@runeditrun/rer 0.1.1 → 0.2.0

package/cli/package-mode.mjs

@@ -0,0 +1,46 @@
+// Package mode: a first-party checkout that pins the @runeditrun/rer package as
+// an exact devDependency instead of carrying a vendored copy (scripts/rer.mjs,
+// scripts/base-cli and scripts/base-onboarding). Its commands run `rer VERB`
+// from node_modules/.bin, and its adapter imports the package's exports.
+import { readFile } from 'node:fs/promises';
+import { resolve } from 'node:path';
+
+export const packageName = '@runeditrun/rer';
+export const exactVersion = /^\d+\.\d+\.\d+(?:-[0-9A-Za-z.-]+)?$/;
+export const vendoredPaths = ['scripts/rer.mjs', 'scripts/base-cli', 'scripts/base-onboarding'];
+
+// The specifier a package.json declares for the package, if any.
+export const declaredPackage = pkg => pkg?.devDependencies?.[packageName] ?? pkg?.dependencies?.[packageName];
+
+// What a verb's OPERATIONS argv and package script are in each mode
+// (a null verb is the bare `rer` alias).
+export const commandArgv = (verb, packaged) => packaged ? ['rer', ...(verb ? [verb] : [])] : ['node', 'scripts/rer.mjs', ...(verb ? [verb] : [])];
+export const commandLine = (verb, packaged) => commandArgv(verb, packaged).join(' ');
+
+// The importer entry pnpm-lock.yaml holds for the package: { group,
+// specifier, version, locked } (locked: the packages section resolves that
+// version with a sha512 integrity), or undefined. pnpm writes lockfile
+// version 9 in a fixed layout, which this reads line by line.
+export async function lockedPackage(root) {
+ let text;
+ try { text = await readFile(resolve(root, 'pnpm-lock.yaml'), 'utf8'); } catch { return undefined; }
+ const lines = text.split('\n'), indent = line => line.length - line.trimStart().length;
+ // The lines under a key at a given indentation, up to the next line at or above it.
+ const block = (from, to, key, depth) => {
+  const start = lines.findIndex((line, index) => index >= from && index < to && indent(line) === depth && line.trim() === key);
+  if (start < 0) return undefined;
+  let end = start + 1;
+  while (end < to && (!lines[end].trim() || indent(lines[end]) > depth)) end++;
+  return [start + 1, end];
+ };
+ const importers = block(0, lines.length, 'importers:', 0), own = importers && block(...importers, '.:', 2);
+ if (!own) return undefined;
+ for (const group of ['devDependencies', 'dependencies']) {
+  const entries = block(...own, `${group}:`, 4), entry = entries && block(...entries, `'${packageName}':`, 6);
+  if (!entry) continue;
+  const fields = Object.fromEntries(lines.slice(...entry).map(line => /^\s+(specifier|version):\s*'?([^'\s]*)'?\s*$/.exec(line)).filter(Boolean).map(match => [match[1], match[2]]));
+  const packages = block(0, lines.length, 'packages:', 0), resolved = packages && block(...packages, `'${packageName}@${fields.version}':`, 2);
+  return { group, specifier: fields.specifier, version: fields.version, locked: Boolean(resolved && lines.slice(...resolved).some(line => /^\s+resolution: \{integrity: sha512-/.test(line))) };
+ }
+ return undefined;
+}

package/cli/parse.mjs

@@ -1,9 +1,15 @@
 import { resolve } from 'node:path';
 import { commonFlags, serverDefaults, verbs } from './contract.mjs';
 import { invalid, refuse } from './errors.mjs';
-const booleans = new Set(['--help', '--json', '--non-interactive', '--yes', '--dry-run', '--open', '--stop', '--no-queue', '--login', '--legacy-v1', '--acknowledge-unverified-metadata']);
+import { isLoopbackHost } from '../modules/operator-auth/loopback.mjs';
+const booleans = new Set(['--help', '--json', '--non-interactive', '--yes', '--dry-run', '--open', '--stop', '--no-queue', '--login', '--legacy-v1', '--acknowledge-unverified-metadata', '--door', '--direct', '--site']);
 export const mailbox = value => typeof value === 'string' && value.length <= 254 && /^[a-zA-Z0-9.!+_%\-]+@[a-zA-Z0-9\-]+(?:\.[a-zA-Z0-9\-]+)+$/.test(value);
-export const loopback = host => ['127.0.0.1', 'localhost', '::1'].includes(host);
+// A loopback host: the shared predicate (including `*.localhost` door names),
+// plus `::1` as --host and a bracket-stripped hostname spell it.
+export const loopback = host => host === '::1' || isLoopbackHost(host);
+// The addresses rer binds directly. A `*.localhost` name is reached through the
+// front door; binding one would give a `::1`-only listener on macOS.
+export const listenHost = host => ['127.0.0.1', 'localhost', '::1'].includes(host);
 export const origin = (host, port) => `http://${host === '::1' ? '[::1]' : host}:${port}`;
 
 export function parse(argv, cwd = process.cwd(), { independent = false, deferTail = false } = {}) {
@@ -39,7 +45,10 @@ export function parse(argv, cwd = process.cwd(), { independent = false, deferTai
  }
  if (options.help) return options;
  if (deferTail) { options.cwd=resolve(cwd,options.cwd);return options; }
- if(options.stop && ['--port','--host','--idle-timeout','--no-queue','--as','--login','--models','--models-service'].some(flag=>options.supplied.has(flag)))throw invalid('--stop cannot be combined with start-only flags.');
+ if(options.stop && ['--port','--host','--idle-timeout','--no-queue','--as','--login','--models','--models-service','--door','--direct'].some(flag=>options.supplied.has(flag)))throw invalid('--stop cannot be combined with start-only flags.');
+ // --port and --host always mean direct mode; --door and --direct pick a mode.
+ if(options.door&&options.direct)throw invalid('Choose one of --door and --direct.');
+ if(options.door&&['--port','--host'].some(flag=>options.supplied.has(flag)))throw invalid('--door cannot be combined with --port or --host, which always serve directly.');
  if(options.models!==undefined && !['fake','live'].includes(options.models))throw invalid('--models takes fake or live.');
  if(options.modelsService!==undefined && options.models!=='live')throw invalid('--models-service requires --models live.');
  if(options.as!==undefined && (options.login || !/^[a-z][a-z0-9-]{0,39}$/.test(options.as)))throw invalid(options.login?'--as and --login cannot be combined.':'--as takes a persona name such as owner, signed-out or admin.');
@@ -53,9 +62,10 @@ export function parse(argv, cwd = process.cwd(), { independent = false, deferTai
   options.port = Number(options.port);
  }
  for(const key of ['httpPort','httpsPort'])if(options[key]!==undefined){if(!/^[0-9]+$/.test(options[key])||Number(options[key])<1||Number(options[key])>65535)throw invalid('Ingress port must be an integer from 1 to 65535.');options[key]=Number(options[key]);}
+ if(options.site&&['platform','image','bindAddress','httpPort','httpsPort','envFile','host'].some(key=>options[key]!==undefined))throw invalid('--site takes no platform, container or host flags: the run site is static files on an assets-only Worker.');
  if(['image','bindAddress','httpPort','httpsPort'].some(key=>options[key]!==undefined)&&options.platform!=='container')throw invalid('Container image and ingress flags require --platform container.');
  if(options.platform !== undefined && !['workers','container'].includes(options.platform))throw invalid('Platform must be workers or container.');
- if (options.host !== undefined && !(verb === 'deploy' && options.platform === 'container') && !loopback(options.host)) throw refuse('Host must be exactly 127.0.0.1, localhost or ::1.');
+ if (options.host !== undefined && !(verb === 'deploy' && options.platform === 'container') && !listenHost(options.host)) throw refuse('Host must be exactly 127.0.0.1, localhost or ::1.');
  if (options.ownerEmail !== undefined) { if (!mailbox(options.ownerEmail)) throw invalid('Provide a valid plain owner mailbox.'); options.ownerEmail = options.ownerEmail.toLowerCase(); }
  if (options.ownerName !== undefined && (options.ownerName.length > 200 || /[\p{Cc}\p{Cf}]/u.test(options.ownerName))) throw invalid('Provide a valid owner name.');
  if (options.target !== undefined && !['local', 'remote'].includes(options.target)) throw invalid('Target must be local or remote.');

package/cli/pnpm-runtime.mjs

@@ -0,0 +1,96 @@
+import { createHash } from 'node:crypto';
+import { createReadStream, createWriteStream } from 'node:fs';
+import { chmod, lstat, mkdir, mkdtemp, readFile, rename, rm, writeFile } from 'node:fs/promises';
+import { homedir } from 'node:os';
+import { join } from 'node:path';
+import { pipeline } from 'node:stream/promises';
+import { Transform } from 'node:stream';
+import { spawn } from 'node:child_process';
+import { missing } from './errors.mjs';
+import { shellQuote } from './node-runtime-cache.mjs';
+
+// The project's pinned pnpm, provided the way rer provides its pinned Node:
+// fetched once from the npm registry, its tarball checked against the
+// registry's sha512 integrity before anything is extracted or run, and kept in
+// rer's own cache (~/.rer/pnpm/pnpm-VERSION). Only rer's own commands for the
+// project put it on their PATH; nothing global changes, and it is used only
+// when the person's PATH has no pnpm of the pinned version.
+export const pnpmCache = () => join(homedir(), '.rer', 'pnpm');
+const directoryOf = version => join(pnpmCache(), `pnpm-${version}`);
+const shim = version => join(directoryOf(version), 'shim');
+const receipt = version => join(directoryOf(version), '.rer-verified.json');
+const entry = version => join(directoryOf(version), 'bin', 'pnpm.cjs');
+
+async function digest(path, algorithm, encoding) {
+ const hash = createHash(algorithm);
+ for await (const chunk of createReadStream(path)) hash.update(chunk);
+ return hash.digest(encoding);
+}
+async function owned(path, directory) {
+ const stat = await lstat(path);
+ if (stat.isSymbolicLink() || (directory ? !stat.isDirectory() : !stat.isFile()) || (process.getuid && stat.uid !== process.getuid()) || (stat.mode & 0o022)) throw Error('Unsafe pnpm cache placement.');
+}
+async function prepareCache() {
+ for (const path of [join(homedir(), '.rer'), pnpmCache()]) {
+  await mkdir(path, { mode: 0o700 }).catch(error => { if (error.code !== 'EEXIST') throw error; });
+  try { await owned(path, true); } catch { throw missing(`The pnpm cache directory must be an owned, non-linked directory without group/other write access: ${path}. Correct its placement and permissions before retrying.`); }
+ }
+ return pnpmCache();
+}
+
+/** The verified cached pnpm's PATH directory, or undefined when none is cached. */
+export async function cachedPnpm(version) {
+ try { await lstat(directoryOf(version)); } catch (error) { if (error.code === 'ENOENT') return; throw error; }
+ try {
+  for (const path of [join(homedir(), '.rer'), pnpmCache(), directoryOf(version), shim(version)]) await owned(path, true);
+  for (const path of [receipt(version), entry(version), join(shim(version), 'pnpm')]) await owned(path, false);
+  const record = JSON.parse(await readFile(receipt(version), 'utf8'));
+  if (record.version !== version || !/^sha512-/.test(record.integrity) || record.entrySha256 !== await digest(entry(version), 'sha256', 'hex')) throw Error('pnpm cache integrity mismatch.');
+  return shim(version);
+ } catch {
+  throw missing(`The cached pnpm is unsafe or incomplete. Preserve it for inspection with: mv ${shellQuote(directoryOf(version))} ${shellQuote(directoryOf(version) + '.quarantine-' + Date.now())}. Then rerun the original rer command to fetch a verified release.`);
+ }
+}
+
+async function download(url, destination, limit, signal) {
+ const response = await fetch(url, { signal, redirect: 'error' });
+ if (!response.ok || !response.body) throw Error('The pnpm release could not be downloaded.');
+ let bytes = 0;
+ const bounded = new Transform({ transform(chunk, encoding, callback) { bytes += chunk.length; callback(bytes > limit ? Error('pnpm release download exceeds its size limit.') : null, chunk); } });
+ await pipeline(response.body, bounded, createWriteStream(destination, { flags: 'wx', mode: 0o600 }), { signal });
+}
+function extract(archive, directory, signal) {
+ const child = spawn('tar', ['-xzf', archive, '-C', directory], { stdio: 'ignore', signal });
+ return new Promise((resolve, reject) => {
+  let failure;
+  child.once('error', error => { failure = error; });
+  child.once('close', code => code === 0 && !failure ? resolve() : reject(failure ?? Error('Verified pnpm release extraction failed.')));
+ });
+}
+
+/** Fetch, verify and cache pnpm VERSION; returns its PATH directory. `registry` is the npm registry origin. */
+export async function downloadPnpm(version, cancellation, { registry = 'https://registry.npmjs.org' } = {}) {
+ const cache = await prepareCache(), temporary = await mkdtemp(join(cache, '.download-'));
+ const signal = AbortSignal.any([cancellation, AbortSignal.timeout(60000)].filter(Boolean));
+ try {
+  const metadata = join(temporary, 'release.json'), archive = join(temporary, 'pnpm.tgz');
+  await download(`${registry}/pnpm/${version}`, metadata, 1024 * 1024, signal);
+  const release = JSON.parse(await readFile(metadata, 'utf8'));
+  const integrity = release?.dist?.integrity;
+  if (release?.version !== version || typeof integrity !== 'string' || !/^sha512-[A-Za-z0-9+/]{86}==$/.test(integrity)) throw Error('The pnpm release integrity is missing.');
+  await download(`${registry}/pnpm/-/pnpm-${version}.tgz`, archive, 64 * 1024 * 1024, signal);
+  if (`sha512-${await digest(archive, 'sha512', 'base64')}` !== integrity) throw Error('pnpm release integrity verification failed; nothing was extracted or run.');
+  // This is the first point at which any downloaded content can be run.
+  await extract(archive, temporary, signal);
+  const extracted = join(temporary, 'package');
+  if (JSON.parse(await readFile(join(extracted, 'package.json'), 'utf8')).version !== version) throw Error('Verified pnpm release did not name the project pin.');
+  await mkdir(join(extracted, 'shim'), { mode: 0o700 });
+  // `node` is rer's own: the command puts its Node first on PATH beside this.
+  await writeFile(join(extracted, 'shim', 'pnpm'), `#!/bin/sh\nexec node ${shellQuote(entry(version))} "$@"\n`, { mode: 0o700 });
+  await writeFile(join(extracted, '.rer-verified.json'), JSON.stringify({ version, integrity, entrySha256: await digest(join(extracted, 'bin', 'pnpm.cjs'), 'sha256', 'hex') }) + '\n', { flag: 'wx', mode: 0o600 });
+  await chmod(extracted, 0o700);
+  try { await rename(extracted, directoryOf(version)); }
+  catch (error) { if (!['EEXIST', 'ENOTEMPTY'].includes(error.code) || !(await cachedPnpm(version))) throw error; }
+  return shim(version);
+ } finally { await rm(temporary, { recursive: true, force: true }); }
+}

package/cli/portability-worker.mjs

@@ -2,7 +2,7 @@ import { portabilityPlan, ensurePortabilitySchema } from '../modules/container/p
 import { exportArchive, importArchive, fileRecords } from '../modules/portability/files.mjs';
 import { readLegacyArchive } from '../modules/portability/format.mjs';
 import { recoverLegacyArchive } from '../modules/portability/legacy-files.mjs';
-import { legacyEmptyTables, requireLegacyEmpty } from '../modules/portability/legacy-safety.mjs';
+import { legacyTargetState, requireLegacyEmpty } from '../modules/portability/legacy-safety.mjs';
 import { migrationReplay } from '../modules/portability/migration-history.mjs';
 import { join } from 'node:path';
 import { readFile } from 'node:fs/promises';
@@ -33,7 +33,7 @@ async function run(direction, { root, path, journal, binding, buckets, policy, t
   const migrations=async()=>migrationReplay(await appliedMigrations(root,proxy.env[binding],binding,unstable_splitSqlQuery),policy);
   const options={ db: proxy.env[binding], buckets: Object.fromEntries(Object.entries(buckets).map(([name, binding]) => [name, proxy.env[binding]])), policy, migrations };
   if(direction==='legacy-preflight') {
-   await requireLegacyEmpty(options,await legacyEmptyTables(options.db));
+   await requireLegacyEmpty(options,await legacyTargetState(options.db,options.migrations));
    return {checkedEmpty:true};
   }
   await ensurePortabilitySchema(proxy.env[binding], await portabilityPlan(unstable_splitSqlQuery));

package/cli/runtime-front-door.mjs

@@ -7,10 +7,12 @@ import { trafficProxy } from './server-proxy.mjs';
 // All public serving, including setup's bounded runtime, uses this listener.
 // The adapter receives a separate loopback port and keeps the public origin
 // for application URLs, cookies and sign-in links.
-export async function runtimeFrontDoor({ host, port, activity }) {
+// In door mode (`door`) the listener is 127.0.0.1 on a port the OS assigns,
+// and only the machine's front door reaches it.
+export async function runtimeFrontDoor({ host, port, activity, door, devKey, origin }) {
  const runtimePort = await runtimeLoopbackPort(port);
  const observer = activity ?? { begin: () => () => {}, touch: () => {} };
- const proxy = await trafficProxy({ host, port, target: runtimePort, activity: observer });
+ const proxy = await trafficProxy({ host, port, target: runtimePort, activity: observer, door, devKey, origin });
  return { ...proxy, runtimePort };
 }
 

package/cli/server-proxy.mjs

@@ -1,18 +1,33 @@
 import http from 'node:http';
 import net from 'node:net';
-import { randomUUID } from 'node:crypto';
+import { createHmac, randomUUID, timingSafeEqual } from 'node:crypto';
 import { posix } from 'node:path';
 import { refuse } from './errors.mjs';
+import { loopback } from './parse.mjs';
 import { fontResponseHeaders } from './font-cache.mjs';
 
 // The public listener observes transport lifetime without buffering or replacing
 // application responses. Preserve Host, Origin, cookies, status and streaming.
 // Each request opens its own loopback connection: a pooled keep-alive socket
 // that the runtime has already dropped would otherwise fail a fresh request.
-export async function trafficProxy({host,port,target,activity}) {
- const probe=randomUUID(),sockets=new Set();
+// In door mode (`door`: {host, header, secret}) it answers only requests whose
+// Host is its own `<name>.localhost:<port>` (or a subdomain) and that carry the
+// per-start secret the front door adds; cookies are not scoped by port, so
+// anything else could bring another site's cookies here.
+// Vite's /@fs/<absolute path> answers only a request holding the checkout's dev
+// key (devKey: the key gate's header or cookie); anything else gets 404, so
+// Vite's refusal page, which lists the serving allow list, never answers it: a
+// 403 carrying that page for any other path (a checkout-root file) is turned
+// into the same 404.
+// A Host that is neither loopback, a `*.localhost` name nor the configured
+// origin's (origin) gets a plain 421 here: the application would refuse it
+// anyway, and an auth check that throws on it must not answer with a crash page.
+export async function trafficProxy({host,port,target,activity,door,devKey,origin}) {
+ const probe=randomUUID(),sockets=new Set(),keyed=keyHolder(devKey),configured=origin?new URL(origin).host:null;
  const server=http.createServer((req,res)=>{
-  if(!publicPath(req.url)){req.resume();notFound(res);return;}
+  if(door&&!doorAdmits(req,door)){req.resume();res.writeHead(403,{'content-type':'text/plain; charset=utf-8'});res.end('This checkout answers only through its front door.');return;}
+  if(!hostAdmits(req,configured)){req.resume();res.writeHead(421,{'content-type':'text/plain; charset=utf-8'});res.end('This local server answers only its own host.');return;}
+  if(!publicPath(req.url)||fsPath(req.url)&&!keyed(req)){req.resume();notFound(res);return;}
   const internal=req.headers['x-rer-probe']===probe;delete req.headers['x-rer-probe'];
   const finish=internal?()=>{}:activity.begin();
   let requestEnded=req.complete,responseEnded=false;
@@ -20,6 +35,20 @@ export async function trafficProxy({host,port,target,activity}) {
   req.once('end',()=>{requestEnded=true;completed();});req.once('aborted',finish);
   res.once('close',()=>{responseEnded=true;if(req.destroyed)finish();else completed();});res.once('finish',()=>{responseEnded=true;completed();});
   const upstream=http.request({host:'127.0.0.1',port:target,path:req.url,method:req.method,headers:req.headers,agent:false},reply=>{
+   // Vite answers a path outside its serving allow list with a 403 page that lists the
+   // allow list (checkout and home paths); a request without the dev key gets 404 instead.
+   // Any other 403 is the application's own and passes through.
+   if(reply.statusCode===403&&!keyed(req)){
+    const parts=[];
+    reply.on('data',chunk=>parts.push(chunk));
+    reply.once('end',()=>{
+     const body=Buffer.concat(parts);
+     if(body.includes(restrictedPage)){notFound(res);return;}
+     res.writeHead(reply.statusCode,fontResponseHeaders(req.url,reply.statusCode,reply.rawHeaders,req.headers));res.end(body);
+    });
+    reply.once('error',()=>res.destroy());
+    return;
+   }
    res.writeHead(reply.statusCode,fontResponseHeaders(req.url,reply.statusCode,reply.rawHeaders,req.headers));reply.pipe(res);
   });
   req.once('aborted',()=>upstream.destroy());res.once('close',()=>upstream.destroy());
@@ -27,7 +56,9 @@ export async function trafficProxy({host,port,target,activity}) {
  });
  server.on('connection',socket=>{sockets.add(socket);socket.on('close',()=>sockets.delete(socket));});
  server.on('upgrade',(req,socket,head)=>{
-  if(!publicPath(req.url)){socket.end('HTTP/1.1 404 Not Found\r\nConnection: close\r\nContent-Length: 0\r\n\r\n');return;}
+  if(door&&!doorAdmits(req,door)){socket.end('HTTP/1.1 403 Forbidden\r\nConnection: close\r\nContent-Length: 0\r\n\r\n');return;}
+  if(!hostAdmits(req,configured)){socket.end('HTTP/1.1 421 Misdirected Request\r\nConnection: close\r\nContent-Length: 0\r\n\r\n');return;}
+  if(!publicPath(req.url)||fsPath(req.url)&&!keyed(req)){socket.end('HTTP/1.1 404 Not Found\r\nConnection: close\r\nContent-Length: 0\r\n\r\n');return;}
   const hmr=String(req.headers['sec-websocket-protocol']??'').split(',').map(s=>s.trim()).includes('vite-hmr');
   const upstream=net.connect(target,'127.0.0.1',()=>{
    upstream.write(`${req.method} ${req.url} HTTP/${req.httpVersion}\r\n${req.rawHeaders.reduce((lines,value,i)=>i%2?lines:lines+value+': '+req.rawHeaders[i+1]+'\r\n','')}\r\n`);
@@ -55,6 +86,33 @@ export async function trafficProxy({host,port,target,activity}) {
  }
  return {probe,port:server.address().port,async close(){for(const socket of sockets)socket.destroy();await new Promise(resolve=>server.close(resolve));}};
 }
+function doorAdmits(req,door){
+ const host=String(req.headers.host??'').toLowerCase(),given=Buffer.from(String(req.headers[door.header]??'')),secret=Buffer.from(door.secret);
+ // The secret never reaches the application.
+ delete req.headers[door.header];
+ for(let i=req.rawHeaders.length-2;i>=0;i-=2)if(req.rawHeaders[i].toLowerCase()===door.header)req.rawHeaders.splice(i,2);
+ return (host===door.host||host.endsWith('.'+door.host))&&given.length===secret.length&&timingSafeEqual(given,secret);
+}
+function hostAdmits(req,configured){
+ const host=req.headers.host;
+ if(host===undefined)return true;
+ let url;try{url=new URL(`http://${host}`);}catch{return false;}
+ if(url.username||url.password||url.pathname!=='/'||url.search||url.hash)return false;
+ return loopback(url.hostname)||url.host===configured;
+}
+// The key gate's own credentials (modules/operator-auth/dev-gate.mjs): the
+// x-rer-dev-key header, or the browser's rer_dev_gate_<port> cookie.
+function keyHolder(key){
+ if(!key)return ()=>false;
+ const same=(a,b)=>{a=Buffer.from(a);b=Buffer.from(b);return a.length===b.length&&timingSafeEqual(a,b);};
+ const cookie=createHmac('sha256',key).update('rer-dev-gate\0cookie').digest('hex');
+ return req=>{
+  const header=req.headers['x-rer-dev-key'];
+  if(header!==undefined)return same(String(header),key);
+  return String(req.headers.cookie??'').split(';').map(part=>part.trim()).some(part=>/^rer_dev_gate_\d+=/.test(part)&&same(part.slice(part.indexOf('=')+1),cookie));
+ };
+}
+const restrictedPage=Buffer.from('<h1>403 Restricted</h1>');
 function notFound(res){res.writeHead(404,{'content-type':'text/plain; charset=utf-8'});res.end('Not found');}
 // The runtime's built-in routes (/cdn-cgi/*: Local Explorer, trigger handlers,
 // R2 and platform proxies), the checkout's private files and export archives
@@ -73,6 +131,12 @@ export function publicPath(url){
  const served=posix.normalize('/'+segments.join('/')).split('/').filter(Boolean),exports=segment=>/^exports$/i.test(segment);
  return !exports(served[0])&&!(served[0]?.startsWith('@')&&served.some(exports));
 }
+// Vite's /@fs/ prefix in any spelling publicPath decodes.
+export function fsPath(url){
+ let path=String(url).split(/[?#]/)[0];
+ for(let round=0;round<4;round++){let decoded;try{decoded=decodeURIComponent(path);}catch{return true;}if(decoded===path)break;path=decoded;}
+ return /^@fs$/i.test(posix.normalize('/'+path.replace(/\\/g,'/').split('/').map(segment=>segment.trim()).join('/')).split('/').filter(Boolean)[0]??'');
+}
 // Count application data frames, not protocol ping/pong or an open control
 // socket. Parse lengths incrementally without retaining application payloads.
 export function frameObserver(touch) {

package/cli/server-registry.mjs

@@ -55,12 +55,13 @@ function memoryMessage(counted,available,floor,mode) {
  const list=counted.length?`Running now:\n${counted.map(listing).join('\n')}\nA dev server holds about 0.5-1.3 GiB and a preview 0.4-0.8 GiB; stopping one with its command above frees that.`:'No dev or preview server is running, so something else is using the memory.';
  return `${head}\n${list}\nTo start anyway, lower the floor, for example RER_SERVERS_MIN_MEMORY_BYTES=${Math.floor(floor/2)} rer ${mode} (0 turns it off).`;
 }
-function limitMessage(counted,cap,limit,mode) {
- const holders=cap<limit?counted.filter(item=>item.explicit&&item.limit===cap):[];
+function limitMessage(counted,cap,explicit,mode) {
+ const holders=explicit?[]:counted.filter(item=>item.explicit&&item.limit===cap);
  const head=`Not started: ${counted.length} dev or preview ${counted.length===1?'server is':'servers are'} running on this computer and the limit is ${cap}.`;
  const list=`Running now:\n${counted.map(listing).join('\n')}`;
  const raise=holders.length
   ?`The limit is ${cap} because ${holders.length===1?'a server was':'servers were'} started with RER_SERVER_LIMIT=${cap} (${holders.map(item=>item.checkout).join(', ')}). Stop ${holders.length===1?'it':'them'} and start again, or start everything with a higher RER_SERVER_LIMIT=N.`
+  :explicit?`This start set RER_SERVER_LIMIT=${cap}; to allow more, start it with a higher RER_SERVER_LIMIT=N.`
   :`To allow more, start this one with a higher limit, for example RER_SERVER_LIMIT=${cap*2} rer ${mode}. Servers started without RER_SERVER_LIMIT allow ${defaultServerLimit}.`;
  return `${head}\n${list}\nTo make room, stop one with its command above. ${raise}`;
 }
@@ -71,9 +72,11 @@ function limitMessage(counted,cap,limit,mode) {
 // before queue admission/local operation. Stop waits for process+state cleanup,
 // which never needs the machine transaction. Generation removal happens last.
 // The limit is 10 unless the person sets RER_SERVER_LIMIT. Every record keeps the
-// limit it started with and whether the person set it. Across the running
-// servers the cap is the lowest limit a person set explicitly, so a deliberate
-// "RER_SERVER_LIMIT=3" keeps holding every start. A recorded default (including
+// limit it started with and whether the person set it. A start that sets
+// RER_SERVER_LIMIT is capped by that value alone, higher or lower than any
+// running server's. A start that sets nothing is capped by the lowest limit a
+// running server's person set explicitly, so a deliberate "RER_SERVER_LIMIT=3"
+// keeps holding starts that do not say otherwise. A recorded default (including
 // the old default of 2 in records written before this rule) never lowers the cap
 // below the current default.
 export const defaultServerLimit=serverDefaults.serverLimit;
@@ -132,8 +135,8 @@ export async function serverRegistry(root,{env=process.env,memory=availableMemor
    const same=state.running.find(item=>item.checkout===checkout);
    if(same)return {existing:same};
    // Journeys are listed but uncounted: they neither use nor lower the cap.
-   const counted=state.running.filter(item=>!item.journey),cap=Math.min(limit,...counted.filter(item=>item.explicit).map(item=>item.limit));
-   if(!journey&&counted.length>=cap)throw refuse(limitMessage(counted,cap,limit,mode));
+   const counted=state.running.filter(item=>!item.journey),cap=explicit?limit:Math.min(limit,...counted.filter(item=>item.explicit).map(item=>item.limit));
+   if(!journey&&counted.length>=cap)throw refuse(limitMessage(counted,cap,explicit,mode));
    // Unreadable memory is not a reason to refuse; only a reading below the floor is.
    const available=journey||floor===0?NaN:await memory();
    if(available<floor)throw refuse(memoryMessage(counted,available,floor,mode));

package/cli/settings.mjs

@@ -1,3 +1,6 @@
+import { missing } from './errors.mjs';
+import { shared } from './shared.mjs';
+
 // Reuse the seed's existing declarations; no parallel auth setting aliases.
 export function localSettingKeys(project) {
  const manifest = project.setupManifest ?? project.setupSeed?.manifest;
@@ -13,3 +16,14 @@ export function requiredLocalSettings(project, values) {
  const manifest=project.setupManifest ?? project.setupSeed?.manifest;
  return [...new Set([keys.email,keys.origin,...(manifest?.fields??[]).filter(field=>field.kind==='secret'&&field.required&&!field.when&&field.input!=='entered'&&field.name!==manifest?.steps.find(step=>step.type==='owner-claim')?.tokenField).map(field=>field.name)])].filter(name=>!values[name]);
 }
+
+// The CLI's own proof to the running application, keyed by the session secret
+// in the seed's private settings: its declared file and format, under the name
+// its adapter declares as sessionSecretKey (default SESSION_SECRET).
+export async function localCliSessionProof(project) {
+ const hooks = project.adapter?.hooks ?? {}, key = hooks.sessionSecretKey ?? 'SESSION_SECRET';
+ const { readSettings } = await shared('adapter-settings.mjs'), { localCliProof } = await shared('adapter-auth.mjs');
+ const secret = (await readSettings(project.root, hooks.secrets ?? {})).values[key];
+ if (typeof secret !== 'string' || !secret) throw missing(`${key} is missing from the private settings.`);
+ return localCliProof(secret);
+}

package/cli/site-check.mjs

@@ -0,0 +1,96 @@
+import { lstat, readdir, readFile } from 'node:fs/promises';
+import { join, posix } from 'node:path';
+import { refuse } from './errors.mjs';
+import { DEV_AI_MARKER, DEV_LAYER_MARKER } from './dev-identity.mjs';
+
+// What a run site may hold: static pages and the files they use, served as
+// Cloudflare static assets with default HTML handling. Never server code,
+// Wrangler configuration, migrations, settings, local data or owner data.
+const FORBIDDEN = /^(?:wrangler\.(?:json|jsonc|toml)|_worker\.js|_routes\.json|_headers|_redirects|.*\.(?:sql|rer|db|sqlite|sqlite3|env|map))$/i;
+// Routes that exist only on an installed instance.
+export const INSTANCE_ROUTES = ['/signin', '/sign-in', '/login', '/setup', '/app', '/auth', '/api', '/__dev', '/health', '/.well-known'];
+const MAX_FILE = 25 * 1024 * 1024, MAX_FILES = 20000;
+
+/** Every file, as a site path ("run.html") with its bytes. */
+async function files(folder) {
+ const found = new Map();
+ async function walk(directory, prefix) {
+  for (const name of (await readdir(directory)).sort()) {
+   const path = join(directory, name), site = prefix + name, status = await lstat(path);
+   if (name.startsWith('.')) throw refuse(`The run site holds a hidden file: ${site}. It contains only public pages and their files.`);
+   if (status.isSymbolicLink() || (!status.isFile() && !status.isDirectory())) throw refuse(`The run site holds a link or special file: ${site}.`);
+   if (status.isDirectory()) { await walk(path, site + '/'); continue; }
+   if (FORBIDDEN.test(name)) throw refuse(`The run site holds ${site}, which is not a static page or asset. Server code, configuration, migrations and data never go in it.`);
+   if (status.size > MAX_FILE) throw refuse(`The run site file ${site} is larger than 25 MiB.`);
+   found.set(site, await readFile(path));
+   if (found.size > MAX_FILES) throw refuse('The run site holds more than 20,000 files.');
+  }
+ }
+ await walk(folder, '');
+ return found;
+}
+
+const safeDecode = path => { try { return decodeURI(path); } catch { return path; } };
+
+/** How Cloudflare's static assets (auto-trailing-slash) answer a path, or null. */
+export function servedFile(names, pathname) {
+ const path = pathname.replace(/^\/+/, '');
+ if (!path) return names.has('index.html') ? 'index.html' : null;
+ if (names.has(path) && !path.endsWith('.html')) return path;
+ const bare = path.replace(/\/$/, '');
+ if (names.has(`${bare}.html`)) return `${bare}.html`;
+ if (names.has(`${bare}/index.html`)) return `${bare}/index.html`;
+ return null;
+}
+
+// href/src attributes, srcset candidates and CSS url() references.
+function references(text, html) {
+ const found = [];
+ if (html) {
+  for (const match of text.matchAll(/<([a-z][a-z0-9-]*)\b([^>]*)>/gi)) {
+   const [, tag, attributes] = match, rel = /\brel\s*=\s*["']?([^"'>]*)/i.exec(attributes)?.[1].toLowerCase() ?? '';
+   for (const attribute of attributes.matchAll(/\b(href|src|srcset|action|poster|data)\s*=\s*(?:"([^"]*)"|'([^']*)')/gi)) {
+    const name = attribute[1].toLowerCase(), value = (attribute[2] ?? attribute[3]).replace(/&amp;/g, '&');
+    const values = name === 'srcset' ? value.split(',').map(part => part.trim().split(/\s+/)[0]).filter(Boolean) : [value];
+    // Only a plain link or a page anchor navigates; everything else is fetched by the page.
+    const navigates = name === 'href' && (tag.toLowerCase() === 'a' || tag.toLowerCase() === 'area' || (tag.toLowerCase() === 'link' && /\b(?:canonical|alternate|author|license|help|me)\b/.test(rel)));
+    for (const url of values) found.push({ url, navigates });
+   }
+  }
+ }
+ for (const match of text.matchAll(/url\(\s*(?:"([^"]*)"|'([^']*)'|([^)\s]*))\s*\)/gi)) found.push({ url: match[1] ?? match[2] ?? match[3], navigates: false });
+ return found;
+}
+
+/**
+ * Refuse a run site folder that is not exactly static pages and the files they
+ * use: an index and a Run page, every same-origin link resolving, no link to an
+ * instance-only route, nothing fetched from another origin, no dev layer, and
+ * none of the given private values (owner identity, secrets, the dev key).
+ */
+export async function checkSite(folder, { privateValues = [] } = {}) {
+ const all = await files(folder), names = new Set(all.keys());
+ if (!names.has('index.html')) throw refuse('The run site has no index.html (its homepage).');
+ if (!servedFile(names, '/run')) throw refuse('The run site has no /run page.');
+ const markers = [DEV_LAYER_MARKER, DEV_AI_MARKER].map(value => Buffer.from(value));
+ const secrets = privateValues.filter(value => typeof value === 'string' && value.length >= 6).map(value => Buffer.from(value));
+ const problems = [];
+ for (const [site, bytes] of all) {
+  if (markers.some(marker => bytes.includes(marker))) throw refuse(`The run site file ${site} contains the local-only dev layer.`);
+  if (secrets.some(secret => bytes.includes(secret))) throw refuse(`The run site file ${site} contains this installation's private data (owner identity or a secret). The run site renders only edition identity.`);
+  const html = site.endsWith('.html'), css = site.endsWith('.css');
+  if (!html && !css) continue;
+  for (const { url, navigates } of references(bytes.toString('utf8'), html)) {
+   if (!url || /^(?:#|mailto:|tel:|data:|javascript:void)/i.test(url)) continue;
+   if (/^(?:[a-z][a-z0-9+.-]*:|\/\/)/i.test(url)) {
+    if (!navigates) problems.push(`${site} fetches ${url} from another origin`);
+    continue;
+   }
+   const pathname = posix.resolve('/' + posix.dirname(site), url.replace(/[?#].*$/, ''));
+   if (INSTANCE_ROUTES.some(route => pathname === route || pathname.startsWith(route + '/'))) problems.push(`${site} links to ${pathname}, which exists only on an installed instance`);
+   else if (!servedFile(names, safeDecode(pathname))) problems.push(`${site} links to ${pathname}, which the site does not have`);
+  }
+ }
+ if (problems.length) throw refuse(`The run site has broken or out-of-site references: ${problems.slice(0, 8).join('; ')}${problems.length > 8 ? `; and ${problems.length - 8} more` : ''}.`);
+ return { files: names.size, pages: [...names].filter(name => name.endsWith('.html')).length };
+}

package/cli/site-preview.mjs

@@ -0,0 +1,53 @@
+import { createServer } from 'node:http';
+import { readdir, readFile, lstat } from 'node:fs/promises';
+import { extname, join } from 'node:path';
+import { servedFile } from './site-check.mjs';
+
+const types = { '.html': 'text/html; charset=utf-8', '.css': 'text/css; charset=utf-8', '.js': 'text/javascript; charset=utf-8', '.mjs': 'text/javascript; charset=utf-8', '.json': 'application/json', '.svg': 'image/svg+xml', '.png': 'image/png', '.jpg': 'image/jpeg', '.jpeg': 'image/jpeg', '.webp': 'image/webp', '.avif': 'image/avif', '.gif': 'image/gif', '.ico': 'image/x-icon', '.woff2': 'font/woff2', '.woff': 'font/woff', '.ttf': 'font/ttf', '.otf': 'font/otf', '.txt': 'text/plain; charset=utf-8', '.xml': 'application/xml', '.webmanifest': 'application/manifest+json' };
+
+async function names(folder) {
+ const found = new Set();
+ async function walk(directory, prefix) {
+  for (const entry of await readdir(directory, { withFileTypes: true })) {
+   if (entry.isDirectory()) await walk(join(directory, entry.name), prefix + entry.name + '/');
+   else if (entry.isFile()) found.add(prefix + entry.name);
+  }
+ }
+ await walk(folder, '');
+ return found;
+}
+
+/**
+ * Serve a built run site on loopback the way Cloudflare's static assets serve
+ * it (auto-trailing-slash HTML handling, 404.html for a missing path): the
+ * preview `rer dev` prints as RER_SITE. GET and HEAD only; nothing else is read.
+ */
+export async function sitePreview(folder, { host = '127.0.0.1', ports }) {
+ const server = createServer(async (request, response) => {
+  try {
+   if (!['GET', 'HEAD'].includes(request.method)) { response.writeHead(405, { allow: 'GET, HEAD' }); return response.end(); }
+   const url = new URL(request.url, 'http://site.invalid'), files = await names(folder);
+   let pathname; try { pathname = decodeURIComponent(url.pathname); } catch { pathname = '/'; }
+   // A request for page.html is answered at its canonical path, as the host does.
+   if (pathname.endsWith('.html') && files.has(pathname.slice(1))) {
+    const canonical = pathname.endsWith('/index.html') || pathname === '/index.html' ? pathname.slice(0, -'index.html'.length) : pathname.slice(0, -'.html'.length);
+    response.writeHead(307, { location: canonical + url.search }); return response.end();
+   }
+   const file = pathname.includes('\0') || pathname.split('/').some(part => part === '..' || part.startsWith('.')) ? null : servedFile(files, pathname);
+   const target = file ?? (files.has('404.html') ? '404.html' : null);
+   if (!target || !(await lstat(join(folder, target))).isFile()) { response.writeHead(404, { 'content-type': 'text/plain; charset=utf-8' }); return response.end('Not found'); }
+   const body = await readFile(join(folder, target));
+   response.writeHead(file ? 200 : 404, { 'content-type': types[extname(target).toLowerCase()] ?? 'application/octet-stream', 'cache-control': 'no-store', 'content-length': body.length });
+   response.end(request.method === 'HEAD' ? undefined : body);
+  } catch { if (!response.headersSent) response.writeHead(500); response.end(); }
+ });
+ for (const port of ports) {
+  const bound = await new Promise(resolve => {
+   const failed = () => resolve(false);
+   server.once('error', failed);
+   server.listen(port, host, () => { server.off('error', failed); resolve(true); });
+  });
+  if (bound) return { url: `http://${host === '::1' ? '[::1]' : host}:${port}`, port, close: () => new Promise(resolve => { server.closeAllConnections?.(); server.close(() => resolve()); }) };
+ }
+ throw new Error('No free port for the run site preview.');
+}