extra, values) => command('secret', extra, values), recordClaim: outcome => command('record-owner', ['--outcome', outcome]) } : { token: deployed.setupToken || undefined };
+   claimed = await claimHostedOwner({ hook: adapter.hooks?.owner, setupManifest, declaration, deployed: { ...state, origin, owner: claimed, observedOwner: () => claims.at(-1)?.outcome }, env, supplied, ...kit, addSecret, beforeClaim: token => link(token, origin), store, signal: context.signal });
+   if (!linked) await linkDependencies?.(origin);
+   if (claimed) store.report(`${claimed === 'claimed' ? 'Claimed the hosted owner' : 'The hosted owner was already claimed and was kept'}${state ? '; the one-time setup token was removed' : ''}. Sign in by email at ${origin}.`);
+   const { setupToken: _, ...result } = deployed;
+   return { ...result, ...(claimed ? { owner: claimed } : {}), dependenciesLinked: true };
   });
  } catch (error) {
   const again = deployAgain(options);
-  if (error instanceof RerError && !deployed?.deployed && !recorded) { error.message = store.redact?.(redaction.redact(error.message)) ?? redaction.redact(error.message); throw error; }
   const { commandFailure } = await shared('failures.mjs');
+  if (error.hookFailure) throw commandFailure(store.redact?.(redaction.redact(error.message)) ?? redaction.redact(error.message));
+  if (error instanceof RerError && !deployed?.deployed && !recorded) { error.message = store.redact?.(redaction.redact(error.message)) ?? redaction.redact(error.message); throw error; }
   const outcome = error.owner ?? claimed ?? observedClaims.at(-1)?.outcome;
-  const state = deployed?.deployed || recorded ? `The application is deployed at ${deployed?.origin ?? recorded.origin}; ${outcome ? `owner ${outcome}` : 'owner claim is not confirmed'}; setup token retirement is not confirmed.` : 'The custom deploy did not finish; inspect its deployment record before recovery.';
+  const state = deployed?.deployed || recorded ? `The application is deployed at ${deployed?.origin ?? recorded.origin}; ${outcome ? `owner ${outcome}` : 'owner claim is not confirmed'}${recorded ? '; setup token retirement is not confirmed' : ''}.` : 'The custom deploy did not finish; inspect its deployment record before recovery.';
   const redact = value => store.redact?.(redaction.redact(value)) ?? redaction.redact(value);
   const readiness = mutationReadinessFailure(error, { again, redact });
   if (readiness) throw commandFailure(readiness);
-  throw commandFailure(redact(`${state} Failed at ${step}: ${error.message}${error.cause ? ` (${error.cause})` : ''}. Fix the cause and run ${again} again using the same environment credentials. ${outcome ? `To retire the token without rebuilding: ${again} --unset-secret ${setupManifest?.steps?.find(item => item.type === 'owner-claim')?.tokenField ?? 'SETUP_TOKEN'}.` : ''}`));
+  throw commandFailure(redact(`${state} Failed at ${step}: ${error.message}${error.cause ? ` (${error.cause})` : ''}. Fix the cause and run ${again} again using the same environment credentials. ${outcome && recorded ? `To retire the token without rebuilding: ${again} --unset-secret ${setupManifest?.steps?.find(item => item.type === 'owner-claim')?.tokenField ?? 'SETUP_TOKEN'}.` : ''}`));
  }
 }

package/cli/deploy-hook.mjs

@@ -0,0 +1,31 @@
+import { waitHealth } from '../modules/deploy-kit/health-request.mjs';
+import { isLoopbackHost } from '../modules/operator-auth/loopback.mjs';
+
+// A custom deploy hook owns its upload and whatever record it keeps of it. It
+// returns { deployed: true, origin }; rer claims the owner only once that
+// origin's /health names the commit this run deployed. The origin is https
+// (http only on loopback), since the claim sends the one-time setup token there.
+export function hookOrigin(deployed, again) {
+ const url = deployed?.deployed === true && typeof deployed.origin === 'string' && URL.canParse(deployed.origin) ? new URL(deployed.origin) : undefined;
+ if (url?.protocol === 'http:' && !isLoopbackHost(url.hostname)) throw hookFailure(`The deploy hook reported its deployment at ${url.origin}, which is not https, so rer sent it nothing and claimed no owner. Make the hook return its https origin, then run ${again} again.`);
+ if (url && (url.protocol === 'https:' || url.protocol === 'http:') && url.origin === deployed.origin) return url.origin;
+ throw hookFailure(`The deploy hook finished without reporting a live deployment, so rer claimed no owner. A deploy hook returns { deployed: true, origin } once its upload is live. Check the hook's output above, fix the hook, then run ${again} again.`);
+}
+
+export async function waitForSource({ origin, sourceSha, again }) {
+ try { await waitHealth({ origin, expected: { sourceSha }, request: (url, init) => globalThis.fetch(url, init) }); }
+ catch (error) {
+  const last = error.attempts?.at(-1);
+  let named;
+  try { named = JSON.parse(last.body).deployment?.sourceSha; } catch {}
+  const seen = !last || last.status === null ? 'it did not answer'
+   : last.status !== 200 ? `its last answer was HTTP ${last.status}`
+   : typeof named === 'string' && /^[0-9a-f]{7,64}$/.test(named) ? `it still answers for commit ${named.slice(0, 12)}`
+   : 'it answers without a deploy identity';
+  throw hookFailure(`The deploy hook reported a deployment at ${origin}, but its /health never named this checkout's commit ${sourceSha.slice(0, 12)} (${seen}), so rer claimed no owner. Check that the hook uploaded this build and that /health answers deploymentHealth(env), then run ${again} again.`);
+ }
+}
+
+function hookFailure(message) {
+ return Object.assign(new Error(message), { hookFailure: true });
+}

package/cli/deploy-observation.mjs

@@ -1,6 +1,7 @@
 // Observe the actual bootstrap exchange of a custom hook, including hooks that
 // call the shared owner helper themselves. Never issue a second claim after it.
-// The deployment record is checked before linking with its live setup token.
+// The kit's deployment record, when the hook keeps one there, is checked before
+// linking with its live setup token; rer checks the origin the hook returns too.
 export async function observeOwner({ paths, inspect, beforeClaim, addSecret }, run) {
  const fetch = globalThis.fetch, claims = [];
  globalThis.fetch = async (input, init = {}) => {
@@ -12,8 +13,8 @@ export async function observeOwner({ paths, inspect, beforeClaim, addSecret }, r
   if (typeof body?.token !== 'string' || !body.token) return fetch(input, init);
   addSecret(body.token);
   const deployed = await inspect();
-  if (url.origin !== deployed.origin) throw new Error('owner-claim-origin-mismatch');
-  await beforeClaim?.(body.token);
+  if (deployed && url.origin !== deployed.origin) throw new Error('owner-claim-origin-mismatch');
+  await beforeClaim?.(body.token, url.origin);
   const response = await fetch(input, init);
   let code;
   if (response.status !== 303) {

package/cli/deploy-owner.mjs

@@ -8,9 +8,11 @@ import { randomBytes } from 'node:crypto';
 // did not upload this run gets a fresh one first, unless the person supplied the
 // token (environment or --env-file) and inspection has not found it absent. A
 // seed with its own owner step function runs its own bootstrap; identity-provider
-// linking runs before retirement.
+// linking runs before retirement. Without `secret`, the Worker's secrets are a
+// deploy hook's own: rer claims with the `token` it returned, else the one rer
+// gave it, and leaves that token with the hook.
 // `beforeClaim(token)` runs while the token is live (dependency approvals need it).
-export async function claimHostedOwner({ hook, setupManifest, declaration, deployed, env, supplied = [], secret, addSecret, beforeClaim, recordClaim, inspect, store, signal, fetch = globalThis.fetch }) {
+export async function claimHostedOwner({ hook, setupManifest, declaration, deployed, env, supplied = [], secret, token: hookToken, addSecret, beforeClaim, recordClaim, inspect, store, signal, fetch = globalThis.fetch }) {
  const claim = setupManifest?.steps?.find(step => step.type === 'owner-claim');
  if (!hook || !['object', 'function'].includes(typeof hook) || Array.isArray(hook) || !deployed.origin) {
   if (declaration.secrets?.some(item => item.binding === (claim?.tokenField ?? 'SETUP_TOKEN'))) throw ownerFailure('the owner bootstrap hook is unavailable');
@@ -20,6 +22,7 @@ export async function claimHostedOwner({ hook, setupManifest, declaration, deplo
  const item = (Array.isArray(declaration.secrets) ? declaration.secrets : []).find(entry => entry?.binding === tokenKey);
  if (!item) { if (claim) throw ownerFailure('the deploy declaration does not name the owner setup token secret'); return undefined; }
  const retire = async outcome => {
+  if (!secret) return outcome;
   try { await recordClaim?.(outcome); await secret(['--unset', tokenKey], env); }
   catch (cause) {
    if (cause.secretChange) { cause.owner = outcome; cause.tokenKey = tokenKey; cause.ownerFinalization = true; throw cause; }
@@ -34,7 +37,8 @@ export async function claimHostedOwner({ hook, setupManifest, declaration, deplo
  // record or live-secret inspection. Keep their completed deploys idempotent.
  if (!deployed.liveSecrets && deployed.retiredSecrets?.includes(tokenKey)) return undefined;
  const given = (!deployed.liveSecrets || deployed.liveSecrets.includes(tokenKey)) && env[item.environment]?.trim() && !supplied.includes(tokenKey);
- let token = deployed.sentSecrets?.includes(tokenKey) || given ? env[item.environment] : undefined;
+ let token = !secret ? hookToken ?? env[item.environment] : deployed.sentSecrets?.includes(tokenKey) || given ? env[item.environment] : undefined;
+ if (!token && !secret) throw ownerFailure(`the deploy hook returned no setupToken and ${item.environment} is not set`);
  if (!token) {
   token = randomBytes(32).toString('hex'); addSecret(token);
   // The secret controller confirms readiness of the full new version identity.
@@ -67,7 +71,8 @@ export async function claimHostedOwner({ hook, setupManifest, declaration, deplo
  if (response.status !== 303) { try { const body = await response.json(); if (typeof body?.error === 'string' && /^[a-z_]{1,64}$/.test(body.error)) code = body.error; } catch {} }
  else await response.body?.cancel();
  const outcome = response.status === 303 ? 'claimed' : response.status === 409 && code === 'already_initialized' ? 'kept' : undefined;
- if (!outcome) throw ownerFailure(`HTTP ${response.status} (${code})${code === 'invalid_setup_token' && given ? `; the ${item.environment} you supplied is not the deployed setup token: leave it unset and rer issues a fresh one` : ''}`);
+ const advice = code !== 'invalid_setup_token' ? '' : !secret ? `; the Worker holds another setup token: have the deploy hook return the one it deployed as setupToken, or set it as ${item.environment} with --env-file` : given ? `; the ${item.environment} you supplied is not the deployed setup token: leave it unset and rer issues a fresh one` : '';
+ if (!outcome) throw ownerFailure(`HTTP ${response.status} (${code})${advice}`);
  return retire(outcome);
 }
 

package/cli/deploy-source.mjs

@@ -0,0 +1,24 @@
+import { execFileSync } from 'node:child_process';
+import { refuse } from './errors.mjs';
+import { deployAgain } from './deploy-inputs.mjs';
+
+// rer deploy publishes the checkout's last commit: the deploy identity names it.
+// Say so before any build or upload, naming the tracked files that differ.
+export function committedSource(root, options) {
+ const git = (...args) => execFileSync('git', args, { cwd: root, encoding: 'utf8', stdio: ['ignore', 'pipe', 'pipe'] });
+ const again = deployAgain(options);
+ let status, sha;
+ try { status = git('status', '--porcelain', '-z', '--untracked-files=no'); sha = git('rev-parse', 'HEAD').trim(); }
+ catch { throw refuse(`rer deploy publishes the checkout's last Git commit, and this checkout has none. Commit the source with Git, then run ${again} again. Nothing was uploaded.`); }
+ const entries = status.split('\0'), paths = [];
+ for (let index = 0; index < entries.length; index++) {
+  if (!entries[index]) continue;
+  paths.push(entries[index].slice(3));
+  // A rename or copy is followed by its original path.
+  if (/^([RC].|.[RC])/.test(entries[index])) index++;
+ }
+ if (!paths.length) return sha;
+ const shown = paths.slice(0, 20).map(path => `  ${path}`);
+ if (paths.length > shown.length) shown.push(`  and ${paths.length - shown.length} more`);
+ throw refuse(`Deploy stopped before building: these tracked files have changes that are not committed:\n${shown.join('\n')}\nrer deploy publishes the last commit. Commit the changes (for example git commit -am "Describe the change") or discard them, then run ${again} again. Nothing was uploaded.`);
+}

package/cli/deploy.mjs

@@ -9,6 +9,7 @@ import { refuseLocalModels } from '../modules/deploy-kit/local-only.mjs';
 import { deployEnvironment, deployAgain } from './deploy-inputs.mjs';
 import { claimHostedOwner } from './deploy-owner.mjs';
 import { mutationReadinessFailure } from './deploy-readiness.mjs';
+import { committedSource } from './deploy-source.mjs';
 
 export function ownerDeploy(declarationPath, lifecycle) {
  // rer verify serves the build with this declaration's vars and secrets.
@@ -28,6 +29,7 @@ export function ownerDeploy(declarationPath, lifecycle) {
   // A dry run reads the settings file too, so a refused key fails here and not only on the real deploy.
   if (options.dryRun && options.envFile) await deployEnvironment({ root, options, declaration, localOnlyKeys });
   if (!change.length) {
+   if (!options.dryRun) committedSource(root, options);
    await lifecycle.run(root, {}, store, () => {}, signal, { verb: 'build', operationToken });
    await checkBuild();
   }

package/cli/inspect.mjs

@@ -3,7 +3,7 @@ import { inventory } from './export.mjs';
 import { lstat, readFile } from 'node:fs/promises';
 import { createHash } from 'node:crypto';
 import { delimiter, dirname, resolve } from 'node:path';
-import { aliases, pins, requiredHooks, serverDefaults, verbs, releaseFlags } from './contract.mjs';
+import { aliases, demoVerb, pins, requiredHooks, serverDefaults, verbs, releaseFlags } from './contract.mjs';
 import { runningVersion } from './version.mjs';
 import { contained, readPackage } from './project.mjs';
 import { shared } from './shared.mjs';
@@ -41,7 +41,7 @@ export async function describe(project) {
      ? operationsEffects
      : verbs[verb]?.effects ?? 'Produce releases; keygen writes a public anchor and, on success, its private key to non-terminal stdout; sign writes a detached signature and prints (but does not execute) the GitHub upload command; receipt verifies against local anchors offline.';
    return [verb, { flags: (verbs[verb]?.flags ?? releaseFlags).filter(flag => capability.flags?.includes(flag)), effects }];
-  })),
+  }).concat(capabilities.dev?.flags?.includes('--demo') ? [['demo', { flags: demoVerb.flags.filter(flag => capabilities.dev.flags.includes(flag)), effects: demoVerb.effects }]] : [])),
   aliases: Object.fromEntries(Object.entries(aliases).filter(([alias, verb]) => pkg.scripts?.[alias] === commandLine(verb, declaredPackage(pkg) !== undefined))),
   local: { state: project.adapter?.state, settings: project.adapter?.settings ?? [], installerState: '.seed/installer', outbox: '/__dev/outbox', ...await localState(project), origin: await savedOrigin(project), ...(project.adapter?.devIdentity ? { devIdentity: true, devKey: '.rer/local/dev-key.env' } : {}) },
   // This pin serves a checkout through the machine's front door (rer door).

package/global/CHANGELOG.md

@@ -1,5 +1,22 @@
 # Changelog
 
+## 0.2.5
+
+- `rer deploy` with a seed's own deploy hook claims the hosted owner from what the hook returns, `{ deployed: true, origin }`, once the origin's `/health` names the checkout's commit, and prints the sign-in address. A hook that keeps its own deployment record (Penny's does) no longer ends in `missing-owner-receipt` with a live, unclaimed app; such a hook returns `setupToken` too when its Worker holds a setup token other than the `SETUP_TOKEN` rer passed it. A hook that reports no deployment, or whose app never names the commit, fails saying so and claims nothing.
+- `rer deploy` with uncommitted changes to tracked files stops before building, lists the files, says to commit them and that nothing was uploaded (exit 4), instead of building first and failing with `owner-source-not-committed`.
+- `rer deploy --demo --dry-run` and `rer build --platform container` work on an exported seed: the container import boundary admits the demo guard's `import { env } from 'cloudflare:workers'` in `src/modules/demo/index.mjs` (that file and that import only) and still refuses a Cloudflare import anywhere else in `src/`. The release smoke now runs the hosted demo dry run on a package-mode export.
+- `rer describe` lists `demo` as a verb (`rer dev --demo`), with its effects and the flags a demo takes.
+- Two launches claiming the same port, or two workers claiming the same checkout's launch, get exactly one winner: the claim is written complete and linked into place, so the other never reads it half-written and takes it as abandoned.
+- `node scripts/export-cli.mjs --to-package` on a composed foundation drops the removed `scripts/base-cli` copy's entries from `composition.lock.json` along with its files, so `rer check` no longer fails `SC-05.auth-copy` for files the conversion deleted.
+- `rer deploy` refuses a seed deploy hook's `http://` origin (other than a loopback host such as `localhost`, `127.0.0.1` or `[::1]`) before sending it anything, so the one-time setup token only travels over https; it says to make the hook return its https origin.
+- After a redeploy whose app answers unhealthy, the owner state in `.rer/deploy/` keeps each health check's status and timing but not the response text, so a secret an app echoes is never saved there; the secret command already kept none.
+- A secret change `rer deploy` could not yet confirm stays recorded until the provider's records agree, and blocks another secret change, deploy or removal until then; a secret added or removed outside rer meanwhile is refused instead of adopted.
+
+### Upgrade notes
+
+- A seed's custom deploy hook returns `{ deployed: true, origin }` with an https origin (and may add `setupToken`); `rer deploy` waits for that origin's `/health` to name the checkout's commit, then claims the owner itself.
+- A seed adopting `rer demo` needs rer 0.2.5 for `rer deploy --demo`.
+
 ## 0.2.4
 
 0.2.3 was tagged but not published; its changes are in 0.2.4.

package/global/launch/state.mjs

@@ -39,6 +39,19 @@ export async function liveWorker(directory) {
  return await live(holder) ? holder : undefined;
 }
 
+// A claim file is written to a private file first and hard-linked into place,
+// so it appears complete or not at all: a process finding it never reads a
+// half-written claim as a dead one and removes it. False when one is there.
+async function linkClaim(path, record) {
+ const written = `${path}.${process.pid}`;
+ await writeFile(written, JSON.stringify(record), { mode: 0o600 });
+ try {
+  await link(written, path);
+  return true;
+ } catch (error) { if (error.code !== 'EEXIST') throw error; return false; }
+ finally { await rm(written, { force: true }); }
+}
+
 // A port chosen for a setup stays claimed while the process that chose it
 // lives, so two launches preparing at once never pick the same port.
 export async function claimPort(port, env = process.env) {
@@ -46,10 +59,7 @@ export async function claimPort(port, env = process.env) {
  await mkdir(directory, { recursive: true, mode: 0o700 });
  const { start } = await processInfo(process.pid);
  for (let attempt = 0; attempt < 2; attempt++) {
-  try {
-   await writeFile(path, JSON.stringify({ pid: process.pid, start }), { flag: 'wx', mode: 0o600 });
-   return { release: async () => { if ((await readJson(path))?.pid === process.pid) await rm(path, { force: true }); } };
-  } catch (error) { if (error.code !== 'EEXIST') throw error; }
+  if (await linkClaim(path, { pid: process.pid, start })) return { release: async () => { if ((await readJson(path))?.pid === process.pid) await rm(path, { force: true }); } };
   if (await live(await readJson(path))) return undefined;
   await rm(path, { force: true });
  }
@@ -68,14 +78,7 @@ export async function claimPinInstall(checkout, { env = process.env, signal, onW
  const path = pinInstallPath(checkout, env), { start } = await processInfo(process.pid);
  for (let waited = false; ; ) {
   signal?.throwIfAborted();
-  // Linked complete, so a waiter never reads a claim still being written.
-  const written = `${path}.${process.pid}`;
-  await writeFile(written, JSON.stringify({ pid: process.pid, start }), { mode: 0o600 });
-  try {
-   await link(written, path);
-   return async () => { if ((await readJson(path))?.pid === process.pid) await rm(path, { force: true }); };
-  } catch (error) { if (error.code !== 'EEXIST') throw error; }
-  finally { await rm(written, { force: true }); }
+  if (await linkClaim(path, { pid: process.pid, start })) return async () => { if ((await readJson(path))?.pid === process.pid) await rm(path, { force: true }); };
   const holder = await readJson(path);
   if (!await live(holder)) { await rm(path, { force: true }); continue; }
   if (!waited) { waited = true; onWait?.(holder.pid); }
@@ -99,15 +102,12 @@ export async function claimLaunch(directory, token) {
  const path = join(directory, 'worker.json');
  for (let attempt = 0; attempt < 3; attempt++) {
   const { start } = await processInfo(process.pid);
-  try {
-   await writeFile(path, JSON.stringify({ token, pid: process.pid, start, startedAt: Date.now(), events: `events-${token}.jsonl` }), { flag: 'wx', mode: 0o600 });
+  if (await linkClaim(path, { token, pid: process.pid, start, startedAt: Date.now(), events: `events-${token}.jsonl` })) {
    for (const entry of await readdir(directory)) if (/^events-.*\.jsonl$/.test(entry) && entry !== `events-${token}.jsonl`) await rm(join(directory, entry), { force: true });
    return true;
-  } catch (error) {
-   if (error.code !== 'EEXIST') throw error;
-   if (await liveWorker(directory)) return false;
-   await rm(path, { force: true });
   }
+  if (await liveWorker(directory)) return false;
+  await rm(path, { force: true });
  }
  return false;
 }

package/modules/container/README.md

@@ -13,7 +13,9 @@ selected through `cacheContract` when the seed implements that contract. This
 is not a general Durable Object adapter. A seed requiring KV or other
 Cloudflare-only APIs cannot use Node.
 The import boundary rejects those APIs and new Cloudflare imports outside the
-platform binding/cache boundary.
+platform binding/cache boundary. The one other file it admits is an exported
+seed's demo guard, `src/modules/demo/index.mjs`, and there only
+`import { env } from 'cloudflare:workers'` (it reads `RER_DEMO`).
 
 The entrypoint holds a Linux kernel `flock` for the lifetime of the host. Each
 installation has one local data volume and one writer. The lock inode retains

package/modules/container/boundary.mjs

@@ -1,5 +1,5 @@
 import { readdir, readFile } from 'node:fs/promises';
-import { join, relative } from 'node:path';
+import { join, relative, sep } from 'node:path';
 import { createRequire } from 'node:module';
 import { pathToFileURL } from 'node:url';
 export async function checkBoundary(root, { engine='node', cacheContract }={}) {
@@ -10,6 +10,9 @@ export async function checkBoundary(root, { engine='node', cacheContract }={}) {
    const name=relative(root,path),tree=ts.createSourceFile(path,await readFile(path,'utf8'),ts.ScriptTarget.Latest,true);
    const cache=cacheContract==='lamp-retained-v1'&&/(?:^|\/)platform\/blobs\/snapshot-cache\.ts$/.test(name);
    const bindings=/(?:^|\/)platform\/bindings\.server\.ts$/.test(name);
+   // The demo guard an exported seed carries reads RER_DEMO from env: that one
+   // file, and only its unrenamed `env` import.
+   const demo=name.split(sep).join('/')==='src/modules/demo/index.mjs';
    const fail=api=>failures.push({path:name,api}),localNames=new Set();
    function names(node){if((ts.isVariableDeclaration(node)||ts.isFunctionDeclaration(node)||ts.isImportSpecifier(node))&&node.name&&ts.isIdentifier(node.name))localNames.add(node.name.text);ts.forEachChild(node,names);}names(tree);
    function visit(node){
@@ -17,7 +20,7 @@ export async function checkBoundary(root, { engine='node', cacheContract }={}) {
      const module=node.moduleSpecifier.text;
      if(module.startsWith('cloudflare:')){
       const imports=node.importClause?.namedBindings;
-      const allowed=module==='cloudflare:workers'&&imports&&ts.isNamedImports(imports)&&imports.elements.every(element=>(bindings&&(element.propertyName??element.name).text==='env')||(cache&&(element.propertyName??element.name).text==='DurableObject'));
+      const allowed=module==='cloudflare:workers'&&imports&&ts.isNamedImports(imports)&&imports.elements.every(element=>(demo&&!node.importClause.name&&!element.propertyName&&element.name.text==='env')||(bindings&&(element.propertyName??element.name).text==='env')||(cache&&(element.propertyName??element.name).text==='DurableObject'));
       if(!allowed)fail('Cloudflare import outside binding/cache contract');
      }
     }

package/modules/deploy-kit/README.md

@@ -114,7 +114,7 @@ The CLI prints JSON: refusal codes and resource names only, never inputs, tokens
 
 - **Inputs.** Declared secrets come from the environment, then `--env-file FILE` (an owned 0600 file of `KEY=VALUE` lines), which wins. For a secret the Worker does not hold yet, rer supplies the setup manifest's owner email (`emailField`) from the local setup's private settings, and a fresh random value for each secret field the manifest generates (`generate`), such as the session secret and the setup token; a value the Worker already holds is kept. A still-missing secret stops the run before any write with a message that names it.
 - **Hosted owner.** After deploy and health pass, rer claims the setup owner on the hosted app: it POSTs the setup token to the seed's standard owner step (`hooks.owner`, by default `/auth/bootstrap`). 303 means claimed; `409 already_initialized` means an owner was already claimed and is kept. Then rer deletes the token secret from the Worker, records the new Worker version in the state file, and lists the token in `retiredSecrets`, so later plans no longer declare it. A Worker that still holds a token rer did not upload in this run (an older deploy) first gets a fresh token through the same recorded secret change. Dependency approvals that need the token run before the claim. A seed with an owner step function, an identity-provider claim, or no declared token secret claims its owner its own way.
-- **Secret changes.** `rer deploy --set-secret NAME` (value from the environment or `--env-file`, under the declaration's environment name) and `--unset-secret NAME` change one declared secret of the recorded Worker without a build. A secret change deploys a new Worker version of the same code, so rer checks the build fingerprint is unchanged and records the new version id, deployment id and etag as the receipt's provider identity: the next deploy recognises its own Worker. An unset secret is retired until it is set again. The change is recorded as pending before it is sent, and the secret listing and active deployment are read until they show it (they lag the change by seconds); a change the provider answers with an error clears that record. If a run ends before the change settles (a lost response), the next run adopts the live version only when the Worker's versions list shows exactly one version after the receipt's, it is the live one, and its script etag and build fingerprint are still the receipt's. A change made outside rer (dashboard, Wrangler), including one made after rer's own, still reads as a replacement and is refused.
+- **Secret changes.** `rer deploy --set-secret NAME` (value from the environment or `--env-file`, under the declaration's environment name) and `--unset-secret NAME` change one declared secret of the recorded Worker without a build. Before writing, rer records the starting version and the exact live names of all other secrets, never their values. Accepted or ambiguous writes retain that intent until readback confirms the change; explicit refusals clear it. An ambiguous failure, or a later command's preflight, can clear an unapplied intent only when the live deployment still matches the receipt and the newest listed version matches it too. A surviving intent blocks further mutations until consistency returns; retry the same command then. Recovery requires the recorded immediate successor (or the recorded confirming rotation's successor), the receipt's script etag and fingerprint, the intended binding's presence, and an unchanged set of other secret names. Ambiguous rotations require a confirming PUT before reporting success. Older intents without names may recover only from the exact starting version's historical bindings, with its id, etag and fingerprint verified; unavailable or malformed historical bindings refuse adoption. Each historical binding must have an exact provider type supported by this kit; unrecognized types cannot prove that a name was not a secret. Added, removed or renamed other secrets refuse deploy and removal before writes. Values remain opaque: these checks cannot distinguish an otherwise identical outside change to the pending binding.
 - **Removal.** `rer deploy --remove --yes` deletes what the state file says rer created for this environment: the Worker (schedules first; its Durable Objects go with it) and each D1, R2, KV and queue that is still the one rer created, after checking all of them before the first delete. A replaced or uncertain resource refuses the whole removal, except a resource whose create answer was lost: under this environment's derived name it is deleted once it is confirmed empty (a D1 with no tables, a KV namespace with no keys, an R2 bucket, which the provider refuses to delete while it holds objects); one holding data is refused as `uncertain-resource-not-empty`, and a queue, whose backlog rer cannot read, as `uncertain-resource-unverifiable` (delete it by hand if it is the empty one from the interrupted run). It then reads back that none is still listed and deletes the state file. An R2 bucket must be empty; a bucket with objects stays, the state file keeps it, and a later `--remove --yes` finishes. Resources rer did not create are never touched.
 
 ### If the state file is lost
@@ -286,12 +286,14 @@ retains the existing window, retrying only 404, 503 and network failures for
 30 seconds by default.
 
 The returned receipt carries `health: {ok, versionId, attempts}`. Each attempt is
-`{offsetMs, status, cfRay, contentType, body, errorClass}`: `status` is null for
-a transport failure, `body` is the first 256 response bytes decoded as UTF-8 and
-`errorClass` is null for the passing attempt. A failed wait throws an error whose
-message names the class and the last status (for example
-`health-http-failed-last-status-503`) and which carries `attempts`, `status` and
-the identity `receipt` (with `health.ok` false). Provider diagnostics are never
+`{offsetMs, status, cfRay, contentType, errorClass}`: `status` is null for
+a transport failure and `errorClass` is null for the passing attempt. The receipt
+and owner state keep no response text, since an unhealthy app may echo a secret.
+A failed wait throws an error whose message names the class and the last status
+(for example `health-http-failed-last-status-503`) and which carries `attempts`
+(each with `body`, the first 256 response bytes decoded as UTF-8, for the
+caller's redacted diagnostic), `status` and the identity `receipt` (with
+`health.ok` false). Provider diagnostics are never
 retained; the endpoint must not return credentials. `readiness: {totalMs, clock,
 sleep}` selects a smaller bound and deterministic time; `healthOptions.now` and
 `healthOptions.sleep` act as `clock` and `sleep` for the same purpose.

package/modules/deploy-kit/deploy.mjs

@@ -64,16 +64,23 @@ export async function deploy({api,plan,artifact,artifactSha256,previousReceipt,r
   return receipt;
 }
 
+// Response prefixes belong only in the caller's redacted diagnostic, never in
+// the ownership record: an unhealthy app may echo a secret, as the secret command also keeps.
+const recorded = attempts => attempts.map(({body:_,...attempt}) => attempt);
+
 /** After an upload the route may take a while to appear: wait for /health with a bound and
  * record every attempt in `receipt.health`. `onHealth(receipt)` runs after each attempt and at the end. */
 async function firstHealth({api,plan,receipt,fetch,healthOptions,readiness,onHealth,asset}) {
   receipt.health = {ok:false,attempts:[]};
   const {now,sleep,...options} = healthOptions;
   const wait = {...(now ? {clock:now} : {}),...(sleep ? {sleep} : {}),...readiness,onAttempt:async (_attempt,attempts) => {
-    receipt.health.attempts = [...attempts];
+    receipt.health.attempts = recorded(attempts);
     if (onHealth) await onHealth(receipt);
   }};
-  try { receipt.health = await verifyHealth({...options,api,plan,receipt,fetch,readiness:wait,asset}); }
+  try {
+    const health = await verifyHealth({...options,api,plan,receipt,fetch,readiness:wait,asset});
+    receipt.health = health.attempts ? {...health,attempts:recorded(health.attempts)} : health;
+  }
   catch (error) {
     receipt.health.ok = false; receipt.health.errorClass = error.message;
     if (onHealth) await onHealth(receipt);

package/modules/deploy-kit/health-request.mjs

@@ -20,7 +20,8 @@ async function bodyPrefix(response) {
 }
 
 /** One credential-free, bounded request. Retain only bounded response evidence. */
-export async function healthRequest({origin, receipt, versionId, request, timeoutMs, offsetMs}) {
+/** `expected` holds the deploy identity fields the caller knows; each must match. */
+export async function healthRequest({origin, expected, request, timeoutMs, offsetMs}) {
   const attempt = {offsetMs,status:null,cfRay:null,contentType:null,body:'',errorClass:null};
   let response;
   try {
@@ -58,11 +59,12 @@ export async function healthRequest({origin, receipt, versionId, request, timeou
   let body;
   try { body = JSON.parse(bytes.toString('utf8')); }
   catch { attempt.errorClass = 'malformed-response'; return {attempt,transient:false}; }
-  if (body?.ok !== true || body.deployment?.sourceSha !== receipt.source.sha || body.deployment?.fingerprint !== receipt.fingerprint || body.deployment?.versionId !== versionId) {
+  if (body?.ok !== true || Object.entries(expected).some(([key, value]) => body.deployment?.[key] !== value)) {
     attempt.errorClass = 'health-identity-mismatch';
     // Right after an upload the edge can still answer from another version: that
     // settles within the bound. The expected version answering wrongly does not.
-    const other = body?.ok === true && typeof body.deployment?.versionId === 'string' && body.deployment.versionId !== versionId;
+    const key = expected.versionId ? 'versionId' : 'sourceSha';
+    const other = body?.ok === true && typeof body.deployment?.[key] === 'string' && body.deployment[key] !== expected[key];
     return {attempt,transient:other};
   }
   return {attempt,transient:false};
@@ -74,13 +76,13 @@ const MIN_DELAY_MS = 2000, MAX_DELAY_MS = 10000;
 
 /** The total bound includes requests, body reads and backoff; no request starts at the deadline.
  * Only a transient outcome is retried. Every attempt is recorded, in order, whatever the end. */
-export async function waitHealth({origin,receipt,versionId,request,timeoutMs=30000,totalMs=90000,clock=()=>performance.now(),sleep=ms=>new Promise(resolve=>setTimeout(resolve,ms)),onAttempt=()=>{},single=false}) {
+export async function waitHealth({origin,receipt,versionId,expected={sourceSha:receipt.source.sha,fingerprint:receipt.fingerprint,versionId},request,timeoutMs=30000,totalMs=90000,clock=()=>performance.now(),sleep=ms=>new Promise(resolve=>setTimeout(resolve,ms)),onAttempt=()=>{},single=false}) {
   assert(Number.isFinite(totalMs) && totalMs > 0 && totalMs <= 90000 && Number.isFinite(timeoutMs) && timeoutMs > 0,'invalid-health-bound');
   const start = clock(); const attempts = []; let delay = 1000;
   while (true) {
     const remaining = totalMs - (clock()-start);
     if (remaining <= 0) break;
-    const result = await healthRequest({origin,receipt,versionId,request,timeoutMs:Math.max(1,Math.ceil(Math.min(timeoutMs,remaining))),offsetMs:Math.round(clock()-start)});
+    const result = await healthRequest({origin,expected,request,timeoutMs:Math.max(1,Math.ceil(Math.min(timeoutMs,remaining))),offsetMs:Math.round(clock()-start)});
     attempts.push(result.attempt); await onAttempt(result.attempt,attempts);
     if (!result.attempt.errorClass) return {ok:true,versionId,attempts};
     // `single` asks once, except that an edge still answering from the previous version settles within the bound.

package/modules/deploy-kit/owner-remove.mjs

@@ -56,6 +56,7 @@ export async function ownerRemove({api: provider, target, statePath, clock, slee
       if (!sameDeployment(live, expected)) throw refuse('owned-resource-replaced', 'worker', target.worker);
       worker = target.worker;
     }
+    assert(!state.pendingSecret, 'secret-change-unsettled');
     const listed = {}, doomed = [];
     for (const kind of KINDS) {
       if (!owned.some(item => item.kind === kind)) continue;

package/modules/deploy-kit/owner-secret-names.mjs

@@ -0,0 +1,31 @@
+import { identifier } from './validation.mjs';
+import { deployedFingerprint } from './worker.mjs';
+
+// Materialized binding families emitted by bindingsFor and secretBindings. Upload
+// directives such as inherit, and unrecognized types, cannot classify history.
+const historicalBindingTypes = new Set(['assets','plain_text','version_metadata','d1','r2_bucket','kv_namespace','queue','durable_object_namespace','service','secret_text']);
+
+export const validSecretNames = names => Array.isArray(names) && names.every(identifier) && new Set(names).size === names.length;
+
+/** Provider secret listings contain names and types, never values to persist. */
+export function secretNames(rows) {
+  if (!Array.isArray(rows) || !rows.every(row => row?.type === 'secret_text')) return null;
+  const names = rows.map(row => row.name);
+  return validSecretNames(names) ? names : null;
+}
+
+/** Older intents lack a name snapshot. Only the exact historical starting version
+ * can supply it: neither the plan nor today's successor proves yesterday's names.
+ * Version resources.bindings is optional in the provider API. Absent, malformed or
+ * mismatched historical evidence cannot authorize adoption. */
+export async function pendingSecretNames(api, worker, {pendingSecret, receipt}) {
+  if (pendingSecret.names !== undefined) return pendingSecret.names;
+  let anchor;
+  try { anchor = await api.request(`/workers/scripts/${worker}/versions/${pendingSecret.versionId}`); }
+  catch (error) { if (error.status === 404) return null; throw error; }
+  const bindings = anchor?.resources?.bindings;
+  if (anchor?.id !== pendingSecret.versionId || anchor?.resources?.script?.etag !== receipt.provider.etag
+    || !Array.isArray(bindings) || !bindings.every(row => row && typeof row === 'object' && !Array.isArray(row) && historicalBindingTypes.has(row.type))
+    || !validSecretNames(bindings.map(row => row.name)) || deployedFingerprint({bindings}) !== receipt.fingerprint) return null;
+  return bindings.filter(row => row.type === 'secret_text' && row.name !== pendingSecret.binding).map(row => row.name);
+}

package/modules/deploy-kit/owner-secret.mjs

@@ -1,5 +1,6 @@
 import { assert, identifier } from './validation.mjs';
 import { activeWorker } from './worker.mjs';
+import { secretNames } from './owner-secret-names.mjs';
 import { waitHealth } from './health-request.mjs';
 import { definiteProviderRefusal } from './provider.mjs';
 import { readOwnerState, writeOwnerState, withStateLock, withScopeHints, sameDeployment, refuse, recordSecretChange, settlePendingSecret } from './owner.mjs';
@@ -26,10 +27,12 @@ export async function ownerSecret({api: provider, target, statePath, binding, va
     const live = await activeWorker(api, target.worker);
     if (!live) throw refuse('owned-resource-missing', 'worker', target.worker);
     if (!sameDeployment(live, state.receipt.provider)) throw refuse('owned-resource-replaced', 'worker', target.worker);
+    assert(!state.pendingSecret, 'secret-change-unsettled');
     const path = `/workers/scripts/${target.worker}/secrets`, present = value !== undefined;
-    const names = async () => { const rows = await api.request(path); assert(Array.isArray(rows), 'invalid-secret-list'); return rows.map(row => row.name); };
-    const existed = (await names()).includes(binding), changed = present || existed;
-    state.pendingSecret = {binding, present, versionId:state.receipt.provider.versionId}; await writeOwnerState(statePath, state);
+    const names = secretNames(await api.request(path));
+    assert(names, 'invalid-secret-list');
+    const existed = names.includes(binding), changed = present || existed;
+    state.pendingSecret = {binding, present, versionId:state.receipt.provider.versionId, names:names.filter(name => name !== binding).sort()}; await writeOwnerState(statePath, state);
     let failure, unchanged = false, confirming = false;
     const put = () => api.request(path, {method:'PUT', body:{name:binding, text:value, type:'secret_text'}});
     try {

package/modules/deploy-kit/owner.mjs

@@ -9,6 +9,7 @@ import { secretBindings, activeWorker, deployedFingerprint } from './worker.mjs'
 import { validateMigrations } from './migrations.mjs';
 import { deploy } from './deploy.mjs';
 import { verifyHealth } from './health.mjs';
+import { validSecretNames, secretNames, pendingSecretNames } from './owner-secret-names.mjs';
 
 /* Owner-account mode: the owner's own Cloudflare account, token and account id.
  * Names are derived from the project id and the owner's environment. A local
@@ -170,7 +171,8 @@ export async function readOwnerState(path, target) {
   // Declared secrets rer removed on purpose (the spent setup token): later plans omit them.
   assert(state.pendingSecret === undefined || identifier(state.pendingSecret?.binding) && typeof state.pendingSecret?.present === 'boolean'
     && (state.pendingSecret.versionId === undefined || uuid(state.pendingSecret.versionId))
-    && (state.pendingSecret.repeatVersionId === undefined || uuid(state.pendingSecret.repeatVersionId)), 'invalid-owner-state');
+    && (state.pendingSecret.repeatVersionId === undefined || uuid(state.pendingSecret.repeatVersionId))
+    && (state.pendingSecret.names === undefined || validSecretNames(state.pendingSecret.names) && !state.pendingSecret.names.includes(state.pendingSecret.binding)), 'invalid-owner-state');
   assert(state.ownerClaim === undefined || ['claimed','kept'].includes(state.ownerClaim?.outcome), 'invalid-owner-state');
   assert(state.retiredSecrets === undefined || Array.isArray(state.retiredSecrets) && state.retiredSecrets.every(identifier), 'invalid-owner-state');
   assert(state.accountId === target.accountId && state.project === target.project && state.environment === target.environment && state.worker === target.worker, 'owner-state-target-mismatch');
@@ -245,22 +247,20 @@ export function recordSecretChange(state, current, {binding, present}) {
 /** A secret change rer recorded as pending but never confirmed (a lost response, or a run that
  * ended before the change settled). It is that change only when the Worker's versions list shows
  * exactly one version after the recorded starting version and it is the live one, still running the receipt's
- * exact script and build fingerprint: adopt its version. A confirming PUT also records its
+ * exact script and build fingerprint, with the other secret names unchanged: adopt its version. A confirming PUT also records its
  * own starting version before it writes; its immediate successor can be recovered by the
  * same checks. Anything later is left to the identity check, which refuses it. */
 export async function settlePendingSecret(api, worker, state, {preflight = false, observe, confirm} = {}) {
   if (!state.pendingSecret || !state.receipt) return false;
   const live = await activeWorker(api, worker);
   if (sameDeployment(live, state.receipt.provider)) {
-    // A new command sees that the abandoned write made no live version change.
-    // During the write's own readback this can still be propagation delay.
-    if (!preflight) {
-      // Deployment propagation can lag a secret write's version. Only a
-      // matching newest version corroborates that the write was unapplied.
-      const versions = (await api.request(`/workers/scripts/${worker}/versions`))?.items;
-      observe?.(Array.isArray(versions) && versions[0]?.id === live.versionId ? live : null);
-      return false;
-    }
+    // Both deployment and newest version must corroborate an unapplied write.
+    // A stale deployment alone must not erase an accepted but unsettled intent.
+    const versions = (await api.request(`/workers/scripts/${worker}/versions`))?.items;
+    const unchanged = Array.isArray(versions) && versions.every(item => uuid(item?.id))
+      && new Set(versions.map(item => item.id)).size === versions.length && versions[0]?.id === live.versionId;
+    observe?.(unchanged ? live : null);
+    if (!preflight || !unchanged) return false;
     delete state.pendingSecret;
     return true;
   }
@@ -269,6 +269,7 @@ export async function settlePendingSecret(api, worker, state, {preflight = false
   // Newest first, as the provider lists them.
   const versions = (await api.request(`/workers/scripts/${worker}/versions`))?.items;
   const ids = Array.isArray(versions) ? versions.map(item => item?.id) : [];
+  if (!ids.every(uuid) || new Set(ids).size !== ids.length) return false;
   const {versionId, repeatVersionId} = state.pendingSecret;
   const immediate = ids.indexOf(versionId) === 1;
   const repeated = repeatVersionId && ids[1] === repeatVersionId && ids.indexOf(versionId) === 2;
@@ -277,7 +278,11 @@ export async function settlePendingSecret(api, worker, state, {preflight = false
   // either the original immediate successor or the second write's successor.
   if (ids[0] !== live.versionId || !(repeatVersionId ? repeated || preflight && immediate && live.versionId === repeatVersionId : immediate)) return false;
   const rows = await api.request(`/workers/scripts/${worker}/secrets`);
-  if (!Array.isArray(rows) || rows.some(row => row.name === state.pendingSecret.binding) !== state.pendingSecret.present) return false;
+  const names = secretNames(rows);
+  if (!names || names.includes(state.pendingSecret.binding) !== state.pendingSecret.present) return false;
+  const priorNames = await pendingSecretNames(api, worker, state);
+  const otherNames = names.filter(name => name !== state.pendingSecret.binding);
+  if (!priorNames || priorNames.length !== otherNames.length || !priorNames.every(name => otherNames.includes(name))) return false;
   if (confirm && !repeatVersionId) { await confirm(live); return false; }
   recordSecretChange(state, live, state.pendingSecret);
   return true;
@@ -347,6 +352,7 @@ async function deployLocked({api, target, plan, artifact, statePath, env, fetch,
   if (await settlePendingSecret(api, target.worker, state, {preflight:true})) await save();
   await checkServiceWorkers(api, plan);
   const priorWorker = await checkOwnedWorker(api, plan, artifact, state);
+  assert(!state.pendingSecret, 'secret-change-unsettled');
   const exists = priorWorker !== null;
   const create = await ownedResourcesToCreate(api, plan, state);
   if (exists) await checkCronOwnership(api, plan);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@runeditrun/rer",
-  "version": "0.2.4",
+  "version": "0.2.5",
   "description": "The rer command: install, set up, run and launch Run Edit Run checkouts.",
   "license": "MIT",
   "type": "module",

package/scripts/publish-check/publication-config.json

@@ -28,6 +28,16 @@
     { "repository": "just-every/run-easel", "reason": "Owner-proposed public name (13 Oct 2026), accepted ahead of the rename; created by clean-history export at the first public tag." },
     { "repository": "just-every/run-willow", "reason": "Owner-proposed public name (13 Oct 2026), accepted ahead of the rename; created by clean-history export at the first public tag." },
     { "repository": "just-every/run-pier", "reason": "Owner-proposed public name (13 Oct 2026), accepted ahead of the rename; created by clean-history export at the first public tag." },
-    { "repository": "just-every/run-linen", "reason": "Owner-proposed public name (13 Oct 2026), accepted ahead of the rename; created by clean-history export at the first public tag." }
+    { "repository": "just-every/run-linen", "reason": "Owner-proposed public name (13 Oct 2026), accepted ahead of the rename; created by clean-history export at the first public tag." },
+    { "repository": "just-every/run-gauge", "reason": "Owner-declared public repository for a next-ten seed (15 Oct 2026); created by clean-history export at the first public tag." },
+    { "repository": "just-every/run-lodge", "reason": "Owner-declared public repository for a next-ten seed (15 Oct 2026); created by clean-history export at the first public tag." },
+    { "repository": "just-every/run-beam", "reason": "Owner-declared public repository for a next-ten seed (15 Oct 2026); created by clean-history export at the first public tag." },
+    { "repository": "just-every/run-locket", "reason": "Owner-declared public repository for a next-ten seed (15 Oct 2026); created by clean-history export at the first public tag." },
+    { "repository": "just-every/run-coaster", "reason": "Owner-declared public repository for a next-ten seed (15 Oct 2026); created by clean-history export at the first public tag." },
+    { "repository": "just-every/run-glove", "reason": "Owner-declared public repository for a next-ten seed (15 Oct 2026); created by clean-history export at the first public tag." },
+    { "repository": "just-every/run-gasket", "reason": "Owner-declared public repository for a next-ten seed (15 Oct 2026); created by clean-history export at the first public tag." },
+    { "repository": "just-every/run-pantry", "reason": "Owner-declared public repository for a next-ten seed (15 Oct 2026); created by clean-history export at the first public tag." },
+    { "repository": "just-every/run-nectar", "reason": "Owner-declared public repository for a next-ten seed (15 Oct 2026); created by clean-history export at the first public tag." },
+    { "repository": "just-every/run-larder", "reason": "Owner-declared public repository for a next-ten seed (15 Oct 2026); created by clean-history export at the first public tag." }
   ]
 }