@jimhoyd/urlcode 0.4.0-alpha.1 → 0.4.0-alpha.2

package/dist/BUILD-MANIFEST.json

@@ -3,88 +3,83 @@
   "files": {
     "dist/adapters.js": "a7153ec52f2ed7e0cdd8ed7d433504815f402ec53b2b1c3d38d0cf0e2fcf6509",
     "dist/agent-lists.js": "35ab484198897501d011cb6cc00b5a6787192e19df29c97646e8c118fcc19eef",
-    "dist/agents-guide.js": "9cecc60690fe91e1f09a5298273c1d918428f114b5abb11f40f37f341668309c",
+    "dist/agents-guide.js": "a76e9818ec995a349085a53e8badd3ef49734275557b50bc7dcbe995ce3d0e9f",
     "dist/assets.js": "0833b093d2fe457ce68281110dc07d47914992753607741c13b339d92c76cf5c",
     "dist/authoring-files.js": "ad32814f9ae9c549c6247396f982aa700d13a293cc0a589609eccc68f8965550",
     "dist/authoring.js": "ec5240e8686c124f4601229b45f89ce112d9eeb9d35e3059fe55e93056c45209",
     "dist/aws.js": "7d8e3a97b4f6dbefbd68da058f05192469d1efcaed5458b284863ebe462e060e",
     "dist/build-cloudflare.js": "af4f49ad45287d7c4105bb84b1592b5b8e76c930f7159505338298f7c5fd5651",
+    "dist/build-static.js": "a2d2fcef3099805392da9140096d9843226bfb582dc046acf9a77f37b8a0d528",
     "dist/bulk.js": "aac88d422bd9a7a341a421fb4e29ff5580b28d39250b7f1f5315ba20ae92da8a",
-    "dist/capabilities.js": "c1e28c7de676c3b43c154d6f767749a1b34df78a64c58b5c23ad95339f964608",
-    "dist/capability-query.js": "850525d542aeeaeb4f89397ac57c6f89daad3fe3fa02ecb0332ea9f75d140b32",
+    "dist/capabilities.js": "28dba05b3851b8b12b3c1b809af87b732f84d601c737afe9225abe429886e691",
+    "dist/capability-query.js": "ba148b27c6a60f8c895f13f26468b16c18ae0a5cddea26b602965c8efbba90ae",
     "dist/catalog.js": "ab1c01c9296cc277d2bd4fd682aeb053656a7d9f91c61974f4b78feea0211de8",
-    "dist/cli.js": "4cba007ed3666fdfdf9fc676de1e346ab8196e3907dc2541eeb3e59842d9891a",
+    "dist/cli.js": "f6097c246c6b9006df58e3463648013ec8837ab3296a8c294809313503be167a",
     "dist/client-address.js": "9d0d01466aab23124330605c5a0e0f981f87c897858acfad909f546a63df165b",
     "dist/cloudflare.js": "17b43b0a6b6a0ef8a893415c989e4ae3976d97cc966adbf897b785f9adc472e3",
-    "dist/compliance-rules/baseline.js": "0a0c03d932f30797c4837c78c6b64ca6bb88f2ca947eb7f6adf5fdcdd280616d",
-    "dist/compliance-rules/privacy.js": "0e4d12106cf777299a7d30451f53c7b996f202fe53d7e1047b69f5df2a74a53d",
-    "dist/compliance-rules/shared.js": "595a7ee3a5af8c52197c5c9cbf09f4289a234e52b7a198afdd498be9be8d28a1",
+    "dist/compliance-rules/baseline.js": "6296dea6bcb9f9bb80ed6ed5ab2f456e7f74e6de2be5d2d98ca8c983fb4df3ab",
+    "dist/compliance-rules/privacy.js": "4cfb1c07d7df698c362dfc8761cd3bba893769e92d7fb0a3901e1c2d25e801f1",
+    "dist/compliance-rules/shared.js": "86fd6db6a93375689acc64975cbc394ce9452dea21ae5941e743f99822515995",
     "dist/compliance-rules/strict.js": "73ee13c2f893acf20cc3d44bf054e58c1474dec52eafe0cf2ce7f4eb96a3bc53",
-    "dist/compliance.js": "e956dc89b0b729fed7031297b8d7554141110334e670edf5cedc3d052a8fb3e4",
+    "dist/compliance.js": "29a18da3cefea94802ac7d817d1ab4e3674abd5c3ac4ef893cb8b01c6a23fb61",
     "dist/conditions.js": "ff25e97da550a3bdd80af55522045669438aa31a77d2bc83ad602bcefdee0475",
     "dist/config-worker.js": "bc2170d60c35f8d5de227cbfc4c5067dc61d7cbc5b98aed88e68a11797072da5",
-    "dist/config.js": "8efc2cfc24e9a958770d73aa8464d18c81d7a9a1d2398398cd9cc2776e639127",
-    "dist/context.js": "a6b0278b4fd478175f43b1ef5ae640ce6e0782c906c6fd2c7d1aebaf5a31c918",
+    "dist/config.js": "0cd82b4c407848f9c66e804a6dd4bf9a8a8503264e51584456578073e0f01921",
+    "dist/context.js": "549a53e4738b9c20a1ec55614027f758026fb5860bf4ac962ce22d7029e48df0",
     "dist/ecosystem-cli.js": "1e71bacd53d6fa8c7857cfcce3c3012ce054771a434b78d1f39e892e32642edd",
     "dist/egress.js": "2ae29fe2cb4590fd2f715abe6817db47fed2f50dd31f37946ecf42eafbb0dd9e",
     "dist/errors.js": "a908e66496afebbdd632a8c159a6e14d23f8f38798a0b4342ca122f2511c6cde",
-    "dist/examples.js": "8de9917a82fb04e44a3182d57c6a95cc730feb8b22a37d54b9b3c4177aa83111",
-    "dist/explain-cli.js": "c5414e9627f428f0d8efa4e4f3f89951ea10a6b3fe1d7f633e48f71a792406d2",
-    "dist/explain.js": "5dd271b699c9b852fbaa4db271d9a370fe98fca43b1d0ac018de0c0b047bf7b8",
-    "dist/extensions.js": "7402ff86017fca83a0e08a50b402bc428056566d63511aa84d609e252dc456e8",
-    "dist/function-sources.js": "f6e8bdd9d4ef728b44c6e1f08c601b11fc4ad3e0c104dacf4fea0b71874ea4e7",
-    "dist/function-worker.js": "3f5bad4f1b5cb812924c2dcc73ece6f816cf6aac26cd471fd1030dcfbf009c3b",
-    "dist/functions.js": "6b1e5d4a3f8db17d4e5df261b98ed15f5f0c5e5507a6fc0f472e9f94ed2b6090",
-    "dist/guest-api.js": "bc2501496a6ef9fd20dddb606fbc6fd557d534dd075e7ad38406248b230013ed",
+    "dist/examples.js": "89ae2b764a688fe52acfb9b94d3d262d7742401ebd0ef10c9ebfc76edfa5631c",
+    "dist/explain-cli.js": "dd342b21a96fc97a11488ac3528793ba0f5d4744b74a1d99085e142c4737b69a",
+    "dist/explain.js": "9450d2699cbe65e5c078c443ba7a6cba95c748e75d455e05264083b3c93c92a2",
+    "dist/extensions.js": "fed2b394466a7d406f9edeaedb71d9da81e50e3150eb7d01f2e7659104afeac7",
+    "dist/function-sources.js": "16fad4abc81c7ee07b6cbcef2d23a9fc50e97a17cb4dde1db53469bbb555c96f",
+    "dist/function-worker.js": "35771790ada4e1b36d447d4967a5e6cf0b543f32944e4c904f5fbf8998e824a5",
+    "dist/functions.js": "0f09d1bd27eb655ceb5900a4a5e2b760d2028b02cb637a6a89a4eb5940828008",
+    "dist/guest-api.js": "49aec9ed72733ad119e63bcfcee18158dcc8ceb951e1823b8947f6407ff24afc",
     "dist/header-validation.js": "465181dbb08ff05f52defdd29fda025c0c64589bf319fa87fa6d3ab4b68216d5",
     "dist/http-policy.js": "4cb187642269078ddf3460a3f1813dc57878a616a6f8132ef8f8d3b4b91ebb56",
     "dist/http-response.js": "5fc3bb9eb932a3fd2fbc72c361416a5f1439b8bf45b2be37baca1c6446abf40c",
-    "dist/index.js": "53648d88b0db7d9168d2f212ea4a28b7fd3ead6238c99c0b8d7d41536274d6d4",
+    "dist/index.js": "7e9f6ec8a125e2dfd4230b2ecd17ac513c0153d778a57bbcee7a1a9cd9681f81",
     "dist/init-with.js": "8371f568867ebdc6ab8e9aa762234ae2aa015865f46aa901254528e20d69b791",
     "dist/interchange-cli.js": "35bd70ba8077af5c3e39404ff0e5d28707632090a59a90645141252449fd3f04",
     "dist/interchange.js": "26789420af33344d9a08c00fe6b2708aa71994224df527b3075295be2151611e",
-    "dist/link-api.js": "0d1f2fb5ef8cd6fda7b071d3e08c53eb4b1c01d4003167af2f400949b70dea4f",
-    "dist/link-cli.js": "c4e2121a3e66f33c640832a7cb362a6a1db8b6d91d55a4239ce38ba0ced67b22",
-    "dist/link-events.js": "502a6038a538fa43094a9ba9c7546f504b4a1832a1377f26ca8cb69c2326670e",
-    "dist/link-records.js": "ef67a58cd107db0c3ac1c0ffd7b32817553606cf69bb3002da4ca0138c272f69",
-    "dist/link-store-worker.js": "0080452bbada2154b923449cd14596579bde94ad5f8dab94ecc84aa0d59c089b",
-    "dist/link-store.js": "526cdbe1b917cc7a74fb6edbbf13717d823ace5b5d6a5f89bc91438056a10b37",
     "dist/logging.js": "8ec57fea26983aa071b05fe15d680d6550b03488101163ed9666da674118cf31",
-    "dist/management-policy.js": "bd5563da52c53ace71b01daed0d2a492baeb3f26f5ec5ee1b0981c2b88df9ffa",
-    "dist/manifest.js": "d4f58f936febbabf09ec1706baae7c1cb186dcd8a3d29b5725dad5b6eaf43a3f",
+    "dist/manifest.js": "977f0f1cbe4466f7fbd9f2a0745e016cb9ebae640bc264fba04b4d02f4dbaca9",
     "dist/match.js": "53ebcc2cda529a8d07fb83f8cb69a1446036ffc1641af3c4bd45a55851bded28",
     "dist/mcp-authoring.js": "5030f52ef9c7ebc7b97305fcce687eb0a0d6164e34fda87f8278135a1e6f3d65",
-    "dist/mcp.js": "ac96c5a094d7cc88cf16d1d1e3c23f45773729fe28855f921581badb2b95eb89",
-    "dist/observability.js": "13a22b9e34cf8da3739856eeada8522fb6c43765386cae07c6aa0981447fcb83",
+    "dist/mcp.js": "e2d70f63481dc40aae60f7c27128e6a09ec370b69fd68aee8890bcc990f4f304",
+    "dist/observability.js": "f4b1ab496f051fe3ef2ed36b2b2e469c63a8940700e2df852e6ff2d9cccdd5ae",
     "dist/operator-host.js": "e3dac9d43a83beb775202b4ab9eeeba7ac63cebfc5dcc669be38d825be587bd0",
     "dist/plugins.js": "a61aa933cd9e1b41020b86fae78aa3a7f45f5313124aa11b50cb57898722385e",
     "dist/policies/agents.js": "c1dbc1e90339f472eeeb2372f7f4637f59a5d210797ea680ac8120a02aa20c10",
-    "dist/policies/cache.js": "ef16d7e592526c29f865b2693faa2c8afbea41c6526687563dffcb13a77fc1f7",
+    "dist/policies/cache.js": "03f79b91694bb78a98de4473384e5110e1ae1c3c83d46f929495d03af04d9da1",
     "dist/policies/compression.js": "800f3ae3b1a4c1fe58c3d9908364ea9d78f655ff50c7f7589f584378e7f194b0",
     "dist/policies/security.js": "2b3bfdf82140156fea4b162adc28ee43ccd85c402fb200680dbb8d8706417420",
     "dist/policies/throttle.js": "bbb0cb1c24cf70d0a1ac32fc0618efb6c44e5b5d42564842f9c585ff7e501603",
     "dist/policies.js": "23fa019b7bf1cdedcc5f7772d2f157e4b381a554bce9e84594c2be4a0f8f76b8",
-    "dist/policy.js": "8285ed144ba42fd34e926e526cd4dcf60d5ab3668adf4f0b797f074ebd5243ce",
+    "dist/policy.js": "33c527008fafe4af18243ba668d069517c20659150f9f1d1a5a1d076e8724f89",
     "dist/prerender.js": "0386ea2411e00b9563b5349133f1d723947b01f837fa92d4c61a699c9cfb5cdb",
-    "dist/project-tests.js": "225761d36bbe7e185c49c10c0334e579caf7d98647c9941faa4b0ea6406522fa",
+    "dist/project-tests.js": "445eaa139d2f1a2534369cfdeef081ef518de03218a467e7c5c2059caf840270",
     "dist/provider-verification.js": "ffcf9f05e8cb5f71ea46a97e279e8a613fdfdf9435ab02bd57af11e2680a9107",
     "dist/proxy.js": "34107e59ac0dbbea090efa3cf5badf3226c5302ba25e8f8ff9b2b5596ed80e50",
-    "dist/readiness.js": "d419b09a83dc8e6790be7c91ba4e1a2a5cf9b141577c98bd24e99a3609553649",
+    "dist/readiness.js": "6ce69a005d7c45cf0ef97fa5eaba34279d43ebf28124eca18359d9db4f599808",
     "dist/recipes.js": "11853f23e63c3c65c5bed03a278cde0349d28c9fa23266c9907a2df318bb5fc3",
     "dist/route-diff.js": "eebac076a886ddfb2bf5b97ea09d81f888e7bb0063d482eddb8e5fef9acea107",
-    "dist/router.js": "4315585232561c1737e579a2cbd990596d337b37565dd449bcb1bbaa6abbfb13",
-    "dist/runtime.js": "f6f1bfa320a427423d66be845de3368552b1f4cca4a28136b913ac26fb9d6169",
-    "dist/scaffold.js": "9dd30112e070ec554bd7cae1ca0a8b03642632be57411ba76a72972f4ba49b3e",
+    "dist/router.js": "cf831025d5ed6778d1d6a0e541177799794e76766c82084ded81d3e87317ca1e",
+    "dist/runtime.js": "0470dcab0774d2da3336e9ce76a4853757bf96081e52bd741f6b44c1bdd4161f",
+    "dist/sandbox.js": "c88c5aa5dd95b4f55f1ba62da7969ad66dbd97c30f72e5b5f2817a2098ac1c65",
+    "dist/scaffold.js": "3ef243aceca7ddf2780aa2c8c04ae17edd07682d3a418fd5d65ba00f5c762f14",
     "dist/schema-query.js": "bfd1844acd8d54ac361115191fcfbaf828a67e223b9ec6e9c22f158761af149b",
-    "dist/server.js": "d8c78d1695b3c11328f3f983281fba78c2aca6a66cf755b39ecf4ec2ec4b6f29",
+    "dist/server.js": "d878bc8f0d6a05f8fd25997cace3150e2ff4d44ee9c8f4b5530e29601e164be1",
     "dist/signals.js": "b55e54efc8fb6703e08f2a1e808ec8e011bda67738db8ceadf1b248f695795be",
     "dist/site.js": "c40a06a6f9e2d6d3bea94727783c115fed4309bb0190787f58434eed64cbde84",
-    "dist/sqlite-version.js": "a3a08d99064bd0f35847e288027e00a516efdd61c675bfbbe7726e3aa900f0d1",
-    "dist/tooling.js": "eaf9aa49df17b5ab3bc538976b2849fac52b5ca779b6e814fd7ca592ecd757b7",
-    "dist/types.js": "8579202bf322e542969bbd9e5b98774963b12ac69bdf362eebfcb068de2d5421",
-    "dist/typescript-authoring.js": "156c617c2cbf992c299dbbbd5398500f0f30d1c90df8630509036da4ffd7cae9",
+    "dist/tooling.js": "7409db98422325cd4181d073d645ea57debca0e54cb151123474b85f4d4ed7dc",
+    "dist/trusted-functions.js": "befd256848be786f97e372c6af0e05ac08a0c93baed38bf2470ea49bc00dd3e4",
+    "dist/types.js": "a1213d033b6a347c63e94685ab9056d8cd7a301d9c83150142afe0f3ab2c6536",
+    "dist/typescript-authoring.js": "27829098603029ab565174e540fb1d5ef68c1a923272b7186f64a362f5244872",
     "dist/vercel.js": "a0da20c095d0c7fa8f579ed4dd5951e7a34191f8a72a57c5e782c9eab39f6f08",
-    "dist/verify-deployment.js": "cac5d10ea18ae5f699df0eb0a5229837297c7627b47e65140f053820cae2414d",
-    "dist/scripts/operational-drills.js": "b7e9448279c59ee9de62023055a9ff5c7a60bcceed4c33d023edc612f5575af9"
+    "dist/verify-deployment.js": "0c2e68f3cf258a364728c801411df5284343bc01b75a64fe275ff84e397e998b",
+    "dist/scripts/operational-drills.js": "c26c406d28013cc554b25a5b6bf8baf4e71d5e67e50d866fae546f538a192317"
   }
 }

package/dist/agents-guide.js

@@ -16,7 +16,7 @@ export function renderMcpConfig(project = '.')         {
   assert(/^[A-Za-z0-9_.-]+(?:\/[A-Za-z0-9_.-]+)*$/.test(project) && !project.split('/').includes('..'), 'MCP project path must be a relative path without ..');
   return JSON.stringify({ mcpServers: { urlcode: { command: 'urlcode', args: ['mcp', '--project', project] } } }, null, 2) + '\n';
 }
-const handlerNames                            = ['redirect','respond','page','static','download','function','link','proxy','conditional','extension'];
+const handlerNames                            = ['redirect','respond','page','static','download','function','proxy','conditional','extension'];
 
 /**
  * The application-level AGENTS.md written by `urlcode init`. Built from the
@@ -48,11 +48,11 @@ authentication; the runtime provides them. Read this file before changing anythi
 3. Run \`urlcode recipes list\` and \`urlcode recipes show NAME\` before writing a
    route from scratch. If a recipe covers the need, add it with
    \`urlcode recipes add NAME --out DIR\` and adapt the copy.
-4. Prefer YAML over code. Prefer native handlers over functions.
+4. Use URLCode's highest-level declarative features whenever possible. Generate custom code only when the framework cannot express the requirement. Check supported extensions and recipes first; explain any capability gap.
 
 ## Ask the runtime through MCP first
 
-\`${mcpConfigFile}\` registers the read-only \`urlcode mcp\` server. When it is
+When present, \`${mcpConfigFile}\` registers the read-only \`urlcode mcp\` server. When it is
 available, prefer its tools over reading documents: \`get_context\`,
 \`get_capability\`, \`get_schema\`, \`search_recipes\`, \`explain\`, \`get_manifest\`.
 The CLI equivalents are the fallback: \`urlcode context\`, \`urlcode capabilities NAME\`,
@@ -62,23 +62,24 @@ The CLI equivalents are the fallback: \`urlcode context\`, \`urlcode capabilitie
 ## What the runtime provides (this version)
 
 - Handlers, exactly one per route: ${handlers.map(name => `\`${name}\``).join(', ')}.
-- Ordered \`middleware\` around any handler, declared in YAML, run in the sandbox.
+- Ordered \`middleware\` around any handler, declared in YAML, trusted by default.
 - Validated inputs: \`parameters\`, \`request.body\` and \`methods\` on the route;
   functions receive validated \`args\`, never raw user input.
 - Policies, host-enforced and off by default: ${policies.map(name => `\`${name}\``).join(', ')}.
 - Site conventions under \`site\`, each generating one native route: ${site.join(', ')}.
 - Bindings: named \`env\` and \`secrets\` references resolved by the operator, never values in YAML.
 
-Never recreate any of these in a function. If a requirement seems to need one
-of them and it is missing, that is a report, not an invitation to reimplement.
+Never recreate any of these in a function; a missing one is a report, not an
+invitation to reimplement it.
 
-## Functions and middleware are sandboxed
+## Functions and middleware are trusted by default; sandbox is opt-in
 
-Guest code runs in an isolated JavaScript engine with a fresh heap per call.
-It sees a text/JSON \`Request\`/\`Response\` subset, validated \`args\` and granted
-\`env\`. There is no \`fetch\`, no Node API, no filesystem, no timers and no
-imports outside the project. Do not write code that needs them; declare a
-\`proxy\` route or a binding instead and say why.
+A route's \`function\`/\`middleware\` code runs trusted, in-process, with full
+Node/filesystem/\`fetch\` access, receiving only the declared/granted \`args\`
+and \`env\`/\`secrets\`. Add \`sandbox: true\` when code warrants isolation
+(untrusted input, an unreviewed contribution, an especially sensitive
+secret): that route then gets a text/JSON subset only, no Node/filesystem/
+outside imports — use \`proxy\`/a binding instead, and say why in \`description\`.
 
 ## Checks that count as evidence
 
@@ -88,10 +89,9 @@ urlcode test
 urlcode audit --expect-routes ${routes}
 \`\`\`
 
-Run all three after every change. Update the expected route count deliberately
-when you add or remove a route, and add fixtures to \`tests/requests.json\` for
-every new route (positive and negative cases, every active method, HEAD).
-Without a global install, invoke \`node /path/to/urlcode/src/cli.ts\` instead of \`urlcode\`.
+Run all three after every change, updating the route count deliberately and
+adding \`tests/requests.json\` fixtures for every new route (positive/negative,
+every active method, HEAD). No global install: use \`node /path/to/urlcode/src/cli.ts\`.
 
 ## Rules
 
@@ -101,8 +101,8 @@ Without a global install, invoke \`node /path/to/urlcode/src/cli.ts\` instead of
   stop; the operator grants it outside this project, pinned to the revision.
 - Secrets stay out of the project: no keys, tokens or credentials in YAML,
   functions, fixtures, \`.env\` files that are not ignored, or commit messages.
-- Authentication is host processing: declare \`auth\` on the route, never build
-  login forms, sessions or password checks in functions.
+- Protect a route with \`auth: true\`/\`auth: { role: admin }\` where an \`auth\`
+  extension is declared; \`cache\` likewise expands to \`policies.cache\`.
 - Validation, tests and the audit are the evidence. Local checks are not a
   deployment, a soak test or a security review; do not claim otherwise.
 

package/dist/build-static.js

@@ -0,0 +1,134 @@
+import { analyzeProjectCapabilities, analyzeCompiledCapabilities, assertTargetCompatibility } from './capabilities.js';
+import { mkdir, writeFile } from 'node:fs/promises';
+import { join, dirname } from 'node:path';
+import { loadDocument } from './config.js';
+import { compileRoutes } from './router.js';
+import { compileAssets } from './assets.js';
+import { assert, ConfigError } from './errors.js';
+import { applySite } from './site.js';
+import { buildManifest, renderManifest, manifestPath } from './manifest.js';
+                                        
+
+                                                                                                                
+                                                                                                                                                 
+
+// The manifests below are this target's own build output, not a published
+// contract: their shape may change with any release.
+const FORMAT = 1;
+
+/** One S3 per-object website redirect: a zero-byte object at `key` carrying
+ * `x-amz-website-redirect-location: location`, which S3 always answers with a
+ * 301 regardless of the object's own metadata. */
+                                                                              
+/** One served file: the bytes are written under `out/objects/<key>`; the
+ * metadata here is what a deploy step sets as the S3 object's own headers. */
+                                                                                                                      
+                                                                                 
+                                                                           
+
+// S3 static-website object keys never start with a slash; the bucket's own
+// "Index document" suffix (conventionally index.html) is what answers a
+// request for a folder path or the site root, exactly the same convention
+// used here for pattern '/'.
+function objectKey(pattern        )         {
+  const trimmed = pattern.slice(1);
+  return trimmed === '' ? 'index.html' : trimmed;
+}
+
+export async function buildStatic(project        , { out = 'dist/static', origin, log = () => {} }               = {})                       {
+  const loaded = await loadDocument(project);
+  // Generated site routes are built like declared ones; the ones that need
+  // an origin get it from --origin, exactly as the server does.
+  await applySite(loaded, { origin, log });
+  assertTargetCompatibility(analyzeProjectCapabilities(loaded, 'static'));
+  const compiled = await compileRoutes(loaded, {}, {}, undefined);
+  const routes = [...compiled.exact.values(), ...[...compiled.byLength.values()].flat(), ...compiled.mounts];
+
+  assertTargetCompatibility(analyzeCompiledCapabilities(loaded.document, compiled, 'static'));
+  assert(routes.length, 'No routes to build');
+
+  // Capability analysis already refused function/middleware/extension,
+  // parameters, request.body, response.headers, bindings, proxy/signals,
+  // conditional/conditions and every policy for this target, so every
+  // surviving route is a plain redirect/respond/page/static/download with no
+  // path placeholders. What is left below are shapes capability analysis
+  // cannot see because they are configuration, not capability, distinctions:
+  // a redirect that needs request-time logic (query passthrough/mapping, a
+  // non-301 status), and a route that needs request-time lifecycle checks
+  // (`enabled: false`, `expires`) or a method other than GET/HEAD.
+  const defaultMethods = new Set(['GET', 'HEAD']);
+  for (const route of routes) {
+    assert(route.enabled !== false, `${route.pattern}: static hosting has no server to answer a disabled route with 404; remove the route instead of disabling it`);
+    assert(route.expiresAt === undefined, `${route.pattern}: static hosting has no server to answer an expired route with 410; remove the route when it expires`);
+    assert(route.methods.every(method => defaultMethods.has(method)), `${route.pattern}: static hosting only ever answers GET/HEAD; this target refuses declared methods ${route.methods.join(', ')}`);
+    if (route.redirect) {
+      assert(!route.names.length, `${route.pattern}: static hosting cannot redirect a path pattern; only an exact literal path can carry an S3 per-object redirect`);
+      const query = route.redirect.query;
+      assert(!query?.pass?.length && !(query?.map && Object.keys(query.map).length), `${route.pattern}: static hosting cannot pass or map query parameters into a redirect target; this needs request-time logic S3 does not have`);
+      assert(!route.redirect.status || route.redirect.status === 301, `${route.pattern}: S3's per-object website redirect always answers 301; this route declares ${route.redirect.status}, which would silently change on this target`);
+    }
+  }
+
+  await compileAssets(loaded.root, routes);
+
+  const objectsDir = join(out, 'objects');
+  await mkdir(objectsDir, { recursive: true });
+  const redirects                   = [];
+  const objects                 = [];
+  const writeObject = async (key        , body            )                => {
+    const target = join(objectsDir, ...key.split('/'));
+    await mkdir(dirname(target), { recursive: true });
+    await writeFile(target, body);
+  };
+
+  for (const route of routes) {
+    if (route.redirect) {
+      const key = objectKey(route.pattern);
+      redirects.push({ key, location: route.redirect.url, status: 301 });
+      await writeObject(key, new Uint8Array());
+      continue;
+    }
+    if (route.static) {
+      const asset = route.asset;
+      assert(asset instanceof Map, `${route.pattern}: static mount has no compiled asset snapshot`);
+      const prefix = route.prefix .slice(1);
+      for (const [name, file] of asset) {
+        const key = prefix + name;
+        objects.push({ key, contentType: file.type, cacheControl: file.cache });
+        await writeObject(key, file.body);
+      }
+      continue;
+    }
+    if (route.page || route.download) {
+      const asset = route.asset;
+      assert(asset && !(asset instanceof Map), `${route.pattern}: route has no compiled asset snapshot`);
+      const key = objectKey(route.pattern);
+      objects.push({ key, contentType: asset.type, cacheControl: asset.cache, ...(asset.attachment ? { contentDisposition: asset.attachment } : {}) });
+      await writeObject(key, asset.body);
+      continue;
+    }
+    if (route.reply) {
+      const key = objectKey(route.pattern);
+      const contentType = route.reply.headers.find(([name]) => name === 'content-type')?.[1] ?? 'application/octet-stream';
+      objects.push({ key, contentType });
+      await writeObject(key, route.reply.body);
+      continue;
+    }
+    // Unreachable: capability analysis already refuses every other handler for this target.
+    throw new ConfigError(`${route.pattern}: static target has no compiler for this route`);
+  }
+
+  const redirectManifest                   = { format: FORMAT, redirects };
+  const objectManifest                 = { format: FORMAT, objects };
+  await writeFile(join(out, 'redirects.json'), JSON.stringify(redirectManifest, null, 2) + '\n');
+  await writeFile(join(out, 'objects.json'), JSON.stringify(objectManifest, null, 2) + '\n');
+  // The semantic manifest travels with the artifact so a reviewer can read
+  // what was built without the project checkout (docs/TOOLING.md).
+  const manifest = manifestPath(out);
+  await writeFile(manifest, renderManifest(await buildManifest(project, origin === undefined ? {} : { origin })));
+  return { out, format: FORMAT, version: loaded.version, routes: routes.length, redirects: redirects.length, files: objects.length, manifest };
+}
+
+// Exported for tests that need the exact key a route compiles to without
+// duplicating the mapping rule.
+export const staticObjectKey = objectKey;

package/dist/capabilities.js

@@ -1,13 +1,19 @@
-import { hasExtensionPolicy } from './extensions.js';
+import { hasExtensionPolicy, effectiveExtensionPolicies } from './extensions.js';
+                                                        
 import { ConfigError } from './errors.js';
 import { effectivePolicies, registry } from './policies.js';
                                                                                                                                                                                           
 
-export const capabilityTargets = ['self-hosted', 'cloudflare', 'aws', 'vercel']         ;
+export const capabilityTargets = ['self-hosted', 'cloudflare', 'aws', 'vercel', 'static']         ;
                                                                 
+/** `static` never reaches the policy-module handshake (src/types.ts `TargetName`): it refuses every
+ * runtime policy outright, so it needs no entry in that exhaustive per-target record. */
+                                                               
                                                                           
-export const capabilityNames = ['extension','policies.extensions','proxy', 'signals', 'conditional', 'conditions', 'redirect', 'respond', 'page', 'static', 'download', 'function', 'middleware', 'link', 'dynamicLinks', 'parameters', 'methods', 'enabled', 'expires', 'request.body', 'response.headers', 'bindings', 'policies.agents', 'policies.security', 'policies.cache', 'policies.compression', 'policies.throttle']         ;
+export const capabilityNames = ['extension','policies.extensions','proxy', 'signals', 'conditional', 'conditions', 'redirect', 'respond', 'page', 'static', 'download', 'function', 'middleware', 'parameters', 'methods', 'enabled', 'expires', 'request.body', 'response.headers', 'bindings', 'policies.agents', 'policies.security', 'policies.cache', 'policies.compression', 'policies.throttle']         ;
                                                             
+/** The resolved operator registration set, when known (loaded via --host-file, same as `inspectExtensions`). Keyed by extension name. */
+                                                                      
                                                                                   
                                                                                                               
                                       
@@ -23,17 +29,55 @@ export const capabilityNames = ['extension','policies.extensions','proxy', 'sign
 export function normalizeCapabilityTarget(target        )                   {
   if (target === 'node') return 'self-hosted';
   if ((capabilityTargets                     ).includes(target)) return target                    ;
-  throw new ConfigError('Unknown capability target; use self-hosted, cloudflare, aws or vercel');
+  throw new ConfigError('Unknown capability target; use self-hosted, cloudflare, aws, vercel or static');
 }
-const internalTarget = (target                  )             => target === 'self-hosted' ? 'node' : target;
+const internalTarget = (target                     )             => target === 'self-hosted' ? 'node' : target;
 const deployment = (target                  )                                    => target === 'self-hosted' ? 'local-runtime' : 'unverified';
 const policyNames = Object.keys(registry)                ;
 
+// static hosting (S3 + CloudFront) has no server at all, so no capability
+// needing request-time evaluation can be represented; only capabilities a
+// build can lower ahead of time (redirect/respond/page/static/download,
+// methods/enabled/expires) survive.
+const staticRefusals                                          = {
+  extension: 'no server, so no operator extension registry to delegate to',
+  'policies.extensions': 'no server, so no operator extension registry to delegate to',
+  proxy: 'no server, so no bounded egress at request time',
+  signals: 'no server, so no fire-and-forget egress after a reply',
+  conditional: 'no server, so request-time condition matching is not possible',
+  conditions: 'no server, so request-time condition matching is not possible',
+  function: 'no server, so no dynamic execution',
+  middleware: 'no server, so no middleware execution',
+  parameters: 'no server, so no request-time parameter validation',
+  'request.body': 'no server, so there is no request body to read or validate',
+  'response.headers': 'no server, so response headers cannot be added per request; set them via S3 object metadata or a CloudFront response headers policy instead',
+  bindings: 'no server, so env/secret bindings cannot be resolved per request',
+};
+
 // Policy modules remain the authority for configuration-dependent support.
-function decision(capability                , target                  , policies                    )                     {
-  if(capability==='extension'||capability==='policies.extensions')return target==='cloudflare'?{support:'refused',reason:'Operator extensions have no Worker artifact lowering'}:{support:'native',reason:'Requires an operator registry and exact revision pin at activation'};
+// `extension`/`policies.extensions` cannot get a target-independent answer:
+// each registered extension declares its own `targets` (src/extensions.ts),
+// so refusal on aws/vercel/self-hosted depends on that extension, not on the
+// capability name. `extensionNames` names the specific extension(s) this
+// requirement involves; `extensions` is the resolved registration set, when
+// the caller has one (loaded via --host-file, same as `inspectExtensions`).
+function decision(capability                , target                  , policies                    , extensionNames                    , extensions                    )                     {
+  if(capability==='extension'||capability==='policies.extensions'){
+    if(target==='cloudflare')return {support:'refused',reason:'Operator extensions have no Worker artifact lowering'};
+    if(target==='static')return {support:'refused',reason:staticRefusals[capability] };
+    if(!extensions)return {support:'conditional',reason:'Depends on the specific registered extension\'s declared targets; resolve with --host-file (CLI) or the runtime\'s extensions option'};
+    const names=extensionNames?.length?extensionNames:[...extensions.keys()];
+    if(!names.length)return {support:'unknown',reason:'No extension registration to check'};
+    const checked=names.map(name=>{const registration=extensions.get(name);return {name,support:(registration?(registration.targets.includes(internalTarget(target))?'native':'refused'):'unknown')                     };});
+    const unknown=checked.filter(item=>item.support==='unknown').map(item=>item.name);
+    if(unknown.length)return {support:'unknown',reason:`Not registered by the host file: ${unknown.join(', ')}`};
+    const refused=checked.filter(item=>item.support==='refused').map(item=>item.name);
+    if(refused.length)return {support:'refused',reason:`Refused by the extension's own declared targets: ${refused.join(', ')}`};
+    return {support:'native',reason:'Registered extension declares support for this target'};
+  }
   const policy = policyNames.find(name => capability === `policies.${name}`);
   if (policy) {
+    if (target === 'static') return { support: 'refused', reason: 'no server, so runtime policies are not enforced for static hosting' };
     if (policy === 'throttle' && !policies && (target === 'aws' || target === 'vercel')) {
       return { support: 'conditional', reason: 'Only partition: route is implemented; counters are per instance' };
     }
@@ -44,19 +88,24 @@ function decision(capability                , target                  , policies
       : support === 'unknown' ? 'No implementation evidence for this target'
       : 'Implemented by the existing policy module; configuration validation still applies' };
   }
-  if (target !== 'self-hosted') {
+  if (target === 'static') {
+    const reason = staticRefusals[capability];
+    if (reason) return { support: 'refused', reason };
+    // redirect/respond/page/static/download/methods/enabled/expires fall through to the target's own success reason below.
+  } else if (target !== 'self-hosted') {
     const reason = ['proxy','signals'].includes(capability) ? 'bounded egress currently requires the self-hosted Node lifecycle'
       : target === 'cloudflare' && ['conditional','conditions'].includes(capability) ? 'conditional routing has no Worker artifact lowering yet'
-      : capability === 'function' ? 'isolated functions need worker threads and the WASM engine'
-      : capability === 'middleware' ? 'declares middleware that needs the sandbox'
-      : capability === 'link' || capability === 'dynamicLinks' ? 'stored live links need a durable writable store'
+      : capability === 'function' ? 'functions need the self-hosted Node lifecycle, whether trusted (in-process) or sandboxed (worker threads and the WASM engine)'
+      : capability === 'middleware' ? 'middleware needs the self-hosted Node lifecycle, whether trusted (in-process) or sandboxed (worker threads and the WASM engine)'
       : target === 'cloudflare' && ['page', 'static', 'download'].includes(capability) ? 'assets need a static-asset binding'
       : target === 'cloudflare' && capability === 'bindings' ? 'env and secret bindings would have to be baked into the artifact'
       : undefined;
     if (reason) return { support: 'refused', reason };
   }
-  return { support: target === 'cloudflare' ? 'compiled' : 'native', reason: target === 'self-hosted'
+  return { support: target === 'cloudflare' || target === 'static' ? 'compiled' : 'native', reason: target === 'self-hosted'
     ? 'Implemented and tested in the local runtime'
+    : target === 'static'
+    ? 'Compiled ahead of time into S3/CloudFront redirect metadata or static objects; provider deployment unverified'
     : 'Implemented with local adapter tests; provider deployment unverified; transport normalization limits apply' };
 }
 
@@ -83,7 +132,7 @@ export function routeCapabilities(route                             , document
       if (branch.respond && !result.includes('respond')) result.push('respond');
     }
   }
-  for (const name of ['redirect', 'respond', 'page', 'static', 'download', 'function', 'link']         ) if (route[name]) result.push(name);
+  for (const name of ['redirect', 'respond', 'page', 'static', 'download', 'function']         ) if (route[name]) result.push(name);
   if (route.middleware?.length) result.push('middleware');
   if (route.parameters?.length) result.push('parameters');
   // Defaults are still semantics required by every route.
@@ -97,32 +146,42 @@ export function routeCapabilities(route                             , document
   return result;
 }
 
-function analyze(document                 , routes                                                          , requestedTarget        )                      {
+function analyze(document                 , routes                                                          , requestedTarget        , registrations                              )                      {
   const target = normalizeCapabilityTarget(requestedTarget);
+  const extensions                                = registrations ? new Map(registrations.map(registration => [registration.name, registration])) : undefined;
   const requirements                          = [];
-  if (Object.keys(document.extensions??{}).length) requirements.push({path:'(project)',capability:'extension',...decision('extension',target)});
-  if (document.dynamicLinks) requirements.push({ path: '(project)', capability: 'dynamicLinks', ...decision('dynamicLinks', target) });
+  if (Object.keys(document.extensions??{}).length) requirements.push({path:'(project)',capability:'extension',...decision('extension',target,undefined,Object.keys(document.extensions??{}),extensions)});
   for (const [path, route] of routes) {
     const policies = effectivePolicies(document, route);
-    for (const capability of routeCapabilities(route, document)) requirements.push({ path, capability, ...decision(capability, target, policies) });
+    for (const capability of routeCapabilities(route, document)) {
+      const extensionNames = capability==='extension' ? (route.extension?[route.extension]:[])
+        : capability==='policies.extensions' ? Object.keys(effectiveExtensionPolicies(document,route)) : undefined;
+      requirements.push({ path, capability, ...decision(capability, target, policies, extensionNames, extensions) });
+    }
   }
   const issues = requirements.filter(item => item.support === 'refused' || item.support === 'unknown' || item.support === 'conditional');
   return { target, deployment: deployment(target), compatible: issues.length === 0, requirements, issues };
 }
 
-/** Preflight only: call after schema validation/site expansion, before resolving bindings. */
-export function analyzeProjectCapabilities(loaded                , target        )                      {
-  return analyze(loaded.document, Object.entries(loaded.routes), target);
+/**
+ * Preflight only: call after schema validation/site expansion, before resolving bindings.
+ * `registrations` is the resolved operator extension set, when known (the same
+ * shape --host-file loads for `inspectExtensions`); without it, `extension`/
+ * `policies.extensions` requirements report `conditional`/`unknown` rather
+ * than a blanket `native` that ignores the specific extension's own targets.
+ */
+export function analyzeProjectCapabilities(loaded                , target        , registrations                              )                      {
+  return analyze(loaded.document, Object.entries(loaded.routes), target, registrations);
 }
 
 /** Analyze normalized route semantics without exporting validators, resources or resolved secrets. */
-export function analyzeCompiledCapabilities(document                 , compiled                    , target        )                      {
+export function analyzeCompiledCapabilities(document                 , compiled                    , target        , registrations                              )                      {
   function* entries()                                              {
     for (const route of compiled.exact.values()) yield [route.pattern, route];
     for (const bucket of compiled.byLength.values()) for (const route of bucket) yield [route.pattern, route];
     for (const route of compiled.mounts) yield [route.pattern, route];
   }
-  return analyze(document, entries(), target);
+  return analyze(document, entries(), target, registrations);
 }
 
 export function assertTargetCompatibility(report                     )       {
@@ -178,15 +237,10 @@ export const capabilityDetails                                           = {
     constraints: ['`directory` required, project-relative, 1 to 1024 characters; `index` must be a .html name', 'Refused on Cloudflare: assets need a static-asset binding'], grants: [] },
   download: { kind: 'handler', summary: 'Serve a project file as an attachment.', schema: ['download'],
     constraints: ['`file` required, project-relative, 1 to 1024 characters; `filename` at most 255 characters', 'Refused on Cloudflare: assets need a static-asset binding'], grants: [] },
-  function: { kind: 'handler', summary: 'Sandboxed project function producing the reply.', schema: ['function'],
-    constraints: ['`source` at most 1024 characters, project-relative; `export` defaults to the default export', '`args` are literals, `{from: path|query|header}` inputs or `{env}` references', 'Self-hosted only: needs worker threads and the WASM engine; no network or filesystem in the guest'], grants: [] },
-  middleware: { kind: 'middleware', summary: 'Sandboxed modules run before the handler.', schema: ['middleware'],
-    constraints: ['At most 16 entries, each with a project-relative `source` and optional `export`', 'Self-hosted only: needs the sandbox'], grants: [] },
-  link: { kind: 'handler', summary: 'Live stored short link resolved from an operator collection.', schema: ['link', 'dynamicLinks'],
-    constraints: ['`collection` matches ^[A-Za-z][A-Za-z0-9_-]{0,63}$; `code` comes from a path parameter', 'Entry urlcode.yaml must set `dynamicLinks: true`', 'Self-hosted only: needs a durable writable store'],
-    grants: ['--link-store collection=/absolute/file binding owned by the operator'] },
-  dynamicLinks: { kind: 'project', summary: 'Entry-point opt-in for live stored-link routes.', schema: ['dynamicLinks'],
-    constraints: ['Entry urlcode.yaml only; ignored defaults to false', 'Does not enable guest storage or management access'], grants: ['--link-store binding when any link route is declared'] },
+  function: { kind: 'handler', summary: 'Project function producing the reply; trusted and unsandboxed by default, sandboxed opt-in.', schema: ['function'],
+    constraints: ['`source` at most 1024 characters, project-relative; `export` defaults to the default export', '`args` are literals, `{from: path|query|header}` inputs or `{env}` references', 'Self-hosted only', 'Trusted by default (`sandbox` false or absent): runs in-process with full Node network/filesystem access, like any other project code', 'Route-level `sandbox: true` runs the whole `function`/`middleware` chain isolated instead: worker threads, the WASM engine, no network or filesystem in the guest (docs/FUNCTION-SECURITY.md)'], grants: [] },
+  middleware: { kind: 'middleware', summary: 'Modules run before the handler; trusted and unsandboxed by default, sandboxed opt-in.', schema: ['middleware'],
+    constraints: ['At most 16 entries, each with a project-relative `source` and optional `export`', 'Self-hosted only', 'Same trusted-by-default / `sandbox: true` opt-in as `function`, applied uniformly to the whole route'], grants: [] },
   parameters: { kind: 'request', summary: 'Validated path, query and header inputs.', schema: ['parameters'],
     constraints: ['Names match ^[A-Za-z_][A-Za-z0-9_-]*$ and `in` is path, query or header', 'Schema types: string, integer, number, boolean, array; length bounds up to 8192'], grants: [] },
   methods: { kind: 'routing', summary: 'Allowed HTTP methods; defaults to GET and HEAD.', schema: ['methods'],

package/dist/capability-query.js

@@ -35,7 +35,6 @@ function usage(base       ,files         ,name               )
     let document        ;try{document=parse(readFileSync(file,'utf8'));}catch{continue;}
     if(!object(document))continue;
     const routes         =[];
-    if(name==='dynamicLinks'&&document.dynamicLinks===true)routes.push('(project)');
     if(name==='extension'&&object(document.extensions)&&Object.keys(document.extensions).length)routes.push('(project)');
     for(const [path,route] of Object.entries(object(document.routes)?document.routes:{})) {
       if(!object(route))continue;