@jimhoyd/urlcode 0.4.0-alpha.1 → 0.4.0-alpha.3

package/dist/cli.js

@@ -21,15 +21,13 @@ import { loadOperatorPolicy, prepareFunctionSnapshot, requestedPermissions } fro
 import { loadDocument } from './config.js';
 import { describeExtensions } from './tooling.js';
                                                         
-import {parseLinkBinding,runLinkCommand,linkPoolOptions} from './link-cli.js';
 import { ConfigError, HttpError } from './errors.js';
-import {supportsConcurrentWal} from './sqlite-version.js';
 import { registry as policyRegistry } from './policies.js';
 import { loadComplianceRules, profileNames as complianceProfiles } from './compliance.js';
 import { parseRouteSnapshot, diffRoutes, renderRouteDiff } from './route-diff.js';
 import { readFile } from 'node:fs/promises';
 
-const usage = `URLCode 0.4.0-alpha.1 — local/self-hosted runtime
+const usage = `URLCode 0.4.0-alpha.3 — local/self-hosted runtime
   urlcode init <directory> [--with auth,admin]  # --with: layered site from installed @jimhoyd/urlcode-<name> packages
   urlcode scaffold [--project directory] [--dry-run]
   urlcode validate [--project directory] [--local] [--origin https://links.example]  # origin: absolute URLs in site.* files
@@ -41,7 +39,8 @@ const usage = `URLCode 0.4.0-alpha.1 — local/self-hosted runtime
     policies: [--trusted-proxies 10.0.0.0/8,fd00::/8]  # peers allowed to set X-Forwarded-For for client policies
   urlcode add <destination-url> [--alias short-code] [--project directory]
   urlcode test [--project directory] [--origin https://links.example]
-  urlcode build --target cloudflare [--project directory] [--out dist/cloudflare] [--origin https://links.example]
+  urlcode build --target cloudflare|static [--project directory] [--out dist/cloudflare|dist/static] [--origin https://links.example]
+    # static: redirect/respond/page/static/download only, compiled for S3 + CloudFront; no server, see docs/STATIC.md
   urlcode routes [--project directory] [--origin https://links.example]
     diff: [--compare previous-routes.json] [--format json|markdown]  # added/removed/changed routes against an earlier report; always exits 0
   urlcode audit [--project directory] [--expect-routes 2]
@@ -54,16 +53,10 @@ const usage = `URLCode 0.4.0-alpha.1 — local/self-hosted runtime
     [--compliance baseline|strict|privacy|none] [--compliance-rules ...] [--compliance-ignore id,id] [--compliance-warn]
     # compares the running deployment's responses with what this project declares; never follows redirects, no --insecure
   urlcode permissions [--project directory]  # inspect requested bindings and egress origins; grants nothing
-  urlcode explain [/route] [--project directory] [--target self-hosted|cloudflare|aws|vercel] [--host-file ...] [--json]
+  urlcode explain [/route] [--project directory] [--target self-hosted|cloudflare|aws|vercel|static] [--host-file ...] [--json]
     # effective methods, handler, middleware, inputs, policies, cache outcome, bindings and target support from the compiled configuration
   urlcode manifest [--project directory] [--json]  # generated semantic manifest; build writes the same file as manifest.json
   urlcode extensions [--project directory] [--host-file /absolute/operator/host.mjs] [--json]  # registered contracts and schemas; executes trusted host code, activates nothing
-  urlcode links init|create|get|list|update|delete|export|import|api --store /absolute/links.sqlite [--collection links]
-    create/update: --destination https://example.com [--code abc] [--status 302] [--enabled true] [--expires UTC]
-    update/delete: --code abc --if-version N (update replaces all mutable fields)
-    export: consistent NDJSON snapshot to stdout [--collection links] [--page-size 100]
-    import: --input /absolute/export.ndjson restores into empty collections (versions are reassigned)
-    api: --auth-file /operator/management.json (or legacy --token-file /operator/token) --port 3001 (separate authenticated server)
   urlcode import [netlify|cloudflare|vercel|netlify-toml] <file> [--format csv|json|yaml] [--out new-file] [--dry-run] [--report json]
   urlcode export --target netlify|cloudflare|vercel|netlify-toml|csv|json|yaml [--project directory] [--out new-file] [--report json]
     conversion: [--accept-provider-differences]  # explicit non-lossless migration candidate; exact behavior requires runtime
@@ -74,16 +67,14 @@ const usage = `URLCode 0.4.0-alpha.1 — local/self-hosted runtime
   urlcode verify-provider --target self-hosted|aws|vercel|cloudflare --origin https://owned-fixture.example
     [--timeout-ms 3000] [--release label] [--git-commit sha]  # explicitly invokes synthetic deployment probes
   urlcode mcp [--project directory] [--allow-authoring] [--host-file ...]  # bounded stdio tooling; --allow-authoring adds project-confined authoring tools, host file adds get_extensions
-  urlcode capabilities [--target self-hosted|cloudflare|aws|vercel] [--json]
+  urlcode capabilities [--target self-hosted|cloudflare|aws|vercel|static] [--json]
   urlcode capabilities <name> [--json]  # one catalog entry: schema fragment, constraints, grants, targets, bundled uses
   urlcode schema <path> [--json|--yaml]  # schema fragment for route, redirect, policies.cache, site.sitemap, ...
-  urlcode context [--project directory] [--target self-hosted|cloudflare|aws|vercel] [--budget 500] [--json] [--stats]
+  urlcode context [--project directory] [--target self-hosted|cloudflare|aws|vercel|static] [--budget 500] [--json] [--stats]
     # compact facts for an authoring agent from the compiled project; --stats compares estimated tokens with the docs
   urlcode doctor
   serve/dev/validate/test/routes/audit/benchmark/explain/context/extensions/mcp: --host-file /absolute/operator/host.mjs (trusted code outside project)
-  serve/dev/validate/test/routes/audit/benchmark: --link-store links=/absolute/links.sqlite
-  Store pool controls: --link-readers 2 (1–8), --link-read-limit 32, --link-write-limit 32 (1–32 each)
-Dev loads .env.local and watches; serve does neither. Functions run in WASM isolation; external bindings require --policy outside the project.
+Dev loads .env.local and watches; serve does neither. Functions run trusted and in-process by default; a route declaring sandbox: true runs in WASM isolation. External bindings require --policy outside the project.
 `;
 const print = (value         )          => process.stdout.write(typeof value === 'string' ? value : JSON.stringify(value) + '\n');
 const options = {
@@ -91,10 +82,8 @@ const options = {
   project:{ type:'string', default:'.' }, 'host-file':{type:'string'}, with:{type:'string'},
   port:{ type:'string' }, host:{ type:'string', default:'127.0.0.1' },
   'expect-routes':{type:'string'}, requests:{type:'string'}, concurrency:{type:'string'}, seconds:{type:'string'}, 'max-p95-ms':{type:'string'}, warmup:{type:'string'}, target:{type:'string'},
-  'link-readers':{type:'string'}, 'link-read-limit':{type:'string'}, 'link-write-limit':{type:'string'},
   workers:{type:'string'}, 'function-timeout-ms':{type:'string'}, 'max-response-bytes':{type:'string'}, 'max-body-bytes':{type:'string'},
   'max-in-flight':{type:'string'}, 'max-in-flight-health':{type:'string'}, 'request-log':{type:'string'}, 'trust-request-id':{type:'boolean'}, 'trusted-proxies':{type:'string'}, metrics:{type:'boolean'},
-  'link-store':{type:'string'}, store:{type:'string'}, collection:{type:'string'}, code:{type:'string'}, destination:{type:'string'}, status:{type:'string'}, enabled:{type:'string'}, expires:{type:'string'}, 'if-version':{type:'string'}, limit:{type:'string'}, after:{type:'string'}, 'token-file':{type:'string'}, 'auth-file':{type:'string'}, input:{type:'string'}, 'page-size':{type:'string'},
   release:{type:'string'}, 'git-commit':{type:'string'}, 'timeout-ms':{type:'string'}, 'fail-on':{type:'string'}, 'expect-metrics':{type:'boolean'},
   budget:{type:'string'}, stats:{type:'boolean'}, out:{type:'string'}, 'dry-run':{type:'boolean'}, compare:{type:'string'}, format:{type:'string'}, compliance:{type:'string'}, 'compliance-rules':{type:'string'}, 'compliance-ignore':{type:'string'}, 'compliance-warn':{type:'boolean'}, policy:{ type:'string' }, origin:{ type:'string' }, alias:{ type:'string' }, local:{ type:'boolean' }, 'allow-authoring':{ type:'boolean' }, help:{ type:'boolean', short:'h' },
 }         ;
@@ -131,7 +120,7 @@ async function complianceOptions(values        )
   if(!complianceProfiles.includes(profile))throw new ConfigError(`Use --compliance ${complianceProfiles.join('|')}`);
   const ignore=(values['compliance-ignore'] ?? '').split(',').map(id=>id.trim()).filter(Boolean);
   const operator=await loadComplianceRules(values['compliance-rules'],values.project);
-  const host={requestLog:values['request-log'] ?? 'minimal',linkEvents:false};
+  const host={requestLog:values['request-log'] ?? 'minimal'};
   if(!['minimal','detailed'].includes(host.requestLog))throw new ConfigError('Use --request-log minimal or detailed');
   return {profile,ignore,origin:values.origin,host,rules:operator?.rules ?? [],disable:operator?.disable ?? [],override:operator?.override ?? {}};
 }
@@ -151,7 +140,7 @@ let serving = false;
 try {
   const { values, positionals } = parseArgs({ allowPositionals:true, options });
   const [command, arg, ...extra] = positionals;
-  values.port ??= command==='links' && arg==='api' ? '3001' : '3000';
+  values.port ??= '3000';
   if (values.help || !command) print(usage);
   else {
     if (values['host-file'] !== undefined) {
@@ -162,7 +151,7 @@ try {
     if (values.with !== undefined && command !== 'init') throw new ConfigError('--with is only supported by init');
     if (values['allow-authoring'] && command !== 'mcp') throw new ConfigError('--allow-authoring is only supported by mcp');
     const hostOptions = { extensions: operatorHost.extensions, plugins: operatorHost.plugins };
-    if ((!['import','recipes','recipe','examples','example','bulk-import'].includes(command) && extra.length) || (!['init','add','links','import','recipes','recipe','examples','example','bulk-import','explain','capabilities','schema'].includes(command) && arg)) throw new ConfigError('Unexpected positional arguments');
+    if ((!['import','recipes','recipe','examples','example','bulk-import'].includes(command) && extra.length) || (!['init','add','import','recipes','recipe','examples','example','bulk-import','explain','capabilities','schema'].includes(command) && arg)) throw new ConfigError('Unexpected positional arguments');
 
     if(command==='import'||command==='export'){
       const { runInterchange } = await import('./interchange-cli.js');
@@ -190,9 +179,8 @@ try {
       print(text);
       // Estimates only (characters / 4); a tokenizer is not a dependency. Stats go to stderr so stdout stays parseable.
       if (values.stats) process.stderr.write(JSON.stringify({ event:'stats', estimate:'characters/4', documentationTokens:await documentationTokens(), contextTokens:estimateTokens(text) }) + '\n');
-    }else if(command==='links'){await runLinkCommand(arg,values,print);}else{
+    }else{
       const permissions = await loadOperatorPolicy(values.policy,values.project);
-      const linkStore=parseLinkBinding(values['link-store'],linkPoolOptions(values));
       switch (command) {
         case 'routes': case 'audit': case 'benchmark': {
           const number = (key                                                                                    ,fallback         )                     => {
@@ -208,12 +196,12 @@ try {
           if(!['json','markdown'].includes(format))throw new ConfigError('Use --format json or markdown');
           if(values.format!==undefined && values.compare===undefined)throw new ConfigError('--format applies to routes --compare');
           const started=performance.now();
-          const app=await startServer({...hostOptions,project:values.project,port:0,local:true,permissions,linkStore,origin:values.origin,log:()=>{}});
+          const app=await startServer({...hostOptions,project:values.project,port:0,local:true,permissions,origin:values.origin,log:()=>{}});
           const startupMs=performance.now()-started;
           try {
             if(command==='routes') {
               const plan=app.testPlan();
-              if(values.compare===undefined) print({routes:plan.inventory.length,dynamicLinks:plan.dynamicLinks,inventory:plan.inventory,policies:plan.policies});
+              if(values.compare===undefined) print({routes:plan.inventory.length,inventory:plan.inventory,policies:plan.policies});
               else {
                 // The diff reports; it never judges, so the exit code stays 0.
                 const before=parseRouteSnapshot(JSON.parse(await readFile(values.compare,'utf8'))); // file boundary: an earlier `routes` report
@@ -243,7 +231,7 @@ try {
           const isFailOn = (value        )                  => (failLevels                     ).includes(value);
           if (!isFailOn(failOn)) throw new ConfigError(`Use --fail-on ${failLevels.join('|')}`);
           const report = await verifyDeployment(values.project, { target: values.target, origin: values.origin, expectRoutes: integer('expect-routes'), timeoutMs: integer('timeout-ms'),
-            expectMetrics: values['expect-metrics'], failOn, compliance: await complianceOptions(values), complianceWarn: values['compliance-warn'], permissions, linkStore, log: print });
+            expectMetrics: values['expect-metrics'], failOn, compliance: await complianceOptions(values), complianceWarn: values['compliance-warn'], permissions, log: print });
           print(report); if (!report.pass) process.exitCode = 1; break;
         }
         case 'verify-provider': {
@@ -260,7 +248,11 @@ try {
           print(report);if(!report.pass)process.exitCode=1;break;
         }
         case 'build': {
-          if (values.target !== 'cloudflare') throw new ConfigError('Use --target cloudflare');
+          if (values.target === 'static') {
+            const { buildStatic } = await import('./build-static.js');
+            print({ event:'built', ...await buildStatic(values.project,{ out:values.out, origin:values.origin }) }); break;
+          }
+          if (values.target !== 'cloudflare') throw new ConfigError('Use --target cloudflare or static');
           const { buildCloudflare } = await import('./build-cloudflare.js');
           print({ event:'built', ...await buildCloudflare(values.project,{ out:values.out, origin:values.origin }) }); break;
         }
@@ -283,24 +275,24 @@ try {
           }
           break;
         case 'validate': {
-          const runtime = await createRuntime(values.project, { ...hostOptions, local:values.local, permissions, linkStore, origin:values.origin });
-          print({ event:'valid', dynamicLinks:runtime.testPlan().dynamicLinks, routes:runtime.count, version:runtime.version }); await runtime.close(); break;
+          const runtime = await createRuntime(values.project, { ...hostOptions, local:values.local, permissions, origin:values.origin });
+          print({ event:'valid', routes:runtime.count, version:runtime.version }); await runtime.close(); break;
         }
         case 'add':
           if (!arg) throw new ConfigError('Provide an HTTP(S) destination URL');
           print({ event:'added', path:await addRedirect(values.project,arg,values.alias) }); break;
         case 'test': {
-          const result = await runProjectTests(values.project, { ...hostOptions, log:print, permissions, linkStore, origin:values.origin });
+          const result = await runProjectTests(values.project, { ...hostOptions, log:print, permissions, origin:values.origin });
           print(result); if (result.failed) process.exitCode = 1; break;
         }
         case 'doctor':
-          print({ node:process.version, sqlite:process.versions.sqlite, liveLinks:supportsConcurrentWal(process.versions.sqlite), platform:process.platform, architecture:process.arch, runtime:'node-process', functionSandbox:'quickjs-wasm', network:false, filesystem:false, guestNetwork:false, hostEgress:'revision-pinned-origin-grants', tooling:['recipes','examples','bulk-import','build-typescript','mcp','verify-provider'], providers:[], capabilityTargets:getCapabilities().targets, policies:Object.keys(policyRegistry), license:'Apache-2.0' }); break;
+          print({ node:process.version, platform:process.platform, architecture:process.arch, runtime:'node-process', functionDefault:'trusted-in-process', sandboxEngine:'quickjs-wasm', trustedFilesystem:true, trustedNetwork:true, sandboxedFilesystem:false, sandboxedNetwork:false, hostEgress:'revision-pinned-origin-grants', tooling:['recipes','examples','bulk-import','build-typescript','mcp','verify-provider'], providers:[], capabilityTargets:getCapabilities().targets, policies:Object.keys(policyRegistry), license:'Apache-2.0' }); break;
         case 'dev': case 'serve': {
           const port = Number(values.port);
           if (!/^\d+$/.test(values.port) || !Number.isInteger(port) || port < 0 || port > 65535) throw new ConfigError('Invalid port');
           if (command === 'serve' && values.local) throw new ConfigError('serve never reads local dotenv files');
           const app = await startServer({ ...hostOptions, project:values.project, host:values.host, port,
-            local:command === 'dev', watch:command === 'dev', origin:values.origin, permissions, linkStore,
+            local:command === 'dev', watch:command === 'dev', origin:values.origin, permissions,
             ...serverCapacity(values) });
           print({ event:'listening', address:app.address.address, port:app.address.port, mode:command, origin:app.origin });
           serving = true;

package/dist/compliance-rules/baseline.js

@@ -1,4 +1,4 @@
-import { oshp, rfc9111, rfc9110, rfc6585, rfc9309, breach, management, active, functionLike, hasSecrets, yamlHeader, handlerCacheControl, directive, emittedSecurityHeaders } from './shared.js';
+import { oshp, rfc9111, rfc9110, rfc6585, rfc9309, breach, active, functionLike, hasSecrets, yamlHeader, handlerCacheControl, directive, emittedSecurityHeaders } from './shared.js';
                                                                                
 
 export const profile = 'baseline';
@@ -87,12 +87,4 @@ const expiredRoutes              = {
   },
 };
 
-const managementPrivate              = {
-  id: 'ops/management-private', title: 'Management and probe listeners stay private', standard: management, severity: 'info', appliesTo: 'project',
-  check({ document }) {
-    if (document.dynamicLinks !== true) return [];
-    return [{ message: 'dynamicLinks is enabled; the link management API and the /_urlcode probes are meant for a private bind', remediation: 'Run `urlcode links api` on a private interface with an operator auth file, and keep /_urlcode/health and /_urlcode/ready internal' }];
-  },
-};
-
-export const rules                            = Object.freeze([securityHeaders, hstsOrigin, secretsCompression, secretsNoStore, cacheControlDeclared, throttleFunctions, robots, expiredRoutes, managementPrivate]);
+export const rules                            = Object.freeze([securityHeaders, hstsOrigin, secretsCompression, secretsNoStore, cacheControlDeclared, throttleFunctions, robots, expiredRoutes]);

package/dist/compliance-rules/privacy.js

@@ -1,13 +1,12 @@
-import { monitoring, linkChannel, active } from './shared.js';
+import { monitoring, active } from './shared.js';
                                                                                
 
 export const profile = 'privacy';
 
 // These rules check the host settings the operator declares for the
-// deployment under review (`host.requestLog`, `host.linkEvents`,
-// `host.includeCode`), because the runtime's log guarantees are settings of
-// the serving process, not of the project. An undeclared setting is reported
-// as unknown rather than assumed.
+// deployment under review (`host.requestLog`), because the runtime's log
+// guarantees are settings of the serving process, not of the project. An
+// undeclared setting is reported as unknown rather than assumed.
 const requestLogMinimal              = {
   id: 'privacy/request-log-minimal', title: 'Request log records stay minimal', standard: monitoring, severity: 'medium', appliesTo: 'project',
   check({ host }) {
@@ -17,16 +16,6 @@ const requestLogMinimal              = {
   },
 };
 
-const linkEventsOff              = {
-  id: 'privacy/link-events-off', title: 'Link events stay off unless declared', standard: linkChannel, severity: 'medium', appliesTo: 'project',
-  check({ document, host }) {
-    if (document.dynamicLinks !== true || host.linkEvents === false) return [];
-    if (host.linkEvents === null) return [{ severity: 'info', message: 'dynamicLinks is enabled and the deployment did not declare whether the link event channel is on', remediation: 'Declare host.linkEvents (and host.includeCode) for the deployment under review' }];
-    if (host.includeCode === true) return [{ severity: 'high', message: 'The link event channel is on with includeCode, so every event names the short code a person followed', remediation: 'Leave includeCode off; the channel then redacts the code and reports only route, outcome and timing' }];
-    return [{ message: 'The link event channel is on, so per-click records leave the process', remediation: 'Enable linkEvents only for a declared click-collection purpose and keep the collector bounded' }];
-  },
-};
-
 const detailedParameters            = {
   id: 'privacy/detailed-log-parameters', title: 'No detailed logging on parameterised routes', standard: monitoring, severity: 'low', appliesTo: 'route',
   check({ route, config, host }) {
@@ -35,4 +24,4 @@ const detailedParameters            = {
   },
 };
 
-export const rules                            = Object.freeze([requestLogMinimal, linkEventsOff, detailedParameters]);
+export const rules                            = Object.freeze([requestLogMinimal, detailedParameters]);

package/dist/compliance-rules/shared.js

@@ -12,8 +12,6 @@ export const rfc6585           = Object.freeze({ name: 'RFC 6585 Additional HTTP
 export const rfc9309           = Object.freeze({ name: 'RFC 9309 Robots Exclusion Protocol', reference: 'https://www.rfc-editor.org/rfc/rfc9309' });
 export const breach           = Object.freeze({ name: 'BREACH (compression side channel)', reference: 'https://www.breachattack.com/', section: 'Mitigations' });
 export const monitoring           = Object.freeze({ name: 'URLCode logging guarantees', reference: 'docs/MONITORING.md', section: 'Log records' });
-export const linkChannel           = Object.freeze({ name: 'URLCode link event channel', reference: 'docs/MONITORING.md', section: 'The link event channel' });
-export const management           = Object.freeze({ name: 'URLCode management security', reference: 'docs/MANAGEMENT-SECURITY.md' });
 export const agentLists           = Object.freeze({ name: 'URLCode bundled agent lists', reference: 'docs/policies/agents.md', section: 'Bundled lists' });
 
 export const active = (route                    )          => route.state === 'active';

package/dist/compliance.js

@@ -37,7 +37,7 @@ import * as privacy from './compliance-rules/privacy.js';
                                                                                                                                        
                                                                               
 /** The host settings under review, null where the operator declared nothing. */
-                                                                                                                                    
+                                                                           
                                  
                                                                                                                               
                                                             
@@ -58,14 +58,14 @@ import * as privacy from './compliance-rules/privacy.js';
                                    
                                                                                                                                              
              
-                                                                                               
+                                                                        
                                                                              
     
  
 export const severities                      = Object.freeze(['high','medium','low','info']);
 export const idPattern = /^[a-z][a-z0-9-]{0,31}\/[a-z][a-z0-9-]{0,63}$/;
 const referencePattern = /^(?:https?:\/\/\S+|RFC ?\d{3,5}|docs\/[A-Za-z0-9./-]+\.md)$/;
-const hostKeys = ['requestLog','linkEvents','includeCode'];
+const hostKeys = ['requestLog'];
 const isSeverity = (value         )                    => (severities                      ).includes(value);
 
                                                                                                              
@@ -147,11 +147,9 @@ export async function loadComplianceRules(file                    , project
 
 function validateHost(host          = {})               {
   assert(host && typeof host === 'object' && !Array.isArray(host) && Object.keys(host).every(key => hostKeys.includes(key)), `Compliance host settings accept ${hostKeys.join(', ')}`);
-  const { requestLog, linkEvents, includeCode } = host                                                                         ;
+  const { requestLog } = host                            ;
   assert(requestLog === undefined || requestLog === 'minimal' || requestLog === 'detailed', 'Compliance host.requestLog must be minimal or detailed');
-  assert(linkEvents === undefined || typeof linkEvents === 'boolean', 'Compliance host.linkEvents must be a boolean');
-  assert(includeCode === undefined || typeof includeCode === 'boolean', 'Compliance host.includeCode must be a boolean');
-  return { requestLog: requestLog ?? null, linkEvents: linkEvents ?? null, includeCode: includeCode ?? null };
+  return { requestLog: requestLog ?? null };
 }
 
 function finding(rule          , raw         , route                    )          {
@@ -209,7 +207,7 @@ export async function runCompliance(app               , { rules = [], profile =
   return {
     profile, rules: set.length, ruleIds: set.map(rule => rule.id), ignored: [...ignore], findings, counts, pass: counts.high === 0,
     evidence: {
-      routes: plan.inventory.length, active, dynamicLinks: plan.dynamicLinks === true,
+      routes: plan.inventory.length, active,
       policies: [...new Set(Object.values(policies).flatMap(Object.keys))].sort(),
       files: loaded.files.map(file => relative(loaded.root, file)),
       origin: origin ?? null, target, host: hostSettings,

package/dist/config.js

@@ -70,16 +70,20 @@ function modulePath(pattern        , kind                           , file
 /**
  * Expands the YAML short forms into the canonical long form. `function: functions/x.mjs`
  * becomes `{source, args}` with an argument per `{param}` in the path, declaring any
- * parameter the route does not declare itself; a string middleware entry becomes `{source}`.
+ * parameter the route does not declare itself; a string middleware entry becomes `{source}`;
+ * a route-level `cache` becomes `policies.cache` (refused alongside a direct `policies.cache`).
  * Everything downstream (routes, audit, the compiled table) sees only the long form.
  */
 export function normalizeRoute(pattern        , route                                   )              {
   const authored = route                       ;
-  if (typeof authored.function !== 'string' && !authored.middleware?.some(entry => typeof entry === 'string')) return route               ;
+  const needsFunction = typeof authored.function === 'string';
+  const needsMiddleware = authored.middleware?.some(entry => typeof entry === 'string') ?? false;
+  const needsCache = authored.cache !== undefined;
+  if (!needsFunction && !needsMiddleware && !needsCache) return route               ;
   const result              = { ...(route               ) };
-  if (authored.middleware) result.middleware = authored.middleware.map((entry)                   => typeof entry === 'string' ? { source: modulePath(pattern, 'middleware', entry) } : entry);
-  if (typeof authored.function === 'string') {
-    const source = modulePath(pattern, 'function', authored.function);
+  if (needsMiddleware) result.middleware = authored.middleware .map((entry)                   => typeof entry === 'string' ? { source: modulePath(pattern, 'middleware', entry) } : entry);
+  if (needsFunction) {
+    const source = modulePath(pattern, 'function', authored.function          );
     const names = pattern.split('/').flatMap(part => { const match = /^\{([A-Za-z_][A-Za-z0-9_]*)\}$/.exec(part); return match ? [match[1] ] : []; });
     const declared = authored.parameters ?? [];
     const parameters = [...declared, ...names.filter(name => !declared.some(p => p.in === 'path' && p.name === name)).map(name => ({ name, in: 'path'         , required: true, schema: { ...SHORT_FORM_PATH_SCHEMA } }))];
@@ -87,6 +91,11 @@ export function normalizeRoute(pattern        , route
     if (parameters.length) result.parameters = parameters;
     result.function = expanded;
   }
+  if (needsCache) {
+    assert(result.policies?.cache === undefined, `Route ${pattern} declares both cache and policies.cache; use one form`);
+    result.policies = { ...result.policies, cache: authored.cache  };
+    delete result.cache;
+  }
   return result;
 }
 export async function safeFile(root        , file         )                  {
@@ -178,7 +187,6 @@ export async function loadDocumentInWorker(project        )
     files.push(path);
     const part = validateDocument(await readConfig(path, budget));
     assert(!part.includes?.length, 'Nested includes are unsupported');
-    assert(part.dynamicLinks===undefined, 'dynamicLinks may only be set in the entry urlcode.yaml');
     assert(part.site===undefined, 'site may only be set in the entry urlcode.yaml');
     for(const [name,extension]of Object.entries(part.extensions??{})){assert(!Object.hasOwn(extensions,name),'Duplicate extension declaration across files');extensions[name]=extension;assert(Object.keys(extensions).length<=16,'Maximum 16 extensions per project');}
     for (const [pattern, route] of Object.entries(part.routes)) {
@@ -190,8 +198,7 @@ export async function loadDocumentInWorker(project        )
   if(Object.keys(extensions).length)document.extensions=extensions;
   normalizeRouteAuth(document, routes);
   assert(Object.keys(routes).length <= 100000, 'Maximum 100000 routes per project');
-  assert(document.dynamicLinks===true || !Object.values(routes).some(route=>route.link), 'Link routes require dynamicLinks: true in urlcode.yaml');
-  return { root, document, routes, files, version: createHash('sha256').update(JSON.stringify(document.extensions?{routes,extensions:document.extensions,policies:document.policies,profiles:document.profiles,site:document.site,dynamicLinks:document.dynamicLinks}: document.site ? {...(document.dynamicLinks===true?{routes,dynamicLinks:true}:{routes}), site:document.site} : document.dynamicLinks===true?{routes,dynamicLinks:true}:routes)).digest('hex').slice(0, 16) };
+  return { root, document, routes, files, version: createHash('sha256').update(JSON.stringify(document.extensions?{routes,extensions:document.extensions,policies:document.policies,profiles:document.profiles,site:document.site}: document.site ? {routes, site:document.site} : routes)).digest('hex').slice(0, 16) };
 }
 export async function loadBindings(root        , local = false, environment                                     = process.env)                                              {
   const vars                         = {};

package/dist/context.js

@@ -27,11 +27,11 @@ import {loadOperatorHost} from './operator-host.js';
           
                                                                                 
                                                            
-                                                                              
+                                                         
                                                                     
                                              
    
-                                                         
+                                                                                               
                                                                               
                                                                                                                        
                                  
@@ -40,14 +40,14 @@ import {loadOperatorHost} from './operator-host.js';
 /** Characters divided by four, rounded up: an estimate, not a tokenizer. */
 export function estimateTokens(text       )        {return Math.ceil(text.length/4);}
 export function renderContext(context               )        {return stringify(context,{lineWidth:0,aliasDuplicateObjects:false});}
-const handlerNames=['redirect','respond','page','static','download','function','link','proxy','conditional','extension']         ;
+const handlerNames=['redirect','respond','page','static','download','function','proxy','conditional','extension']         ;
 const policyNames=Object.keys(registry).sort()                ;
 // Fixed for every project: what generation must not attempt, whatever the documentation says.
 const constraints                                                  ={
- guestNetwork:{value:false,note:'Functions and middleware run in a WASM sandbox without fetch or sockets; outbound calls are proxy or signals routes under operator grants'},
- nodeApis:{value:false,note:'No Node built-ins, process, filesystem or npm packages in guest code; relative ES-module imports only'},
+ guestNetwork:{value:true,note:'Trusted (default) functions and middleware run in-process with full Node network access; route `sandbox: true` runs that route in a WASM sandbox without fetch or sockets, where outbound calls must be proxy or signals routes under operator grants'},
+ nodeApis:{value:true,note:'Trusted (default) functions and middleware have full Node built-ins, process, filesystem and npm packages available, same as any other project code; route `sandbox: true` restricts that route to relative ES-module imports only, no Node built-ins/filesystem/npm packages'},
  regexRoutes:{value:false,note:'Paths are whole segments: exact literals or {param} placeholders declared as required string parameters'},
- oneHandlerPerRoute:{value:true,note:'Exactly one of redirect, respond, page, static, download, function, link, proxy, conditional or extension; middleware wraps it'},
+ oneHandlerPerRoute:{value:true,note:'Exactly one of redirect, respond, page, static, download, function, proxy, conditional or extension; middleware wraps it'},
  pathShape:{value:'exact or {param}',note:'No greedy captures or general-purpose wildcards; a segment is a literal or a named placeholder'},
  wildcardMounts:{value:false,note:'Only static and extension routes mount a subtree; nothing else matches below its path'},
  yamlInterpolation:{value:false,note:'No ${...} templating; bind typed inputs through parameters, args and context'},
@@ -79,7 +79,6 @@ export async function buildContext(project       ,options               ={})
   for(const name of handlerNames)handlers[name]=0;
   for(const name of policyNames)policyCounts[name]=0;
   if(Object.keys(document.extensions??{}).length)used.add('extension');
-  if(document.dynamicLinks)used.add('dynamicLinks');
   for(const route of routes) {
    handlers[handlerOf(route)]=(handlers[handlerOf(route)]??0)+1;
    for(const capability of routeCapabilities(route,document))used.add(capability);
@@ -113,11 +112,11 @@ export async function buildContext(project       ,options               ={})
    project:{
     entry:'urlcode.yaml',routes:compiled.count,handlers,extensions:sorted(Object.keys(document.extensions??{})),
     policies:{project:policyNames.filter(name=>topLevel[name]),routes:policyCounts},
-    bindings:{env:sorted(env),secrets:sorted(secrets)},dynamicLinks:document.dynamicLinks===true,site:sorted(Object.keys(document.site??{})),
+    bindings:{env:sorted(env),secrets:sorted(secrets)},site:sorted(Object.keys(document.site??{})),
     files:{includes:loaded.files.slice(1).map(file=>relative(loaded.root,file).split('\\').join('/')),functions:sorted(functions),middleware:sorted(middleware)},
     ...(options.hostFile===undefined?{}:{host:{extensions:sorted((host.extensions??[]).map(item=>item.name)),plugins:(host.plugins??[]).length}}),
    },
-   routes:routes.map(route=>({path:route.pattern,methods:route.methods,handler:handlerOf(route)})).sort((a,b)=>a.path<b.path?-1:a.path>b.path?1:0),
+   routes:routes.map(route=>({path:route.pattern,methods:route.methods,handler:handlerOf(route),sandbox:route.sandbox===true,...(route.sandboxReason?{sandboxReason:route.sandboxReason}:{})})).sort((a,b)=>a.path<b.path?-1:a.path>b.path?1:0),
    constraints:{...constraints},
    targets,
    commands:{
@@ -138,7 +137,7 @@ const drops                                                  =[
  ['constraintNotes',context=>{for(const [key,item] of Object.entries(context.constraints))context.constraints[key]=typeof item==='object'?item.value:item;}],
  ['files',context=>{delete context.project.files;}],
  ['commands',context=>{delete context.commands;}],
- ['summary',context=>{context.project={entry:context.project.entry,routes:context.project.routes,handlers:context.project.handlers,extensions:[],policies:{project:[],routes:{}},bindings:{env:[],secrets:[]},dynamicLinks:context.project.dynamicLinks,site:[]};}],
+ ['summary',context=>{context.project={entry:context.project.entry,routes:context.project.routes,handlers:context.project.handlers,extensions:[],policies:{project:[],routes:{}},bindings:{env:[],secrets:[]},site:[]};}],
 ];
 function fitBudget(context               ,budget       )                {
  const omitted                 =[];

package/dist/examples.js

@@ -21,7 +21,7 @@ import {assert} from './errors.js';
                                                                                                      
  
 // Fixed package data, like the recipe catalog: names come from here, metadata from each example.yaml.
-export const exampleNames=['assets','aws','cloudflare','compliance','conditions','cookbook','egress','extensions','live-links','monitoring','prerender','provider-conformance','tunnel','vercel']         ;
+export const exampleNames=['assets','aws','cloudflare','compliance','conditions','cookbook','egress','extensions','monitoring','prerender','provider-conformance','tunnel','vercel']         ;
 export const routeIndexFile='route-index.json';
 const examplesRoot=fileURLToPath(new URL('../examples/',import.meta.url));
 const root=(name        )=>examplesRoot+name+'/';
@@ -31,7 +31,7 @@ export async function listExamples()                            {
   for(const name of exampleNames)result.push(await metadata(name));
   return result;
 }
-const handlerNames=['extension','proxy','conditional','redirect','function','page','static','download','respond','link']         ;
+const handlerNames=['extension','proxy','conditional','redirect','function','page','static','download','respond']         ;
 function handlerOf(route             )         {return handlerNames.find(name=>route[name]!==undefined)??'unknown';}
 /**
  * Derives the per-route tag index of one project from its loaded routes: handler,

package/dist/explain-cli.js

@@ -1,5 +1,5 @@
 import {ConfigError} from './errors.js';
-import {normalizeCapabilityTarget} from './capabilities.js';
+import {capabilityTargets, normalizeCapabilityTarget} from './capabilities.js';
                                                         
 import {explainRoute,explainProject} from './tooling.js';
                                                    
@@ -8,11 +8,11 @@ import {buildManifest,renderManifest} from './manifest.js';
 
                                                                                                                                                      
 const table=(rows           )       =>{const widths=rows[0] .map((_,i)=>Math.max(...rows.map(row=>row[i] .length)));return rows.map(row=>row.map((cell,i)=>cell.padEnd(widths[i] )).join('  ').trimEnd()).join('\n')+'\n';};
-const targetsOf=(target                 )                   =>target===undefined?['self-hosted','cloudflare','aws','vercel']:[normalizeCapabilityTarget(target)];
+const targetsOf=(target                 )                   =>target===undefined?[...capabilityTargets]:[normalizeCapabilityTarget(target)];
 function summary(explanation                 ,targets                   )        {
   const handler=explanation.handler,detail=handler.kind==='function'?`${handler.source          }#${handler.export          }`:handler.kind==='redirect'?`${handler.status          } ${handler.url          }`:handler.kind==='extension'?handler.name          :handler.kind==='page'||handler.kind==='download'?handler.file          :handler.kind==='static'?handler.directory          :handler.kind==='proxy'?handler.url          :handler.kind==='respond'?String(handler.status):'';
   const support=targets.map(target=>explanation.targets[target].compatible?target:`${target}:refused`).join(',');
-  return [explanation.path,explanation.methods.join(','),`${handler.kind}${detail?` ${detail}`:''}`,explanation.state,String(explanation.middleware.length),explanation.policies.names.join(',')||'-',explanation.cache.outcome,support].join('\t');
+  return [explanation.path,explanation.methods.join(','),`${handler.kind}${detail?` ${detail}`:''}`,explanation.state,explanation.sandbox?'sandboxed':'trusted',String(explanation.middleware.length),explanation.policies.names.join(',')||'-',explanation.cache.outcome,support].join('\t');
 }
 function detail(explanation                 ,targets                   )        {
   const lines         =[`route: ${explanation.path}`];
@@ -20,6 +20,8 @@ function detail(explanation                 ,targets                   )
   if(explanation.generated)lines.push(`generated: site.${explanation.generated}`);
   lines.push(`state: ${explanation.state}${explanation.expires?` (expires ${explanation.expires})`:''}`,`methods: ${explanation.methods.join(', ')}`,`handler: ${JSON.stringify(explanation.handler)}`);
   lines.push(`middleware: ${explanation.middleware.length?explanation.middleware.map(item=>`${item.source}#${item.export}`).join(' -> '):'none'}`);
+  // Route-level, so it is printed for a native handler with middleware too.
+  lines.push(`execution: ${explanation.sandbox?'sandboxed (QuickJS)':'trusted (in-process)'}${explanation.sandboxReason?`; ${explanation.sandboxReason}`:''}`);
   lines.push(`inputs: ${explanation.inputs.parameters.length?explanation.inputs.parameters.map(p=>`${p.in}:${p.name}${p.required?'':'?'}`).join(', '):'none'}${explanation.inputs.body?`; body ${JSON.stringify(explanation.inputs.body)}`:''}`);
   lines.push(`policies: ${explanation.policies.names.length?explanation.policies.names.join(', '):'none'}`);
   for(const [name,entry] of Object.entries(explanation.policies.inventory))lines.push(`  ${name}: ${JSON.stringify(entry)}`);
@@ -43,7 +45,7 @@ export async function runExplainCommand(command                     ,route
     if(options.json){print(renderManifest(manifest));return 0;}
     const lines=[`revision: ${manifest.revision}`,`urlcode: ${manifest.urlcode}`,`files: ${manifest.files.join(', ')}`,`routes: ${manifest.routeCount}`,`capabilities: ${manifest.capabilities.join(', ')}`,
       `extensions: ${Object.keys(manifest.extensions).join(', ')||'none'}`,`recipes: ${manifest.recipes.map(recipe=>recipe.id).join(', ')||'none'}`,
-      `external: env ${manifest.external.env.join(', ')||'-'}; secrets ${manifest.external.secrets.join(', ')||'-'}; proxy ${manifest.external.egress.proxy.join(', ')||'-'}; signals ${manifest.external.egress.signals.join(', ')||'-'}; link stores ${manifest.external.linkStores.join(', ')||'-'}`,
+      `external: env ${manifest.external.env.join(', ')||'-'}; secrets ${manifest.external.secrets.join(', ')||'-'}; proxy ${manifest.external.egress.proxy.join(', ')||'-'}; signals ${manifest.external.egress.signals.join(', ')||'-'}`,
       `functions: ${manifest.functions.map(item=>`${item.source}#${item.export}`).join(', ')||'none'}`,`middleware: ${manifest.middleware.map(item=>`${item.source}#${item.export}`).join(', ')||'none'}`,
       `targets: ${Object.entries(manifest.targets).map(([target,support])=>`${target} ${support.compatible?'supported':`${support.issues} issue${support.issues===1?'':'s'}`}`).join('; ')}`,'Use --json for the full manifest.'];
     print(lines.join('\n')+'\n');return 0;
@@ -52,7 +54,7 @@ export async function runExplainCommand(command                     ,route
   if(route===undefined){
     const report=await explainProject(options.project,base);
     if(options.json){print(report);return 0;}
-    print(table([['route','methods','handler','state','mw','policies','cache','targets'],...report.routes.map(item=>summary(item,targets).split('\t'))]));return 0;
+    print(table([['route','methods','handler','state','execution','mw','policies','cache','targets'],...report.routes.map(item=>summary(item,targets).split('\t'))]));return 0;
   }
   if(!route.startsWith('/'))throw new ConfigError('Provide an absolute route path such as /docs');
   const explanation=await explainRoute(options.project,route,base);

package/dist/explain.js

@@ -15,7 +15,7 @@ import {effectivePolicies} from './policies.js';
 // binding values are replaced by their names, module paths are made
 // project-relative and secrets never appear.
 
-const handlerNames=['extension','proxy','conditional','redirect','function','page','static','download','respond','link']                                          ;
+const handlerNames=['extension','proxy','conditional','redirect','function','page','static','download','respond']                                          ;
 
                                                                                       
                                                                                                                    
@@ -29,6 +29,11 @@ const handlerNames=['extension','proxy','conditional','redirect','function','pag
                                    
                                                                                                                         
                                                                                                               
+                                                                                         
+                                                                                               
+                                                                                                 
+                                                                                  
+                                         
                                                                    
                                                                                                               
                        
@@ -57,7 +62,6 @@ function handlerOf(route              ,root       )                  {
     case 'static':return {kind,directory:route.static .directory,...(route.static .index?{index:route.static .index}:{})};
     case 'download':return {kind,file:route.download .file,...(route.download .filename?{filename:route.download .filename}:{}),...(route.download .contentType?{contentType:route.download .contentType}:{})};
     case 'respond':return {kind,status:route.reply?.status??route.respond .status??200};
-    case 'link':return {kind,collection:route.link .collection};
     default:return {kind:'none'};
   }
 }
@@ -80,11 +84,11 @@ function providerOf(name       ,requirement                                 ,opt
   if(requirement)try{requirementValid=registration.policySchema?Boolean(new Ajv.default({strict:false,allErrors:false}).compile(registration.policySchema)(requirement)):false;}catch{requirementValid=false;}
   return {registered:true,version:registration.version,targets:[...registration.targets],revisionMatch:options.projectSha256===undefined?false:registration.projectSha256===options.projectSha256,requirementValid};
 }
-function targetsOf(loaded               ,route              )                                        {
+function targetsOf(loaded               ,route              ,options               )                                        {
   const table={exact:new Map([[route.pattern,route]]),byLength:new Map(),mounts:[],modules:[],count:1};
   const result={}                                          ;
   for(const target of capabilityTargets){
-    const report=analyzeCompiledCapabilities(loaded.document,table,target);
+    const report=analyzeCompiledCapabilities(loaded.document,table,target,options.extensions);
     const issues=report.issues.filter(issue=>issue.path===route.pattern).map(({capability,support,reason})=>({capability,support,reason}));
     result[target]={compatible:issues.length===0,issues};
   }
@@ -111,12 +115,13 @@ export function explainCompiledRoute(loaded               ,route              ,c
     state:routeState(route,options.now??Date.now()),enabled:route.enabled!==false,...(route.expires?{expires:route.expires}:{}),
     methods:[...route.methods],conditional:Boolean(route.match||route.conditional),handler,
     middleware:route.middleware.map(item=>({source:relativeSource(root,item.source),export:item.export})),
+    sandbox:route.sandbox===true,...(route.sandboxReason?{sandboxReason:route.sandboxReason}:{}),
     inputs:{parameters:route.parameters.map(({name,in:location,required,schema})=>({name,in:location,required,schema})),...(route.request?.body?{body:route.request.body}:{})},
     policies:{names,inventory,extensions},
     cache:cacheOf(route,chain,extensionNames),
     bindings:{env,secrets},egress,
     responseHeaders:route.responseHeaders.map(([name,value])=>[name,value]),
-    capabilities:routeCapabilities(route,loaded.document),targets:targetsOf(loaded,route),
+    capabilities:routeCapabilities(route,loaded.document),targets:targetsOf(loaded,route,options),
     note:'Derived from the compiled configuration; request conditions, parameter values and handler execution are not evaluated.',
   };
 }