@mason-data/cli 0.9.0 → 0.11.0

package/dist/src/cli/replica.js

@@ -4,14 +4,52 @@ import { isFailure, serviceText, whoAmI } from "./hosted.js";
 export const REPLICA_PART = /^[a-z0-9][a-z0-9-]{0,62}$/;
 export const REPLICA_ENV = "MASON_REPLICA";
 export const replicaText = (r) => `${r.org}/${r.name}`;
-/** The replica the command means: `--replica`, else `MASON_REPLICA`; null when neither names one, a Failure when it is
- *  not `<org>/<name>` (never repeated beyond 200 characters, made printable). `usage`: the command's, said after a wrong
- *  `--replica`. */
-export function replicaOf(flag, usage, env = process.env) {
+/**
+ * THE REPLICA THE COMMAND MEANS, ONE RESOLVER FOR EVERY COMMAND THAT NAMES ONE (`mason deploy`, `mason user …
+ * --replica`, `mason token create`, `mason replica create | status`): the command's own argument where it takes one
+ * (`mason replica status acme/shop`), else `--replica`, else `MASON_REPLICA`; null when none names one, a Failure when
+ * it is not `<org>/<name>` (never repeated beyond 200 characters, made printable), or when the argument and `--replica`
+ * name two replicas. `usage`: the command's, said after a wrong line.
+ *
+ * WHEN THE ENVIRONMENT CHOSE THE TARGET IT IS SAID, on stderr (`say`): an agent inherits an environment it may never
+ * read, and `MASON_REPLICA` exported turns `mason user add` from this project's users to a replica's.
+ */
+export function replicaOf(flag, usage, env = process.env, o = {}) {
+    if (o.argument !== undefined) {
+        const r = replicaNamed(o.argument, "argument", usage);
+        if (flag === undefined || "message" in r)
+            return r;
+        const f = replicaNamed(flag, "--replica", usage);
+        if ("message" in f)
+            return f;
+        if (replicaText(f) === replicaText(r))
+            return r;
+        return { message: `the replica is named twice: ${replicaText(r)} and --replica ${replicaText(f)}`, code: "usage", fix: `name one: ${replicaText(r)}, or --replica ${replicaText(f)}`, usage };
+    }
     const from = flag !== undefined ? "--replica" : env[REPLICA_ENV] !== undefined ? REPLICA_ENV : null;
     if (from === null)
         return null;
-    return replicaNamed((from === "--replica" ? flag : env[REPLICA_ENV]) ?? "", from, usage);
+    const r = replicaNamed((from === "--replica" ? flag : env[REPLICA_ENV]) ?? "", from, usage);
+    if (!("message" in r) && r.from === REPLICA_ENV)
+        (o.say ?? sayStderr)(envChoseText(r));
+    return r;
+}
+/** What is said on stderr when `MASON_REPLICA` chose the replica (a name `REPLICA_PART` holds: safe to print). */
+export const envChoseText = (r) => `using ${REPLICA_ENV}=${replicaText(r)} (--replica names another; unset ${REPLICA_ENV} for none)`;
+const sayStderr = (line) => { process.stderr.write(`${line}\n`); };
+/** The organisation the command means: its own argument (`mason replica list acme`), else `--org`; null when neither
+ *  names one, a wrong line's Failure when one is not a slug or the two differ. */
+export function orgOf(flag, argument, usage) {
+    const named = [argument, flag].filter((x) => x !== undefined).map((x) => orgNamed(x, usage));
+    const bad = named.find((x) => typeof x !== "string");
+    if (bad !== undefined)
+        return bad;
+    const [a, b] = named;
+    if (a === undefined)
+        return null;
+    if (b !== undefined && a !== b)
+        return { message: `the organisation is named twice: ${a} and --org ${b}`, code: "usage", fix: `name one: ${a}, or --org ${b}`, usage };
+    return a;
 }
 /** `raw` as a replica's name, `<org>/<name>`, each part `REPLICA_PART`: the one grammar of `--replica`, `MASON_REPLICA`
  *  and a command's own argument (`mason replica status <org>/<name>`); a Failure otherwise, a wrong line's (`usage`)

package/dist/src/cli/replication-mode.js

@@ -165,6 +165,11 @@ export function dropStatements(o) {
     return `SELECT pg_drop_replication_slot('${o.slot}') FROM pg_replication_slots WHERE slot_name = '${o.slot}' AND NOT active;` +
         (o.owned ? ` DROP PUBLICATION IF EXISTS ${o.publication};` : "");
 }
+/** The statement that lists Mason's replication slots on a database (each named `mason_…`, `replicationNames`), for a
+ *  person to find the one to drop when its name is not known (a hosted replica's record of it could not be read). */
+export function listSlotsStatement() {
+    return "SELECT slot_name, database, active FROM pg_replication_slots WHERE left(slot_name, 6) = 'mason_';";
+}
 /**
  * WHAT THE RECORD NAMES THAT THIS START NO LONGER READS, to drop before the record names the new one (each holds what
  * Mason made on a database nothing would drop otherwise): a slot under another name (the sources file renamed) goes

package/dist/src/cli/request-filter.js

@@ -1,6 +1,7 @@
 import { OUTCOMES } from "../api/request-log.js";
 import { parseRequestCursor, requestCursor } from "../duck/requests.js";
 import { didYouMean } from "../lib/did-you-mean.js";
+import { parseDuration } from "../lib/table-sync.js";
 /** How many requests a read returns unless it says. */
 export const DEFAULT_REQUEST_LIMIT = 40;
 export const MAX_REQUEST_LIMIT = 10_000;
@@ -12,21 +13,30 @@ export const MAX_SEARCH = 200;
 /** How many sync events a read returns unless it says, and the most it may. */
 export const DEFAULT_EVENT_LIMIT = 40;
 export const MAX_EVENT_LIMIT = MAX_REQUEST_LIMIT;
-const AGE = /^(\d+)(s|m|h|d)$/;
-const AGE_MS = { s: 1000, m: 60_000, h: 3_600_000, d: 86_400_000 };
 /** a date, or a date and time with its zone (a time without one would be read in this machine's zone: refused) */
 const ISO = /^\d{4}-\d{2}-\d{2}(T\d{2}:\d{2}(:\d{2}(\.\d{1,6})?)?(Z|[+-]\d{2}:?\d{2}))?$/;
+/** The furthest a JavaScript Date reaches from 1970, either way (ECMA-262 21.4.1.1). */
+const MAX_TIME_MS = 8.64e15;
 const usage = (message, fix) => ({ message, code: "usage", ...(fix !== undefined ? { fix } : {}) });
 export const QUERY_NAMES = (k) => k;
 /**
  * THE TIME GRAMMAR, ONE FOR EVERY ENTRANCE (`--since` / `--until` of mason logs and mason usage, and the run's `since` and
  * `until` of /api/requests, /api/events, /api/usage and /api/logs): an ISO 8601 date or time with its zone, or an age
- * before `now` (30s, 30m, 2h, 7d), as an ISO time; a time with no zone is refused, as is anything else.
+ * before `now` (30s, 30m, 2h, 7d, 2 hours), read by the command line's one duration grammar (src/lib/table-sync.ts
+ * `parseDuration`) with its unit written, as an ISO time; a time with no zone is refused, as is anything else. A bare
+ * number is refused here, as it always was: as a TIME it reads as well as a Unix timestamp as an age in seconds.
  */
 export function timeOf(name, text, now) {
-    const age = AGE.exec(text.trim());
-    if (age !== null)
-        return new Date(now - Number(age[1]) * AGE_MS[age[2]]).toISOString();
+    const age = Number.isFinite(Number(text.trim())) ? null : parseDuration(text, { zero: true });
+    if (age !== null && !("problem" in age)) {
+        // an age past what a time can hold (Date's ±8.64e15 ms) is the command line's mistake, refused as one: never a throw,
+        // which the run's API would answer 500
+        const at = now - age.seconds * 1000;
+        if (!Number.isFinite(at) || Math.abs(at) > MAX_TIME_MS) {
+            return usage(`${name} ${JSON.stringify(text)} is further back than a time reaches`, "a shorter age (30m, 2h, 7d), or an ISO 8601 date or time with its zone (2026-10-28, 2026-10-28T09:00:00Z)");
+        }
+        return new Date(at).toISOString();
+    }
     const t = ISO.test(text.trim()) ? Date.parse(text.trim()) : NaN;
     if (Number.isNaN(t)) {
         return usage(`${name} ${JSON.stringify(text)} is not a time`, "an age (30m, 2h, 7d) or an ISO 8601 date or time with its zone (2026-10-28, 2026-10-28T09:00:00Z)");

package/dist/src/cli/run-server.js

@@ -28,13 +28,14 @@ import { fileURLToPath } from "node:url";
 import { readBody, sendJson } from "../lib/http-json.js";
 import { projectFingerprint } from "../lib/project-files.js";
 import { guard, newTunnel, SECURITY_HEADERS } from "./security.js";
+import { PAGE_READ_ONLY, PAGE_READ_ONLY_WHY, pageWrite } from "./ui-read-only.js";
 import { maskedUrl } from "./preflight.js";
 import { errorJson, nextJson } from "./command.js";
 import { phaseCounts, readiness, syncTotals, tableSync } from "./readiness.js";
 import { restartsFact } from "./supervise.js";
 import { withRestarts } from "../duck/events.js";
 import { NO_ROLES } from "../duck/grants.js";
-import { addedNext, addUser, attributesToAdd, disabledNext, disableUser, enabledNext, enableUser, listUsers, removeUser, REMOVED_NEXT, roleToAdd, withLastUsed } from "./user.js";
+import { addedNext, addUser, attributesToAdd, disabledNext, disableUser, enabledNext, enableUser, fromNext, listUsers, rangesText, removeUser, REMOVED_NEXT, roleToAdd, setUserFrom, withLastUsed } from "./user.js";
 import { userRole } from "./roles.js";
 import { postgresFacts, postgresLink } from "./pg-url.js";
 import { catalogTable, parseSourceText, shownPath } from "./sources.js";
@@ -101,6 +102,11 @@ export function runState(ctx, copies, stream, now = Date.now(), { columns = fals
         // why the page offers no Add or Remove, or null: the project's files deployed read-only (MASON_PROJECT_READONLY), or
         // a server's project folder mounted read-only — a control that can only fail is not offered
         sourcesReadOnly: sourcesReadOnly(ctx, sources.file?.file ?? null),
+        // why the page offers no control that changes anything (MASON_UI_READ_ONLY=1, src/cli/ui-read-only.ts), or null:
+        // every change it would send is refused
+        pageReadOnly: ctx.pageReadOnly === true ? PAGE_READ_ONLY_WHY : null,
+        // the Unix socket the page is served on too (MASON_UI_SOCKET), or null: mason status says it
+        pageSocket: ctx.pageSocket ?? null,
         source: { url: maskedUrl(ctx.source.url), host: ctx.source.host, database: ctx.source.database, remote: ctx.source.remote, demo: ctx.demo === true,
             // `replication` while a table's sync is replication (the run streams), else `poll`: each table's own is its kept
             version: facts.versionText, standby: facts.standby, changes: repl !== null ? "replication" : "poll", name: sources.file?.name ?? null, file: sources.file?.file ?? null,
@@ -556,23 +562,33 @@ export function createRunServer(ctx) {
             res.writeHead(v.status, { "Content-Type": "text/plain; charset=utf-8" }).end(`${v.reason}\n`);
             return;
         }
+        // A READ-ONLY PAGE (MASON_UI_READ_ONLY=1): every change the page asks for is refused by rule, before any route is
+        // read, so a route added later is refused too; the commands' requests (the run's token) are served as before
+        if (ctx.pageReadOnly === true && pageWrite(req.method, req.headers.authorization)) {
+            sendFailure(res, 403, PAGE_READ_ONLY);
+            return;
+        }
         const url = new URL(req.url ?? "/", `http://127.0.0.1:${ctx.port}`);
+        // HEAD IS GET BY RULE, never route by route: routed as a GET, answered with its status and headers, and its body
+        // dropped by Node's own response to a HEAD. It passes nothing GET does not: the guard and the read-only rule above
+        // have judged it as the HEAD it is, and only GET routes are reached, none of which changes anything.
+        const method = req.method === "HEAD" ? "GET" : req.method;
         void (async () => {
             try {
-                const file = req.method === "GET" || req.method === "HEAD" ? page.get(url.pathname) : undefined;
+                const file = method === "GET" ? page.get(url.pathname) : undefined;
                 if (file !== undefined) {
                     res.writeHead(200, { "Content-Type": file.type, "Content-Length": file.body.length, ...(file.immutable ? { "Cache-Control": IMMUTABLE } : {}) })
-                        .end(req.method === "HEAD" ? undefined : file.body);
+                        .end(file.body);
                 }
-                else if (req.method === "GET" && url.pathname === "/api/ping") {
+                else if (method === "GET" && url.pathname === "/api/ping") {
                     // what proves a run is up (src/cli/runs.ts answers): this token answered, by this process
                     sendJson(res, 200, { pid: process.pid });
                 }
-                else if (req.method === "GET" && url.pathname === "/api/state") {
+                else if (method === "GET" && url.pathname === "/api/state") {
                     // lean, as the page polls it; ?columns=1 with each table's columns (mason status --json)
                     sendJson(res, 200, await state(ctx, url.searchParams.get("columns") === "1"));
                 }
-                else if (req.method === "GET" && /^\/api\/tables\/[^/]+\/columns$/.test(url.pathname)) {
+                else if (method === "GET" && /^\/api\/tables\/[^/]+\/columns$/.test(url.pathname)) {
                     // one table's columns, read when the page's Columns… form opens (never with the state, polled every 2 s)
                     let table;
                     try {
@@ -583,18 +599,18 @@ export function createRunServer(ctx) {
                     }
                     sendJson(res, 200, tableColumns(ctx, table));
                 }
-                else if (req.method === "GET" && url.pathname === "/api/slow") {
+                else if (method === "GET" && url.pathname === "/api/slow") {
                     // the last day's slow statements, from the request log (src/duck/requests.ts)
                     sendJson(res, 200, { slow: await ctx.duck.requests.slow(SLOW_MS), slowMs: SLOW_MS });
                 }
-                else if (req.method === "GET" && url.pathname === "/api/refused") {
+                else if (method === "GET" && url.pathname === "/api/refused") {
                     sendJson(res, 200, await ctx.duck.requests.refused());
                 }
-                else if (req.method === "GET" && url.pathname === "/api/unsupported") {
+                else if (method === "GET" && url.pathname === "/api/unsupported") {
                     // the refused statements grouped by the unsupported SQL they used (src/duck/gaps.ts): mason status
                     sendJson(res, 200, await unsupported(ctx, url.searchParams));
                 }
-                else if (req.method === "GET" && url.pathname === "/api/requests") {
+                else if (method === "GET" && url.pathname === "/api/requests") {
                     // the filters, read as mason logs --requests reads its options (src/cli/request-filter.ts)
                     const q = requestFilter(requestFilterText(url.searchParams));
                     if ("message" in q) {
@@ -603,20 +619,20 @@ export function createRunServer(ctx) {
                     }
                     sendJson(res, 200, { ...await ctx.duck.requests.page(q), keptDays: ctx.duck.requests.days });
                 }
-                else if (req.method === "GET" && url.pathname === "/api/queries") {
+                else if (method === "GET" && url.pathname === "/api/queries") {
                     // the last day's and week's statements in one scan of the request log (mason status); asked on its own, never
                     // with /api/state, which the page asks every 2 s
                     // (cached SUMMARY_TTL_MS: up to 30 s old)
                     sendJson(res, 200, { queries: await summary() });
                 }
-                else if (req.method === "GET" && url.pathname === "/api/activity") {
+                else if (method === "GET" && url.pathname === "/api/activity") {
                     // one time range's statements, clients and slowest (the Usage page's), from the request log
                     sendJson(res, 200, await activity(ctx, url.searchParams));
                 }
-                else if (req.method === "GET" && url.pathname === "/api/running") {
+                else if (method === "GET" && url.pathname === "/api/running") {
                     sendJson(res, 200, { running: ctx.listener.running() });
                 }
-                else if (req.method === "POST" && url.pathname === "/api/cancel") {
+                else if (method === "POST" && url.pathname === "/api/cancel") {
                     const body = JSON.parse(await readBody(req, 64 * 1024));
                     const whole = (x) => typeof x === "number" && Number.isInteger(x) && x >= 1;
                     if (!whole(body.session))
@@ -640,7 +656,7 @@ export function createRunServer(ctx) {
                     }
                     sendFailure(res, 409, { message: `session ${r.idle} is running no statement: nothing to cancel`, code: "refused", why: "its statement ended, or it is between two", next: [running] });
                 }
-                else if (req.method === "GET" && url.pathname === "/api/logs") {
+                else if (method === "GET" && url.pathname === "/api/logs") {
                     // the run's last log entries from memory (mason serve has no file to read): { at, text } each, oldest first
                     const lines = Number(url.searchParams.get("lines") ?? Math.min(40, ctx.logs.capacity));
                     if (!Number.isInteger(lines) || lines < 1 || lines > ctx.logs.capacity)
@@ -649,15 +665,15 @@ export function createRunServer(ctx) {
                     const since = sinceText === null ? undefined : timeParam("since", sinceText, Date.now());
                     sendJson(res, 200, { lines: ctx.logs.recent({ lines, ...(since !== undefined ? { since } : {}) }), kept: ctx.logs.capacity });
                 }
-                else if (req.method === "GET" && url.pathname === "/api/events") {
+                else if (method === "GET" && url.pathname === "/api/events") {
                     // the sync's events and the run's restarts, newest last (src/duck/events.ts): mason logs --events, mason status
                     sendJson(res, 200, await events(ctx, url.searchParams));
                 }
-                else if (req.method === "GET" && url.pathname === "/api/usage") {
+                else if (method === "GET" && url.pathname === "/api/usage") {
                     // usage over time, a sample a minute (src/duck/usage.ts): mason usage
                     sendJson(res, 200, await usage(ctx, url.searchParams));
                 }
-                else if (req.method === "POST" && url.pathname === "/api/pick") {
+                else if (method === "POST" && url.pathname === "/api/pick") {
                     const body = JSON.parse(await readBody(req, 64 * 1024));
                     if (typeof body.table !== "string" || typeof body.picked !== "boolean")
                         throw new Refusal(400, "send { table, picked, columns?, key?, sync?, keep? }");
@@ -697,13 +713,13 @@ export function createRunServer(ctx) {
                         sendJson(res, 200, { ...r, state: await state(ctx) });
                     }
                 }
-                else if (req.method === "POST" && url.pathname === "/api/ui/tunnel") {
+                else if (method === "POST" && url.pathname === "/api/ui/tunnel") {
                     await openTunnel(ctx, tunnels, req, res);
                 }
-                else if (req.method === "POST" && url.pathname === "/api/share") {
+                else if (method === "POST" && url.pathname === "/api/share") {
                     await openShare(ctx, req, res);
                 }
-                else if (req.method === "GET" && url.pathname === "/api/share/choices") {
+                else if (method === "GET" && url.pathname === "/api/share/choices") {
                     // what a share with no role named reads, or the roles to choose from: the page asks before it asks the person
                     if (ctx.pageShares === undefined) {
                         sendFailure(res, 409, SERVED_SHARE);
@@ -716,7 +732,7 @@ export function createRunServer(ctx) {
                     }
                     sendJson(res, 200, "failure" in r ? { choices: r.choices } : { choices: [], role: r.role, reads: r.reads });
                 }
-                else if ((req.method === "POST" && /^\/api\/share\/[^/]+\/beat$/.test(url.pathname)) || (req.method === "DELETE" && /^\/api\/share\/[^/]+$/.test(url.pathname))) {
+                else if ((method === "POST" && /^\/api\/share\/[^/]+\/beat$/.test(url.pathname)) || (method === "DELETE" && /^\/api\/share\/[^/]+$/.test(url.pathname))) {
                     // the page's share: a beat holds it, a DELETE is Stop sharing; a share of mason share's is its command's to end
                     if (ctx.pageShares === undefined || ctx.shares === undefined) {
                         sendFailure(res, 409, SERVED_SHARE);
@@ -736,14 +752,14 @@ export function createRunServer(ctx) {
                     }
                     const ended = ctx.shares.ended;
                     const why = ended?.user === user ? `: ${ended.why}` : "";
-                    const ok = req.method === "DELETE" ? await ctx.pageShares.stop(user) : ctx.pageShares.beat(user);
+                    const ok = method === "DELETE" ? await ctx.pageShares.stop(user) : ctx.pageShares.beat(user);
                     if (!ok) {
                         sendFailure(res, 404, { message: `the share ${user} is not open${why === "" ? "" : `; it ended${why}`}`, code: "not_found", fix: "Connect from anywhere opens a new one, with a new address and password" });
                         return;
                     }
                     sendJson(res, 200, { ok: true });
                 }
-                else if (req.method === "POST" && /^\/api\/share\/[^/]+$/.test(url.pathname)) {
+                else if (method === "POST" && /^\/api\/share\/[^/]+$/.test(url.pathname)) {
                     // what the command knows of its tunnel, as it knows it: mason status says it, and the run stops the client
                     const body = tunnelReport(JSON.parse(await readBody(req, 64 * 1024)));
                     if (body === null)
@@ -755,7 +771,7 @@ export function createRunServer(ctx) {
                     }
                     sendJson(res, 200, { ok: true });
                 }
-                else if (req.method === "GET" && url.pathname === "/api/users") {
+                else if (method === "GET" && url.pathname === "/api/users") {
                     // mason user list --json's shape: the users, and whether each connects (and with ?lastUsed=1 when each was last used)
                     const r = listUsers(ctx.users.file, ctx.users.apiKey, postgresLink(ctx.users.postgresUrl), ctx.roles?.() ?? NO_ROLES);
                     if ("message" in r) {
@@ -768,7 +784,7 @@ export function createRunServer(ctx) {
                         : { users: r.users, lastUsedNote: LAST_USED_NOT_ASKED, requestLogDays: ctx.duck.requests.days };
                     sendJson(res, 200, { ...used, urlNote: null, next: nextJson([["mason user add <name>", "a user for a tool: its password and URL, printed once"]]) });
                 }
-                else if (req.method === "POST" && url.pathname === "/api/users") {
+                else if (method === "POST" && url.pathname === "/api/users") {
                     const body = JSON.parse(await readBody(req, 64 * 1024));
                     if (typeof body.name !== "string")
                         throw new Refusal(400, "send { name }: the user's name");
@@ -776,6 +792,8 @@ export function createRunServer(ctx) {
                         throw new Refusal(400, "send { name, role }: the role's name, a string");
                     if (body.set !== undefined && !(Array.isArray(body.set) && body.set.every((x) => typeof x === "string")))
                         throw new Refusal(400, "send { name, role, set }: set is a list of \"attribute=value\" strings, as mason user add --set takes them");
+                    if (body.from !== undefined && !(Array.isArray(body.from) && body.from.every((x) => typeof x === "string")))
+                        throw new Refusal(400, "send { name, from }: from is a list of address ranges (\"10.0.0.0/16\"), as mason user add --from takes them");
                     // the role must be one the roles file names NOW (src/cli/user.ts roleToAdd): refused before anything is written
                     const roleProblem = body.role === undefined ? null : roleToAdd(body.role, ctx.roles?.() ?? NO_ROLES);
                     if (roleProblem !== null) {
@@ -791,7 +809,7 @@ export function createRunServer(ctx) {
                     }
                     // mason user add --json's shape: its password, once, and the URL to paste (this run is up, so it has one)
                     const r = addUser(ctx.users.file, ctx.users.apiKey, body.name, { link: postgresLink(ctx.users.postgresUrl), database: ctx.users.database, roles: ctx.roles?.() ?? NO_ROLES,
-                        ...(typeof body.role === "string" ? { role: body.role } : {}), attributes: attributes.values });
+                        ...(typeof body.role === "string" ? { role: body.role } : {}), attributes: attributes.values, ...(Array.isArray(body.from) ? { from: body.from } : {}) });
                     if ("message" in r) {
                         sendFailure(res, statusOf(r), r);
                         return;
@@ -800,7 +818,28 @@ export function createRunServer(ctx) {
                     ctx.log(`user ${added.user} added${replaced ? " (in place of one the API key's rotation had removed)" : ""}`);
                     sendJson(res, 200, { ...added, next: nextJson(addedNext(added.user, true)) });
                 }
-                else if (req.method === "POST" && /^\/api\/users\/[^/]+\/(disable|enable)$/.test(url.pathname)) {
+                else if (method === "POST" && /^\/api\/users\/[^/]+\/from$/.test(url.pathname)) {
+                    // mason user from --json's shape, through its own function: the user's address ranges replaced (null: any address)
+                    let name;
+                    try {
+                        name = decodeURIComponent(url.pathname.split("/")[3]);
+                    }
+                    catch {
+                        throw new Refusal(400, `${url.pathname} does not name a user: POST /api/users/<name>/from`);
+                    }
+                    const body = JSON.parse(await readBody(req, 64 * 1024));
+                    if (!(body.from === null || (Array.isArray(body.from) && body.from.every((x) => typeof x === "string"))))
+                        throw new Refusal(400, "send { from }: a list of address ranges (\"10.0.0.0/16\"), or null for any address");
+                    const r = setUserFrom(ctx.users.file, name, body.from);
+                    if ("message" in r) {
+                        sendFailure(res, statusOf(r), r);
+                        return;
+                    }
+                    if (!r.already)
+                        ctx.log(`user ${r.changed.name} connects from ${rangesText(r.changed.from)}`);
+                    sendJson(res, 200, { ...r, next: nextJson(fromNext(r.changed.name, r.changed.from)) });
+                }
+                else if (method === "POST" && /^\/api\/users\/[^/]+\/(disable|enable)$/.test(url.pathname)) {
                     // mason user disable|enable --json's shape, through its own functions: kept, its password unchanged
                     const [, , , encoded, verb] = url.pathname.split("/");
                     let name;
@@ -831,7 +870,7 @@ export function createRunServer(ctx) {
                         sendJson(res, 200, { ...r, next: nextJson(enabledNext(r.enabled.name)) });
                     }
                 }
-                else if (req.method === "DELETE" && url.pathname.startsWith("/api/users/")) {
+                else if (method === "DELETE" && url.pathname.startsWith("/api/users/")) {
                     let name;
                     try {
                         name = decodeURIComponent(url.pathname.slice("/api/users/".length));
@@ -847,7 +886,7 @@ export function createRunServer(ctx) {
                     ctx.log(`user ${r.removed.name} removed`);
                     sendJson(res, 200, { ...r, next: nextJson(REMOVED_NEXT) });
                 }
-                else if (req.method === "POST" && url.pathname === "/api/sync") {
+                else if (method === "POST" && url.pathname === "/api/sync") {
                     const body = JSON.parse(await readBody(req, 64 * 1024));
                     if (!Array.isArray(body.tables) || !body.tables.length || !body.tables.every((x) => typeof x === "string"))
                         throw new Refusal(400, "send { tables: [schema.table, …] }");
@@ -862,7 +901,7 @@ export function createRunServer(ctx) {
                         throw e;
                     }
                 }
-                else if (req.method === "POST" && url.pathname === "/api/remove") {
+                else if (method === "POST" && url.pathname === "/api/remove") {
                     const body = JSON.parse(await readBody(req, 64 * 1024));
                     if (!Array.isArray(body.tables) || !body.tables.length || !body.tables.every((m) => typeof m === "string"))
                         throw new Refusal(400, "send { tables: [name, …] }");

package/dist/src/cli/secret-input.js

@@ -0,0 +1,193 @@
+/**
+ * A SECRET READ FROM THE PERSON OR THE PIPE, NEVER FROM A FLAG, AN ARGUMENT OR A FILE (`mason replica create`'s database
+ * URL, issue 720): on a terminal a hidden prompt, otherwise stdin read whole. Node's own TTY handling, no dependency.
+ *
+ *   - THE PROMPT (stdin a terminal): the question on stderr, stdin in raw mode, so the terminal echoes nothing and keeps
+ *     no line of it; each key is read here. Enter ends it; Ctrl-C, or Ctrl-D or Enter on an empty line, cancels; Backspace
+ *     and Ctrl-U edit; a terminal's escape sequences (a bracketed paste's markers, an arrow) are dropped. The terminal is
+ *     put back as it was on EVERY way out — the answer, a cancel, an error of the stream, its end, a signal (SIGINT,
+ *     SIGTERM, SIGHUP while raw mode keeps Ctrl-C from being one), and the process's exit.
+ *   - THE PIPE (stdin not a terminal): read whole, bounded at `max` bytes and by a time limit (a pipe left open and
+ *     silent never holds the command), one trailing newline (`\n` or `\r\n`) trimmed; more than one line is refused.
+ *
+ * Nothing read is ever written anywhere by this module: what went wrong is said by kind, never by value.
+ */
+import { StringDecoder } from "node:string_decoder";
+const SIGNALS = ["SIGINT", "SIGTERM", "SIGHUP"];
+/**
+ * THE HIDDEN PROMPT: `question` on `output` (stderr), a line read from `input` (a terminal) in raw mode, echoing nothing.
+ * At most `max` characters are kept; a longer line is read to its end (so nothing of it is left for the shell to echo)
+ * and refused.
+ */
+export function readHidden(input, output, question, max, signals = process) {
+    return new Promise((resolve, reject) => {
+        const wasRaw = input.isRaw === true;
+        const decoder = new StringDecoder("utf8");
+        let line = [];
+        let tooLong = false;
+        let escape = "";
+        let ended = false;
+        const restore = () => { if (!wasRaw)
+            input.setRawMode?.(false); };
+        const finish = (r) => {
+            if (ended)
+                return;
+            ended = true;
+            input.removeListener("data", onData);
+            input.removeListener("end", onEnd);
+            input.removeListener("close", onEnd);
+            input.removeListener("error", onError);
+            for (const s of SIGNALS)
+                signals.removeListener(s, onSignal);
+            signals.removeListener("exit", restore);
+            try {
+                restore();
+            }
+            finally {
+                input.pause();
+                // the person's Enter was not echoed: the next line starts on a line of its own
+                output.write("\n");
+                line = [];
+                if (r instanceof Error)
+                    reject(r);
+                else
+                    resolve(r);
+            }
+        };
+        const onSignal = () => finish({ none: "cancelled" });
+        const onEnd = () => finish({ none: line.length ? "closed" : "cancelled" });
+        const onError = (e) => finish(e);
+        const onData = (chunk) => {
+            const text = typeof chunk === "string" ? chunk : decoder.write(chunk);
+            for (const c of text) {
+                if (ended)
+                    return;
+                // a terminal's escape sequence (an arrow, a bracketed paste's markers, a title report): dropped whole
+                if (escape === "esc") {
+                    escape = c === "[" ? "csi" : c === "]" ? "osc" : "";
+                    continue;
+                }
+                if (escape === "csi") {
+                    if (c >= "@" && c <= "~")
+                        escape = "";
+                    continue;
+                }
+                if (escape === "osc") {
+                    if (c === "\x07" || c === "\x1b")
+                        escape = "";
+                    continue;
+                }
+                if (c === "\x1b") {
+                    escape = "esc";
+                    continue;
+                }
+                if (c === "\r" || c === "\n") {
+                    finish(tooLong ? { none: "too_long" } : line.length === 0 ? { none: "empty" } : { value: line.join("") });
+                    return;
+                }
+                if (c === "\x03") {
+                    finish({ none: "cancelled" });
+                    return;
+                }
+                if (c === "\x04") {
+                    if (line.length === 0 && !tooLong) {
+                        finish({ none: "cancelled" });
+                        return;
+                    }
+                    continue;
+                }
+                if (c === "\x7f" || c === "\b") {
+                    line.pop();
+                    continue;
+                }
+                if (c === "\x15") {
+                    line = [];
+                    tooLong = false;
+                    continue;
+                }
+                if (c < " ")
+                    continue;
+                if (line.length >= max) {
+                    tooLong = true;
+                    continue;
+                }
+                line.push(c);
+            }
+        };
+        try {
+            if (input.setRawMode === undefined)
+                throw new Error("stdin is a terminal that cannot turn its echo off");
+            // the question first, then echo off: nothing typed before it is shown as asked
+            output.write(question);
+            input.setRawMode(true);
+            for (const s of SIGNALS)
+                signals.on(s, onSignal);
+            signals.on("exit", restore);
+            input.on("data", onData);
+            input.on("end", onEnd);
+            input.on("close", onEnd);
+            input.on("error", onError);
+            input.resume();
+        }
+        catch (e) {
+            finish(e instanceof Error ? e : new Error(String(e)));
+        }
+    });
+}
+/**
+ * THE PIPE: `input` read whole, at most `max` bytes after one trailing newline is trimmed, within `timeoutMs`. Empty,
+ * more than one line, longer than `max`, or nothing by the time limit, each said by kind.
+ */
+export function readPiped(input, max, timeoutMs) {
+    return new Promise((resolve, reject) => {
+        const chunks = [];
+        let bytes = 0;
+        let ended = false;
+        const finish = (r) => {
+            if (ended)
+                return;
+            ended = true;
+            clearTimeout(timer);
+            input.removeListener("data", onData);
+            input.removeListener("end", onEnd);
+            input.removeListener("error", onError);
+            input.pause();
+            if (r instanceof Error)
+                reject(r);
+            else
+                resolve(r);
+        };
+        const timer = setTimeout(() => finish({ none: "timeout" }), timeoutMs);
+        // the newline a shell's echo or a file ends with is not the URL's: room for it, then the bound
+        const most = max + 2;
+        const onData = (chunk) => {
+            const b = typeof chunk === "string" ? Buffer.from(chunk, "utf8") : chunk;
+            bytes += b.length;
+            if (bytes > most) {
+                finish({ none: "too_long" });
+                return;
+            }
+            chunks.push(b);
+        };
+        const onEnd = () => {
+            let text = Buffer.concat(chunks).toString("utf8");
+            chunks.length = 0;
+            if (text.endsWith("\r\n"))
+                text = text.slice(0, -2);
+            else if (text.endsWith("\n"))
+                text = text.slice(0, -1);
+            if (text === "")
+                return finish({ none: "empty" });
+            if (/[\r\n]/.test(text))
+                return finish({ none: "lines" });
+            if (Buffer.byteLength(text, "utf8") > max)
+                return finish({ none: "too_long" });
+            finish({ value: text });
+        };
+        const onError = (e) => finish(e);
+        input.on("data", onData);
+        input.on("end", onEnd);
+        input.on("error", onError);
+        input.resume();
+    });
+}

package/dist/src/cli/security.js

@@ -62,6 +62,11 @@ export function newTunnel(port, now = Date.now()) {
 export function setCookieHeader(token, port) {
     return `${cookieName(port)}=${token}; HttpOnly; SameSite=Strict; Path=/`;
 }
+/** Where a trade sends the browser: the same address without its secret, RELATIVE to the one asked (`./` for `/`), so a
+ *  page a reverse proxy serves under a prefix of its own lands back there, never on the proxy's root. */
+export function sameAddress(url) {
+    return `./${url.pathname.slice(url.pathname.lastIndexOf("/") + 1)}${url.search}${url.hash}`;
+}
 /** The Host a browser may send for a loopback port: its two names, that port, and nothing else. */
 const loopbackHosts = (port) => [`127.0.0.1:${port}`, `localhost:${port}`];
 /** A change must come from the page at `hosts`: its Origin is one of them. */
@@ -83,7 +88,7 @@ function throughTunnel(req, tunnels, now) {
     const offered = url.searchParams.get("ticket");
     if (offered !== null && (req.method === "GET" || req.method === "HEAD")) {
         url.searchParams.delete("ticket");
-        const location = url.pathname + (url.search || "") + url.hash;
+        const location = sameAddress(url);
         const t = tunnels.find((x) => x.ticket !== null && now < x.ticketUntil && sameSecret(x.ticket, offered));
         if (t !== undefined) {
             t.ticket = null;
@@ -117,7 +122,7 @@ export function guard(req, port, token, tunnels = [], now = Date.now()) {
         if (!sameSecret(offered, token))
             return { ok: false, status: 403, reason: "the token in the URL is not this run's" };
         url.searchParams.delete("token");
-        return { ok: false, status: 303, location: url.pathname + (url.search || "") + url.hash, setCookie: setCookieHeader(token, port) };
+        return { ok: false, status: 303, location: sameAddress(url), setCookie: setCookieHeader(token, port) };
     }
     const cookie = cookieOf(req.cookie, cookieName(port));
     if (cookie === null || !sameSecret(cookie, token)) {