mfeflow 0.4.0 → 0.5.0

package/dist/index.js

@@ -1,14 +1,16 @@
 import { stripVTControlCharacters } from "node:util";
-import { MfeflowError, PlanBuilder, applyPlan, buildRegistry, dotenvKeys, fetchFeatureIndex, findDiverged, findProjectRoot, getHttps, hasErrno, inOrder, isMfeflowError, loadFeature, loadProject, messageOf, parseFeature, readCappedText, realFs, recordPlan, renderDiff, renderTemplate, resolveFeature, runtimeConfigFiles, saveProject, schemaKeys, serializeProject, summarize, writeFileAtomic } from "@mfeflow/core";
+import { COST_MODEL, DOCS_URL, MFE_NAME, REGISTRY_NAMESPACE, ROUTE_OVERLAP, isLoopbackHttp, isSafeRelativePath, judgeCost, judgeRemoteInitial, primaryExpose, redactUrl, redactUrlsIn, registryIndexUrl, registryTemplateProblem, remoteDistFiles, round1, routesOverlap, validateMfeManifest, validateRegistryEntry, validateRegistryIndex } from "@mfeflow/contracts";
+import { MfeflowError, PlanBuilder, TRUST_ENV, addTrusted, applyPlan, buildRegistry, checkIntegrity, configDirOf, dotenvKeys, fetchFeatureIndex, findDiverged, findProjectRoot, getHttps, hasErrno, inOrder, isMfeflowError, loadFeature, loadProject, messageOf, parseFeature, parseTrustEnv, readCappedText, readTrusted, realFs, recordPlan, removeTrusted, renderDiff, renderTemplate, resolveFeature, runtimeConfigFiles, saveProject, schemaKeys, serializeProject, summarize, trustedNamespaces, writeFileAtomic } from "@mfeflow/core";
 import { defineCommand, runCommand } from "citty";
 import node_path from "node:path";
-import { COST_MODEL, DOCS_URL, MFE_NAME, REGISTRY_NAMESPACE, assetsFromManifest, isSafeRelativePath, judgeCost, registryIndexUrl, registryTemplateProblem, round1, validateMfeManifest, validateRegistryEntry } from "@mfeflow/contracts";
 import promises from "node:fs/promises";
 import node_fs from "node:fs";
+import semver, { gt } from "semver";
 import { createRequire } from "node:module";
-import semver from "semver";
+import { HostError, INDEX_CACHE_CONTROL, PreconditionFailedError, applyPlan as static_applyPlan, artifactPrefix, comparable, indexKey, localHost, planDeploy, readIndex, satisfiesRange } from "@mfeflow/registry/static";
 import { parse } from "yaml";
 import node_zlib from "node:zlib";
+import node_os from "node:os";
 import { spawn, spawnSync } from "node:child_process";
 import node_net from "node:net";
 import { fileURLToPath } from "node:url";
@@ -266,7 +268,11 @@ function loadAny(name, source) {
         } : {},
         ...void 0 === source.version ? {} : {
             version: source.version
-        }
+        },
+        trusted: source.trusted?.has(name.slice(0, name.indexOf('/'))) === true,
+        ...true === source.checkIndex ? {
+            checkIndex: true
+        } : {}
     });
 }
 const RESERVED = new Set([
@@ -444,7 +450,7 @@ const EXIT = {
     feature: 4,
     build: 5,
     registry: 6,
-    upgrade: 7,
+    deploy: 7,
     cancelled: 130
 };
 class Cancelled extends Error {
@@ -462,7 +468,7 @@ const BY_RANGE = {
     2: EXIT.feature,
     3: EXIT.build,
     4: EXIT.registry,
-    5: EXIT.upgrade
+    5: EXIT.deploy
 };
 function exitCodeOfCode(code) {
     if (USAGE_ERRORS.has(code)) return EXIT.usage;
@@ -557,7 +563,13 @@ function planReport(plan) {
                 action: c.action
             })),
         dependencies: plan.dependencies.map((d)=>({
-                ...d
+                file: d.file,
+                name: d.name,
+                range: d.range,
+                dev: d.dev,
+                ...true === d.thirdParty ? {
+                    thirdParty: true
+                } : {}
             })),
         scripts: plan.scripts.map((s)=>({
                 file: s.file,
@@ -625,6 +637,7 @@ function checkPlan(c, plan) {
             'range'
         ])c.string(d, key, p);
         c.boolean(d, 'dev', p);
+        if (void 0 !== d.thirdParty) c.boolean(d, 'thirdParty', p);
     });
     c.objects(plan, "scripts", at, (s, p)=>{
         for (const key of [
@@ -720,6 +733,72 @@ function checkBudget(c, value) {
         ])c.string(f, key, p);
     });
 }
+function checkFindings(c, value) {
+    c.objects(value, 'findings', '', (f, p)=>{
+        for (const key of [
+            'code',
+            'message',
+            'fix',
+            'docs'
+        ])c.string(f, key, p);
+    });
+}
+function checkDeploy(c, value) {
+    for (const key of [
+        'root',
+        'env',
+        'host',
+        'remote',
+        'version'
+    ])c.string(value, key, '');
+    for (const key of [
+        'dryRun',
+        'published'
+    ])c.boolean(value, key, '');
+    for (const key of [
+        'fromEnv',
+        'servedBefore',
+        'previous',
+        'rolledBackFrom',
+        'localEntry'
+    ])if (null !== value[key] && 'string' != typeof value[key]) c.add(key, 'must be text or null');
+    c.texts(value, 'uploaded', '');
+    c.texts(value, 'skipped', '');
+    c.texts(value, 'warnings', '');
+    c.objects(value, 'uploads', '', (u, p)=>{
+        for (const key of [
+            'key',
+            'contentType',
+            'cacheControl'
+        ])c.string(u, key, p);
+        if ('number' != typeof u.bytes) c.add(`${p}bytes`, 'must be a number');
+        if (![
+            'create-only',
+            'if-match',
+            'none'
+        ].includes(String(u.guard))) c.add(`${p}guard`, 'must be create-only, if-match or none');
+    });
+    if (true === value.dryRun && Array.isArray(value.uploaded) && value.uploaded.length > 0) c.add('uploaded', 'must be empty for a dry run');
+    if (void 0 !== value.index && !isObj(value.index)) c.add('index', 'must be an object');
+    checkFindings(c, value);
+}
+function checkStatus(c, value) {
+    c.string(value, 'root', '');
+    c.string(value, 'host', '');
+    c.objects(value, 'envs', '', (e, p)=>{
+        c.string(e, 'env', p);
+        c.boolean(e, 'published', p);
+        if (null !== e.generatedAt && 'string' != typeof e.generatedAt) c.add(`${p}generatedAt`, 'must be text or null');
+        c.objects(e, 'remotes', p, (r, q)=>{
+            c.string(r, 'name', q);
+            c.string(r, 'version', q);
+            c.texts(r, 'history', q);
+            c.texts(r, 'drift', q);
+            if (null !== r.unreferenced) c.texts(r, 'unreferenced', q);
+        });
+    });
+    checkFindings(c, value);
+}
 function validateResult(value) {
     const c = new Check();
     if (!isObj(value)) {
@@ -781,6 +860,7 @@ function validateResult(value) {
                     'namespace',
                     'index'
                 ])c.string(r, key, p);
+                c.boolean(r, 'trusted', p);
                 if ('number' != typeof r.items) c.add(`${p}items`, 'must be a number');
                 if (null !== r.error) if (isObj(r.error)) for (const key of [
                     'code',
@@ -796,8 +876,10 @@ function validateResult(value) {
                 'add',
                 'remove',
                 'list',
-                'build'
-            ].includes(String(value.action))) c.add('action', 'must be add, remove, list or build');
+                'build',
+                'trust',
+                'untrust'
+            ].includes(String(value.action))) c.add('action', 'must be add, remove, list, build, trust or untrust');
             c.boolean(value, 'dryRun', '');
             c.boolean(value, 'changed', '');
             if (null !== value.root) c.string(value, 'root', '');
@@ -807,6 +889,7 @@ function validateResult(value) {
                     'url',
                     'index'
                 ])c.string(r, key, p);
+                c.boolean(r, 'trusted', p);
             });
             if (null !== value.build) if (isObj(value.build)) {
                 for (const key of [
@@ -842,8 +925,16 @@ function validateResult(value) {
             });
             if (!isObj(value.overrides)) c.add('overrides', 'must be an object');
             break;
+        case 'deploy':
+        case 'promote':
+        case 'rollback':
+            checkDeploy(c, value);
+            break;
+        case 'status':
+            checkStatus(c, value);
+            break;
         default:
-            c.add('command', 'must be init, add, features, registry, doctor, validate, check-compat, budget or dev');
+            c.add('command', 'must be init, add, features, registry, doctor, validate, check-compat, budget, dev, deploy, promote, rollback or status');
     }
     return c.issues;
 }
@@ -979,6 +1070,18 @@ function withProjectChange(plan, project) {
         ]
     };
 }
+function stampCli(project, plan) {
+    if (0 === withProjectChange(plan, project).changes.length) return project;
+    return raiseCli(project);
+}
+function raiseCli(project) {
+    const running = readPackageJson().version;
+    if (void 0 !== project.cli && !gt(running, project.cli)) return project;
+    return {
+        ...project,
+        cli: running
+    };
+}
 async function missingFolders(root) {
     const missing = [];
     let dir = root;
@@ -1045,7 +1148,8 @@ async function write_exists(dir) {
     }
 }
 async function writePlan(request) {
-    const { rt, globals, root, plan, project } = request;
+    const { rt, globals, root, plan } = request;
+    const project = stampCli(request.project, plan);
     const shown = withProjectChange(plan, project);
     if (!globals.json) {
         rt.io.stdout(summarize(shown));
@@ -1272,32 +1376,32 @@ const KEYS = new Set([
     'topology',
     'options'
 ]);
-function bad(source, why) {
+function preset_bad(source, why) {
     throw new MfeflowError('E109', `${source}: ${why}`);
 }
 function isRecord(value) {
     return 'object' == typeof value && null !== value && !Array.isArray(value);
 }
 function stringList(source, key, value) {
-    if (!Array.isArray(value) || !value.every((item)=>'string' == typeof item)) bad(source, `${key} must be a list of text`);
+    if (!Array.isArray(value) || !value.every((item)=>'string' == typeof item)) preset_bad(source, `${key} must be a list of text`);
     return value;
 }
 function optionsOf(source, value) {
-    if (!isRecord(value)) bad(source, 'options must be an object of feature names');
+    if (!isRecord(value)) preset_bad(source, 'options must be an object of feature names');
     const out = {};
     for (const [feature, given] of Object.entries(value)){
-        if (!isRecord(given)) bad(source, `options.${feature} must be an object`);
+        if (!isRecord(given)) preset_bad(source, `options.${feature} must be an object`);
         out[feature] = given;
     }
     return out;
 }
 function parsePreset(source, value) {
-    if (!isRecord(value)) bad(source, 'must be a JSON object');
+    if (!isRecord(value)) preset_bad(source, 'must be a JSON object');
     const preset = {};
     for (const [key, item] of Object.entries(value)){
-        if (!KEYS.has(key)) bad(source, `"${key}" is not a preset option`);
+        if (!KEYS.has(key)) preset_bad(source, `"${key}" is not a preset option`);
         if ('scope' === key || 'packageManager' === key || 'topology' === key) {
-            if ('string' != typeof item) bad(source, `${key} must be text`);
+            if ('string' != typeof item) preset_bad(source, `${key} must be text`);
             preset[key] = item;
         } else if ('remotes' === key || 'features' === key) preset[key] = stringList(source, key, item);
         else if ('options' === key) preset.options = optionsOf(source, item);
@@ -1306,13 +1410,13 @@ function parsePreset(source, value) {
 }
 async function readUrl(url, fetchImpl) {
     const response = await getHttps(url, fetchImpl, 'E109');
-    if (!response.ok) bad(url, `answered ${String(response.status)}`);
+    if (!response.ok) preset_bad(url, `answered ${String(response.status)}`);
     return readCappedText(response, MAX_BYTES, ()=>new MfeflowError('E109', `${url}: is larger than 100 KB`));
 }
 async function loadPreset(source, sources) {
     let text;
     if (/^https?:\/\//i.test(source)) {
-        if (!source.toLowerCase().startsWith('https://')) bad(source, 'must be https');
+        if (!source.toLowerCase().startsWith('https://')) preset_bad(source, 'must be https');
         text = await readUrl(source, sources.fetch);
     } else {
         const file = node_path.resolve(sources.cwd, source);
@@ -1334,6 +1438,9 @@ async function loadPreset(source, sources) {
     }
     return parsePreset(source, value);
 }
+async function trustedIn(rt, registries) {
+    return trustedNamespaces(registries ?? {}, await readTrusted(rt.configDir), parseTrustEnv(rt.io.env[TRUST_ENV]));
+}
 const ADD_ARGS = {
     port: {
         type: 'string',
@@ -1370,6 +1477,10 @@ const ADD_ARGS = {
         description: 'add env-key: root, every shell or every remote, instead of --app',
         valueHint: 'root|shell|remotes'
     },
+    'accept-changed-content': {
+        type: 'boolean',
+        description: 'Take a registry feature whose content differs from the hash recorded in mfeflow.json'
+    },
     ...GLOBAL_ARGS
 };
 function portFor(args, project, start) {
@@ -1388,17 +1499,23 @@ async function nameFrom(rt, globals, given, what) {
     });
     throw new MfeflowError('E107', `add ${what} needs a name: mfeflow add ${what} <name>`);
 }
-async function addAppParts(rt, globals, builder, project, next, kind, name) {
+async function addAppParts(rt, globals, builder, project, next, kind, name, acceptChanged) {
     const names = [
         'core',
         ...Object.keys(project.features).filter((n)=>'core' !== n)
     ];
     const { canPrompt } = globals;
+    const trusted = await trustedIn(rt, project.registries);
+    const untrusted = [
+        ...new Set(names.filter((n)=>n.startsWith('@')).map((n)=>n.slice(0, n.indexOf('/'))).filter((ns)=>ns in (project.registries ?? {}) && !trusted.fetch.has(ns)))
+    ];
+    if (untrusted.length > 0) throw new MfeflowError('E405', `${untrusted.join(', ')} is installed here but not trusted on this machine, so it was not requested`);
     const loadedAll = await Promise.all(names.map((feature)=>loadAny(feature, {
             roots: rt.roots,
             registries: project.registries,
             fetch: rt.fetch,
-            version: project.features[feature]?.version
+            version: project.features[feature]?.version,
+            trusted: trusted.privateOk
         })));
     let core;
     const fromRegistry = [];
@@ -1415,6 +1532,20 @@ async function addAppParts(rt, globals, builder, project, next, kind, name) {
                 fix: `Nothing was written. Use a registry URL with {version} so ${recorded} can be fetched, or add the app by hand.`
             });
             fromRegistry.push(feature);
+            const entry = next.features[feature];
+            const now = loaded.integrity;
+            if (void 0 !== entry && void 0 !== now) {
+                if (void 0 === entry.integrity) {
+                    if (!globals.json) rt.io.stdout(`${feature} has no integrity hash in mfeflow.json; recording one now.`);
+                    next.features[feature] = {
+                        ...entry,
+                        integrity: now
+                    };
+                } else if (checkIntegrity(feature, entry.integrity, now, acceptChanged)) next.features[feature] = {
+                    ...entry,
+                    integrity: now
+                };
+            }
         }
         planned.push({
             feature,
@@ -1447,10 +1578,13 @@ async function addApp(rt, globals, args, kind, given) {
                 path: `apps/${name}`,
                 port
             }
+        },
+        features: {
+            ...project.features
         }
     };
     const builder = createBuilder(root, chosen.checkout);
-    const core = await addAppParts(rt, globals, builder, project, next, 'remote' === kind ? 'remotes' : 'shell', name);
+    const core = await addAppParts(rt, globals, builder, project, next, 'remote' === kind ? 'remotes' : 'shell', name, true === args['accept-changed-content']);
     const version = core.manifest.version;
     if ('remote' === kind) await resolveFeature({
         feature: await remoteGlue({
@@ -1612,10 +1746,13 @@ async function addFeatures(rt, globals, local, requested, options) {
         };
     }
     assertOptionsAreForFeatures(options, adding);
+    const trusted = await trustedIn(rt, project.registries);
     const loaded = await Promise.all(adding.map((name)=>loadAny(name, {
             roots: rt.roots,
             registries: project.registries,
-            fetch: rt.fetch
+            fetch: rt.fetch,
+            trusted: trusted.privateOk,
+            checkIndex: true
         })));
     const thirdParty = loaded.filter((f)=>'third-party' === f.trust).map((f)=>f.manifest.name);
     assertThirdPartyAllowed(thirdParty, globals, canPrompt);
@@ -1672,7 +1809,7 @@ function finding(check, code, detail, options = {}) {
     if (void 0 !== options.path) out.path = options.path;
     return out;
 }
-const done = (findings)=>Promise.resolve({
+const findings_done = (findings)=>Promise.resolve({
         findings
     });
 const SINGLETON_SPECIFIERS = [
@@ -1930,11 +2067,6 @@ async function versionIn(app, name, root) {
     }
     return declared;
 }
-function comparable(version) {
-    const exact = semver.valid(version);
-    if (null !== exact) return exact;
-    return null === semver.validRange(version) ? void 0 : semver.minVersion(version)?.version ?? void 0;
-}
 function unresolved(check, code, name, specs) {
     return finding(check, code, `${name} is ${specs.join(', ')}: the version cannot be compared until install, so it is not checked`, {
         severity: 'warning'
@@ -1975,12 +2107,6 @@ const singletonVersions = {
         };
     }
 };
-function fits(range, shellVersion) {
-    if (void 0 === shellVersion) return true;
-    const have = comparable(shellVersion);
-    const valid = semver.validRange(range);
-    return void 0 === have || null === valid || semver.satisfies(have, valid);
-}
 async function compatFor(shell, remote, root) {
     const out = [];
     const at = {
@@ -1993,7 +2119,7 @@ async function compatFor(shell, remote, root) {
         if (void 0 !== have && void 0 === comparable(have)) out.push(unresolved('compat', 'E302', name, [
             `${shell.name} ${have}`
         ]));
-        else if (!fits(range, have)) out.push(finding('compat', 'E302', `${remote.name} needs ${name} ${range} (mfe.json platform) but ${shell.name} has ${String(have)}`, at));
+        else if (!satisfiesRange(range, have)) out.push(finding('compat', 'E302', `${remote.name} needs ${name} ${range} (mfe.json platform) but ${shell.name} has ${String(have)}`, at));
     }
     for (const name of SINGLETON_PACKAGES){
         const [theirs, mine] = await Promise.all([
@@ -2011,7 +2137,7 @@ async function compatFor(shell, remote, root) {
         ];
         if (open.length > 0) out.push(unresolved('compat', 'E302', name, open));
         if (void 0 !== want && void 0 !== mine) {
-            if (!fits(`^${want}`, mine) && !(name in platform)) out.push(finding('compat', 'E302', `${remote.name} uses ${name} ${want}, ${shell.name} provides ${mine}`, {
+            if (!satisfiesRange(`^${want}`, mine) && !(name in platform)) out.push(finding('compat', 'E302', `${remote.name} uses ${name} ${want}, ${shell.name} provides ${mine}`, {
                 app: remote.name
             }));
         }
@@ -2040,7 +2166,7 @@ function issueText(read) {
 const appsOnDisk = {
     id: 'config.apps',
     title: 'every app in mfeflow.json is on disk',
-    run: ({ apps })=>done(apps.filter((app)=>!app.present).map((app)=>finding('config.apps', 'E112', `${app.name} (${app.rel}/package.json not found)`, {
+    run: ({ apps })=>findings_done(apps.filter((app)=>!app.present).map((app)=>finding('config.apps', 'E112', `${app.name} (${app.rel}/package.json not found)`, {
                 app: app.name,
                 path: `${app.rel}/package.json`
             })))
@@ -2048,7 +2174,7 @@ const appsOnDisk = {
 const mfeJson = {
     id: 'config.mfe-json',
     title: 'every app has a valid mfe.json that matches mfeflow.json',
-    run: ({ apps })=>done(apps.filter((app)=>app.present).flatMap((app)=>{
+    run: ({ apps })=>findings_done(apps.filter((app)=>app.present).flatMap((app)=>{
             const at = {
                 app: app.name,
                 path: `${app.rel}/mfe.json`
@@ -2074,26 +2200,28 @@ const config_ports = {
             ...byPort.get(app.port) ?? [],
             app.name
         ]);
-        return done([
+        return findings_done([
             ...byPort
         ].filter(([, names])=>names.length > 1).map(([port, names])=>finding('config.ports', 'E115', `${names.join(' and ')} both use ${String(port)}`)));
     }
 };
 const config_routes = {
     id: 'config.routes',
-    title: 'no two remotes claim the same route',
+    title: 'no two remotes claim overlapping routes',
     run: ({ apps })=>{
-        const claimed = new Map();
+        const claimed = [];
         const out = [];
-        for (const app of apps)if ('remote' === app.kind && 'ok' === app.mfe.state) for (const route of app.mfe.value.routes){
-            const owner = claimed.get(route);
-            if (void 0 !== owner && owner !== app.name) out.push(finding('config.routes', 'E116', `${route} is claimed by ${owner} and ${app.name}`, {
+        for (const app of apps)if ('remote' === app.kind && 'ok' === app.mfe.state) {
+            for (const route of app.mfe.value.routes)for (const other of claimed)if (other.app !== app.name && routesOverlap(route, other.route)) out.push(finding('config.routes', 'E116', `${app.name} route ${route} overlaps ${other.app} route ${other.route}`, {
                 app: app.name,
                 path: `${app.rel}/mfe.json`
             }));
-            else claimed.set(route, app.name);
+            for (const route of app.mfe.value.routes)claimed.push({
+                app: app.name,
+                route
+            });
         }
-        return done(out);
+        return findings_done(out);
     }
 };
 const config_registry = {
@@ -2124,7 +2252,7 @@ const config_registry = {
                 path: `registry/envs/${env}/${name}.json`
             }));
         }
-        return done(out);
+        return findings_done(out);
     }
 };
 const localCheckout = {
@@ -2139,17 +2267,17 @@ const localCheckout = {
             const unbuilt = [
                 ...scanCheckout(node_path.resolve(root, project.local))
             ].filter(([, p])=>!p.built).map(([name])=>name);
-            return done(0 === unbuilt.length ? [] : [
+            return findings_done(0 === unbuilt.length ? [] : [
                 finding('config.local', 'E110', `${unbuilt.join(', ')} not built in ${project.local}`)
             ]);
         } catch (error) {
-            return done([
+            return findings_done([
                 finding('config.local', 'E110', error instanceof Error ? error.message : String(error))
             ]);
         }
     }
 };
-const drift = {
+const config_drift = {
     id: 'files.drift',
     title: 'copied files match the hashes in mfeflow.json',
     run: async ({ root, project })=>({
@@ -2196,7 +2324,7 @@ async function eachPlace(view, check) {
         findings: [],
         skipped: NOT_INSTALLED
     };
-    return done((await Promise.all(places(view).map(check))).flat());
+    return findings_done((await Promise.all(places(view).map(check))).flat());
 }
 async function serverKeysOf(place) {
     const source = await readText(node_path.join(place.dir, 'env.ts'));
@@ -2508,7 +2636,7 @@ const runtimePlugins = {
 const workspaceVersions = {
     id: 'singletons.workspace-version',
     title: 'every workspace package has a version',
-    run: ({ workspace })=>done(workspace.filter((p)=>!p.hasVersion).map((p)=>finding('singletons.workspace-version', 'E111', `${p.pkg.name ?? p.rel} (${p.rel}/package.json)`, {
+    run: ({ workspace })=>findings_done(workspace.filter((p)=>!p.hasVersion).map((p)=>finding('singletons.workspace-version', 'E111', `${p.pkg.name ?? p.rel} (${p.rel}/package.json)`, {
                 path: `${p.rel}/package.json`,
                 fixable: true
             })))
@@ -2532,7 +2660,7 @@ const DOCTOR_CHECKS = [
     singletonVersions,
     workspaceVersions,
     compat,
-    drift,
+    config_drift,
     runtimePlugins,
     ...envChecks
 ];
@@ -2695,16 +2823,6 @@ async function shellInitial(dist) {
         bytes
     };
 }
-const sizes_isObj = (v)=>'object' == typeof v && null !== v && !Array.isArray(v);
-const ORIGIN = 'https://dist.invalid';
-const SCRIPT = /\.[cm]?js$/;
-function distPath(url) {
-    try {
-        return decodeURIComponent(new URL(url).pathname).replace(/^\//, '');
-    } catch  {
-        return;
-    }
-}
 async function remoteSizes(dist) {
     const text = await readText(node_path.join(dist, 'mf-manifest.json'));
     if (void 0 === text) return;
@@ -2714,34 +2832,13 @@ async function remoteSizes(dist) {
     } catch  {
         return;
     }
-    if (!sizes_isObj(manifest) || !sizes_isObj(manifest.metaData) || !sizes_isObj(manifest.metaData.remoteEntry)) return;
-    const local = {
-        ...manifest,
-        metaData: {
-            ...manifest.metaData,
-            publicPath: 'auto',
-            getPublicPath: void 0,
-            globalName: void 0,
-            remoteEntry: {
-                ...manifest.metaData.remoteEntry,
-                type: void 0
-            }
-        }
-    };
-    let assets;
-    try {
-        assets = assetsFromManifest(local, `${ORIGIN}/mf-manifest.json`);
-    } catch  {
-        return;
-    }
-    const entry = void 0 === assets.remoteEntry ? void 0 : distPath(assets.remoteEntry);
-    if (void 0 === entry) return;
-    const entryBytes = await gzipBytes(node_path.join(dist, ...entry.split('/')));
+    const files = remoteDistFiles(manifest);
+    if (void 0 === files) return;
+    const entryBytes = await gzipBytes(node_path.join(dist, ...files.entry.split('/')));
     if (void 0 === entryBytes) return;
     const exposes = {};
-    for (const [name, urls] of Object.entries(assets.exposes)){
-        const files = urls.flatMap((url)=>distPath(url) ?? []).filter((f)=>SCRIPT.test(f));
-        const bytes = await sumGzip(dist, files);
+    for (const [name, list] of Object.entries(files.exposes)){
+        const bytes = await sumGzip(dist, list);
         if (void 0 !== bytes) exposes[name] = bytes;
     }
     return {
@@ -2808,11 +2905,14 @@ async function remoteBudget(app, dist, model, out) {
     }));
     const own = 'ok' === app.mfe.state ? app.mfe.value : void 0;
     const budgetKb = own?.budgets?.initialJsKb ?? null;
-    const exposeNames = Object.keys(size.exposes);
-    const expose = exposeNames.includes('./App') ? './App' : exposeNames[0];
+    const expose = primaryExpose(Object.keys(size.exposes));
     const routes = (own?.routes ?? []).map((route)=>{
-        const total = round1((size.entryBytes + (void 0 === expose ? 0 : size.exposes[expose] ?? 0)) / 1024);
-        const routePass = null === budgetKb ? null : total <= budgetKb;
+        const verdict = judgeRemoteInitial({
+            entryBytes: size.entryBytes,
+            exposeBytes: void 0 === expose ? 0 : size.exposes[expose] ?? 0
+        }, budgetKb ?? void 0, model);
+        const total = verdict.totalKb;
+        const routePass = null === budgetKb ? null : verdict.pass;
         if (false === routePass) out.push(finding('budget', 'E304', `${app.name} on ${route} loads ${String(total)} KB; mfe.json budgets.initialJsKb is ${String(budgetKb)}`, {
             app: app.name,
             path: `${app.rel}/mfe.json`
@@ -2875,6 +2975,782 @@ function formatBudget(result) {
     for (const f of result.findings)lines.push('', `error ${f.code} ${f.message}`, `  Fix: ${f.fix}`, `  ${f.docs}`);
     return lines.join('\n');
 }
+const USAGE = '--host must be file:<dir> or s3://<bucket>[/prefix]';
+function parseHostSpec(spec, cwd) {
+    if (spec.startsWith('file:')) {
+        const dir = spec.slice(5);
+        if ('' === dir) throw new MfeflowError('E506', `${USAGE}; "${spec}" names no folder`);
+        const home = /^~(?:[/\\](.*))?$/.exec(dir);
+        if (home) return {
+            kind: 'file',
+            dir: node_path.resolve(node_os.homedir(), home[1] ?? '')
+        };
+        return {
+            kind: 'file',
+            dir: node_path.resolve(cwd, dir)
+        };
+    }
+    if (spec.startsWith('s3://')) {
+        const [bucket = '', ...rest] = spec.slice(5).split('/');
+        const parts = rest.filter((part)=>'' !== part);
+        if (!/^[a-z0-9][a-z0-9.-]{1,61}[a-z0-9]$/.test(bucket)) throw new MfeflowError('E506', `${USAGE}; the bucket name is not valid`);
+        if (parts.some((part)=>'.' === part || '..' === part)) throw new MfeflowError('E506', `${USAGE}; the prefix cannot contain . or ..`);
+        return {
+            kind: 's3',
+            bucket,
+            prefix: parts.join('/')
+        };
+    }
+    throw new MfeflowError('E506', USAGE);
+}
+function describeHost(host) {
+    if ('file' === host.kind) return `file:${host.dir}`;
+    return '' === host.prefix ? `s3://${host.bucket}` : `s3://${host.bucket}/${host.prefix}`;
+}
+const hosts_present = (env, name)=>{
+    const value = env[name];
+    return void 0 === value || '' === value ? void 0 : value;
+};
+function secretsOf(env) {
+    return [
+        'AWS_ACCESS_KEY_ID',
+        'AWS_SECRET_ACCESS_KEY',
+        'AWS_SESSION_TOKEN'
+    ].map((name)=>hosts_present(env, name)).filter((value)=>void 0 !== value);
+}
+function redact(text, secrets) {
+    return secrets.reduce((out, secret)=>out.replaceAll(secret, '***'), text);
+}
+function withPrefix(inner, prefix) {
+    if ('' === prefix) return inner;
+    const at = (key)=>`${prefix}/${key}`;
+    return {
+        put: (key, body, options)=>inner.put(at(key), body, options),
+        get: (key)=>inner.get(at(key)),
+        head: (key)=>inner.head(at(key)),
+        ...void 0 === inner.list ? {} : {
+            list: async (keyPrefix)=>(await inner.list?.(at(keyPrefix)))?.filter((key)=>key.startsWith(`${prefix}/`)).map((key)=>key.slice(prefix.length + 1)) ?? []
+        }
+    };
+}
+async function openHost(spec, options) {
+    if ('file' === spec.kind) return localHost(spec.dir);
+    const { s3Host } = await import("@mfeflow/registry/s3");
+    const { env } = options;
+    const accessKeyId = hosts_present(env, 'AWS_ACCESS_KEY_ID');
+    const secretAccessKey = hosts_present(env, 'AWS_SECRET_ACCESS_KEY');
+    const region = hosts_present(env, 'MFEFLOW_S3_REGION') ?? hosts_present(env, 'AWS_REGION');
+    const missing = [
+        ...void 0 === accessKeyId ? [
+            'AWS_ACCESS_KEY_ID'
+        ] : [],
+        ...void 0 === secretAccessKey ? [
+            'AWS_SECRET_ACCESS_KEY'
+        ] : [],
+        ...void 0 === region ? [
+            'MFEFLOW_S3_REGION'
+        ] : []
+    ];
+    if (void 0 === accessKeyId || void 0 === secretAccessKey || void 0 === region) throw new MfeflowError('E506', `set ${missing.join(', ')} to use ${describeHost(spec)}`);
+    const endpoint = hosts_present(env, 'MFEFLOW_S3_ENDPOINT');
+    const sessionToken = hosts_present(env, 'AWS_SESSION_TOKEN');
+    return withPrefix(s3Host({
+        region,
+        bucket: spec.bucket,
+        accessKeyId,
+        secretAccessKey,
+        ...void 0 === endpoint ? {} : {
+            endpoint
+        },
+        ...void 0 === sessionToken ? {} : {
+            sessionToken
+        },
+        ...void 0 === options.fetch ? {} : {
+            fetch: options.fetch
+        }
+    }), spec.prefix);
+}
+const GATE_CODES = {
+    schema: 'E501',
+    'route-overlap': 'E502',
+    compat: 'E503',
+    budget: 'E504',
+    rollout: 'E505'
+};
+const ENV_NAME = /^[a-z][a-z0-9-]*$/;
+function envOf(args, key = 'env') {
+    const env = args_text(args, key);
+    if (void 0 === env) throw new MfeflowError('E107', `--${key} <env> is required`);
+    if (!ENV_NAME.test(env)) throw new MfeflowError('E107', `--${key} "${env}" must be lowercase letters, digits and -`);
+    return env;
+}
+function positionals(args, max, usage) {
+    const given = Array.isArray(args._) ? args._.map(String) : [];
+    const surplus = given[max];
+    if (void 0 !== surplus) throw new MfeflowError('E107', `unexpected "${surplus}" (${usage})`);
+    return given;
+}
+async function openSession(rt, args, raw = readGlobals(args, rt.io.env, rt.io.cwd, rt.io.interactive)) {
+    const view = await inspectProject(await findProjectRoot(raw.cwd));
+    const flag = args_text(args, 'host');
+    const spec = flag ?? view.project.registry?.host;
+    if (void 0 === spec) throw new MfeflowError('E506', 'no host: pass --host or set registry.host in mfeflow.json');
+    const parsed = parseHostSpec(spec, void 0 === flag ? view.root : raw.cwd);
+    const secrets = secretsOf(rt.io.env);
+    let host;
+    try {
+        host = await openHost(parsed, {
+            env: rt.io.env,
+            ...void 0 === rt.hostFetch ? {} : {
+                fetch: rt.hostFetch
+            }
+        });
+    } catch (error) {
+        throw hostFailure(error, secrets);
+    }
+    const flagUrl = args_text(args, 'base-url');
+    const baseUrl = void 0 === flagUrl ? view.project.registry?.baseUrl === void 0 ? void 0 : normalizeBaseUrl(view.project.registry.baseUrl, 'registry.baseUrl') : normalizeBaseUrl(flagUrl, '--base-url');
+    return {
+        rt,
+        globals: raw,
+        view,
+        host: void 0 === rt.wrapHost ? host : rt.wrapHost(host),
+        hostLabel: describeHost(parsed),
+        secrets,
+        baseUrl
+    };
+}
+function normalizeBaseUrl(value, label) {
+    const bad = (why)=>new MfeflowError('E506', `${label} ${why}`);
+    if (/[?#]/.test(value)) throw bad('must not contain a query or a fragment');
+    let url;
+    try {
+        url = new URL(value);
+    } catch  {
+        throw bad('must be a URL such as https://cdn.example.com');
+    }
+    if ('' !== url.username || '' !== url.password) throw bad('must not contain credentials');
+    if ('http:' === url.protocol && !isLoopbackHttp(url)) throw bad('uses http, which is allowed only on localhost; use https');
+    if ('https:' !== url.protocol && 'http:' !== url.protocol) throw bad('must be an https URL');
+    let end = url.href.length;
+    while(end > 0 && 47 === url.href.charCodeAt(end - 1))end -= 1;
+    return url.href.slice(0, end);
+}
+function hostFailure(error, secrets) {
+    if (error instanceof MfeflowError || error instanceof PreconditionFailedError) return error;
+    const message = redact(messageOf(error), secrets);
+    if (error instanceof HostError) return new MfeflowError(message.includes('already published') ? 'E511' : 'E506', message);
+    if (error instanceof SyntaxError) return new MfeflowError('E506', `the index is ${message}`);
+    return error instanceof Error ? error : new Error(message);
+}
+async function onHost(s, work) {
+    try {
+        return await work();
+    } catch (error) {
+        throw hostFailure(error, s.secrets);
+    }
+}
+function remoteApp(view, name) {
+    const remotes = view.apps.filter((a)=>'remote' === a.kind);
+    if (void 0 === name) throw new MfeflowError('E107', `name the remote (remotes: ${remotes.map((a)=>a.name).join(', ')})`);
+    const app = remotes.find((a)=>a.name === name);
+    if (void 0 === app) throw new MfeflowError('E107', `"${name}" is not a remote of this project (remotes: ${remotes.map((a)=>a.name).join(', ')})`);
+    if ('ok' !== app.mfe.state) throw new MfeflowError('E113', `${app.rel}/mfe.json is ${app.mfe.state}`);
+    return app;
+}
+async function shellVersions(view, mfe) {
+    const shells = view.apps.filter((a)=>'shell' === a.kind && a.present);
+    const shell = shells.find((a)=>mfe.shells.includes(a.name)) ?? shells[0];
+    if (void 0 === shell) return {};
+    const out = {};
+    for (const name of new Set([
+        ...Object.keys(mfe.platform ?? {}),
+        ...SINGLETON_PACKAGES
+    ])){
+        const version = await versionIn(shell, name, view.root);
+        if (void 0 !== version) out[name] = version;
+    }
+    return out;
+}
+const shellManifestKey = (env)=>`envs/${env}/shell/mf-manifest.json`;
+async function readShellManifest(s, env, file) {
+    try {
+        if (void 0 !== file) {
+            const body = await promises.readFile(node_path.resolve(s.globals.cwd, file), 'utf8');
+            return {
+                manifest: JSON.parse(body),
+                warnings: []
+            };
+        }
+        const stored = await onHost(s, ()=>s.host.get(shellManifestKey(env)));
+        if (void 0 === stored) return {
+            warnings: [
+                `no shell manifest at ${shellManifestKey(env)}; compat used workspace versions`
+            ]
+        };
+        return {
+            manifest: JSON.parse(new TextDecoder().decode(stored.body)),
+            warnings: []
+        };
+    } catch (error) {
+        if (error instanceof MfeflowError) throw error;
+        return {
+            warnings: [
+                'the shell manifest could not be read or is not valid JSON; compat used workspace versions'
+            ]
+        };
+    }
+}
+async function hostEnvs(s) {
+    if (void 0 === s.host.list) return [];
+    const keys = await onHost(s, ()=>s.host.list?.('envs/') ?? Promise.resolve([]));
+    const envs = keys.flatMap((key)=>{
+        const match = /^envs\/([a-z][a-z0-9-]*)\/index\.json$/.exec(key);
+        return match?.[1] === void 0 ? [] : [
+            match[1]
+        ];
+    });
+    return [
+        ...new Set(envs)
+    ].toSorted((a, b)=>a.localeCompare(b));
+}
+async function currentIndex(s, env) {
+    return onHost(s, ()=>readIndex(s.host, env));
+}
+function baseUrlFor(s, index) {
+    if (void 0 !== s.baseUrl) return s.baseUrl;
+    for (const remote of index?.remotes ?? []){
+        const marker = `/${remote.name}/`;
+        const at = remote.entry.lastIndexOf(marker);
+        if (at > 0) return remote.entry.slice(0, at);
+    }
+    throw new MfeflowError('E506', "no base URL: pass --base-url or set registry.baseUrl in mfeflow.json (where the host's files are served from)");
+}
+function describeUploads(plan) {
+    return plan.uploads.map((u)=>({
+            key: u.key,
+            bytes: 'string' == typeof u.body ? new TextEncoder().encode(u.body).length : u.body.length,
+            contentType: u.contentType,
+            cacheControl: u.cacheControl,
+            guard: void 0 !== u.ifMatch ? 'if-match' : void 0 !== u.ifNoneMatch ? 'create-only' : 'none'
+        }));
+}
+function gateFindings(plan, app) {
+    return plan.failures.map((f)=>finding('deploy.gates', GATE_CODES[f.code], f.message, {
+            app
+        }));
+}
+function otherWriter(index, env, name) {
+    if (void 0 === index) return `${indexKey(env)} was created by someone else`;
+    const served = index.remotes.find((r)=>r.name === name)?.version;
+    const at = void 0 === index.generatedAt ? '' : ` at ${index.generatedAt}`;
+    return `${indexKey(env)} was rewritten${at} by another deploy${void 0 === served ? '' : `; it now serves ${name}@${served}`}`;
+}
+async function commit(s, options) {
+    let attempt = 0;
+    for(;;){
+        attempt += 1;
+        const planned = await onHost(s, options.plan);
+        const { plan } = planned;
+        if (plan.failures.length > 0 || options.dryRun || true === planned.noop) return {
+            planned,
+            applied: void 0,
+            published: false
+        };
+        const toApply = true === options.noPublish ? {
+            ...plan,
+            uploads: plan.uploads.filter((u)=>u.key !== plan.indexKey)
+        } : plan;
+        try {
+            const applied = await onHost(s, ()=>static_applyPlan(s.host, toApply));
+            return {
+                planned,
+                applied,
+                published: true !== options.noPublish
+            };
+        } catch (error) {
+            if (!(error instanceof PreconditionFailedError)) throw error;
+            if (attempt < 2) continue;
+            const now = await currentIndex(s, options.env).catch(()=>void 0);
+            throw new MfeflowError('E510', otherWriter(now?.index, options.env, options.name));
+        }
+    }
+}
+function localEntryOf(remote) {
+    return {
+        version: remote.version ?? '',
+        manifestUrl: remote.entry,
+        ...void 0 === remote.remoteEntry ? {} : {
+            remoteEntry: remote.remoteEntry
+        },
+        ...void 0 === remote.type ? {} : {
+            type: remote.type
+        },
+        ...void 0 === remote.entryGlobalName ? {} : {
+            entryGlobalName: remote.entryGlobalName
+        },
+        ...void 0 === remote.exposes ? {} : {
+            exposes: remote.exposes
+        },
+        ...void 0 === remote.previous ? {} : {
+            previous: remote.previous
+        },
+        ...void 0 === remote.owner ? {} : {
+            owner: remote.owner
+        }
+    };
+}
+async function writeLocalEntry(root, env, remote) {
+    const file = node_path.join(root, 'registry', 'envs', env, `${remote.name}.json`);
+    await promises.mkdir(node_path.dirname(file), {
+        recursive: true
+    });
+    await promises.writeFile(file, `${JSON.stringify(localEntryOf(remote), null, 2)}\n`);
+    return node_path.relative(root, file).split(node_path.sep).join('/');
+}
+const HOST_ARGS = {
+    host: {
+        type: 'string',
+        description: 'Where the registry lives: file:<dir> or s3://<bucket>[/prefix] (default registry.host)',
+        valueHint: 'spec'
+    },
+    'base-url': {
+        type: 'string',
+        description: "Where the host's files are served from (default registry.baseUrl)",
+        valueHint: 'url'
+    },
+    'shell-manifest': {
+        type: 'string',
+        description: "The shell's deployed mf-manifest.json (default envs/<env>/shell/ on the host)",
+        valueHint: 'file'
+    }
+};
+const DEPLOY_ARGS = {
+    env: {
+        type: 'string',
+        description: 'Environment to deploy to',
+        valueHint: 'env'
+    },
+    version: {
+        type: 'string',
+        description: "Version to publish (default: the remote's package.json version)",
+        valueHint: 'v'
+    },
+    dist: {
+        type: 'string',
+        description: 'Build output folder inside the remote (default dist)',
+        valueHint: 'dir'
+    },
+    publish: {
+        type: 'boolean',
+        default: true,
+        description: 'Move the index to the new version (--no-publish uploads the files and stops)'
+    },
+    ...HOST_ARGS,
+    ...GLOBAL_ARGS
+};
+const PROMOTE_ARGS = {
+    from: {
+        type: 'string',
+        description: 'Environment to copy the version from',
+        valueHint: 'env'
+    },
+    to: {
+        type: 'string',
+        description: 'Environment to point at it',
+        valueHint: 'env'
+    },
+    ...HOST_ARGS,
+    ...GLOBAL_ARGS
+};
+const ROLLBACK_ARGS = {
+    env: {
+        type: 'string',
+        description: 'Environment to roll back',
+        valueHint: 'env'
+    },
+    to: {
+        type: 'string',
+        description: 'Version to go back to (default: the previous one)',
+        valueHint: 'v'
+    },
+    force: {
+        type: 'boolean',
+        description: 'Roll back even if the schema, route or compatibility checks fail (the files must still exist)'
+    },
+    ...HOST_ARGS,
+    ...GLOBAL_ARGS
+};
+async function deploy_walk(root, rel, out) {
+    const entries = await promises.readdir(node_path.join(root, rel), {
+        withFileTypes: true
+    });
+    for (const entry of entries){
+        const next = '' === rel ? entry.name : `${rel}/${entry.name}`;
+        if (entry.isDirectory()) await deploy_walk(root, next, out);
+        else if (entry.isFile()) out[next] = new Uint8Array(await promises.readFile(node_path.join(root, next)));
+    }
+}
+async function readBuild(dir, shown) {
+    const files = {};
+    try {
+        await deploy_walk(dir, '', files);
+    } catch (error) {
+        if (hasErrno(error, 'ENOENT') || hasErrno(error, 'ENOTDIR')) throw new MfeflowError('E507', `${shown} does not exist`);
+        throw error;
+    }
+    const raw = files['mf-manifest.json'];
+    if (void 0 === raw) throw new MfeflowError('E507', `${shown}/mf-manifest.json is not there`);
+    let manifest;
+    try {
+        manifest = JSON.parse(new TextDecoder().decode(raw));
+    } catch  {
+        throw new MfeflowError('E507', `${shown}/mf-manifest.json is not valid JSON`);
+    }
+    return {
+        manifest,
+        files
+    };
+}
+async function deploy_confirm(s, message, dryRun) {
+    if (dryRun || !s.globals.canPrompt) return;
+    if (!await s.rt.prompter.confirm({
+        message,
+        initialValue: false
+    })) throw new Cancelled();
+}
+async function deploy_finish(s, facts, done) {
+    const { plan, before, warnings, noop } = done.planned;
+    const after = plan.index.remotes.find((r)=>r.name === facts.remote);
+    const shown = true === noop ? before : after;
+    const failed = plan.failures.length > 0;
+    const dryRun = s.globals.dryRun;
+    const moved = done.published && !failed;
+    let localEntry = null;
+    const local = 'dev' !== facts.env;
+    if (moved && local && void 0 !== after) localEntry = await writeLocalEntry(s.view.root, facts.env, after);
+    const notes = moved && !local ? [
+        'registry/envs/dev was not written: `mfeflow dev` reads it'
+    ] : [];
+    const result = {
+        ok: !failed,
+        command: facts.command,
+        dryRun,
+        root: s.view.root,
+        env: facts.env,
+        fromEnv: facts.fromEnv ?? null,
+        host: s.hostLabel,
+        remote: facts.remote,
+        version: facts.version,
+        servedBefore: before?.version ?? null,
+        published: moved,
+        previous: shown?.previous ?? null,
+        rolledBackFrom: shown?.rolledBackFrom ?? null,
+        uploads: failed ? [] : describeUploads(plan),
+        uploaded: done.applied?.uploaded ?? [],
+        skipped: done.applied?.skipped ?? [],
+        localEntry,
+        warnings: [
+            ...warnings,
+            ...notes
+        ],
+        findings: gateFindings(plan, facts.remote)
+    };
+    if (dryRun && !failed) result.index = plan.index;
+    return result;
+}
+function formatDeploy(result) {
+    const lines = [];
+    const target = `${result.remote}@${result.version}`;
+    const route = null === result.fromEnv ? `to ${result.env}` : `from ${result.fromEnv} to ${result.env}`;
+    const verb = result.dryRun ? `Plan for ${result.command}` : result.command;
+    lines.push(`${verb} ${target} ${route} (${result.host})`);
+    for (const f of result.findings)lines.push(`error ${f.code} ${f.message}`, `  Fix: ${f.fix}`, `  ${f.docs}`);
+    for (const w of result.warnings)lines.push(`warning ${w}`);
+    if (!result.ok) {
+        lines.push('Nothing was uploaded.');
+        return lines.join('\n');
+    }
+    if (result.dryRun) {
+        lines.push('Would upload, in order:');
+        for (const u of result.uploads)lines.push(`  ${u.key} (${String(u.bytes)} bytes, ${u.guard})`);
+        lines.push('Dry run: nothing was written.');
+        return lines.join('\n');
+    }
+    const files = `${String(result.uploaded.length)} uploaded, ${String(result.skipped.length)} already there`;
+    if (result.published) {
+        const was = null === result.servedBefore ? 'first deploy' : `was ${result.servedBefore}`;
+        lines.push(`Files: ${files}`, `${result.env} now serves ${target} (${was}).`);
+        if (null !== result.rolledBackFrom) lines.push(`Rolled back from ${result.rolledBackFrom}.`);
+        if (null !== result.localEntry) lines.push(`Wrote ${result.localEntry}.`);
+    } else if (result.uploaded.length + result.skipped.length > 0) lines.push(`Files: ${files}`, `The index was not changed; ${result.env} still serves ${result.servedBefore ?? 'nothing'}.`);
+    else lines.push(`${result.env} already serves ${target}. Nothing to do.`);
+    return lines.join('\n');
+}
+async function deployPlan(s, mfe, build, version, env, shellFile) {
+    const { index, etag } = await currentIndex(s, env);
+    const shell = await readShellManifest(s, env, shellFile);
+    const plan = planDeploy({
+        remote: mfe,
+        version,
+        manifest: build.manifest,
+        files: build.files,
+        env,
+        baseUrl: baseUrlFor(s, index),
+        ...void 0 === index || void 0 === etag ? {} : {
+            currentIndex: index,
+            currentIndexEtag: etag
+        },
+        ...void 0 === shell.manifest ? {} : {
+            shellManifest: shell.manifest
+        },
+        workspaceVersions: await shellVersions(s.view, mfe)
+    });
+    return {
+        plan,
+        before: index?.remotes.find((r)=>r.name === mfe.name),
+        warnings: [
+            ...shell.warnings,
+            ...plan.warnings
+        ]
+    };
+}
+async function runDeploy(rt, args, raw) {
+    assertKnownFlags(raw, DEPLOY_ARGS);
+    const globals = readGlobals(args, rt.io.env, rt.io.cwd, rt.io.interactive);
+    const [name] = positionals(args, 1, 'mfeflow deploy <remote> --env <env>');
+    const env = envOf(args);
+    const s = await openSession(rt, args, globals);
+    const app = remoteApp(s.view, name);
+    const version = args_text(args, 'version') ?? app.pkg?.version;
+    if (void 0 === version) throw new MfeflowError('E507', `${app.name} has no version: pass --version or set one in its package.json`);
+    const dist = args_text(args, 'dist') ?? 'dist';
+    const build = await readBuild(node_path.join(app.dir, dist), `${app.rel}/${dist}`);
+    const noPublish = false === args.publish;
+    await deploy_confirm(s, `Deploy ${app.name}@${version} to ${env} on ${s.hostLabel}?`, globals.dryRun);
+    const done = await commit(s, {
+        env,
+        name: app.name,
+        dryRun: globals.dryRun,
+        noPublish,
+        plan: ()=>deployPlan(s, app.mfe.value, build, version, env, args_text(args, 'shell-manifest'))
+    });
+    const result = await deploy_finish(s, {
+        command: 'deploy',
+        env,
+        remote: app.name,
+        version
+    }, done);
+    if (!globals.json) rt.io.stdout(formatDeploy(result));
+    return result;
+}
+async function versionManifest(s, name, version) {
+    const prefix = artifactPrefix(name, version);
+    const missing = (what)=>new MfeflowError('E509', `${name}@${version}: ${what} (${prefix}/)`);
+    const stored = await s.host.get(`${prefix}/mf-manifest.json`);
+    if (void 0 === stored) throw missing('mf-manifest.json is not on the host');
+    let manifest;
+    try {
+        manifest = JSON.parse(new TextDecoder().decode(stored.body));
+    } catch  {
+        throw missing('mf-manifest.json on the host is not valid JSON');
+    }
+    const dist = remoteDistFiles(manifest);
+    if (void 0 === dist) throw missing('mf-manifest.json has no usable remote entry');
+    const wanted = [
+        ...new Set([
+            dist.entry,
+            ...Object.values(dist.exposes).flat()
+        ])
+    ];
+    const gone = [];
+    for (const file of wanted)if (await s.host.head(`${prefix}/${file}`) === void 0) gone.push(file);
+    if (gone.length > 0) throw missing(`${gone.slice(0, 5).join(', ')}${gone.length > 5 ? ' and more' : ''} not on the host`);
+    return manifest;
+}
+async function movePlan(s, app, version, env, source, shellFile, options = {}) {
+    const { index, etag } = await currentIndex(s, env);
+    const before = index?.remotes.find((r)=>r.name === app.name);
+    const origin = options.guard?.(before) ?? source;
+    if (before?.version === version) return {
+        plan: {
+            uploads: [],
+            index: index ?? {
+                remotes: []
+            },
+            indexKey: '',
+            failures: [],
+            warnings: []
+        },
+        before,
+        warnings: [],
+        noop: true
+    };
+    const manifest = await versionManifest(s, app.name, version);
+    const shell = await readShellManifest(s, env, shellFile);
+    const mfe = {
+        ...app.mfe,
+        routes: origin.routes ?? app.mfe.routes,
+        owner: origin.owner ?? app.mfe.owner
+    };
+    const plan = planDeploy({
+        remote: mfe,
+        version,
+        manifest,
+        files: {},
+        env,
+        baseUrl: baseUrlFor(s, {
+            remotes: [
+                origin,
+                ...index?.remotes ?? []
+            ]
+        }),
+        ...void 0 === index || void 0 === etag ? {} : {
+            currentIndex: index,
+            currentIndexEtag: etag
+        },
+        ...void 0 === shell.manifest ? {} : {
+            shellManifest: shell.manifest
+        },
+        workspaceVersions: await shellVersions(s.view, mfe)
+    });
+    const warnings = [
+        ...shell.warnings,
+        ...plan.warnings
+    ];
+    const gates = plan.failures.filter((f)=>'budget' !== f.code);
+    const forced = true === options.force ? gates : [];
+    const blocking = gates.filter((f)=>!forced.includes(f));
+    if (blocking.length > 0) return {
+        plan: {
+            ...plan,
+            failures: blocking
+        },
+        before,
+        warnings
+    };
+    if (forced.length > 0) {
+        const invalid = validateRegistryIndex(plan.index).filter((i)=>i.code !== ROUTE_OVERLAP);
+        if (invalid.length > 0) throw new MfeflowError('E501', `even --force cannot write an invalid index: ${invalid.map((i)=>`${i.path} ${i.message}`).join('; ')}`);
+        warnings.push(`FORCED: --force skipped ${String(forced.length)} failed check(s); ${version} may not work with the shell that is deployed: ${forced.map((f)=>f.message).join(' | ')}`);
+    }
+    const indexUpload = {
+        key: plan.indexKey,
+        body: `${JSON.stringify(plan.index, null, 2)}\n`,
+        contentType: 'application/json',
+        cacheControl: INDEX_CACHE_CONTROL,
+        ...void 0 === etag ? {
+            ifNoneMatch: '*'
+        } : {
+            ifMatch: etag
+        }
+    };
+    return {
+        plan: {
+            ...plan,
+            failures: [],
+            uploads: [
+                indexUpload
+            ]
+        },
+        before,
+        warnings
+    };
+}
+function inEnv(index, name, env) {
+    const remote = index?.remotes.find((r)=>r.name === name);
+    if (remote?.version === void 0) throw new MfeflowError('E508', `${name} is not deployed to ${env}`);
+    return remote;
+}
+async function runPromote(rt, args, raw) {
+    assertKnownFlags(raw, PROMOTE_ARGS);
+    const globals = readGlobals(args, rt.io.env, rt.io.cwd, rt.io.interactive);
+    const [name] = positionals(args, 1, 'mfeflow promote <remote> --from <env> --to <env>');
+    const from = envOf(args, 'from');
+    const to = envOf(args, 'to');
+    if (from === to) throw new MfeflowError('E107', `--from and --to are both "${from}"`);
+    const s = await openSession(rt, args, globals);
+    const app = remoteApp(s.view, name);
+    const source = inEnv((await currentIndex(s, from)).index, app.name, from);
+    const version = source.version ?? '';
+    await deploy_confirm(s, `Point ${to} at ${app.name}@${version} (now in ${from}) on ${s.hostLabel}?`, globals.dryRun);
+    const done = await commit(s, {
+        env: to,
+        name: app.name,
+        dryRun: globals.dryRun,
+        plan: async ()=>{
+            const nowSource = inEnv((await currentIndex(s, from)).index, app.name, from);
+            if (nowSource.version !== version) throw new MfeflowError('E510', `${from} now serves ${app.name}@${String(nowSource.version)}, not ${version} as when this promote started; check \`mfeflow status\` and run it again`);
+            return movePlan(s, {
+                name: app.name,
+                mfe: app.mfe.value
+            }, version, to, nowSource, args_text(args, 'shell-manifest'));
+        }
+    });
+    const result = await deploy_finish(s, {
+        command: 'promote',
+        env: to,
+        fromEnv: from,
+        remote: app.name,
+        version
+    }, done);
+    if (!globals.json) rt.io.stdout(formatDeploy(result));
+    return result;
+}
+async function runRollback(rt, args, raw) {
+    assertKnownFlags(raw, ROLLBACK_ARGS);
+    const globals = readGlobals(args, rt.io.env, rt.io.cwd, rt.io.interactive);
+    const [name] = positionals(args, 1, 'mfeflow rollback <remote> --env <env>');
+    const env = envOf(args);
+    const s = await openSession(rt, args, globals);
+    const app = remoteApp(s.view, name);
+    const explicit = args_text(args, 'to');
+    const target = (remote)=>{
+        const known = [
+            ...new Set([
+                remote.previous,
+                ...remote.history ?? []
+            ])
+        ].filter((v)=>void 0 !== v);
+        const to = explicit ?? remote.previous;
+        if (void 0 === to) throw new MfeflowError('E508', `${app.name} in ${env} has no previous version to go back to`);
+        if (to === remote.version) throw new MfeflowError('E508', `${env} already serves ${app.name}@${to}`);
+        if (!known.includes(to)) throw new MfeflowError('E508', `${app.name}@${to} is not in the history of ${env} (${0 === known.length ? 'empty' : known.join(', ')})`);
+        return to;
+    };
+    const current = inEnv((await currentIndex(s, env)).index, app.name, env);
+    const to = target(current);
+    await deploy_confirm(s, `Roll ${env} back from ${app.name}@${current.version ?? ''} to ${to} on ${s.hostLabel}?`, globals.dryRun);
+    const done = await commit(s, {
+        env,
+        name: app.name,
+        dryRun: globals.dryRun,
+        plan: ()=>movePlan(s, {
+                name: app.name,
+                mfe: app.mfe.value
+            }, to, env, current, args_text(args, 'shell-manifest'), {
+                force: true === args.force,
+                guard: (fresh)=>{
+                    const now = inEnv(void 0 === fresh ? void 0 : {
+                        remotes: [
+                            fresh
+                        ]
+                    }, app.name, env);
+                    if (void 0 === explicit && now.version !== current.version) throw new MfeflowError('E510', `${env} now serves ${app.name}@${String(now.version)}, not ${String(current.version)} as when this rollback started; check \`mfeflow status\` and run it again`);
+                    target(now);
+                    return now;
+                }
+            })
+    });
+    const result = await deploy_finish(s, {
+        command: 'rollback',
+        env,
+        remote: app.name,
+        version: to
+    }, done);
+    if (!globals.json) rt.io.stdout(formatDeploy(result));
+    return result;
+}
 const LOCAL_HOSTS = new Set([
     'localhost',
     '127.0.0.1',
@@ -3554,17 +4430,27 @@ function features_line(feature, widths) {
     ];
     return `  ${feature.source.padEnd(widths.source)} ${feature.name.padEnd(widths.name)} ${feature.version.padEnd(7)} ${feature.description} [${tags.join(', ')}]`;
 }
-function fetchIndexes(rt, registries) {
+function fetchIndexes(rt, registries, trusted) {
     return Promise.all(Object.entries(registries).toSorted(([a], [b])=>a.localeCompare(b)).map(async ([namespace, template])=>{
         const base = {
             namespace,
-            index: registryIndexUrl(template)
+            index: redactUrl(registryIndexUrl(template))
+        };
+        if (!trusted.fetch.has(namespace)) return {
+            status: {
+                ...base,
+                trusted: false,
+                items: 0,
+                error: null
+            },
+            items: []
         };
         try {
-            const items = await fetchFeatureIndex(namespace, registries, rt.fetch);
+            const items = await fetchFeatureIndex(namespace, registries, rt.fetch, trusted.privateOk.has(namespace));
             return {
                 status: {
                     ...base,
+                    trusted: true,
                     items: items.length,
                     error: null
                 },
@@ -3575,6 +4461,7 @@ function fetchIndexes(rt, registries) {
             return {
                 status: {
                     ...base,
+                    trusted: true,
                     items: 0,
                     error: report
                 },
@@ -3604,7 +4491,7 @@ async function runFeatures(rt, args, raw) {
                 installed: installed.has(first.name)
             };
         })),
-        fetchIndexes(rt, project?.registries ?? {})
+        trustedIn(rt, project?.registries).then((trusted)=>fetchIndexes(rt, project?.registries ?? {}, trusted))
     ]);
     const fromRegistries = fetched.flatMap(({ status, items })=>items.toSorted((a, b)=>a.name.localeCompare(b.name)).map((item)=>{
             const name = `${status.namespace}/${item.name}`;
@@ -3636,6 +4523,11 @@ async function runFeatures(rt, args, raw) {
             rt.io.stdout(features.map((f)=>features_line(f, widths)).join('\n'));
         }
         for (const { namespace, error } of registries)if (error) rt.io.stderr(`Could not read ${namespace}: ${error.message}\n  ${error.fix}`);
+        const untrusted = registries.filter((r)=>!r.trusted).map((r)=>r.namespace);
+        if (untrusted.length > 0) rt.io.stdout([
+            '',
+            ...untrusted.map((namespace)=>`${namespace}: not trusted yet, nothing was requested. Run \`mfeflow registry trust ${namespace}\` to list its features.`)
+        ].join('\n'));
         rt.io.stdout(0 === registries.length ? '\nFrom a registry: mfeflow registry add @namespace <url>, then mfeflow add @namespace/name.' : '\nAdd one with: mfeflow add @namespace/name.');
     }
     return {
@@ -3904,12 +4796,14 @@ const REGISTRY_ARGS = {
     },
     ...GLOBAL_ARGS
 };
-const USAGE = 'mfeflow registry add @namespace <url-template> | list | remove @namespace | build <dir>';
-function registry_entries(project) {
+const registry_USAGE = 'mfeflow registry add @namespace <url-template> | list | remove @namespace | trust @namespace | untrust @namespace | build <dir>';
+async function registry_entries(rt, project) {
+    const trusted = await trustedIn(rt, project.registries);
     return Object.entries(project.registries ?? {}).toSorted(([a], [b])=>a.localeCompare(b)).map(([namespace, url])=>({
             namespace,
-            url,
-            index: registryIndexUrl(url)
+            url: redactUrl(url),
+            index: redactUrl(registryIndexUrl(url)),
+            trusted: trusted.fetch.has(namespace)
         }));
 }
 function registry_result(action, globals, extra) {
@@ -3938,11 +4832,13 @@ async function projectOf(globals) {
     };
 }
 async function save(globals, root, project, registries) {
-    const { registries: _old, ...rest } = project;
+    const { registries: old, ...rest } = project;
+    const changed = JSON.stringify(old ?? {}) !== JSON.stringify(registries);
+    const base = changed ? raiseCli(rest) : rest;
     const next = Object.keys(registries).length > 0 ? {
-        ...rest,
+        ...base,
         registries
-    } : rest;
+    } : base;
     if (!globals.dryRun) await saveProject(root, next);
     return next;
 }
@@ -3954,25 +4850,34 @@ async function addRegistry(rt, globals, namespaceArg, url) {
     const { root, project } = await projectOf(globals);
     const current = project.registries ?? {};
     const existing = current[namespace];
+    const shown = redactUrl(url);
     if (existing === url) {
-        if (!globals.json) rt.io.stdout(`${namespace} already points at ${url}; nothing to do.`);
+        const newlyTrusted = !globals.dryRun && await addTrusted(rt.configDir, {
+            namespace,
+            template: url
+        });
+        if (!globals.json) rt.io.stdout(`${namespace} already points at ${shown}; nothing to do${newlyTrusted ? ' except trust it' : ''}.`);
         return registry_result('add', globals, {
             root,
-            registries: registry_entries(project)
+            registries: await registry_entries(rt, project)
         });
     }
-    if (void 0 !== existing) throw new MfeflowError('E107', `${namespace} already points at ${existing}`, {
+    if (void 0 !== existing) throw new MfeflowError('E107', `${namespace} already points at ${redactUrl(existing)}`, {
         fix: `Run \`mfeflow registry remove ${namespace}\` first, then add it again.`
     });
     const next = await save(globals, root, project, {
         ...current,
         [namespace]: url
     });
-    if (!globals.json) rt.io.stdout(globals.dryRun ? `Dry run: would add ${namespace} -> ${url}. Nothing was written.` : `Added ${namespace} -> ${url}\nSee what it offers: mfeflow features`);
+    if (!globals.dryRun) await addTrusted(rt.configDir, {
+        namespace,
+        template: url
+    });
+    if (!globals.json) rt.io.stdout(globals.dryRun ? `Dry run: would add and trust ${namespace} -> ${shown}. Nothing was written.` : `Added ${namespace} -> ${shown} and trusted it on this machine.\nSee what it offers: mfeflow features`);
     return registry_result('add', globals, {
         root,
         changed: true,
-        registries: registry_entries(next)
+        registries: await registry_entries(rt, next)
     });
 }
 async function removeRegistry(rt, globals, namespaceArg) {
@@ -3987,26 +4892,73 @@ async function removeRegistry(rt, globals, namespaceArg) {
         fix: `Keep ${namespace} while they are installed: \`mfeflow add remote\` and \`add shell\` fetch them again and fail without it.`
     });
     const next = await save(globals, root, project, rest);
-    if (!globals.json) rt.io.stdout(globals.dryRun ? `Dry run: would remove ${namespace}. Nothing was written.` : `Removed ${namespace} (${url}).`);
+    if (!globals.json) rt.io.stdout(globals.dryRun ? `Dry run: would remove ${namespace}. Nothing was written.` : `Removed ${namespace} (${redactUrl(url)}).`);
     return registry_result('remove', globals, {
         root,
         changed: true,
-        registries: registry_entries(next)
+        registries: await registry_entries(rt, next)
     });
 }
 async function listRegistries(rt, globals) {
     const { root, project } = await projectOf(globals);
-    const registries = registry_entries(project);
+    const registries = await registry_entries(rt, project);
     if (!globals.json) if (0 === registries.length) rt.io.stdout('No registries. Add one: mfeflow registry add @namespace https://example.com/{name}.json');
     else {
         const width = Math.max(...registries.map((r)=>r.namespace.length));
-        rt.io.stdout(registries.map((r)=>`  ${r.namespace.padEnd(width)}  ${r.url}`).join('\n'));
+        rt.io.stdout(registries.map((r)=>`  ${r.namespace.padEnd(width)}  ${r.url}  [${r.trusted ? 'trusted' : 'not trusted yet'}]`).join('\n'));
+        if (registries.some((r)=>!r.trusted)) rt.io.stdout('\nTrust one with: mfeflow registry trust @namespace');
     }
     return registry_result('list', globals, {
         root,
         registries
     });
 }
+async function trustRegistry(rt, globals, namespaceArg) {
+    const namespace = assertNamespace(namespaceArg, 'trust');
+    const { root, project } = await projectOf(globals);
+    const template = project.registries?.[namespace];
+    if (void 0 === template) throw new MfeflowError('E107', `${namespace} is not in this project's registries`, {
+        fix: 'List them with `mfeflow registry list`, or add it with `mfeflow registry add`.'
+    });
+    const shown = redactUrl(template);
+    const recorded = await readTrusted(rt.configDir);
+    const already = recorded.some((e)=>e.namespace === namespace && e.template === template);
+    if (!already && !globals.dryRun) {
+        if (globals.canPrompt) {
+            const yes = await rt.prompter.confirm({
+                message: `Trust ${namespace} (${shown})? mfeflow will request its index and features from that address.`
+            });
+            if (!yes) throw new Cancelled();
+        } else if (!globals.yes) throw new MfeflowError('E107', `trusting ${namespace} needs a person to confirm it; pass --yes to trust it without a terminal (or set ${TRUST_ENV}=${namespace} for one run)`);
+        await addTrusted(rt.configDir, {
+            namespace,
+            template
+        });
+    }
+    if (!globals.json) rt.io.stdout(globals.dryRun ? `Dry run: would trust ${namespace} (${shown}). Nothing was written.` : already ? `${namespace} is already trusted.` : `Trusted ${namespace} (${shown}) on this machine.`);
+    return registry_result('trust', globals, {
+        root,
+        changed: !already,
+        registries: await registry_entries(rt, project)
+    });
+}
+async function untrustRegistry(rt, globals, namespaceArg) {
+    const namespace = assertNamespace(namespaceArg, 'untrust');
+    let found;
+    try {
+        found = await projectOf(globals);
+    } catch (error) {
+        if (!isMfeflowError(error) || 'MFEFLOW_E102' !== error.code) throw error;
+    }
+    const recorded = (await readTrusted(rt.configDir)).some((e)=>e.namespace === namespace);
+    if (recorded && !globals.dryRun) await removeTrusted(rt.configDir, namespace);
+    if (!globals.json) rt.io.stdout(recorded ? globals.dryRun ? `Dry run: would stop trusting ${namespace}. Nothing was written.` : `No longer trusting ${namespace}. mfeflow features will not request it.` : `${namespace} was not trusted; nothing to do.`);
+    return registry_result('untrust', globals, {
+        root: found?.root ?? null,
+        changed: recorded,
+        registries: void 0 === found ? [] : await registry_entries(rt, found.project)
+    });
+}
 async function buildFolder(rt, globals, args, dirArg) {
     if (void 0 === dirArg) throw new MfeflowError('E107', 'registry build needs the folder that holds your features: mfeflow registry build ./my-registry');
     const dir = node_path.resolve(globals.cwd, dirArg);
@@ -4040,17 +4992,19 @@ async function buildFolder(rt, globals, args, dirArg) {
 }
 async function runRegistry(rt, args, raw) {
     assertKnownFlags(raw, REGISTRY_ARGS);
-    const globals = readGlobals(args, rt.io.env, rt.io.cwd);
+    const globals = readGlobals(args, rt.io.env, rt.io.cwd, rt.io.interactive);
     const positional = Array.isArray(args._) ? args._.map(String) : [];
     const [action, first, second] = positional;
     const takes = {
         add: 2,
         remove: 1,
         list: 0,
-        build: 1
+        build: 1,
+        trust: 1,
+        untrust: 1
     };
     const surplus = positional[(takes[action ?? ''] ?? 1 / 0) + 1];
-    if (void 0 !== surplus) throw new MfeflowError('E107', `unexpected "${surplus}" (${USAGE})`);
+    if (void 0 !== surplus) throw new MfeflowError('E107', `unexpected "${surplus}" (${registry_USAGE})`);
     switch(action){
         case 'add':
             return addRegistry(rt, globals, first, second);
@@ -4058,13 +5012,177 @@ async function runRegistry(rt, args, raw) {
             return removeRegistry(rt, globals, first);
         case 'list':
             return listRegistries(rt, globals);
+        case 'trust':
+            return trustRegistry(rt, globals, first);
+        case 'untrust':
+            return untrustRegistry(rt, globals, first);
         case 'build':
             return buildFolder(rt, globals, args, first);
         case void 0:
         default:
-            throw new MfeflowError('E107', void 0 === action ? `registry needs an action (${USAGE})` : `unknown action "${action}" (${USAGE})`);
+            throw new MfeflowError('E107', void 0 === action ? `registry needs an action (${registry_USAGE})` : `unknown action "${action}" (${registry_USAGE})`);
     }
 }
+const STATUS_ARGS = {
+    env: {
+        type: 'string',
+        description: 'Only this environment (default: every env on the host, and every folder in registry/envs but dev)',
+        valueHint: 'env'
+    },
+    host: {
+        type: 'string',
+        description: 'Where the registry lives: file:<dir> or s3://<bucket>[/prefix] (default registry.host)',
+        valueHint: 'spec'
+    },
+    ...GLOBAL_ARGS
+};
+const decodeVersion = (segment)=>segment.replaceAll('_', '+');
+function mentioned(indexes, name) {
+    const out = new Set();
+    for (const index of indexes)for (const remote of index.remotes.filter((r)=>r.name === name)){
+        const all = [
+            remote.version,
+            remote.previous,
+            remote.rolledBackFrom,
+            ...remote.history ?? []
+        ];
+        for (const v of all)if (void 0 !== v) out.add(v);
+    }
+    return out;
+}
+function compareVersions(a, b) {
+    if (null !== semver.valid(a) && null !== semver.valid(b)) return semver.compareBuild(a, b);
+    return a.localeCompare(b);
+}
+function pendingOver(served, version) {
+    if (void 0 === served || null === semver.valid(version) || null === semver.valid(served)) return true;
+    return semver.compareBuild(version, served) > 0;
+}
+async function unreferenced(s, name, served, indexes) {
+    if (void 0 === s.host.list) return null;
+    const keys = await onHost(s, ()=>s.host.list?.(`${name}/`) ?? Promise.resolve([]));
+    const tracked = mentioned(indexes, name);
+    const found = new Set();
+    for (const key of keys){
+        const segment = key.split('/')[1];
+        if (void 0 !== segment && '' !== segment) found.add(decodeVersion(segment));
+    }
+    return [
+        ...found
+    ].filter((v)=>!tracked.has(v) && pendingOver(served, v)).toSorted(compareVersions);
+}
+function driftOf(view, env, remote, extra) {
+    const file = `registry/envs/${env}/${remote.name}.json`;
+    const entry = view.registry[env]?.[remote.name];
+    const drift = [];
+    let local = null;
+    if (void 0 === entry) drift.push(`${file} is missing; the host serves ${String(remote.version)}`);
+    else if ('ok' !== entry.state) drift.push(`${file} is ${entry.state}`);
+    else {
+        local = entry.value.version;
+        if (local !== remote.version) drift.push(`${file} says ${local}, the host serves ${String(remote.version)}`);
+        else if (entry.value.manifestUrl !== remote.entry) drift.push(`${file} points at ${entry.value.manifestUrl}, the host at ${remote.entry}`);
+    }
+    if (null !== extra && extra.length > 0) drift.push(`uploaded but not pointed at: ${extra.join(', ')} (deploy it, or it was uploaded with --no-publish)`);
+    return {
+        local,
+        drift
+    };
+}
+async function envStatus(s, env, all, findings) {
+    const index = all.get(env);
+    if (void 0 === index) return {
+        env,
+        published: false,
+        generatedAt: null,
+        remotes: []
+    };
+    const remotes = [];
+    for (const remote of index.remotes){
+        const extra = await unreferenced(s, remote.name, remote.version, [
+            ...all.values()
+        ]);
+        const { local, drift } = driftOf(s.view, env, remote, extra);
+        for (const message of drift)findings.push(finding('status.drift', 'E512', message, {
+            severity: 'warning',
+            app: remote.name
+        }));
+        remotes.push({
+            name: remote.name,
+            version: remote.version ?? '',
+            previous: remote.previous ?? null,
+            history: remote.history ?? [],
+            rolledBackFrom: remote.rolledBackFrom ?? null,
+            local,
+            unreferenced: extra,
+            drift
+        });
+    }
+    return {
+        env,
+        published: true,
+        generatedAt: index.generatedAt ?? null,
+        remotes
+    };
+}
+function formatStatus(result) {
+    const lines = [
+        `Registry ${result.host}`
+    ];
+    for (const e of result.envs){
+        lines.push('', e.env);
+        if (!e.published) {
+            lines.push('  nothing deployed yet');
+            continue;
+        }
+        lines.push(`  index written ${e.generatedAt ?? 'at an unknown time'}`);
+        for (const r of e.remotes){
+            const back = null === r.previous ? 'no previous' : `previous ${r.previous}`;
+            const rolled = null === r.rolledBackFrom ? '' : `, rolled back from ${r.rolledBackFrom}`;
+            lines.push(`  ${r.name}  ${r.version}  (${back}${rolled})${r.drift.length > 0 ? '  DRIFT' : ''}`);
+            for (const d of r.drift)lines.push(`    drift: ${d}`);
+        }
+    }
+    if (result.findings.length > 0) lines.push('', 'Drift: see the lines marked above; fix it with deploy, promote or rollback.');
+    return lines.join('\n');
+}
+async function runStatus(rt, args, raw) {
+    assertKnownFlags(raw, STATUS_ARGS);
+    const globals = readGlobals(args, rt.io.env, rt.io.cwd, rt.io.interactive);
+    positionals(args, 0, 'mfeflow status [--env <env>]');
+    const s = await openSession(rt, args, globals);
+    const onTheHost = await hostEnvs(s);
+    const envs = void 0 === args.env ? [
+        ...new Set([
+            ...onTheHost,
+            ...s.view.envDirs.filter((e)=>'dev' !== e)
+        ])
+    ].toSorted((a, b)=>a.localeCompare(b)) : [
+        envOf(args)
+    ];
+    const findings = [];
+    const out = [];
+    const all = new Map();
+    for (const env of new Set([
+        ...envs,
+        ...onTheHost,
+        ...s.view.envDirs
+    ])){
+        const { index } = await currentIndex(s, env);
+        if (void 0 !== index) all.set(env, index);
+    }
+    for (const env of envs)out.push(await envStatus(s, env, all, findings));
+    const result = {
+        ok: true,
+        command: 'status',
+        root: s.view.root,
+        host: s.hostLabel,
+        envs: out,
+        findings
+    };
+    if (!globals.json) rt.io.stdout(formatStatus(result));
+    return result;
+}
 const REPO_URL = 'https://github.com/mfeflow/mfeflow';
 function flagLabel(name, def) {
     const alias = 'alias' in def ? [
@@ -4103,8 +5221,8 @@ function exitCodesText() {
         `  ${String(EXIT.project)}    project or config problem (MFEFLOW_E1xx)`,
         `  ${String(EXIT.feature)}    feature problem (MFEFLOW_E2xx)`,
         `  ${String(EXIT.build)}    build or runtime problem (MFEFLOW_E3xx)`,
-        `  ${String(EXIT.registry)}    registry problem (MFEFLOW_E4xx)`,
-        `  ${String(EXIT.upgrade)}    upgrade problem (MFEFLOW_E5xx)`,
+        `  ${String(EXIT.registry)}    feature registry problem (MFEFLOW_E4xx)`,
+        `  ${String(EXIT.deploy)}    deploy problem (MFEFLOW_E5xx)`,
         `  ${String(EXIT.cancelled)}  cancelled at a prompt, or Ctrl+C in mfeflow dev`
     ].join('\n');
 }
@@ -4300,6 +5418,7 @@ function realRuntime(io = processIo()) {
         system: createSystem(io),
         fetch: (url, init)=>fetch(url, init),
         roots: assetRoots(),
+        configDir: configDirOf(io.env),
         dev: realDevHost()
     };
 }
@@ -4351,13 +5470,14 @@ const COMMANDS = [
     {
         name: 'registry',
         summary: 'configure third-party feature registries, or build one to host',
-        usage: 'mfeflow registry add @namespace <url-template> | mfeflow registry list | mfeflow registry remove @namespace | mfeflow registry build <dir> [--out dir]',
+        usage: 'mfeflow registry add @namespace <url-template> | mfeflow registry list | mfeflow registry remove @namespace | mfeflow registry trust @namespace | mfeflow registry untrust @namespace | mfeflow registry build <dir> [--out dir]',
         args: REGISTRY_ARGS,
         examples: [
             'mfeflow registry add @acme https://acme.github.io/features/{name}.json',
             'mfeflow registry add @test http://127.0.0.1:4010/{name}.json   # plain http: loopback hosts only',
             'mfeflow registry list --json',
             'mfeflow registry remove @acme --dry-run',
+            'mfeflow registry trust @acme   # a registry from a cloned repo is not asked until you trust it',
             'mfeflow registry build ./my-registry --out ./site'
         ],
         run: runRegistry
@@ -4409,6 +5529,54 @@ const COMMANDS = [
         ],
         run: runBudget
     },
+    {
+        name: 'deploy',
+        summary: "upload a remote's build to the registry host and point an environment at it",
+        usage: 'mfeflow deploy <remote> --env <env> [--version <v>] [--host <spec>] [--no-publish]',
+        args: DEPLOY_ARGS,
+        examples: [
+            'mfeflow deploy catalog --env staging --host file:./site --base-url https://cdn.example.com',
+            'mfeflow deploy catalog --env prod',
+            'mfeflow deploy catalog --env prod --version 1.4.2 --dry-run',
+            'mfeflow deploy catalog --env prod --no-publish   # upload, leave the index alone',
+            'mfeflow deploy catalog --env prod --host s3://my-registry/mfe --json'
+        ],
+        run: runDeploy
+    },
+    {
+        name: 'promote',
+        summary: 'point one environment at the version another environment serves; no upload',
+        usage: 'mfeflow promote <remote> --from <env> --to <env> [--host <spec>]',
+        args: PROMOTE_ARGS,
+        examples: [
+            'mfeflow promote catalog --from staging --to prod',
+            'mfeflow promote catalog --from staging --to prod --dry-run'
+        ],
+        run: runPromote
+    },
+    {
+        name: 'rollback',
+        summary: 'point an environment back at an earlier version; no rebuild, no upload',
+        usage: 'mfeflow rollback <remote> --env <env> [--to <version>] [--host <spec>]',
+        args: ROLLBACK_ARGS,
+        examples: [
+            'mfeflow rollback catalog --env prod',
+            'mfeflow rollback catalog --env prod --to 1.3.0',
+            'mfeflow rollback catalog --env prod --dry-run --json'
+        ],
+        run: runRollback
+    },
+    {
+        name: 'status',
+        summary: 'show what each environment serves, the version before it, and drift',
+        usage: 'mfeflow status [--env <env>] [--host <spec>]',
+        args: STATUS_ARGS,
+        examples: [
+            'mfeflow status',
+            'mfeflow status --env prod --json'
+        ],
+        run: runStatus
+    },
     {
         name: 'dev',
         summary: 'run the shell and every remote together, with a dev registry that follows the project',
@@ -4455,7 +5623,7 @@ function fail(error, rt, json, verbose) {
     if (isMfeflowError(mfe)) {
         if (json) rt.io.stdout(JSON.stringify(failure(mfe), null, 2));
         else rt.io.stderr(mfe.format());
-        if (verbose && void 0 !== mfe.cause) rt.io.stderr(unexpectedText(mfe.cause, true));
+        if (verbose && void 0 !== mfe.cause) rt.io.stderr(redactUrlsIn(unexpectedText(mfe.cause, true)));
         return exitCodeFor(mfe);
     }
     if (json) {