@runeditrun/rer 0.1.0 → 0.2.0

package/global/main.mjs

@@ -1,11 +1,13 @@
-import { dispatcher, locate, unsupportedMessage } from './checkout.mjs';
+import { dispatcher, locate, pinnedPackage, unsupportedMessage } from './checkout.mjs';
 import { delegate } from './delegate.mjs';
 import { localDefaults } from './launch/local-defaults.mjs';
+import { packageName as pinnedName } from './package-info.mjs';
 
 const help = `Usage: rer VERB [FLAGS]
 
 Inside a project (the nearest OPERATIONS.json at or above this folder, or --cwd DIR),
-every verb runs that checkout's own pinned rer, exactly as node scripts/rer.mjs VERB would.
+every verb runs that checkout's own pinned rer: the @runeditrun/rer version its package.json
+pins (installed first by rer install or rer dev), else its vendored scripts/rer.mjs.
 
   rer dev              Launch a first-party checkout with no setup steps: installs dependencies,
                        sets up a local owner and a free port when needed, starts the app and prints
@@ -14,6 +16,8 @@ every verb runs that checkout's own pinned rer, exactly as node scripts/rer.mjs
                        to 10 minutes on a first launch, or rerun it to reattach. rer dev --stop stops it.
   rer list [DIR]       The checkouts in DIR (default: here), newest first, with whether rer dev can
                        launch them, whether they are set up, and their running URL. --json for data.
+  rer door ...         The opt-in front door: every checkout at http://NAME.localhost:PORT, started
+                       on its first visit and stopped when idle. rer door --help for its verbs.
   rer cli status       This rer: version, contents digest, install channel, launcher and other rer
                        commands on PATH. --json for data.
   rer cli install      Install this package for the current user (~/.local/bin/rer).
@@ -21,11 +25,17 @@ every verb runs that checkout's own pinned rer, exactly as node scripts/rer.mjs
   rer update           Move to the latest published rer (--version X for an exact one), the way it
                        was installed: npx and install.sh installs switch atomically, npm installs run npm.
   rer --version        Print this rer's version; inside a checkout, also the version the checkout pins.
+  rer queue NAME -- COMMAND [ARGS]
+                       Run COMMAND once this computer's job queue admits it (heavy package scripts
+                       of a checkout that pins the rer package use it).
 
 Checkout verbs: install, setup, dev, preview, build, verify, reset, deploy, export, import,
 outbox, doctor, describe, check, release. Run rer VERB --help in a checkout for its flags.
 `;
 
+// The verbs that install an uninstalled pinned package before they run.
+const installsFirst = new Set(['install', 'check', 'describe']);
+
 export async function main(argv) {
  const [verb] = argv;
  if (verb === '--version' || verb === '-v') return (await import('./version.mjs')).versionCommand(argv);
@@ -38,10 +48,34 @@ export async function main(argv) {
  if (!verb || verb === '--help' || verb === '-h' || verb === 'help') { process.stdout.write(help); return 0; }
  if (verb === 'cli') return (await import('./cli/command.mjs')).cliCommand(argv.slice(1));
  if (verb === 'list') return (await import('./list.mjs')).listCommand(argv.slice(1));
+ if (verb === 'door') return (await import('./door/command.mjs')).doorCommand(argv.slice(1));
  const target = locate(argv);
  if (target.profile === 'unsupported') { process.stderr.write(unsupportedMessage(target.root, target.version) + '\n'); return 2; }
+ const first = target.profile === 'first-party', mode = first ? dispatcher(target.root).mode : undefined;
+ if (verb === 'queue') {
+  const [, name, separator, command] = argv;
+  if (!name || separator !== '--' || !command) { process.stderr.write('Usage: rer queue NAME -- COMMAND [ARGS]\n'); return 2; }
+  if (mode === 'package') return delegate(target, target.args);
+  return (await import('../onboarding/queued-entry.mjs')).queuedCommandLine(argv.slice(1));
+ }
  // A checkout that pins its own rer package runs all of it, launching included.
- const mode = target.profile === 'first-party' ? dispatcher(target.root).mode : undefined;
+ // Until node_modules holds the pinned version, install, check and describe
+ // install it with the frozen lockfile (then run the pinned verb, so a fresh
+ // clone checks with the pinned bytes), the zero-setup launch installs it
+ // first, and every other verb says to install.
+ const pinned = first && mode !== 'package' ? pinnedPackage(target.root) : undefined;
+ if (pinned && !pinned.ready && !argv.includes('--help')) {
+  if (installsFirst.has(verb)) {
+   const { installPinned } = await import('./launch/install-pinned.mjs'), { LaunchFailure } = await import('./launch/failure.mjs');
+   try { await installPinned(target.root); }
+   catch (failure) { if (!(failure instanceof LaunchFailure)) throw failure; process.stderr.write(failure.message + '\n'); return failure.exitCode; }
+   return delegate(target, target.args);
+  }
+  if (verb !== 'dev') {
+   process.stderr.write(`${target.root} pins ${pinnedName} ${pinned.declared}, ${pinned.installed ? `but node_modules holds ${pinned.installed}` : 'which is not installed yet'}. Run rer install, then rer ${verb} again.\n`);
+   return 3;
+  }
+ }
  if (verb === 'dev' && mode && mode !== 'package' && !argv.includes('--help')) return (await import('./launch/dev.mjs')).launchDev(target);
  // Every other server start or queued job on a vendored pin gets the person
  // defaults too (a pinned package applies its own).

package/global/version.mjs

@@ -2,9 +2,7 @@
 // checkout (or with --cwd DIR) a second line names the version that checkout
 // pins: its package's, or the one its vendored copy recorded, which
 // `rer describe` reports as cliVersion.
-import { readFileSync } from 'node:fs';
-import { dirname, join } from 'node:path';
-import { dispatcher, locate } from './checkout.mjs';
+import { dispatcher, locate, pinnedPackage } from './checkout.mjs';
 import { describeCheckout } from './launch/facts.mjs';
 import { ownManifest } from './package-info.mjs';
 
@@ -12,13 +10,15 @@ export async function versionCommand(argv) {
  process.stdout.write(ownManifest().version + '\n');
  const target = locate(argv);
  if (target.profile !== 'first-party') return 0;
- const { mode, entry } = dispatcher(target.root);
- if (mode === 'bundled') return 0;
- if (mode === 'package') {
-  const pinned = JSON.parse(readFileSync(join(dirname(dirname(entry)), 'package.json'), 'utf8')).version;
-  process.stdout.write(`This checkout (${target.root}) pins rer ${pinned} (package).\n`);
+ const pinned = pinnedPackage(target.root);
+ if (pinned) {
+  process.stdout.write(pinned.ready
+   ? `This checkout (${target.root}) pins rer ${pinned.installed} (package).\n`
+   : `This checkout (${target.root}) pins rer ${pinned.declared} (package), ${pinned.installed ? `but node_modules holds ${pinned.installed}` : 'not installed yet'}: run rer install.\n`);
   return 0;
  }
+ const { mode, entry } = dispatcher(target.root);
+ if (mode === 'bundled') return 0;
  let described;
  try { described = await describeCheckout(target.root, entry, process.env); }
  catch (failure) { process.stdout.write(`This checkout (${target.root}): its pinned rer version could not be read: ${failure.message.split('\n')[0]}\n`); return 0; }

package/modules/dependencies/protocol.mjs

@@ -1,5 +1,6 @@
 import { readJson, discover } from '../operator-auth/identity/oidc/network.mjs';
 import { PRESETS, MINIMUM_PROVIDER_VERSION } from '../operator-auth/identity/oidc/presets.mjs';
+import { isLoopbackHost } from '../operator-auth/loopback.mjs';
 export const INTERFACE = 'oidc-provider@1';
 export const CALLBACK = '/.well-known/rer-link/callback';
 export const PATHS = ['/auth/oidc/auth/callback','/auth/oidc/auth/logout'];
@@ -7,7 +8,7 @@ export const NETWORK = { timeoutMs:5000 };
 export function insist(value, code = 'invalid_link', status = 400) { if (!value) throw Object.assign(new Error(code),{code,status}); }
 export function originOf(value, local = false) {
  let u;try { u=new URL(value); } catch { insist(false); }
- insist(u.origin===value && !u.username && !u.password && (u.protocol==='https:' || local && u.protocol==='http:' && ['localhost','127.0.0.1','[::1]'].includes(u.hostname)));
+ insist(u.origin===value && !u.username && !u.password && (u.protocol==='https:' || local && u.protocol==='http:' && isLoopbackHost(u.hostname)));
  return u.origin;
 }
 export async function providerMetadata(issuer, fetcher, contract = INTERFACE) {

package/modules/deploy-kit/README.md

@@ -140,12 +140,45 @@ When a token lacks a permission, the CLI prints which one instead of only a stat
 A seed carries a copy of `modules/deploy-kit/` from a Base pin. Refresh the copy, write a `deploy.json` from the plan the seed already builds, and point `deploy`, and the hosting step of `setup`, at `owner-cli.mjs`. Keep any throwaway controller only for proofs. In `deploy.json` declare:
 
 - the bindings the app uses (`DB`, `FILES`, `JOBS` and so on), with each queue's consumer and dead-letter queue and each SQLite Durable Object class;
-- the secrets the app reads, such as its session secret and the mail provider's key;
+- the secrets the app reads, such as its session secret and the mail provider's key. A secret item may add `verifyStandIn`, the hosted-valid value `rer verify`'s hosted check binds in its place (`{"binding": "MAIL_PROVIDER", "environment": "MAIL_PROVIDER", "verifyStandIn": "resend"}`); the kit validates it (a non-empty string), leaves it out of the plan and its fingerprint, and never sends it or makes it a secret value;
 - any Cron schedule and the public setup fields the app takes in `vars`;
 - `originVar`, the variable that holds the app's public origin (for example `APP_ORIGIN`).
 
 A seed whose setup provisions nothing declares the same bindings and deploys through its own `deploy` verb. Resource names change from `rer-seedproof-*` or a chosen prefix to `<project>-<environment>-*`. The kit refuses rather than adopts an earlier installation's resources.
 
+### Run site (`rer deploy --site`)
+
+A seed's run site (`run-<seed>.com`: its marketing homepage, `/run` and docs, written by `rer build --site`) deploys to the owner's account as a **Base-generated site Worker** (`site.mjs`). The seed declares only the apex domain, beside `deploy.json`, in the file its `commandAdapter` `site.declaration` names (Base's seeds: `deploy-site.json`):
+
+```json
+{ "version": 1, "domain": "run-cradle.com" }
+```
+
+The domain is an apex hostname: no scheme, path, port, upper case or `www.`. The plan (`sitePlan`) names:
+
+- the Worker `<project>-<environment>--site`. Owner Worker names never contain `--`, so it can never be the installed app's Worker (`<project>-<environment>`), and a site deploy never reads or writes the app Worker or any of its resources;
+- its one module, `site-worker.mjs` (`SITE_WORKER`): fixed content Base generates, with no seed code. Its only binding is the assets (`ASSETS`), it runs first on every request (`run_worker_first`), and it has no secrets, no schedules and workers.dev off. A request to `www.<domain>` gets a 301 to `https://<domain>` with path and query kept; every other request is answered from the assets exactly as an assets-only Worker would answer it: the `rer build --site` folder with `html_handling: auto-trailing-slash` (`/run` serves `run.html`) and `not_found_handling: 404-page`;
+- the apex as a Workers Custom Domain, and `www.<domain>` as a second Custom Domain on the same Worker, so the www host has DNS and a certificate and its requests reach the Worker's redirect.
+
+No zone ruleset is read or written. Every request now invokes the Worker: one page view costs one Worker request for the page and one per same-origin file it loads (the default seed's run site: at most 7 per uncached page view).
+
+`rer deploy --site --dry-run` builds the site and prints that plan (`--json`: a `site` event and a result with `dryRun: true`, `deployed: false` and the same `site` object) with no provider request and nothing written, even with `CLOUDFLARE_ACCOUNT_ID` and `CLOUDFLARE_API_TOKEN` set. Without `--dry-run` it needs both inputs. Ownership is read from the provider alone, so a deploy from a fresh checkout (a CI runner with no `.rer/`) recognises the site it deployed before:
+
+- the Worker is the kit's when its latest deployment serves, at 100%, the Worker's newest version, and that version's message annotation is the kit's `rer-site:<fingerprint>` (every site upload sets it);
+- a Custom Domain is the kit's when its service is the kit's Worker.
+
+A read-only preflight reads the zone (it must be in this account, else `site-zone-missing`), the Worker and the zone's Custom Domains, and refuses before any write: `resource-name-collision` for a Worker of the name whose live version the kit did not upload, or for a hostname attached to another service (or to a Worker that is not the kit's); `owned-resource-replaced` for a kit Worker whose latest deployment is not the kit's upload (a dashboard rollback or a split deployment). It then uploads the assets and the site Worker, checks that the new version is live, turns workers.dev off, attaches each missing hostname, and reads the Worker and both domains back. A repeat attaches nothing new. `.rer/deploy/site-<environment>.json` receives a receipt for the person; it is never read. The real path is tested only against the fake Cloudflare API in `tests/site-provider.mjs`, where every zone ruleset path answers 403; it has not run against a live account.
+
+The token needs, beyond the owner-account permissions above:
+
+| Permission | Scope | Used for |
+| --- | --- | --- |
+| Workers Scripts: Edit | the account | the site Worker upload, its assets, versions and deployments, workers.dev, and Workers Custom Domains (`/workers/domains`) |
+| Zone: Read | the run site zones | finding the zone by name |
+| Workers Routes: Edit | the run site zones | Workers Custom Domains, which also create their DNS records and certificates |
+
+No Single Redirect (dynamic redirect ruleset) permission is needed. Base's references declare reserved `.example` domains (`run-default-seed.example`, `run-<edition>.example` for a new foundation), so a real deploy of either stops at `site-zone-missing`.
+
 ## Migration safety
 
 SQL files have ordered unique names and SHA-256 identities. `_rer_deploy_migrations` is permanent controller-owned history. Applied entries must be an unchanged prefix of the desired set. A new migration gets an `applying` claim before its SQL and completion marker are submitted together to the D1 batch query API. Any interrupted, failed or uncertain outcome remains blocked and must be inspected explicitly; the kit never automatically retries, rolls back user data, or marks an unknown outcome successful. Readback checks every final identity.

package/modules/deploy-kit/artifact.mjs

@@ -40,6 +40,16 @@ export async function collectFiles(root, directory = '', budget = {bytes:0,count
   }
   return files;
 }
+// Wrangler's .assetsignore in an assets folder: gitignore-style lines naming
+// files that are never assets. The file itself is never one either.
+export function assetsIgnore(text = '') {
+  const rules = String(text).split(/\r?\n/).map(line => line.trim()).filter(line => line && !line.startsWith('#')).map(line => {
+    const negate = line.startsWith('!'), body = negate ? line.slice(1) : line, directory = body.endsWith('/'), pattern = body.replace(/\/+$/, '');
+    const glob = pattern.replace(/^\//, '').split('/').map(part => part === '**' ? '.*' : part.replace(/[.+^${}()|[\]\\]/g, '\\$&').replaceAll('*', '[^/]*').replaceAll('?', '[^/]')).join('/');
+    return { negate, test: new RegExp(`^${pattern.includes('/') ? '' : '(?:.*/)?'}${glob}${directory ? '/.*' : '(?:/.*)?'}$`) };
+  });
+  return path => path === '.assetsignore' || rules.reduce((ignored, rule) => rule.test.test(path) ? !rule.negate : ignored, false);
+}
 /** Built files a deployed Worker must serve: everything for the browser except documents
  * (the app answers those; asset html_handling redirects them) and dot paths (never public). */
 export const publicAssetPaths = paths => paths.filter(path => !path.split('/').some(part => part.startsWith('.')) && extname(path) !== '.html');

package/modules/deploy-kit/owner.mjs

@@ -18,7 +18,7 @@ const segment = /^[a-z][a-z0-9]*(?:-[a-z0-9]+)*$/;
 const STATE_KIND = 'rer-deploy-owner-state';
 const KINDS = ['d1','r2','kv','queues'];
 const DECLARATION_KEYS = ['version','project','compatibilityDate','compatibilityFlags','d1','r2','kv','queues','durableObjects','secrets','crons','vars','originVar','services','workersDev','platforms','container'];
-const ENTRY_KEYS = {d1:['binding'],r2:['binding','locationHint'],kv:['binding'],queues:['binding','consumer','deadLetterQueue'],durableObjects:['binding','className','storage'],secrets:['binding','environment'],services:['binding','project','entrypoint','allowedHosts','grant']};
+const ENTRY_KEYS = {d1:['binding'],r2:['binding','locationHint'],kv:['binding'],queues:['binding','consumer','deadLetterQueue'],durableObjects:['binding','className','storage'],secrets:['binding','environment','verifyStandIn'],services:['binding','project','entrypoint','allowedHosts','grant']};
 
 function refuse(code, kind, name) { const error = new Error(code); error.resource = `${kind}:${name}`; return error; }
 
@@ -110,7 +110,8 @@ export function ownerPlan(target, declaration, artifact, { localOnlyKeys = [] }
     ...(kv.length ? {kv} : {}),
     queues:queues.map(item => ({...item,name:name(item.binding),...(item.deadLetterQueue === undefined ? {} : {deadLetterQueue:name(item.deadLetterQueue)})})),
     durableObjects:entries(declaration,'durableObjects').map(item => ({...item})),
-    secrets:entries(declaration,'secrets').map(item => ({...item})),
+    // verifyStandIn is only `rer verify`'s hosted-check value: never planned, sent or stored.
+    secrets:entries(declaration,'secrets').map(({verifyStandIn,...item}) => { assert(verifyStandIn === undefined || typeof verifyStandIn === 'string' && verifyStandIn.length > 0 && verifyStandIn.length <= 1024, 'invalid-verify-stand-in'); return item; }),
     crons:[...(declaration.crons ?? [])],vars,
     // Only declarations using these add the keys, so earlier plans and fingerprints are unchanged.
     ...(services.length ? {services} : {}),...(declaration.workersDev === false ? {workersDev:false} : {})});
@@ -182,7 +183,7 @@ async function checkSavedResourceIdentities(api, state) {
 async function checkServiceWorkers(api, plan) {
   for (const {service} of plan.services ?? []) if (await workerSettings(api, service) === null) throw refuse('service-worker-missing','service',service);
 }
-async function workerSettings(api, worker) {
+export async function workerSettings(api, worker) {
   try { return await api.request(`/workers/scripts/${worker}/settings`); }
   catch (error) { if (error.status === 404) return null; throw error; }
 }
@@ -220,7 +221,7 @@ async function checkOwnedWorker(api, plan, artifact, state) {
 }
 
 /** One deploy at a time per state file: an exclusive lock file for the whole run. */
-async function withStateLock(path, run) {
+export async function withStateLock(path, run) {
   await mkdir(dirname(path),{recursive:true,mode:0o700});
   const lock = `${path}.lock`;
   let handle;

package/modules/deploy-kit/prepare.mjs

@@ -3,7 +3,7 @@ import { mkdir, writeFile, readdir, rm } from 'node:fs/promises';
 import { resolve, join, relative } from 'node:path';
 import { pathToFileURL } from 'node:url';
 import { assert, hash, localPath } from './validation.mjs';
-import { collectFiles, regularBytes, validateArtifact, MAX_ARTIFACT } from './artifact.mjs';
+import { assetsIgnore, collectFiles, regularBytes, validateArtifact, MAX_ARTIFACT } from './artifact.mjs';
 import { collectBuildModules } from './build-modules.mjs';
 import { refuseLocalModels } from './local-only.mjs';
 
@@ -24,7 +24,8 @@ export async function packageBuild({root,source,runIdentity,productDirectory = '
   const config = JSON.parse(await regularBytes(join(build,'wrangler.json'),1024*1024));
   const main = localPath(relative(build,resolve(build,config.main)));
   const modules = await collectBuildModules(build,config,main);
-  const assets = await collectFiles(join(product,'dist/client'));
+  const ignored = assetsIgnore(await regularBytes(join(product,'dist/client/.assetsignore'),65536).then(String,error => { if (error.code === 'ENOENT') return ''; throw error; }));
+  const assets = (await collectFiles(join(product,'dist/client'))).filter(file => !ignored(file.path));
   const migrations = [];
   for (const name of (await readdir(join(product,'migrations/core'))).sort()) {
     assert(/^[0-9]+_[a-zA-Z0-9_-]+\.sql$/.test(name),'unexpected-migration-file');

package/modules/deploy-kit/provider.mjs

@@ -12,13 +12,15 @@ export function cloudflare({ accountId, token, fetch: request = globalThis.fetch
   assert(hexId(accountId), 'invalid-cloudflare-account-id');
   assert(typeof token === 'string' && token.trim() && !/[\r\n]/.test(token), 'invalid-cloudflare-api-token');
   let requests = 0;
-  async function envelope(path, { method = 'GET', body, assetToken } = {}) {
+  // `zone` scope: the zone-level API (/zones/...), for a run site's zone lookup and redirect rule.
+  async function envelope(path, { method = 'GET', body, assetToken, zone = false } = {}) {
     assert(typeof path === 'string' && /^\/[a-z0-9/_?=&.,%-]+$/i.test(path) && !path.includes('..') && !path.split('?')[0].includes('%'), 'invalid-provider-path');
+    assert(!zone || /^\/zones(?:[/?]|$)/.test(path), 'invalid-provider-path');
     assert(++requests <= maxRequests, 'provider-request-budget');
     assert(!assetToken || path === '/workers/assets/upload?base64=true', 'invalid-asset-auth-target');
     const signal = AbortSignal.timeout(timeoutMs);
     let response;
-    try { response = await request(`https://api.cloudflare.com/client/v4/accounts/${accountId}${path}`, {
+    try { response = await request(zone ? `https://api.cloudflare.com/client/v4${path}` : `https://api.cloudflare.com/client/v4/accounts/${accountId}${path}`, {
       method, redirect: 'error', signal, headers: { Authorization: `Bearer ${assetToken ?? token}`, ...(body && !(body instanceof FormData) ? { 'Content-Type':'application/json' } : {}) },
       ...(body === undefined ? {} : { body: body instanceof FormData ? body : JSON.stringify(body) }),
     }); } catch { throw new Error('provider-transport-failed'); }
@@ -95,5 +97,6 @@ export function cloudflare({ accountId, token, fetch: request = globalThis.fetch
     }
     throw new Error('provider-pagination-limit');
   }
-  return { accountId, envelope, list, async request(path, options) { return (await envelope(path, options)).result; } };
+  return { accountId, envelope, list, async request(path, options) { return (await envelope(path, options)).result; },
+    async zoneRequest(path, options = {}) { return (await envelope(path, { ...options, zone: true })).result; } };
 }

package/modules/deploy-kit/site.mjs

@@ -0,0 +1,135 @@
+import { mkdir, rename, writeFile } from 'node:fs/promises';
+import { dirname } from 'node:path';
+import { assert, hash, resourceName } from './validation.mjs';
+import { ownerWorkerName, workerSettings } from './owner.mjs';
+import { uploadAssets, workerOrigin } from './worker.mjs';
+
+/* A seed's run site (run-<seed>.com): the folder `rer build --site` writes,
+ * served on the owner's own account by a Base-generated module Worker (fixed
+ * content, no seed code) whose only binding is its assets. The Worker runs
+ * first on every request: www.<domain> gets a 301 to the apex with path and
+ * query kept, and everything else is answered from the assets. It has no
+ * secrets and no schedules, workers.dev stays off, and its name can never be
+ * the installed app's Worker name, so a site deploy never touches the app or
+ * its resources. The apex and www.<domain> are Workers Custom Domains; no zone
+ * ruleset is read or written.
+ *
+ * Ownership is proven from the provider alone, so a deploy from a fresh
+ * checkout (a CI runner) recognises the site it deployed before: the Worker is
+ * the kit's when its latest deployment serves, at 100%, the Worker's newest
+ * version and that version carries the kit's `rer-site:<fingerprint>`
+ * annotation; a Custom Domain is the kit's when its service is the kit's
+ * Worker. Anything of the same name that is not the kit's is refused, never
+ * adopted. A local receipt is written for the person and never read. */
+
+const RECEIPT_KIND = 'rer-deploy-site-receipt';
+const APEX = /^(?!www\.)(?:[a-z0-9](?:[a-z0-9-]{0,61}[a-z0-9])?\.)+[a-z][a-z0-9-]{0,62}$/;
+const ANNOTATION = /^rer-site:[0-9a-f]{64}$/;
+export const SITE_ASSETS_CONFIG = Object.freeze({ html_handling: 'auto-trailing-slash', not_found_handling: '404-page' });
+export const SITE_MODULE = 'site-worker.mjs';
+/** The site Worker. It names no domain: only the site's two Custom Domains route to it. */
+export const SITE_WORKER = `// Run site Worker, generated by Base's deploy kit (rer deploy --site). Do not edit.
+export default {
+  async fetch(request, env) {
+    const url = new URL(request.url);
+    if (url.hostname.startsWith('www.')) return new Response(null, { status: 301, headers: { location: \`https://\${url.hostname.slice(4)}\${url.pathname}\${url.search}\` } });
+    return env.ASSETS.fetch(request);
+  },
+};
+`;
+
+function refuse(code, kind, name) { const error = new Error(code); error.resource = `${kind}:${name}`; return error; }
+
+/** deploy-site.json: `{ "version": 1, "domain": "run-cradle.com" }`, the apex hostname only. */
+export function siteDeclaration(value) {
+  assert(value && typeof value === 'object' && !Array.isArray(value) && value.version === 1 && Object.keys(value).sort().join() === 'domain,version', 'invalid-site-declaration');
+  assert(typeof value.domain === 'string' && value.domain.length <= 253 && APEX.test(value.domain), 'invalid-site-domain');
+  return value;
+}
+
+/** The app is `<project>-<environment>`; owner names never hold `--`, so the site Worker cannot be it. */
+export function siteWorkerName(project, environment) {
+  const worker = `${ownerWorkerName(project, environment)}--site`;
+  assert(resourceName(worker), 'owner-name-too-long');
+  return worker;
+}
+
+/** Everything a site deploy will do, with no provider request. */
+export function sitePlan({ project, environment, compatibilityDate, declaration, assets }) {
+  const { domain } = siteDeclaration(declaration);
+  assert(/^\d{4}-\d{2}-\d{2}$/.test(compatibilityDate ?? ''), 'invalid-plan');
+  assert(typeof assets === 'string' && assets.startsWith('/'), 'invalid-site-assets');
+  return { version: 1, worker: siteWorkerName(project, environment), appWorker: ownerWorkerName(project, environment), module: SITE_MODULE, assets, compatibilityDate,
+    bindings: ['ASSETS'], secrets: [], crons: [], workersDev: false, runWorkerFirst: true, assetsConfig: { ...SITE_ASSETS_CONFIG },
+    domain, hostnames: [domain, `www.${domain}`],
+    redirects: [{ from: `https://www.${domain}/*`, to: `https://${domain}/`, status: 301, keeps: ['path', 'query'] }] };
+}
+
+/** The version the Worker's latest deployment serves, as the kit reads ownership: null when there is no Worker. */
+async function servedVersion(api, worker) {
+  if (!await workerSettings(api, worker)) return null;
+  const { deployments } = await api.request(`/workers/scripts/${worker}/deployments`);
+  assert(Array.isArray(deployments) && deployments.length > 0, 'invalid-deployments');
+  const [latest] = deployments, single = latest.versions?.length === 1 && latest.versions[0].percentage === 100 ? latest.versions[0].version_id : null;
+  const newest = (await api.request(`/workers/scripts/${worker}/versions`))?.items?.[0]?.id;
+  const version = single ? await api.request(`/workers/scripts/${worker}/versions/${single}`) : null;
+  const annotation = version?.annotations?.['workers/message'];
+  return { kit: typeof annotation === 'string' && ANNOTATION.test(annotation), annotation, current: Boolean(single) && single === newest };
+}
+/** The Worker is absent (false) or the kit's (true); anything else is refused. */
+async function ownWorker(api, worker) {
+  const served = await servedVersion(api, worker);
+  if (!served) return false;
+  // Someone else's Worker of this name, or one whose live version the kit did not upload.
+  if (!served.kit) throw refuse('resource-name-collision', 'worker', worker);
+  // A kit version that is no longer the newest one served alone: a dashboard rollback or a split deployment.
+  if (!served.current) throw refuse('owned-resource-replaced', 'worker', worker);
+  return true;
+}
+
+async function writeReceipt(path, receipt) {
+  await mkdir(dirname(path), { recursive: true, mode: 0o700 });
+  const temporary = `${path}.${process.pid}.tmp`;
+  await writeFile(temporary, JSON.stringify({ version: 1, kind: RECEIPT_KIND, ...receipt }, null, 2) + '\n', { flag: 'wx', mode: 0o600 });
+  await rename(temporary, path);
+}
+
+/** Read-only preflight, then the site Worker upload and both Custom Domains, then readback. */
+export async function siteDeploy({ api, plan, files, receiptPath }) {
+  assert(typeof receiptPath === 'string' && receiptPath.length, 'missing-receipt-path');
+  assert(plan?.module === SITE_MODULE && Array.isArray(files) && files.some(file => file.path === 'index.html'), 'invalid-site-assets');
+  const zones = await api.zoneRequest(`/zones?name=${plan.domain}&account.id=${api.accountId}`);
+  const zone = Array.isArray(zones) ? zones.find(row => row?.name === plan.domain && row.account?.id === api.accountId) : null;
+  if (!zone) throw refuse('site-zone-missing', 'zone', plan.domain);
+  // Preflight: the Worker and each hostname are the kit's own or absent before any write.
+  const existed = await ownWorker(api, plan.worker);
+  const attached = await api.request(`/workers/domains?zone_id=${zone.id}`);
+  assert(Array.isArray(attached), 'invalid-domain-list');
+  for (const hostname of plan.hostnames) {
+    const row = attached.find(item => item?.hostname === hostname);
+    if (row && (!existed || row.service !== plan.worker)) throw refuse('resource-name-collision', 'domain', hostname);
+  }
+
+  const fingerprint = hash({ files: files.map(({ path, sha256 }) => ({ path, sha256 })), config: plan.assetsConfig, module: hash(SITE_WORKER), compatibilityDate: plan.compatibilityDate });
+  const jwt = await uploadAssets(api, plan.worker, files);
+  const body = new FormData();
+  body.set('metadata', new Blob([JSON.stringify({ main_module: SITE_MODULE, compatibility_date: plan.compatibilityDate, bindings: [{ type: 'assets', name: 'ASSETS' }],
+    assets: { jwt, config: { ...plan.assetsConfig, run_worker_first: true } }, annotations: { 'workers/message': `rer-site:${fingerprint}` } })], { type: 'application/json' }));
+  body.set(SITE_MODULE, new Blob([SITE_WORKER], { type: 'application/javascript+module' }), SITE_MODULE);
+  await api.request(`/workers/scripts/${plan.worker}`, { method: 'PUT', body });
+  const uploaded = await servedVersion(api, plan.worker);
+  assert(uploaded?.current && uploaded.annotation === `rer-site:${fingerprint}`, 'site-upload-not-live');
+  await workerOrigin(api, plan.worker, { enable: true, workersDev: false });
+  for (const hostname of plan.hostnames) {
+    if (attached.some(row => row?.hostname === hostname)) continue;
+    const row = await api.request('/workers/domains', { method: 'PUT', body: { environment: 'production', hostname, service: plan.worker, zone_id: zone.id } });
+    assert(row?.hostname === hostname && row.service === plan.worker && typeof row.id === 'string', 'invalid-domain-attach');
+  }
+  // Readback: the kit's Worker live and both domains on it.
+  assert(await ownWorker(api, plan.worker), 'site-worker-missing');
+  const domains = await api.request(`/workers/domains?zone_id=${zone.id}`);
+  for (const hostname of plan.hostnames) assert(domains.some(row => row.hostname === hostname && row.service === plan.worker), 'domain-readback-mismatch');
+  const receipt = { worker: plan.worker, domain: plan.domain, zoneId: zone.id, fingerprint, files: files.length, hostnames: plan.hostnames, redirect: plan.redirects[0] };
+  await writeReceipt(receiptPath, receipt);
+  return { origin: `https://${plan.domain}`, receipt };
+}

package/modules/erasure/CONTRACT.md

@@ -31,8 +31,11 @@ outside D1 and R2.
   leaves-first, the subject row last) is deleted in a D1 batch that also holds
   portability's `erasureStatements(table, key)` for that row and
   `invalidateTransfersStatements()`. A batch holds at most `rows` dependents, so
-  deletion work is bounded. Scope/audit and completeness checks also read the
-  declared closure; their cost grows with that closure. A guard on the operation's step
+  deletion work is bounded. The first step reads and orders the declared closure
+  and queues what it leaves; every later step reads, verifies and deletes only its
+  own slice of that queue, and the last step reads the closure once more from the
+  subject and every remembered parent, so the work of an erasure is linear in its
+  rows. A guard on the operation's step
   counter makes a concurrent runner fail with `erasure_busy` (409) instead of
   committing twice.
 - **ERASE-005 — Blobs after the commit.** For a declared `blob` edge, each row's
@@ -51,7 +54,7 @@ outside D1 and R2.
   replaced with one label per erasure, `erased:<128 random bits>`. The label is
   not derived from the subject, so nobody who holds the database or an older
   archive can recompute it or test a guess against it. Declared `clear` columns
-  are overwritten. Audit rows for selected dependents are relabelled in every batch. Temporary
+  are overwritten. Audit rows for a batch's dependents are relabelled in that batch, and every remembered dependent's in the final one. Temporary
   scope preserves earlier keys until the final pass, catching audit rows written
   after those dependents disappeared; that scope is then removed atomically.
 - **ERASE-008 — Value-free receipt.** The receipt row holds the entity name,

package/modules/erasure/README.md

@@ -62,7 +62,14 @@ if (receipt.phase !== 'complete') await env.JOBS.send({ erasure: opened.id }); /
 `commit(id,{rows,until})` runs only the D1 phase: bounded atomic batches of at
 most `rows` dependents (default 500), leaves first, with the subject row last.
 Each deleted row's `erasureStatements` and `invalidateTransfersStatements()` go
-in the same batch. `deleteBlobs(id,{until})` runs only the blob phase, after the
+in the same batch.
+The first step collects and orders the whole plan and queues what it does not delete
+in the private scope table; each later step reads and verifies only its own slice, so the
+work of an erasure is linear in its rows, however many steps it takes. The queue is
+not trusted for completeness: once it is empty, one more step collects the graph again
+from the subject and every remembered parent, and anything written meanwhile is
+erased before the receipt says `complete`. Index the child columns an edge
+matches on (`on`), as foreign keys usually are, or each step scans that table. `deleteBlobs(id,{until})` runs only the blob phase, after the
 commit. `run` does both within the time budget. Every phase is safe to repeat,
 and a concurrent runner gets `erasure_busy` (409). The receipt says `complete`
 only after the completion transaction re-reads every declared dependent and audit path

package/modules/erasure/audit.mjs

@@ -4,7 +4,7 @@ import { statement, quote, chunks, randomHex } from './sql.mjs';
  * nobody holding the database (or an old archive) can recompute or test it. */
 export const newLabel = () => 'erased:' + randomHex(16);
 
-export function auditStatements(db, d, plan, label, { only } = {}) {
+export function auditStatements(db, d, plan, label, { only, relabel = true } = {}) {
   const out = [];
   for (const item of d.audit) {
     if (only && item.of !== only) continue;
@@ -13,7 +13,7 @@ export function auditStatements(db, d, plan, label, { only } = {}) {
     const set = [`${quote(item.column)}=?`, ...clear.map(([c]) => `${quote(c)}=?`)].join(',');
     // A previously relabelled row is still this operation's audit: a writer
     // may have changed its detail after the first cleanup.
-    out.push(statement(db, `UPDATE ${quote(item.table)} SET ${set} WHERE ${quote(item.column)}=?${item.where ? ` AND (${item.where})` : ''}`, label, ...clear.map(([, v]) => v), label));
+    if (relabel) out.push(statement(db, `UPDATE ${quote(item.table)} SET ${set} WHERE ${quote(item.column)}=?${item.where ? ` AND (${item.where})` : ''}`, label, ...clear.map(([, v]) => v), label));
     for (const part of chunks(keys, 200)) {
       out.push(statement(db, `UPDATE ${quote(item.table)} SET ${set} WHERE ${quote(item.column)} IN (SELECT value FROM json_each(?))${item.where ? ` AND (${item.where})` : ''}`,
         label, ...clear.map(([, v]) => v), JSON.stringify(part)));

package/modules/erasure/cascade.mjs

@@ -5,6 +5,7 @@ import { verificationStatements, childAbsenceStatements } from './verification.m
 import { collect, matchSql, checkDeclared } from './plan.mjs';
 import { auditStatements } from './audit.mjs';
 import { progressStatement, committedStatement } from './receipt.mjs';
+import { queueStatements, readQueue, consumeStatement, clearQueue, slicePlan, rootScopeExists } from './queue.mjs';
 
 const where = (keys, table) => keys.get(table).pk.map(c => `${c === 'rowid' ? 'rowid' : quote(c)}=?`).join(' AND ');
 const values = e => Object.values(e.key);
@@ -37,7 +38,8 @@ export async function deletionStatements(ctx, d, plan, entries, id, deleted) {
 export async function firstStatements(ctx, d, plan, label) {
   return d.beforeStatements ? await d.beforeStatements({ db: ctx.db, subject: plan.subject, label }) : [];
 }
-export const cleanupStatements = (ctx, d, plan, label) => [...redactStatements(ctx.db, d, plan), ...auditStatements(ctx.db, d, plan, label)];
+// `relabel: false` (a slice of the plan) leaves the table-wide relabel of earlier audit rows to the final batch.
+export const cleanupStatements = (ctx, d, plan, label, options) => [...redactStatements(ctx.db, d, plan), ...auditStatements(ctx.db, d, plan, label, options)];
 /** Commits with the subject row: a second redaction/audit pass catches rows written
  * during a long erasure. Verify before removing the root (so triggers cannot hide
  * new children through CASCADE), then after final policy effects. */
@@ -53,8 +55,43 @@ export async function finalStatements(ctx, d, plan, id, label, now, deleted) {
   return out;
 }
 
+const lost = error => {
+  if (/erasure_retained_missing/.test(String(error?.message ?? error))) throw new ErasureError('retained_row_missing', 409);
+  if (/CHECK constraint failed/.test(String(error?.message ?? error))) throw new ErasureError('erasure_busy', 409);
+  throw error;
+};
+
+/** A non-final step: deletes `entries` (a slice of the plan in deletion order)
+ * and leaves `rest` queued. Everything the batch verifies is bounded by the
+ * slice. Completeness is the final step's job, which collects the whole graph
+ * again from the subject and every remembered parent. */
+async function sliceStep(ctx, d, op, entries, { first = null, rest = null } = {}) {
+  const { db, fence } = ctx, id = op.id, deleted = JSON.parse(op.deleted);
+  const plan = await slicePlan(db, d, JSON.parse(op.subject), entries);
+  const batch = [db.prepare('PRAGMA defer_foreign_keys=ON'),
+    guard(db, "EXISTS(SELECT 1 FROM rer_erasure_operations WHERE id=? AND step=? AND phase='deleting')", id, op.step),
+    ...await fence.transfers()];
+  batch.push(...await scopeStatements(db, d, first ?? plan, id, first ? [...entries, first.root] : entries, { whole: Boolean(first) }));
+  if (first) batch.push(...await firstStatements(ctx, d, plan, op.label));
+  batch.push(...await verificationStatements(db, d, plan, id, op.label));
+  batch.push(...cleanupStatements(ctx, d, plan, op.label, { relabel: false }));
+  batch.push(...await deletionStatements(ctx, d, plan, entries, id, deleted));
+  batch.push(...await verificationStatements(db, d, plan, id, op.label, { intake: false }));
+  if (rest) batch.push(...queueStatements(db, id, rest));
+  else batch.push(consumeStatement(db, id, entries.at(-1).seq));
+  batch.push(progressStatement(db, id, op.step, deleted), db.prepare('DELETE FROM rer_erasure_guard'));
+  try { await db.batch(batch); }
+  catch (error) {
+    if (/erasure_scope_changed/.test(String(error?.message ?? error))) { await clearQueue(db, id).run(); return 'changed'; }
+    return lost(error);
+  }
+  return true;
+}
+
 /** One bounded, atomic D1 commit of up to `rows` dependents, leaves first. The
- * subject row commits with the last step. A concurrent runner loses the guard. */
+ * subject row commits with the last step. A concurrent runner loses the guard.
+ * The first step collects and orders the whole plan and queues what it leaves;
+ * later steps take their slice from the queue until it is empty. */
 export async function step(ctx, d, id, { rows = 500 } = {}) {
   const { db, fence } = ctx;
   const op = await statement(db, 'SELECT * FROM rer_erasure_operations WHERE id=?', id).first();
@@ -63,29 +100,33 @@ export async function step(ctx, d, id, { rows = 500 } = {}) {
   const now = new Date().toISOString(), deleted = JSON.parse(op.deleted);
   await checkDeclared(db, d);
   insist(Number.isInteger(rows) && rows > 0, 'batch_rows');
+  if (op.step > 0) {
+    const slice = await readQueue(db, id, rows);
+    if (slice.length) {
+      insist(await rootScopeExists(db, id, d), 'erasure_scope_missing', 409);
+      return sliceStep(ctx, d, op, slice);
+    }
+  }
   const remembered = await readScope(db, id);
   insist(op.step === 0 || remembered.some(e => e.table === d.root.table), 'erasure_scope_missing', 409);
   const plan = await collect(db, d, JSON.parse(op.subject), remembered);
   insist(plan && plan.root, 'subject_removed_outside_erasure', 409);
+  const take = plan.order.slice(0, rows), final = take.length === plan.order.length;
+  if (!final) return sliceStep(ctx, d, op, take, { first: op.step === 0 ? plan : null, rest: plan.order.slice(rows) });
   const batch = [db.prepare('PRAGMA defer_foreign_keys=ON'),
     guard(db, "EXISTS(SELECT 1 FROM rer_erasure_operations WHERE id=? AND step=? AND phase='deleting')", id, op.step),
     ...await fence.transfers()];
-  const take = plan.order.slice(0, rows), final = take.length === plan.order.length;
   batch.push(...await scopeStatements(db, d, plan, id, [...take, plan.root]));
   if (op.step === 0) batch.push(...await firstStatements(ctx, d, plan, op.label));
   batch.push(...await verificationStatements(db, d, plan, id, op.label));
   batch.push(...cleanupStatements(ctx, d, plan, op.label));
   batch.push(...await deletionStatements(ctx, d, plan, take, id, deleted));
-  if (final) batch.push(...await finalStatements(ctx, d, plan, id, op.label, now, deleted));
-  else batch.push(...await verificationStatements(db, d, plan, id, op.label, { intake: false }));
-
-  batch.push(progressStatement(db, id, op.step, deleted), db.prepare('DELETE FROM rer_erasure_guard'));
+  batch.push(...await finalStatements(ctx, d, plan, id, op.label, now, deleted));
+  batch.push(clearQueue(db, id), progressStatement(db, id, op.step, deleted), db.prepare('DELETE FROM rer_erasure_guard'));
   try { await db.batch(batch); }
   catch (error) {
     if (/erasure_scope_changed/.test(String(error?.message ?? error))) return 'changed';
-    if (/erasure_retained_missing/.test(String(error?.message ?? error))) throw new ErasureError('retained_row_missing', 409);
-    if (/CHECK constraint failed/.test(String(error?.message ?? error))) throw new ErasureError('erasure_busy', 409);
-    throw error;
+    return lost(error);
   }
-  return !final;
+  return false;
 }