@runeditrun/rer 0.1.0 → 0.2.0

package/cli/server-registry.mjs

@@ -55,12 +55,13 @@ function memoryMessage(counted,available,floor,mode) {
  const list=counted.length?`Running now:\n${counted.map(listing).join('\n')}\nA dev server holds about 0.5-1.3 GiB and a preview 0.4-0.8 GiB; stopping one with its command above frees that.`:'No dev or preview server is running, so something else is using the memory.';
  return `${head}\n${list}\nTo start anyway, lower the floor, for example RER_SERVERS_MIN_MEMORY_BYTES=${Math.floor(floor/2)} rer ${mode} (0 turns it off).`;
 }
-function limitMessage(counted,cap,limit,mode) {
- const holders=cap<limit?counted.filter(item=>item.explicit&&item.limit===cap):[];
+function limitMessage(counted,cap,explicit,mode) {
+ const holders=explicit?[]:counted.filter(item=>item.explicit&&item.limit===cap);
  const head=`Not started: ${counted.length} dev or preview ${counted.length===1?'server is':'servers are'} running on this computer and the limit is ${cap}.`;
  const list=`Running now:\n${counted.map(listing).join('\n')}`;
  const raise=holders.length
   ?`The limit is ${cap} because ${holders.length===1?'a server was':'servers were'} started with RER_SERVER_LIMIT=${cap} (${holders.map(item=>item.checkout).join(', ')}). Stop ${holders.length===1?'it':'them'} and start again, or start everything with a higher RER_SERVER_LIMIT=N.`
+  :explicit?`This start set RER_SERVER_LIMIT=${cap}; to allow more, start it with a higher RER_SERVER_LIMIT=N.`
   :`To allow more, start this one with a higher limit, for example RER_SERVER_LIMIT=${cap*2} rer ${mode}. Servers started without RER_SERVER_LIMIT allow ${defaultServerLimit}.`;
  return `${head}\n${list}\nTo make room, stop one with its command above. ${raise}`;
 }
@@ -71,9 +72,11 @@ function limitMessage(counted,cap,limit,mode) {
 // before queue admission/local operation. Stop waits for process+state cleanup,
 // which never needs the machine transaction. Generation removal happens last.
 // The limit is 10 unless the person sets RER_SERVER_LIMIT. Every record keeps the
-// limit it started with and whether the person set it. Across the running
-// servers the cap is the lowest limit a person set explicitly, so a deliberate
-// "RER_SERVER_LIMIT=3" keeps holding every start. A recorded default (including
+// limit it started with and whether the person set it. A start that sets
+// RER_SERVER_LIMIT is capped by that value alone, higher or lower than any
+// running server's. A start that sets nothing is capped by the lowest limit a
+// running server's person set explicitly, so a deliberate "RER_SERVER_LIMIT=3"
+// keeps holding starts that do not say otherwise. A recorded default (including
 // the old default of 2 in records written before this rule) never lowers the cap
 // below the current default.
 export const defaultServerLimit=serverDefaults.serverLimit;
@@ -132,8 +135,8 @@ export async function serverRegistry(root,{env=process.env,memory=availableMemor
    const same=state.running.find(item=>item.checkout===checkout);
    if(same)return {existing:same};
    // Journeys are listed but uncounted: they neither use nor lower the cap.
-   const counted=state.running.filter(item=>!item.journey),cap=Math.min(limit,...counted.filter(item=>item.explicit).map(item=>item.limit));
-   if(!journey&&counted.length>=cap)throw refuse(limitMessage(counted,cap,limit,mode));
+   const counted=state.running.filter(item=>!item.journey),cap=explicit?limit:Math.min(limit,...counted.filter(item=>item.explicit).map(item=>item.limit));
+   if(!journey&&counted.length>=cap)throw refuse(limitMessage(counted,cap,explicit,mode));
    // Unreadable memory is not a reason to refuse; only a reading below the floor is.
    const available=journey||floor===0?NaN:await memory();
    if(available<floor)throw refuse(memoryMessage(counted,available,floor,mode));
@@ -167,11 +170,16 @@ export async function serverRegistry(root,{env=process.env,memory=availableMemor
   throw refuse('The existing server is still starting. Wait for its ready output.');
  }
  return {checkout,existing,stop,reserve,serve,update,updateActivity,waitReady,custodyToken:()=>owned?.token,
+  // The sockets close even when the record cannot be removed (its registry
+  // deleted under it, say): an open listener would keep this process alive.
   close(){return closing??=(async()=>{
-   if(owned)await change(state=>{state.running=state.running.filter(item=>item.generation!==owned.generation);});
-   if(control)await new Promise(resolve=>control.close(resolve));
-   if(owned)await unlink(owned.control).catch(error=>{if(error.code!=='ENOENT')throw error;});
-   await lifetime.close();
+   try{if(owned)await change(state=>{state.running=state.running.filter(item=>item.generation!==owned.generation);});}
+   finally{
+    try{
+     if(control)await new Promise(resolve=>control.close(resolve));
+     if(owned)await unlink(owned.control).catch(error=>{if(error.code!=='ENOENT')throw error;});
+    }finally{await lifetime.close();}
+   }
   })();}
  };
 }

package/cli/settings.mjs

@@ -1,3 +1,6 @@
+import { missing } from './errors.mjs';
+import { shared } from './shared.mjs';
+
 // Reuse the seed's existing declarations; no parallel auth setting aliases.
 export function localSettingKeys(project) {
  const manifest = project.setupManifest ?? project.setupSeed?.manifest;
@@ -13,3 +16,14 @@ export function requiredLocalSettings(project, values) {
  const manifest=project.setupManifest ?? project.setupSeed?.manifest;
  return [...new Set([keys.email,keys.origin,...(manifest?.fields??[]).filter(field=>field.kind==='secret'&&field.required&&!field.when&&field.input!=='entered'&&field.name!==manifest?.steps.find(step=>step.type==='owner-claim')?.tokenField).map(field=>field.name)])].filter(name=>!values[name]);
 }
+
+// The CLI's own proof to the running application, keyed by the session secret
+// in the seed's private settings: its declared file and format, under the name
+// its adapter declares as sessionSecretKey (default SESSION_SECRET).
+export async function localCliSessionProof(project) {
+ const hooks = project.adapter?.hooks ?? {}, key = hooks.sessionSecretKey ?? 'SESSION_SECRET';
+ const { readSettings } = await shared('adapter-settings.mjs'), { localCliProof } = await shared('adapter-auth.mjs');
+ const secret = (await readSettings(project.root, hooks.secrets ?? {})).values[key];
+ if (typeof secret !== 'string' || !secret) throw missing(`${key} is missing from the private settings.`);
+ return localCliProof(secret);
+}

package/cli/site-check.mjs

@@ -0,0 +1,96 @@
+import { lstat, readdir, readFile } from 'node:fs/promises';
+import { join, posix } from 'node:path';
+import { refuse } from './errors.mjs';
+import { DEV_AI_MARKER, DEV_LAYER_MARKER } from './dev-identity.mjs';
+
+// What a run site may hold: static pages and the files they use, served as
+// Cloudflare static assets with default HTML handling. Never server code,
+// Wrangler configuration, migrations, settings, local data or owner data.
+const FORBIDDEN = /^(?:wrangler\.(?:json|jsonc|toml)|_worker\.js|_routes\.json|_headers|_redirects|.*\.(?:sql|rer|db|sqlite|sqlite3|env|map))$/i;
+// Routes that exist only on an installed instance.
+export const INSTANCE_ROUTES = ['/signin', '/sign-in', '/login', '/setup', '/app', '/auth', '/api', '/__dev', '/health', '/.well-known'];
+const MAX_FILE = 25 * 1024 * 1024, MAX_FILES = 20000;
+
+/** Every file, as a site path ("run.html") with its bytes. */
+async function files(folder) {
+ const found = new Map();
+ async function walk(directory, prefix) {
+  for (const name of (await readdir(directory)).sort()) {
+   const path = join(directory, name), site = prefix + name, status = await lstat(path);
+   if (name.startsWith('.')) throw refuse(`The run site holds a hidden file: ${site}. It contains only public pages and their files.`);
+   if (status.isSymbolicLink() || (!status.isFile() && !status.isDirectory())) throw refuse(`The run site holds a link or special file: ${site}.`);
+   if (status.isDirectory()) { await walk(path, site + '/'); continue; }
+   if (FORBIDDEN.test(name)) throw refuse(`The run site holds ${site}, which is not a static page or asset. Server code, configuration, migrations and data never go in it.`);
+   if (status.size > MAX_FILE) throw refuse(`The run site file ${site} is larger than 25 MiB.`);
+   found.set(site, await readFile(path));
+   if (found.size > MAX_FILES) throw refuse('The run site holds more than 20,000 files.');
+  }
+ }
+ await walk(folder, '');
+ return found;
+}
+
+const safeDecode = path => { try { return decodeURI(path); } catch { return path; } };
+
+/** How Cloudflare's static assets (auto-trailing-slash) answer a path, or null. */
+export function servedFile(names, pathname) {
+ const path = pathname.replace(/^\/+/, '');
+ if (!path) return names.has('index.html') ? 'index.html' : null;
+ if (names.has(path) && !path.endsWith('.html')) return path;
+ const bare = path.replace(/\/$/, '');
+ if (names.has(`${bare}.html`)) return `${bare}.html`;
+ if (names.has(`${bare}/index.html`)) return `${bare}/index.html`;
+ return null;
+}
+
+// href/src attributes, srcset candidates and CSS url() references.
+function references(text, html) {
+ const found = [];
+ if (html) {
+  for (const match of text.matchAll(/<([a-z][a-z0-9-]*)\b([^>]*)>/gi)) {
+   const [, tag, attributes] = match, rel = /\brel\s*=\s*["']?([^"'>]*)/i.exec(attributes)?.[1].toLowerCase() ?? '';
+   for (const attribute of attributes.matchAll(/\b(href|src|srcset|action|poster|data)\s*=\s*(?:"([^"]*)"|'([^']*)')/gi)) {
+    const name = attribute[1].toLowerCase(), value = (attribute[2] ?? attribute[3]).replace(/&amp;/g, '&');
+    const values = name === 'srcset' ? value.split(',').map(part => part.trim().split(/\s+/)[0]).filter(Boolean) : [value];
+    // Only a plain link or a page anchor navigates; everything else is fetched by the page.
+    const navigates = name === 'href' && (tag.toLowerCase() === 'a' || tag.toLowerCase() === 'area' || (tag.toLowerCase() === 'link' && /\b(?:canonical|alternate|author|license|help|me)\b/.test(rel)));
+    for (const url of values) found.push({ url, navigates });
+   }
+  }
+ }
+ for (const match of text.matchAll(/url\(\s*(?:"([^"]*)"|'([^']*)'|([^)\s]*))\s*\)/gi)) found.push({ url: match[1] ?? match[2] ?? match[3], navigates: false });
+ return found;
+}
+
+/**
+ * Refuse a run site folder that is not exactly static pages and the files they
+ * use: an index and a Run page, every same-origin link resolving, no link to an
+ * instance-only route, nothing fetched from another origin, no dev layer, and
+ * none of the given private values (owner identity, secrets, the dev key).
+ */
+export async function checkSite(folder, { privateValues = [] } = {}) {
+ const all = await files(folder), names = new Set(all.keys());
+ if (!names.has('index.html')) throw refuse('The run site has no index.html (its homepage).');
+ if (!servedFile(names, '/run')) throw refuse('The run site has no /run page.');
+ const markers = [DEV_LAYER_MARKER, DEV_AI_MARKER].map(value => Buffer.from(value));
+ const secrets = privateValues.filter(value => typeof value === 'string' && value.length >= 6).map(value => Buffer.from(value));
+ const problems = [];
+ for (const [site, bytes] of all) {
+  if (markers.some(marker => bytes.includes(marker))) throw refuse(`The run site file ${site} contains the local-only dev layer.`);
+  if (secrets.some(secret => bytes.includes(secret))) throw refuse(`The run site file ${site} contains this installation's private data (owner identity or a secret). The run site renders only edition identity.`);
+  const html = site.endsWith('.html'), css = site.endsWith('.css');
+  if (!html && !css) continue;
+  for (const { url, navigates } of references(bytes.toString('utf8'), html)) {
+   if (!url || /^(?:#|mailto:|tel:|data:|javascript:void)/i.test(url)) continue;
+   if (/^(?:[a-z][a-z0-9+.-]*:|\/\/)/i.test(url)) {
+    if (!navigates) problems.push(`${site} fetches ${url} from another origin`);
+    continue;
+   }
+   const pathname = posix.resolve('/' + posix.dirname(site), url.replace(/[?#].*$/, ''));
+   if (INSTANCE_ROUTES.some(route => pathname === route || pathname.startsWith(route + '/'))) problems.push(`${site} links to ${pathname}, which exists only on an installed instance`);
+   else if (!servedFile(names, safeDecode(pathname))) problems.push(`${site} links to ${pathname}, which the site does not have`);
+  }
+ }
+ if (problems.length) throw refuse(`The run site has broken or out-of-site references: ${problems.slice(0, 8).join('; ')}${problems.length > 8 ? `; and ${problems.length - 8} more` : ''}.`);
+ return { files: names.size, pages: [...names].filter(name => name.endsWith('.html')).length };
+}

package/cli/site-preview.mjs

@@ -0,0 +1,53 @@
+import { createServer } from 'node:http';
+import { readdir, readFile, lstat } from 'node:fs/promises';
+import { extname, join } from 'node:path';
+import { servedFile } from './site-check.mjs';
+
+const types = { '.html': 'text/html; charset=utf-8', '.css': 'text/css; charset=utf-8', '.js': 'text/javascript; charset=utf-8', '.mjs': 'text/javascript; charset=utf-8', '.json': 'application/json', '.svg': 'image/svg+xml', '.png': 'image/png', '.jpg': 'image/jpeg', '.jpeg': 'image/jpeg', '.webp': 'image/webp', '.avif': 'image/avif', '.gif': 'image/gif', '.ico': 'image/x-icon', '.woff2': 'font/woff2', '.woff': 'font/woff', '.ttf': 'font/ttf', '.otf': 'font/otf', '.txt': 'text/plain; charset=utf-8', '.xml': 'application/xml', '.webmanifest': 'application/manifest+json' };
+
+async function names(folder) {
+ const found = new Set();
+ async function walk(directory, prefix) {
+  for (const entry of await readdir(directory, { withFileTypes: true })) {
+   if (entry.isDirectory()) await walk(join(directory, entry.name), prefix + entry.name + '/');
+   else if (entry.isFile()) found.add(prefix + entry.name);
+  }
+ }
+ await walk(folder, '');
+ return found;
+}
+
+/**
+ * Serve a built run site on loopback the way Cloudflare's static assets serve
+ * it (auto-trailing-slash HTML handling, 404.html for a missing path): the
+ * preview `rer dev` prints as RER_SITE. GET and HEAD only; nothing else is read.
+ */
+export async function sitePreview(folder, { host = '127.0.0.1', ports }) {
+ const server = createServer(async (request, response) => {
+  try {
+   if (!['GET', 'HEAD'].includes(request.method)) { response.writeHead(405, { allow: 'GET, HEAD' }); return response.end(); }
+   const url = new URL(request.url, 'http://site.invalid'), files = await names(folder);
+   let pathname; try { pathname = decodeURIComponent(url.pathname); } catch { pathname = '/'; }
+   // A request for page.html is answered at its canonical path, as the host does.
+   if (pathname.endsWith('.html') && files.has(pathname.slice(1))) {
+    const canonical = pathname.endsWith('/index.html') || pathname === '/index.html' ? pathname.slice(0, -'index.html'.length) : pathname.slice(0, -'.html'.length);
+    response.writeHead(307, { location: canonical + url.search }); return response.end();
+   }
+   const file = pathname.includes('\0') || pathname.split('/').some(part => part === '..' || part.startsWith('.')) ? null : servedFile(files, pathname);
+   const target = file ?? (files.has('404.html') ? '404.html' : null);
+   if (!target || !(await lstat(join(folder, target))).isFile()) { response.writeHead(404, { 'content-type': 'text/plain; charset=utf-8' }); return response.end('Not found'); }
+   const body = await readFile(join(folder, target));
+   response.writeHead(file ? 200 : 404, { 'content-type': types[extname(target).toLowerCase()] ?? 'application/octet-stream', 'cache-control': 'no-store', 'content-length': body.length });
+   response.end(request.method === 'HEAD' ? undefined : body);
+  } catch { if (!response.headersSent) response.writeHead(500); response.end(); }
+ });
+ for (const port of ports) {
+  const bound = await new Promise(resolve => {
+   const failed = () => resolve(false);
+   server.once('error', failed);
+   server.listen(port, host, () => { server.off('error', failed); resolve(true); });
+  });
+  if (bound) return { url: `http://${host === '::1' ? '[::1]' : host}:${port}`, port, close: () => new Promise(resolve => { server.closeAllConnections?.(); server.close(() => resolve()); }) };
+ }
+ throw new Error('No free port for the run site preview.');
+}

package/cli/site-render.mjs

@@ -0,0 +1,77 @@
+#!/usr/bin/env node
+// Child of `rer build --site` and `rer dev`: builds the seed's declared site
+// entry with the checkout's own Vite for Node (an SSR build), loads it and
+// calls its sitePages({ styles }), then writes the static run site: "/" to
+// index.html, "/run" to run.html, "/docs/a" to docs/a.html, "/404" to
+// 404.html, the declared public files, and the stylesheet and files the
+// entry's CSS imports compile to. The optional site config is a Vite config
+// naming the plugins the site pages need (a docs virtual module, a CSS
+// toolchain); the app's own Vite config is never loaded, because its Worker
+// plugins do not run in Node. It reads no installation data.
+// Usage: node site-render.mjs ROOT ENTRY OUTPUT [CONFIG]
+import { cp, lstat, mkdir, rm, writeFile } from 'node:fs/promises';
+import { createRequire } from 'node:module';
+import { dirname, join, resolve, sep } from 'node:path';
+import { pathToFileURL } from 'node:url';
+
+const [root, entry, output, config] = process.argv.slice(2);
+const fail = message => { process.stderr.write(`${message}\n`); process.exit(2); };
+if (!root || !entry || !output) fail('Usage: site-render.mjs ROOT ENTRY OUTPUT [CONFIG]');
+const inside = (base, path) => { const target = resolve(base, path); return target === base || target.startsWith(base + sep) ? target : null; };
+// Compiled CSS and the files it references land under this folder of the site.
+const ASSETS = 'site-assets';
+
+let vite;
+try { vite = await import(pathToFileURL(createRequire(join(root, 'package.json')).resolve('vite')).href); }
+catch { fail('The run site renders with the checkout\'s own Vite. Run rer install first.'); }
+process.env.NODE_ENV ??= 'production';
+
+// The Node bundle sits beside the output, inside the checkout, so its external
+// imports resolve from the checkout's node_modules. It never enters the site.
+const server = `${output}.render`;
+let module, styles = [], files = [];
+try {
+ const built = await vite.build({
+  root, configFile: config ? resolve(root, config) : false, envFile: false, logLevel: 'error', mode: 'production',
+  build: {
+   ssr: resolve(root, entry), outDir: server, emptyOutDir: true, copyPublicDir: false, ssrEmitAssets: true,
+   cssCodeSplit: false, assetsDir: ASSETS, sourcemap: false, minify: false, reportCompressedSize: false, watch: null,
+  },
+ }).catch(error => fail(`The run site entry ${entry} did not build: ${error.message.split('\n')[0]}${config ? '' : ' If its pages need Vite plugins (a docs virtual module, a CSS toolchain), name a site Vite config: site: { config } in the command adapter.'}`));
+ const outputs = (Array.isArray(built) ? built : [built]).flatMap(result => result.output ?? []);
+ const chunk = outputs.find(item => item.type === 'chunk' && item.isEntry);
+ if (!chunk) fail(`The run site entry ${entry} produced no module.`);
+ files = outputs.filter(item => item.type === 'asset' && item.fileName.startsWith(`${ASSETS}/`)).map(item => item.fileName);
+ styles = files.filter(name => name.endsWith('.css')).map(name => `/${name}`);
+ await writeFile(join(server, 'package.json'), '{"type":"module"}\n');
+ module = await import(pathToFileURL(join(server, chunk.fileName)).href);
+ if (typeof module.sitePages !== 'function') fail(`${entry} must export sitePages(), returning { pages: [{ path, html }], assets: [public paths] }.`);
+ const build = await module.sitePages({ styles });
+ if (!Array.isArray(build?.pages) || !Array.isArray(build.assets)) fail('sitePages() returns { pages, assets }.');
+
+ const written = new Set();
+ for (const page of build.pages) {
+  if (typeof page?.path !== 'string' || !/^\/(?:[a-z0-9][a-z0-9._-]*(?:\/[a-z0-9][a-z0-9._-]*)*)?$/i.test(page.path) || page.path.endsWith('.html') || typeof page.html !== 'string') fail(`Invalid site page ${JSON.stringify(page?.path)}: a path such as /run with its HTML.`);
+  const file = page.path === '/' ? 'index.html' : `${page.path.slice(1)}.html`;
+  if (written.has(file) || file.startsWith(`${ASSETS}/`)) fail(`Duplicate site page ${page.path}.`);
+  written.add(file);
+  await mkdir(dirname(join(output, file)), { recursive: true });
+  await writeFile(join(output, file), page.html);
+ }
+ const publicDirectory = resolve(root, 'public');
+ for (const asset of build.assets) {
+  const source = typeof asset === 'string' && !asset.split('/').some(part => !part || part.startsWith('.')) && inside(publicDirectory, asset);
+  if (!source || source === publicDirectory) fail(`Invalid site asset ${JSON.stringify(asset)}: a file or folder under public/.`);
+  if (asset === ASSETS || asset.startsWith(`${ASSETS}/`)) fail(`public/${ASSETS} is reserved for the run site's compiled styles; rename it.`);
+  await lstat(source).catch(() => fail(`Missing site asset public/${asset}.`));
+  await cp(source, join(output, asset), { recursive: true, errorOnExist: true, force: false, verbatimSymlinks: true });
+ }
+ // Only the emitted files: the Node chunks share the folder and never ship.
+ for (const file of files) {
+  await mkdir(dirname(join(output, file)), { recursive: true });
+  await cp(join(server, file), join(output, file), { errorOnExist: true, force: false });
+ }
+ process.stdout.write(`${JSON.stringify({ pages: build.pages.length, assets: build.assets.length, styles: styles.length })}\n`);
+} finally { await rm(server, { recursive: true, force: true }); }
+// Vite and the loaded pages can keep handles open; every file is written.
+process.exit(0);

package/cli/site.mjs

@@ -0,0 +1,109 @@
+import { readFile, rename, rm, mkdir } from 'node:fs/promises';
+import { dirname, join, relative } from 'node:path';
+import { fileURLToPath } from 'node:url';
+import { contained } from './project.mjs';
+import { invalid, missing, refuse, RerError } from './errors.mjs';
+import { checkSite } from './site-check.mjs';
+import { readDevKey } from './dev-identity.mjs';
+import { shared } from './shared.mjs';
+
+// The run site: a seed's static marketing pages, /run and docs, built from
+// edition identity with no installation data. A seed opts in with
+// commandAdapter's `site: { entry, output, declaration, config? }`: the module
+// whose sitePages({ styles }) returns the pages, the ignored folder the build
+// writes, the deploy declaration naming the run site's domain, and optionally
+// the Vite config holding the plugins the site pages need.
+const relativePath = value => typeof value === 'string' && /^[A-Za-z0-9._/-]+$/.test(value) && !value.split('/').some(part => !part || part === '.' || part === '..');
+
+export function declaredSite(project) {
+ const site = project.adapter?.site;
+ if (!site) throw refuse('This checkout declares no run site. A seed opts in with site: { entry, output, declaration } in its command adapter; see SEED-COMMAND-CONTRACT.md.');
+ if (!relativePath(site.entry) || !relativePath(site.output) || !relativePath(site.declaration) || (site.config !== undefined && !relativePath(site.config)) || ['src', 'public', 'node_modules', 'migrations'].some(top => site.output === top || site.output.startsWith(top + '/'))) throw invalid('The declared run site needs a relative entry, an output folder outside src, public and node_modules, a deploy declaration and, when named, a relative site Vite config.');
+ return site;
+}
+
+// Owner identity, secrets and the dev key: none may appear in the run site.
+async function privateValues(project) {
+ const values = [], names = project.adapter.input?.names ?? {};
+ const { localVariables } = await shared('local/environment.mjs');
+ const variables = await readFile(join(project.root, project.adapter.hooks?.secrets?.file ?? '.dev.vars'), 'utf8').then(localVariables, () => ({}));
+ for (const [key, value] of Object.entries(variables)) if ([names.email, names.name].includes(key) || /SECRET|TOKEN|PASSWORD|_KEY$/.test(key)) values.push(value);
+ const answers = await readFile(join(project.root, '.seed/installer/setup-answers.json'), 'utf8').then(JSON.parse, () => ({}));
+ for (const key of [names.email, names.name]) if (typeof answers?.[key] === 'string') values.push(answers[key]);
+ const key = await readDevKey(project.root).catch(() => null);
+ if (key) values.push(key);
+ return values;
+}
+
+/** Render the run site into its declared folder, check it and replace the previous build. */
+export async function buildSite(project, store, signal) {
+ const site = declaredSite(project);
+ await contained(project.root, site.entry);
+ if (site.config) await contained(project.root, site.config);
+ const folder = await contained(project.root, site.output, { optional: true });
+ await mkdir(dirname(folder), { recursive: true });
+ const staging = `${folder}.building-${process.pid}`;
+ await rm(staging, { recursive: true, force: true });
+ try {
+  await mkdir(staging);
+  await store.run('Building the run site', process.execPath, [fileURLToPath(new URL('./site-render.mjs', import.meta.url)), project.root, site.entry, staging, ...(site.config ? [site.config] : [])], { cwd: project.root, signal, heavy: false });
+  const checked = await checkSite(staging, { privateValues: await privateValues(project) });
+  await rm(folder, { recursive: true, force: true });
+  await rename(staging, folder);
+  return { folder, ...checked };
+ } finally { await Promise.all([staging, `${staging}.render`].map(path => rm(path, { recursive: true, force: true }))); }
+}
+
+async function siteDeployment(project, options, folder) {
+ const site = declaredSite(project), environment = options.environment ?? 'production';
+ const read = async path => { try { return JSON.parse(await readFile(await contained(project.root, path), 'utf8')); } catch (error) { if (error instanceof RerError) throw error; throw invalid(`Malformed ${path}.`); } };
+ const app = await read(project.adapter.deploy?.declaration ?? 'deploy.json'), declaration = await read(site.declaration);
+ const { sitePlan } = await import('../modules/deploy-kit/site.mjs');
+ try { return sitePlan({ project: app.project, environment, compatibilityDate: app.compatibilityDate, declaration, assets: folder }); }
+ catch (error) { throw invalid(`The run site deploy declaration is invalid (${error.message}). ${site.declaration} holds {"version": 1, "domain": "<apex hostname>"}.`); }
+}
+
+/** `rer build --site` and `rer deploy --site [--dry-run]`. */
+export async function siteCommand(project, options, store, signal, out) {
+ const built = await buildSite(project, store, signal);
+ if (options.verb === 'build') {
+  // Output redaction masks an inherited PWD (a credential-shaped name), so the
+  // checkout-relative folder is named too.
+  const path = relative(project.root, built.folder);
+  if (!options.json) out.human(`Run site written to ${path} (${built.pages} pages, ${built.files} files): ${built.folder}`);
+  return { site: { folder: built.folder, path, pages: built.pages, files: built.files } };
+ }
+ const plan = await siteDeployment(project, options, built.folder);
+ const human = [`Run site plan: site Worker ${plan.worker}, Base-generated, its only binding the assets (the app's Worker ${plan.appWorker} is not touched)`, `  assets: ${plan.assets} (${built.files} files; HTML ${plan.assetsConfig.html_handling}, not found ${plan.assetsConfig.not_found_handling}; the Worker runs first)`,
+  `  custom domains: ${plan.hostnames.join(', ')}; workers.dev off`, ...plan.redirects.map(rule => `  redirect in the Worker: ${rule.from} -> ${rule.to} (${rule.status}, keeps ${rule.keeps.join(' and ')})`)];
+ const summary = { worker: plan.worker, appWorker: plan.appWorker, module: plan.module, bindings: plan.bindings, assets: plan.assets, files: built.files, domain: plan.domain, hostnames: plan.hostnames, workersDev: false, runWorkerFirst: true, assetsConfig: plan.assetsConfig, redirects: plan.redirects.map(({ from, to, status }) => ({ from, to, status })) };
+ if (options.dryRun) {
+  if (options.json) out.event('site', summary); else for (const line of human) out.human(line);
+  store.report('deploy --site: dry run complete; no deployment occurred and no provider request was made.');
+  return { dryRun: true, deployed: false, site: summary };
+ }
+ const names = ['CLOUDFLARE_ACCOUNT_ID', 'CLOUDFLARE_API_TOKEN'];
+ if (names.some(name => !process.env[name]?.trim())) throw missing('CLOUDFLARE_ACCOUNT_ID and CLOUDFLARE_API_TOKEN are required, with the run site token permissions in the deploy-kit README.');
+ if (!options.json) for (const line of human) out.human(line);
+ const { cloudflare } = await import('../modules/deploy-kit/provider.mjs');
+ const { collectFiles } = await import('../modules/deploy-kit/artifact.mjs');
+ const { siteDeploy } = await import('../modules/deploy-kit/site.mjs');
+ const environment = options.environment ?? 'production';
+ try {
+  const api = cloudflare({ accountId: process.env.CLOUDFLARE_ACCOUNT_ID, token: process.env.CLOUDFLARE_API_TOKEN });
+  // The receipt is for the person; ownership is read from the provider, so a fresh checkout deploys too.
+  const result = await siteDeploy({ api, plan, files: await collectFiles(built.folder), receiptPath: join(project.root, '.rer', 'deploy', `site-${environment}.json`) });
+  return { dryRun: false, deployed: true, origin: result.origin, site: summary };
+ } catch (error) {
+  if (error instanceof RerError) throw error;
+  throw new RerError('deploy_refused', `Run site deploy stopped: ${/^[a-z0-9-]{1,80}$/.test(error.message) ? error.message : 'site-deploy-failed'}${error.resource ? ` (${error.resource})` : ''}.`, 1);
+ }
+}
+
+/** For rer dev: build the run site and serve it on the first free port above the app's. */
+export async function devSite(project, store, signal, { host, port }) {
+ const built = await buildSite(project, store, signal);
+ const { sitePreview } = await import('./site-preview.mjs');
+ return { ...await sitePreview(built.folder, { host, ports: Array.from({ length: 50 }, (_, index) => port + 1 + index).filter(value => value <= 65535) }), folder: relative(project.root, built.folder) };
+}
+

package/global/CHANGELOG.md

@@ -0,0 +1,63 @@
+# Changelog
+
+## 0.2.0
+
+What changes for a user since 0.1.1.
+
+### Package mode
+
+- A first-party seed pins `@runeditrun/rer` as an exact devDependency instead of
+  carrying `scripts/rer.mjs`, `scripts/base-cli` and `scripts/base-onboarding`.
+  `node scripts/export-cli.mjs --to-package SEED_ROOT [--version X]` converts a
+  vendored seed (it refuses local edits and lists them).
+- `rer check` and `rer describe` in a checkout whose `node_modules` lacks its
+  pin install it with the frozen lockfile first, then run the pinned verb, so a
+  fresh clone checks with the pinned bytes. `rer check --profile first-party`
+  accepts package mode (SC-13) and still accepts vendored mode.
+- Named exports for every Base file a seed's adapter, Vite config, build or
+  package script imports; nothing needs `internal/`.
+
+### Lobby, homepage variants, setup state
+
+- The Lobby (the pre-claim page) and `GET /setup/state`; a seed supplies its own
+  first-run read, and the fonts stylesheet its edition names.
+- Homepage variants and a hydration check that follows a redirecting `/`, counts
+  cross-origin client scripts and fails an edit case React hydrated too early to test.
+
+### Run sites
+
+- `rer build --site` builds the seed's run site (with its own Vite config and
+  CSS) and `rer deploy --site` deploys it. Ownership is proven from the provider
+  alone (the latest deployment serves the newest version, which carries the
+  kit's annotation), so a fresh CI checkout redeploys; a foreign Worker or
+  domain is refused.
+- The site Worker is Base-generated: `www.<domain>` answers a 301 to the apex
+  (path and query kept) and everything else comes from assets. No zone ruleset
+  is read or written.
+- The publication scan accepts the run-NAME repository names the owner
+  proposed (for example run-lamp under the just-every account) as intended
+  public destinations; the earlier names stay valid.
+
+### Local development hardening
+
+- A request with a foreign `Host` gets a plain 421; keyless `/@fs` and any
+  path Vite would answer with its 403 "Restricted" page (which lists checkout
+  and home paths) get 404. The dev key opens them.
+- `rer` fetches the pinned pnpm from the npm registry, checked against its
+  integrity hash, when PATH lacks it.
+- An explicit `RER_SERVER_LIMIT` caps its own start, higher or lower.
+- `rer door`: keys never go through the door, a moved checkout keeps its name,
+  a restart hands starts over, a missing folder is a plain page.
+
+### Hosted output
+
+- Built `.html` files are served by the hosted Worker (`staticAssetResponse`),
+  including revalidation (`If-None-Match` answers 304). The hosted check
+  requests every built file and sends one conditional request per `.html`.
+- A deploy secret may carry `verifyStandIn` for the hosted check.
+- Packed deploy assets leave out `.assetsignore` and what it names.
+
+### Fixes
+
+- Setup reads the seed's declared settings format and session-secret name.
+- Large stores export, and a fresh install recovers a legacy backup.