@runeditrun/rer 0.0.0-stage → 0.1.0

package/onboarding/process-scope.mjs

@@ -0,0 +1,118 @@
+import { execFile } from 'node:child_process'
+import { readFile } from 'node:fs/promises'
+import { randomUUID } from 'node:crypto'
+import { promisify } from 'node:util'
+import { setTimeout as delay } from 'node:timers/promises'
+import { inspectionMs, readProcessIdentity, readProcessTable, sameBirth } from './process-table.mjs'
+
+const execute = promisify(execFile)
+const scopes = new WeakMap()
+const baselines = new WeakMap()
+const birthKey = member => `${member.pid}:${member.birth}`
+const marker = 'RER_ONBOARDING_PROCESS_OWNER'
+
+// An exclusive inherited token follows a child through chdir, setsid and
+// reparenting. Shared directory, executable name and process group never grant
+// ownership. Tokens and inspected environments stay private to this module.
+// No process present before this store can have been started by it. This
+// immutable exclusion avoids repeatedly reading foreign environments; it never
+// authorizes signalling a process. Every later match still requires its token.
+export async function createProcessBaseline() {
+  const baseline = Object.freeze({})
+  baselines.set(baseline, new Set((await readProcessTable()).map(birthKey)))
+  return baseline
+}
+export function createProcessScope(baseline, token = randomUUID()) {
+  const scope = Object.freeze({ token })
+  if (baseline && !baselines.has(baseline)) throw new Error('Unknown process baseline.')
+  scopes.set(scope, { excluded: baselines.get(baseline), unmarked: new Map() })
+  return scope
+}
+export function processScopeEnvironment(scope, environment) {
+  if (!scopes.has(scope)) throw new Error('Unknown process scope.')
+  // Nested command stores add custody without erasing their parent's marker.
+  return { ...environment, [marker]: [...new Set([...inheritedScopeTokens(process.env), ...inheritedScopeTokens(environment), scope.token])].join(',') }
+}
+export async function scopedProcesses(scope, table, timeout = inspectionMs, previous = []) {
+  if (!scopes.has(scope)) throw new Error('Unknown process scope.')
+  const inspectionEnd = Date.now() + timeout
+  // Inspect same-user candidates in one bounded call. A child can change cwd,
+  // detach and lose its parent between captures; the exclusive inherited marker
+  // still proves ownership. Arguments/environment never leave this function.
+  // A zombie keeps no environment to read and no descendants (they were reparented
+  // and carry the marker themselves), so it can neither prove nor hold ownership.
+  const { excluded, unmarked } = scopes.get(scope)
+  const liveKeys = new Set(table.map(birthKey))
+  for (const key of unmarked.keys()) if (!liveKeys.has(key)) unmarked.delete(key)
+  // A stable unmarked foreign process cannot inherit a new launch token without
+  // a fork. Known owners (including exec transitions) are always reinspected;
+  // their descendants are independently discovered by ancestry as well.
+  const candidates = table.filter(member => !excluded?.has(birthKey(member))
+    && (!unmarked.has(birthKey(member)) || previous.some(saved => sameBirth(saved, member))) && !member.state?.startsWith('Z')
+    && (member.uid === undefined || member.uid === process.getuid())
+)
+  if (!candidates.length) return []
+  const environments = process.platform === 'linux' ? new Map() : await readEnvironments(candidates.map(member => member.pid), timeout)
+  const matches = []
+  inspectCandidate: for (const member of candidates) {
+    let environment
+    for (;;) {
+      try {
+        if (process.platform === 'linux') environment = await readFile(`/proc/${member.pid}/environ`, { encoding: 'utf8', signal: AbortSignal.timeout(Math.max(1, inspectionEnd - Date.now())) })
+        else environment = environments.get(member.pid)
+        if (environment === undefined) throw new Error('Missing process ownership metadata.')
+        break
+      } catch (error) {
+        // Linux withholds the environment of same-user processes that opted out
+        // of inspection. Actual ancestry remains an independent custody proof.
+        if (process.platform === 'linux' && error?.code === 'EACCES') continue inspectCandidate
+        // Exit may remove environ before stat or the zombie state catches up.
+        // Reconcile the same birth inside this bounded inspection; never treat
+        // a transient read error as foreign ownership or completed cleanup.
+        const current = await readProcessIdentity(member.pid, Math.max(1, inspectionEnd - Date.now()))
+        if (!sameBirth(current, member) || current.state.startsWith('Z')) continue inspectCandidate
+        if (Date.now() < inspectionEnd && (process.platform !== 'linux' || ['ENOENT', 'ESRCH'].includes(error.code))) {
+          // The same live birth is still between images (fork/exec) or being
+          // reaped. Wait for its environment to become readable, up to the
+          // inspection deadline, instead of reading the batch listing once.
+          await delay(5)
+          if (process.platform !== 'linux') for (const [pid, text] of await readEnvironments([member.pid], Math.max(1, inspectionEnd - Date.now()))) environments.set(pid, text)
+          continue
+        }
+        throw new Error(`Could not inspect ownership of process ${member.pid} (${error.code ?? 'missing'}, state ${current.state}).`)
+      }
+    }
+    if (environment.split(/[\0\s]+/).some(value => value.startsWith(marker + '=')
+      && value.slice(marker.length + 1).split(',').includes(scope.token))) matches.push(member)
+    else unmarked.set(birthKey(member), true)
+  }
+  // A recycled PID must not transfer a token reading to its successor. PGID may
+  // legitimately change, so follow the same birth identity across that change.
+  // The caller rechecks each match's full PID/start/command identity.
+  return matches
+}
+
+// macOS exposes a process environment only through ps. One bounded call lists
+// every candidate; a process that vanishes or is between images yields no line
+// or an empty command, and callers wait for that same birth rather than guess.
+async function readEnvironments(pids, timeout) {
+  let stdout
+  try {
+    ({ stdout } = await execute('/bin/ps', ['eww', '-p', pids.join(','), '-o', 'pid=', '-o', 'command='], { timeout, maxBuffer: 16 * 1024 * 1024 }))
+  } catch (error) {
+    // ps may lose a candidate while it enumerates. Keep partial private output
+    // only for that exit code; each missing identity is checked by the caller.
+    if (error.code === 1 && typeof error.stdout === 'string') stdout = error.stdout
+    else throw new Error('Could not inspect scoped process ownership.')
+  }
+  const environments = new Map()
+  for (const line of stdout.split('\n')) {
+    const match = line.match(/^\s*(\d+)\s+(.+)$/)
+    if (match) environments.set(Number(match[1]), match[2])
+  }
+  return environments
+}
+
+export function inheritedScopeTokens(environment) {
+  return String(environment?.[marker] ?? '').split(',').filter(value => /^[0-9a-f]{8}(?:-[0-9a-f]{4}){3}-[0-9a-f]{12}$/i.test(value))
+}

package/onboarding/process-table.mjs

@@ -0,0 +1,118 @@
+import { execFile } from 'node:child_process'
+import { readFile, readdir, stat } from 'node:fs/promises'
+import { promisify } from 'node:util'
+import { setTimeout as delay } from 'node:timers/promises'
+
+const execute = promisify(execFile)
+// One bounded wait for any process inspection; a loaded machine can take over a
+// second to list processes, which must not abort an otherwise healthy cleanup.
+export const inspectionMs = 5000
+export const validPid = (pid) => Number.isSafeInteger(pid) && pid > 0 && pid <= 0x7fffffff
+
+// Inspect numeric identity and the executable name, never private argv.
+// Linux's start ticks distinguish recycled PIDs more precisely than ps lstart.
+async function linuxProcess(pid, pgid, signal) {
+  for (;;) {
+    signal.throwIfAborted()
+    let text
+    try { text = await readFile(`/proc/${pid}/stat`, { encoding: 'utf8', signal }) } catch (error) {
+      if (error.code === 'ENOENT' || error.code === 'ESRCH') return
+      throw error
+    }
+    const group = pgid ?? Number(text.slice(text.lastIndexOf(')') + 2).trim().split(/\s+/)[2])
+    if (pgid === undefined && group === 0) return // Kernel tasks cannot belong to an owned detached group.
+    let member
+    try { member = parseLinuxProcess(pid, group, text) } catch {
+      // Procfs may finish an already-open read while its task is exiting or
+      // replacing its thread leader. An invalid snapshot never grants identity:
+      // reconcile this same PID until valid, gone, or the inspection aborts.
+      await delay(5, undefined, { signal }); continue
+    }
+    if (!member) return
+    try { return { ...member, uid: (await stat(`/proc/${pid}`)).uid } }
+    catch (error) { if (error.code === 'ENOENT' || error.code === 'ESRCH') return; throw error }
+  }
+}
+
+export function parseLinuxProcess(pid, pgid, text) {
+  if (!validPid(pid) || !validPid(pgid) || !text.startsWith(`${pid} (`) || !text.includes(') ')) {
+    throw new Error('Invalid process identity.')
+  }
+  const fields = text.slice(text.lastIndexOf(')') + 2).trim().split(/\s+/)
+  const ppid = Number(fields[1])
+  if (Number(fields[2]) !== pgid) return
+  if (!Number.isSafeInteger(ppid) || ppid < 0 || !/^\d+$/.test(fields[19])) {
+    throw new Error('Invalid process identity.')
+  }
+  return { pid, ppid, pgid, state: fields[0], birth: fields[19], command: text.slice(text.indexOf('(') + 1, text.lastIndexOf(')')) }
+}
+
+async function processGroup(pgid, signal) {
+  if (process.platform === 'linux') {
+    // Minimal Linux containers need not install ps. Procfs provides exact
+    // start ticks and includes zombies until their actual parent reaps them.
+    const pids = (await readdir('/proc')).filter((name) => /^\d+$/.test(name)).map(Number).filter(validPid)
+    const group = []
+    for (let offset = 0; offset < pids.length; offset += 16) {
+      signal.throwIfAborted()
+      const members = await Promise.all(pids.slice(offset, offset + 16).map((pid) => linuxProcess(pid, pgid, signal)))
+      group.push(...members.filter(Boolean))
+    }
+    return group
+  }
+  const { stdout } = await execute('/bin/ps', [
+    '-ax', '-o', 'pid=', '-o', 'ppid=', '-o', 'pgid=', '-o', 'uid=', '-o', 'stat=', '-o', 'lstart=',
+  ], { env: { ...process.env, LC_ALL: 'C', TZ: 'UTC' }, signal, killSignal: 'SIGKILL', maxBuffer: 8 * 1024 * 1024 })
+  const group = []
+  for (const line of stdout.split('\n').filter((line) => line.trim())) {
+    const match = line.match(/^\s*(\d+)\s+(\d+)\s+(\d+)\s+(\d+)\s+(\S+)\s+(.{24})\s*$/)
+    if (!match) throw new Error('Could not read process identities.')
+    const [, id, parent, groupId, uid, state, birth] = match
+    const pid = Number(id)
+    const ppid = Number(parent)
+    if (pgid === undefined && (pid === 0 || Number(groupId) === 0)) continue
+    if (pgid !== undefined && Number(groupId) !== pgid) continue
+    if (!validPid(pid) || !validPid(Number(groupId)) || !Number.isSafeInteger(ppid) || ppid < 0 || !Number.isFinite(Date.parse(birth))) {
+      throw new Error('Invalid process identity.')
+    }
+    group.push({ pid, ppid, pgid: Number(groupId), uid: Number(uid), state, birth })
+  }
+  return group
+}
+
+// Executable inspection is limited to owned candidates. Asking macOS ps for
+// comm across every user process invokes expensive argv lookups and can make
+// cleanup slower than the existing bounded shutdown contract.
+export async function readProcessIdentity(pid, timeout = inspectionMs) {
+  if (!validPid(pid) || !(timeout > 0)) throw new Error('Invalid process identity deadline.')
+  if (process.platform === 'linux') return linuxProcess(pid, undefined, AbortSignal.timeout(timeout))
+  let stdout
+  try {
+    ({ stdout } = await execute('/bin/ps', ['-p', String(pid), '-o', 'pid=', '-o', 'ppid=', '-o', 'pgid=', '-o', 'uid=', '-o', 'stat=', '-o', 'lstart=', '-o', 'comm='],
+      { env: { ...process.env, LC_ALL: 'C', TZ: 'UTC' }, timeout, killSignal: 'SIGKILL', maxBuffer: 1024 * 1024 }))
+  } catch (error) { if (error.code === 1 && !error.stdout?.trim()) return; throw new Error('Could not inspect process identity.') }
+  const match = stdout.match(/^\s*(\d+)\s+(\d+)\s+(\d+)\s+(\d+)\s+(\S+)\s+(.{24})\s+(.+?)\s*$/)
+  if (!match) throw new Error('Invalid process identity.')
+  const [, id, parent, groupId, uid, state, birth, command] = match
+  if (Number(id) !== pid || !validPid(Number(groupId)) || !Number.isFinite(Date.parse(birth + ' UTC'))) throw new Error('Invalid process identity.')
+  return { pid, ppid: Number(parent), pgid: Number(groupId), uid: Number(uid), state, birth, command }
+}
+
+export async function readProcessTable(timeout = inspectionMs, pgid) {
+  if (!(timeout > 0)) throw new Error('Process inspection deadline expired.')
+  const controller = new AbortController()
+  let timer
+  try {
+    return await Promise.race([processGroup(pgid, controller.signal), new Promise((_, reject) => {
+      timer = setTimeout(() => {
+        controller.abort()
+        reject(new Error('Process inspection deadline expired.'))
+      }, timeout)
+    })])
+  } finally { clearTimeout(timer) }
+}
+
+export const sameBirth = (left, right) => validPid(left?.pid) && left.pid === right?.pid && left.birth === right?.birth
+
+export const sameProcess = (left, right) => validPid(left?.pid) && left?.pid === right?.pid
+  && left?.birth === right?.birth && left?.command === right?.command

package/onboarding/process-tree.mjs

@@ -0,0 +1,36 @@
+import { scopedProcesses } from './process-scope.mjs'
+import { inspectionMs, readProcessIdentity, readProcessTable, sameBirth, sameProcess, validPid } from './process-table.mjs'
+
+// Retain PID/start/command identities after close. An exclusive inherited marker
+// recovers descendants after reparenting; group membership and cwd never grant
+// ownership. Inspect executable identity only for actual custody candidates.
+export async function readOwnedTree(child, previous = [], timeout = inspectionMs, scope = previous.scope) {
+  if (!validPid(child.pid)) throw new Error('Invalid owned process tree.')
+  const table = await readProcessTable(timeout)
+  const candidates = table.filter(member => previous.some(saved => sameBirth(member, saved)))
+  let owned = (await Promise.all(candidates.map(member => readProcessIdentity(member.pid, timeout))))
+    .filter(member => member && previous.some(saved => sameProcess(member, saved)))
+  if (scope) {
+    for (const member of await scopedProcesses(scope, table, timeout, previous)) {
+      if (owned.some(saved => sameBirth(saved, member))) continue
+      const live = await readProcessIdentity(member.pid, timeout)
+      if (sameBirth(member, live) && !owned.some(saved => sameProcess(saved, live))) owned.push(live)
+    }
+  } else if (!previous.length && child.exitCode == null && child.signalCode == null) {
+    const leader = await readProcessIdentity(child.pid, timeout)
+    if (!leader || leader.ppid !== process.pid) throw new Error('Could not establish owned process tree identity.')
+    owned = [leader]
+  }
+  let changed
+  do {
+    changed = false
+    for (const member of table) {
+      if (owned.some(saved => sameBirth(saved, member))) continue
+      if (!owned.some(parent => parent.pid === member.ppid)) continue
+      const live = await readProcessIdentity(member.pid, timeout)
+      if (sameBirth(member, live) && owned.some(parent => parent.pid === live.ppid)) { owned.push(live); changed = true }
+    }
+  } while (changed)
+  Object.defineProperty(owned, 'scope', { value: scope })
+  return owned
+}

package/onboarding/production-modules.mjs

@@ -0,0 +1,22 @@
+import { readdir } from 'node:fs/promises';
+import { dirname, join, relative, resolve } from 'node:path';
+
+// Vite has already emitted the complete Worker module graph. Miniflare 5
+// requires explicit modules; use its own rule compiler for Wrangler's rules.
+export async function productionModules(main, rules, {compileModuleRules,testRegExps}) {
+ const root=dirname(main),compiled=compileModuleRules(rules);
+ const modules=[{type:'ESModule',path:main}];
+ async function visit(directory){
+  for(const entry of (await readdir(directory,{withFileTypes:true})).sort((a,b)=>a.name.localeCompare(b.name))){
+   const path=join(directory,entry.name);
+   if(entry.isSymbolicLink())throw Error('Production modules must be regular output files.');
+   if(entry.isDirectory())await visit(path);
+   else if(entry.isFile()&&resolve(path)!==resolve(main)){
+    const name=relative(root,path).split('\\').join('/');
+    const rule=compiled.find(rule=>testRegExps(rule.include,name));
+    if(rule)modules.push({type:rule.type,path});
+   }
+  }
+ }
+ await visit(root);return {modulesRoot:root,modules};
+}

package/onboarding/production-options.mjs

@@ -0,0 +1,40 @@
+import {createRequire} from 'node:module';
+import {realpath} from 'node:fs/promises';
+import {resolve} from 'node:path';
+import {readSettings} from './adapter-settings.mjs';
+import {productionModules} from './production-modules.mjs';
+
+// The project's own Miniflare, found through its pinned Wrangler without
+// loading Wrangler: serving needs only Miniflare, and loading Wrangler as well
+// keeps tens of megabytes resident for the whole session.
+export async function projectMiniflare(root){
+ return createRequire(await realpath(resolve(root,'node_modules/wrangler/package.json')))('miniflare');
+}
+
+// Runs once, in a short-lived process (production-plan.mjs): the pinned Wrangler
+// converter supplies real bindings/assets/migrations, and the result is plain
+// data for the serving process to hand to Miniflare.
+export async function productionPlan(root,origin,port,host='127.0.0.1'){
+ const require=createRequire(await realpath(resolve(root,'node_modules/wrangler/package.json')));
+ const {unstable_getMiniflareWorkerOptions,unstable_readConfig}=require('wrangler');
+ const miniflare=require('miniflare');
+ const config=unstable_readConfig({config:resolve(root,'dist/server/wrangler.json')});
+ const selected=unstable_getMiniflareWorkerOptions(config);
+ const vars=(await readSettings(root,{file:'.dev.vars'})).values;
+ const {modulesRules,...workerOptions}=selected.workerOptions;
+ const worker={...workerOptions,name:config.name,...await productionModules(selected.main,modulesRules,miniflare),
+  bindings:{...workerOptions.bindings,...vars,[process.env.RER_ORIGIN_KEY ?? 'AUTH_ORIGIN']:origin,RER_DEV_ORIGIN:origin,...(process.env.RER_DEV_KEY?{RER_DEV_KEY:process.env.RER_DEV_KEY}:{})}};
+ // No Local Explorer, and trigger handlers only when the project declares Cron Triggers and rer preview runs them (RER_RUNTIME_TRIGGERS):
+ // rer's scheduler calls this internal loopback port, and the public proxy answers 404 for /cdn-cgi/*.
+ return {host,port,unsafeTriggerHandlers:process.env.RER_RUNTIME_TRIGGERS==='1',unsafeLocalExplorer:false,workers:[worker,...selected.externalWorkers]};
+}
+
+// JSON drops functions and flattens buffers, patterns and maps without a word.
+// A plan that would change on its way to the serving process is refused.
+export function serializePlan(plan){
+ return JSON.stringify(plan,function(key,value){
+  const original=this[key],kind=typeof original==='object'&&original!==null?Object.getPrototypeOf(original)?.constructor?.name:typeof original;
+  if(['function','bigint','symbol','Uint8Array','Buffer','ArrayBuffer','Map','Set','RegExp'].includes(kind))throw Error(`The Worker configuration holds a ${kind} at "${key}" that cannot be passed to the preview runtime.`);
+  return value;
+ });
+}

package/onboarding/production-plan.mjs

@@ -0,0 +1,8 @@
+import {productionPlan,serializePlan} from './production-options.mjs';
+
+// Short-lived: resolves the Worker's Miniflare options with Wrangler and writes
+// them as JSON to stdout, a pipe only the starting runtime reads. The plan holds
+// private settings, so it is never written to a file or an argument.
+if(process.env.RER_ORIGIN_KEY && !/^[A-Z][A-Z0-9_]*$/.test(process.env.RER_ORIGIN_KEY))throw Error('Invalid local origin setting name');
+const plan=await productionPlan(process.cwd(),process.env.RER_DEV_ORIGIN,Number(process.env.RER_RUNTIME_PORT),process.env.RER_RUNTIME_HOST);
+await new Promise((done,fail)=>process.stdout.write(serializePlan(plan),error=>error?fail(error):done()));

package/onboarding/production-runtime.mjs

@@ -0,0 +1,30 @@
+import {spawn} from 'node:child_process';
+import {fileURLToPath} from 'node:url';
+import {resolve} from 'node:path';
+import {projectMiniflare} from './production-options.mjs';
+
+// Preview's resident process. Wrangler resolves the Worker's options in a
+// short-lived child that exits before serving starts; this process then holds
+// only the pinned Miniflare, which owns one workerd and no bundler or
+// file/config watcher.
+let planner,stopping,runtime;
+const stop=()=>stopping??=(async()=>{planner?.kill('SIGTERM');await runtime?.dispose();})();
+process.on('SIGINT',()=>void stop());process.on('SIGTERM',()=>void stop());
+async function plan(){
+ let text='';
+ planner=spawn(process.execPath,[fileURLToPath(new URL('./production-plan.mjs',import.meta.url))],{cwd:process.cwd(),env:process.env,stdio:['ignore','pipe','inherit']});
+ planner.stdout.setEncoding('utf8').on('data',chunk=>{text+=chunk;});
+ const code=await new Promise((done,fail)=>{planner.once('error',fail);planner.once('close',done);});
+ if(stopping)return undefined;
+ if(code!==0)throw Error('Resolving the Worker configuration failed.');
+ return JSON.parse(text);
+}
+try{
+ const options=await plan();
+ if(options){
+  const {Miniflare,convertV4MiniflareOptions}=await projectMiniflare(process.cwd());
+  runtime=new Miniflare({...convertV4MiniflareOptions(options),resourcePersistencePath:resolve(process.cwd(),'.wrangler/state/v3')});
+  if(stopping)await runtime.dispose();
+  else await runtime.ready;
+ }
+}catch(error){await stop();throw error;}

package/onboarding/project-vite.mjs

@@ -0,0 +1,14 @@
+import {createRequire} from 'node:module';
+import {readFileSync} from 'node:fs';
+import {dirname,join,resolve} from 'node:path';
+
+// The project's own vite entry file, so `dev` runs node on it directly instead
+// of through `pnpm exec`, which keeps a 50-100 MB wrapper process alive for the
+// whole session.
+export function projectViteBinary(root){
+ let manifest;
+ try{manifest=createRequire(join(resolve(root),'package.json')).resolve('vite/package.json');}
+ catch{throw new Error('The project\'s vite is not installed. Run rer install first.');}
+ const bin=JSON.parse(readFileSync(manifest,'utf8')).bin;
+ return join(dirname(manifest),typeof bin==='string'?bin:bin.vite);
+}