@runeditrun/rer 0.1.1 → 0.2.1

package/cli/managed-server.mjs

@@ -1,5 +1,6 @@
 import { prepareLiveModels } from './ai-local.mjs';
 import {fileURLToPath} from 'node:url';
+import {join} from 'node:path';
 import { serverRegistry } from './server-registry.mjs';
 import { activityClock } from './server-activity.mjs';
 import { runtimeFrontDoor } from './runtime-front-door.mjs';
@@ -13,24 +14,29 @@ import { invalid,missing,refuse,RerError,lifecycleError } from './errors.mjs';
 import { processInfo } from '../modules/job-queue/processes.mjs';
 import { declaredCrons,runScheduled } from './scheduled.mjs';
 import { readDevKey,requireDevKey,refuseManagedInstallation,resolvePersona,openUrl,DEV_KEY_HEADER } from './dev-identity.mjs';
+import { announceDoorRoute,claimSavedName,moveCheckout,routeRunning,verifyDoorFor } from './door-mode.mjs';
 
 // Seeds without devIdentity keep the outbox sign-in unchanged. With it, dev
 // opens signed in (RER_SIGNED_IN, RER_OPEN); --login and preview keep the
 // outbox, reached through RER_OPEN's one-time key exchange. A runtime that
 // serves no outbox (a seed's preview without one) is not pointed at it.
-export function ready(out,url,dev,json=false,outbox=true){
+// A seed that declares a run site also gets RER_SITE: its static run site
+// (homepage, /run, docs) served locally on its own port, after the ready lines.
+export function ready(out,url,dev,json=false,outbox=true,siteUrl){
  const signInUrl=url+'/__dev/outbox',open=dev&&(dev.identity||outbox);
- if(json){out.event('ready',{url,...(outbox?{signInUrl}:{}),...(dev?{signedInAs:dev.signedInAs??null,...(open?{openUrl:dev.openUrl}:{})}:{})});return;}
+ if(json){out.event('ready',{url,...(outbox?{signInUrl}:{}),...(dev?{signedInAs:dev.signedInAs??null,...(open?{openUrl:dev.openUrl}:{})}:{}),...(siteUrl?{siteUrl}:{})});return;}
  out.human(`RER_READY ${url}`);
- if(dev?.identity){if(dev.signedInAs)out.human(`RER_SIGNED_IN ${dev.signedInAs}`);out.human(`RER_OPEN ${dev.openUrl}`);out.human('Open that link on this computer. Its fragment holds this checkout\'s dev key, which the page keeps only as a cookie; never share the link.');return;}
- if(!outbox)return;
- out.human(`RER_SIGN_IN ${signInUrl}`);
- if(dev)out.human(`RER_OPEN ${dev.openUrl}`);
- out.human(`Open ${dev?'the last link on this computer (it carries the dev key; never share it)':'the outbox'}, choose the newest sign-in message and follow its link. No email was sent.`);
+ if(dev?.identity){if(dev.signedInAs)out.human(`RER_SIGNED_IN ${dev.signedInAs}`);else if(dev.ownerLeft)out.human('No active owner remains in this app, so rer dev cannot sign in as one. Use rer dev --login with another operator, or rer reset --yes and rer setup for a new owner.');out.human(`RER_OPEN ${dev.openUrl}`);out.human('Open that link on this computer. Its fragment holds this checkout\'s dev key, which the page keeps only as a cookie; never share the link.');}
+ else if(outbox){
+  out.human(`RER_SIGN_IN ${signInUrl}`);
+  if(dev)out.human(`RER_OPEN ${dev.openUrl}`);
+  out.human(`Open ${dev?'the last link on this computer (it carries the dev key; never share it)':'the outbox'}, choose the newest sign-in message and follow its link. No email was sent.`);
+ }
+ if(siteUrl)out.human(`RER_SITE ${siteUrl}`);
 }
 export async function managedServer(project,options,out,{clock={}}={}){
  const registry=await serverRegistry(project.root),controller=new AbortController();
- let store,operation,proxy,activity,app,termination,reason,cleanupPromise,finished,selected,cleaned;
+ let store,operation,proxy,activity,app,termination,reason,cleanupPromise,finished,selected,cleaned,site;
  const scheduling=new AbortController();
  let activityWrites=Promise.resolve(),pendingActivity,activityWriting=false,infrastructureFailure;
  function recordActivity(fields){
@@ -39,13 +45,14 @@ export async function managedServer(project,options,out,{clock={}}={}){
  }
  const stopped=new Promise(resolve=>{finished=resolve;});
  const cleanupDone=new Promise(resolve=>{cleaned=resolve;});
- const cleanup=()=>cleanupPromise??=(async()=>{scheduling.abort();activity?.close();await store?.closeCommands();await proxy?.close();await operation?.release();})();
+ const cleanup=()=>cleanupPromise??=(async()=>{scheduling.abort();activity?.close();await site?.close();await store?.closeCommands();await proxy?.close();await operation?.release();})();
  const stop=async why=>{reason??=why;controller.abort();finished();await cleanupDone;return {};};
  const handlers=new Map(['SIGINT','SIGTERM'].map(name=>[name,()=>{termination=name;void stop(name);} ]));
  for(const [name,handler]of handlers)process.on(name,handler);
  try{
   if(options.stop){await registry.stop(options.verb,options);return {};}
   controller.signal.throwIfAborted();
+  if(options.door||options.direct)await moveCheckout(project,options,out,registry);
   const devIdentity=project.adapter.devIdentity;
   if(options.as!==undefined&&!(devIdentity&&options.verb==='dev'))throw invalid('--as needs a seed that declares devIdentity.');
   let devKey=devIdentity?await readDevKey(project.root):null;
@@ -62,13 +69,20 @@ export async function managedServer(project,options,out,{clock={}}={}){
    if(options.verb==='dev' && (running.models??'fake')!==(options.models??'fake'))throw refuse('Stop the running dev server before changing --models mode.');
    if(options.modelsService)throw refuse('Stop the running dev server before saving live-dev credentials.');
    if(options.verb==='dev'&&Boolean(running.login)!==Boolean(options.login))throw refuse(`The running dev server ${running.login?'uses':'does not use'} --login. Stop it with rer dev --stop to change sign-in mode.`);
-   const response=await fetch(running.url+'/health',{headers:{'x-rer-probe':running.probe},signal:AbortSignal.timeout(5000)});
+   // A door-mode server is probed on its own proxy, never through the door.
+   await claimSavedName(project,running.url);
+   await routeRunning(running);
+   const {appFetch}=await shared('app-fetch.mjs');
+   const response=await appFetch(running.url+'/health',{headers:{'x-rer-probe':running.probe},signal:AbortSignal.timeout(5000)});
    if(!response.ok || (await response.json()).status!=='ok')throw refuse('Registered application failed health verification. Stop it before retrying.');
    if(devIdentity)devKey=await requireDevKey(project.root);
-   emitReady(out,options,running.url,devIdentity&&await devReady(running.url,devKey,options,controller.signal));return {reused:true};
+   // A key is sent (or printed) for a door origin only once the door proves it is ours.
+   if(devIdentity)await verifyDoorFor(running.url);
+   const dev=devIdentity&&await devReady(running.url,devKey,options,controller.signal);
+   await emitReady(out,options,project.root,running.url,dev,true,running.siteUrl);return {reused:true};
   }
   await registry.serve(async action=>{
-   if(action==='status')return {...activity?.snapshot(),url:selected?.url,probe:proxy?.probe};
+   if(action==='status')return {...activity?.snapshot(),url:selected?.url,probe:proxy?.probe,siteUrl:site?.url};
    if(action==='stop')return stop('explicit stop');
    throw Error('Unknown management operation');
   });
@@ -81,7 +95,7 @@ export async function managedServer(project,options,out,{clock={}}={}){
   const seed=project.adapter.setup?await loadInstallerSeed(project.root,project.adapter):undefined;project.setupManifest=seed?.manifest;
   const keys=localSettingKeys(project);
   selected=await selectedOrigin(project,options);
-  await availablePort(selected.host,selected.port,{root:project.root,saved:!selected.explicitPort&&selected.savedOrigin!==undefined});
+  if(!selected.door)await availablePort(selected.host,selected.port,{root:project.root,saved:!selected.explicitPort&&selected.savedOrigin!==undefined});
   if(!selected.vars[keys.email])throw missing('Private owner settings are missing. Run rer setup first.');
   if(devIdentity&&!devKey)devKey=await requireDevKey(project.root);
   if(devIdentity&&options.verb==='dev'&&!options.login)refuseManagedInstallation(selected.vars,process.env);
@@ -97,7 +111,8 @@ export async function managedServer(project,options,out,{clock={}}={}){
   await tools(project.root,store,controller.signal);
   activity=activityClock({...clock,seconds:options.idleTimeout,onIdle:()=>void stop('idle timeout'),onChange:recordActivity});
   const crons=project.adapter.scheduled!==false?await declaredCrons(project.root,project.adapter).catch(error=>{throw refuse(`The declared scheduled triggers cannot run locally: ${error.message}`);}):[];
-  proxy=await runtimeFrontDoor({host:selected.host,port:selected.port,activity});const internal=proxy.runtimePort;
+  proxy=await runtimeFrontDoor({host:selected.host,port:selected.port,activity,door:selected.door,devKey:devKey??undefined,origin:selected.url});const internal=proxy.runtimePort;
+  if(selected.door)await announceDoorRoute(selected,proxy,registry);
   const modelsLive = options.verb==='dev' ? await prepareLiveModels(project.root,options,store,controller.signal) : undefined;
   const adapterOptions={modelsLive,selectedOrigin:selected.url,operationToken:operation.token,privateSettings:project.adapter.settings,runtimePort:internal,devKey:devKey??undefined,devLogin:Boolean(options.login),scheduled:crons.length>0};
   const input={[keys.email]:selected.vars[keys.email]};
@@ -110,9 +125,22 @@ export async function managedServer(project,options,out,{clock={}}={}){
    if(!identity)throw Error('Runtime exited before custody registration.');
    await registry.update({runtimeProcess:{pid:identity.pid,start:identity.start}});
   },controller.signal,{...adapterOptions,verb:options.verb,dev:project.adapter.dev,preview:project.adapter.preview});
+  // A key is sent (or printed) for a door origin only once the door proves it is ours.
+  if(devKey)await verifyDoorFor(selected.url);
   const dev=devIdentity&&await devReady(selected.url,devKey,options,controller.signal);
   const outbox=await outboxServed(selected.url,devKey,controller.signal);
-  activity.ready();emitReady(out,options,selected.url,dev,outbox);
+  if(options.verb==='dev'&&project.adapter.site){
+   const {devSite}=await import('./site.mjs');
+   try {
+    site=await devSite(project,store,controller.signal,{host:selected.host,port:selected.port});
+    await registry.update({siteUrl:site.url});
+   } catch(error) {
+    if(error.code!=='site_private_data')throw error;
+    const message=`Run site preview refused: ${error.message} The app is running; fix the site and run rer build --site before publishing it.`;
+    if(options.json)out.event('warning',{code:error.code,message});else out.progress(`Warning: ${message}\n`);
+   }
+  }
+  activity.ready();await emitReady(out,options,project.root,selected.url,dev,outbox,site?.url);
   if(crons.length){
    out.progress(`Running ${crons.length===1?'the scheduled trigger':'the scheduled triggers'} locally: ${crons.join(' | ')}\n`);
    void runScheduled({crons,url:`http://127.0.0.1:${internal}`,path:options.verb==='preview'?'/cdn-cgi/local/scheduled':undefined,signal:scheduling.signal,report:run=>reportScheduled(out,options,run)});
@@ -125,19 +153,32 @@ export async function managedServer(project,options,out,{clock={}}={}){
  }catch(error){if(termination)throw new RerError('cancelled',`Stopped by ${termination} after owned children were stopped.`,termination==='SIGINT'?130:143);if(['idle timeout','explicit stop'].includes(reason))return {};throw await lifecycleError(error,store);}finally{await cleanup();cleaned();while(activityWriting)await activityWrites;await registry.close();for(const [name,handler]of handlers)process.off(name,handler);}
 }
 function reportScheduled(out,options,run){
- const at=new Date().toISOString().replace(/\.\d+Z$/,'Z'),outcome=run.skipped?`skipped (${run.error})`:run.ok?`ok ${run.ms}ms`:`failed (${run.status?`HTTP ${run.status}`:run.error}) ${run.ms}ms`;
- if(options.json)out.event('scheduled',{at,cron:run.cron,ok:run.ok,skipped:Boolean(run.skipped),status:run.status,ms:run.ms});else out.human(`RER_SCHEDULED ${at} "${run.cron}" ${outcome}`);
+ const error=options.verb==='preview'&&run.status===404 ? 'The preview target does not expose /cdn-cgi/local/scheduled. Forward the adapter context scheduled flag to previewTarget, or set RER_RUNTIME_TRIGGERS=1 in a custom target using the shared production runtime. For another runtime, expose that internal trigger endpoint or declare scheduled:false.' : run.error;
+ const at=new Date().toISOString().replace(/\.\d+Z$/,'Z'),outcome=run.skipped?`skipped (${error})`:run.ok?`ok ${run.ms}ms`:`failed (${run.status?`HTTP ${run.status}`:error}) ${run.ms}ms`;
+ if(options.json)out.event('scheduled',{at,cron:run.cron,ok:run.ok,skipped:Boolean(run.skipped),status:run.status,ms:run.ms,...(error?{error}:{})});else out.human(`RER_SCHEDULED ${at} "${run.cron}" ${outcome}${error&&run.status?` — ${error}`:''}`);
 }
 // GET, not HEAD: a seed's outbox route need not answer HEAD. The body is never read.
 async function outboxServed(url,devKey,signal){
- const response=await fetch(url+'/__dev/outbox',{headers:devKey?{[DEV_KEY_HEADER]:devKey}:{},signal});
+ const {appFetch}=await shared('app-fetch.mjs');
+ const response=await appFetch(url+'/__dev/outbox',{headers:devKey?{[DEV_KEY_HEADER]:devKey}:{},signal});
  await response.body?.cancel();
  return response.ok;
 }
-function emitReady(out,options,url,dev,outbox){ready(out,url,dev||undefined,options.json,outbox);}
+// dev also keeps its RER_OPEN link in owner-only .rer/local/open-url (0600),
+// which reset removes with the rest of .rer/local, for a person or agent that
+// did not keep the terminal output.
+async function emitReady(out,options,root,url,dev,outbox,siteUrl){
+ if(options.verb==='dev'&&dev?.openUrl){
+  const {privateDirectory,writePrivateFile}=await shared('private-files.mjs');
+  await writePrivateFile(join(await privateDirectory(root,['.rer','local']),'open-url'),dev.openUrl+'\n');
+ }
+ ready(out,url,dev||undefined,options.json,outbox,siteUrl);
+}
 async function devReady(url,key,options,signal){
  if(options.verb==='preview')return {openUrl:openUrl(url,key,{path:'/__dev/key',next:'/__dev/outbox'})};
- if(options.login)return {openUrl:openUrl(url,key,{next:'/__dev/outbox'})};
+ if(options.login)return {openUrl:openUrl(url,key,{path:'/__dev/key',next:'/__dev/outbox'})};
  const as=options.as??'owner',persona=await resolvePersona(url,key,as,signal);
- return {identity:true,signedInAs:persona.email??null,openUrl:openUrl(url,key,{path:'/__dev/key',as})};
+ // The owner persona names the owner the session will actually have (the
+ // remaining owner once the setup owner has left), or none when none is left.
+ return {identity:true,signedInAs:persona.email??null,ownerLeft:as==='owner'&&!persona.email,openUrl:openUrl(url,key,{path:'/__dev/key',as})};
 }

package/cli/package-calls.mjs

@@ -0,0 +1,81 @@
+// A package-mode checkout's commands outside package.json and OPERATIONS.json:
+// its delivery operations (rer-project.json, and the delivery producer's
+// packaging.json that rer-project.json is generated from), the scripts those
+// operations and its CI workflows run, and the workflows themselves. Converting
+// to package mode rewrites their calls into the removed vendored copy
+// (scripts/rer.mjs, scripts/base-cli, scripts/base-onboarding); check fails
+// while any remains.
+import { readFile, readdir } from 'node:fs/promises';
+import { resolve } from 'node:path';
+
+// A command line that runs a file of the vendored copy, and (in a JavaScript
+// file) a string literal naming one, as a spawn argument does.
+const vendoredCall = /\b(?:node|bash|sh)\s+(?:\.\/)?scripts\/(?:rer\.mjs|base-cli\/|base-onboarding\/)/;
+const vendoredLiteral = /(['"`])(?:\.\/)?scripts\/(?:rer\.mjs|base-cli\/|base-onboarding\/)[^'"`\n]*\1/;
+const commentLine = /^\s*(?:#|\/\/|\/?\*)/;
+const jsFile = /\.(?:mjs|cjs|js)$/;
+// A seed-relative script path in a command.
+const scriptToken = /(?<![\w./$-])(?:\.\/)?((?:[\w.-]+\/)*[\w.-]+\.(?:sh|bash|mjs|cjs|js))(?![\w./-])/g;
+
+// The files holding delivery operations, and where in each they are.
+export const operationFiles = [
+ { file: 'rer-project.json', operations: value => value?.operations },
+ { file: 'scripts/delivery/base/packaging.json', operations: value => value?.project?.operations },
+];
+
+async function text(root, file) {
+ try { return await readFile(resolve(root, file), 'utf8'); } catch (error) { if (error.code === 'ENOENT' || error.code === 'EISDIR') return undefined; throw error; }
+}
+
+// Each operations file present: { file, text, value, operations }.
+export async function operationSources(root) {
+ const found = [];
+ for (const { file, operations } of operationFiles) {
+  const source = await text(root, file);
+  if (source === undefined) continue;
+  let value; try { value = JSON.parse(source); } catch { continue; }
+  const commands = operations(value);
+  if (commands && typeof commands === 'object') found.push({ file, text: source, value, operations: commands });
+ }
+ return found;
+}
+
+// The checkout's CI workflow files: { file, text }.
+export async function workflowSources(root) {
+ let names;
+ try { names = await readdir(resolve(root, '.github/workflows')); } catch { return []; }
+ const found = [];
+ for (const name of names.filter(name => /\.ya?ml$/.test(name)).sort()) found.push({ file: `.github/workflows/${name}`, text: await text(root, `.github/workflows/${name}`) });
+ return found.filter(source => source.text !== undefined);
+}
+
+// The seed's own script files a command runs (that exist, outside node_modules
+// and the vendored copy).
+export async function calledScripts(root, command) {
+ const found = [];
+ for (const [, path] of command.matchAll(scriptToken)) {
+  if (/^(?:node_modules\/|scripts\/(?:rer\.mjs$|base-cli\/|base-onboarding\/))/.test(path) || found.includes(path)) continue;
+  if (await text(root, path) !== undefined) found.push(path);
+ }
+ return found;
+}
+
+// Every place these commands still call the vendored copy, as `file:line: text`
+// (or `file operations.NAME: command`).
+export async function vendoredCalls(root) {
+ const calls = [], scripts = new Set();
+ for (const { file, operations } of await operationSources(root)) for (const [name, command] of Object.entries(operations)) {
+  if (typeof command !== 'string') continue;
+  if (vendoredCall.test(command)) calls.push(`${file} operations.${name}: ${command}`);
+  for (const path of await calledScripts(root, command)) scripts.add(path);
+ }
+ const lines = (file, source, literals) => source.split('\n').forEach((line, index) => {
+  if (!commentLine.test(line) && (vendoredCall.test(line) || (literals && vendoredLiteral.test(line)))) calls.push(`${file}:${index + 1}: ${line.trim().slice(0, 160)}`);
+ });
+ for (const { file, text: source } of await workflowSources(root)) {
+  lines(file, source, false);
+  for (const path of await calledScripts(root, source)) scripts.add(path);
+ }
+ for (const path of [...scripts].sort()) lines(path, await text(root, path), jsFile.test(path));
+ return calls;
+}

package/cli/package-mode.mjs

@@ -0,0 +1,46 @@
+// Package mode: a first-party checkout that pins the @runeditrun/rer package as
+// an exact devDependency instead of carrying a vendored copy (scripts/rer.mjs,
+// scripts/base-cli and scripts/base-onboarding). Its commands run `rer VERB`
+// from node_modules/.bin, and its adapter imports the package's exports.
+import { readFile } from 'node:fs/promises';
+import { resolve } from 'node:path';
+
+export const packageName = '@runeditrun/rer';
+export const exactVersion = /^\d+\.\d+\.\d+(?:-[0-9A-Za-z.-]+)?$/;
+export const vendoredPaths = ['scripts/rer.mjs', 'scripts/base-cli', 'scripts/base-onboarding'];
+
+// The specifier a package.json declares for the package, if any.
+export const declaredPackage = pkg => pkg?.devDependencies?.[packageName] ?? pkg?.dependencies?.[packageName];
+
+// What a verb's OPERATIONS argv and package script are in each mode
+// (a null verb is the bare `rer` alias).
+export const commandArgv = (verb, packaged) => packaged ? ['rer', ...(verb ? [verb] : [])] : ['node', 'scripts/rer.mjs', ...(verb ? [verb] : [])];
+export const commandLine = (verb, packaged) => commandArgv(verb, packaged).join(' ');
+
+// The importer entry pnpm-lock.yaml holds for the package: { group,
+// specifier, version, locked } (locked: the packages section resolves that
+// version with a sha512 integrity), or undefined. pnpm writes lockfile
+// version 9 in a fixed layout, which this reads line by line.
+export async function lockedPackage(root) {
+ let text;
+ try { text = await readFile(resolve(root, 'pnpm-lock.yaml'), 'utf8'); } catch { return undefined; }
+ const lines = text.split('\n'), indent = line => line.length - line.trimStart().length;
+ // The lines under a key at a given indentation, up to the next line at or above it.
+ const block = (from, to, key, depth) => {
+  const start = lines.findIndex((line, index) => index >= from && index < to && indent(line) === depth && line.trim() === key);
+  if (start < 0) return undefined;
+  let end = start + 1;
+  while (end < to && (!lines[end].trim() || indent(lines[end]) > depth)) end++;
+  return [start + 1, end];
+ };
+ const importers = block(0, lines.length, 'importers:', 0), own = importers && block(...importers, '.:', 2);
+ if (!own) return undefined;
+ for (const group of ['devDependencies', 'dependencies']) {
+  const entries = block(...own, `${group}:`, 4), entry = entries && block(...entries, `'${packageName}':`, 6);
+  if (!entry) continue;
+  const fields = Object.fromEntries(lines.slice(...entry).map(line => /^\s+(specifier|version):\s*'?([^'\s]*)'?\s*$/.exec(line)).filter(Boolean).map(match => [match[1], match[2]]));
+  const packages = block(0, lines.length, 'packages:', 0), resolved = packages && block(...packages, `'${packageName}@${fields.version}':`, 2);
+  return { group, specifier: fields.specifier, version: fields.version, locked: Boolean(resolved && lines.slice(...resolved).some(line => /^\s+resolution: \{integrity: sha512-/.test(line))) };
+ }
+ return undefined;
+}

package/cli/parse.mjs

@@ -1,9 +1,15 @@
 import { resolve } from 'node:path';
 import { commonFlags, serverDefaults, verbs } from './contract.mjs';
 import { invalid, refuse } from './errors.mjs';
-const booleans = new Set(['--help', '--json', '--non-interactive', '--yes', '--dry-run', '--open', '--stop', '--no-queue', '--login', '--legacy-v1', '--acknowledge-unverified-metadata']);
+import { isLoopbackHost } from '../modules/operator-auth/loopback.mjs';
+const booleans = new Set(['--help', '--json', '--non-interactive', '--yes', '--dry-run', '--open', '--stop', '--detach', '--foreground', '--no-queue', '--login', '--legacy-v1', '--acknowledge-unverified-metadata', '--door', '--direct', '--site']);
 export const mailbox = value => typeof value === 'string' && value.length <= 254 && /^[a-zA-Z0-9.!+_%\-]+@[a-zA-Z0-9\-]+(?:\.[a-zA-Z0-9\-]+)+$/.test(value);
-export const loopback = host => ['127.0.0.1', 'localhost', '::1'].includes(host);
+// A loopback host: the shared predicate (including `*.localhost` door names),
+// plus `::1` as --host and a bracket-stripped hostname spell it.
+export const loopback = host => host === '::1' || isLoopbackHost(host);
+// The addresses rer binds directly. A `*.localhost` name is reached through the
+// front door; binding one would give a `::1`-only listener on macOS.
+export const listenHost = host => ['127.0.0.1', 'localhost', '::1'].includes(host);
 export const origin = (host, port) => `http://${host === '::1' ? '[::1]' : host}:${port}`;
 
 export function parse(argv, cwd = process.cwd(), { independent = false, deferTail = false } = {}) {
@@ -39,7 +45,11 @@ export function parse(argv, cwd = process.cwd(), { independent = false, deferTai
  }
  if (options.help) return options;
  if (deferTail) { options.cwd=resolve(cwd,options.cwd);return options; }
- if(options.stop && ['--port','--host','--idle-timeout','--no-queue','--as','--login','--models','--models-service'].some(flag=>options.supplied.has(flag)))throw invalid('--stop cannot be combined with start-only flags.');
+ if (options.detach && options.foreground) throw invalid('Choose one of --detach and --foreground.');
+ if(options.stop && ['--port','--host','--idle-timeout','--detach','--foreground','--no-queue','--as','--login','--models','--models-service','--door','--direct'].some(flag=>options.supplied.has(flag)))throw invalid('--stop cannot be combined with start-only flags.');
+ // --port and --host always mean direct mode; --door and --direct pick a mode.
+ if(options.door&&options.direct)throw invalid('Choose one of --door and --direct.');
+ if(options.door&&['--port','--host'].some(flag=>options.supplied.has(flag)))throw invalid('--door cannot be combined with --port or --host, which always serve directly.');
  if(options.models!==undefined && !['fake','live'].includes(options.models))throw invalid('--models takes fake or live.');
  if(options.modelsService!==undefined && options.models!=='live')throw invalid('--models-service requires --models live.');
  if(options.as!==undefined && (options.login || !/^[a-z][a-z0-9-]{0,39}$/.test(options.as)))throw invalid(options.login?'--as and --login cannot be combined.':'--as takes a persona name such as owner, signed-out or admin.');
@@ -53,9 +63,10 @@ export function parse(argv, cwd = process.cwd(), { independent = false, deferTai
   options.port = Number(options.port);
  }
  for(const key of ['httpPort','httpsPort'])if(options[key]!==undefined){if(!/^[0-9]+$/.test(options[key])||Number(options[key])<1||Number(options[key])>65535)throw invalid('Ingress port must be an integer from 1 to 65535.');options[key]=Number(options[key]);}
+ if(options.site&&['platform','image','bindAddress','httpPort','httpsPort','envFile','host'].some(key=>options[key]!==undefined))throw invalid('--site takes no platform, container or host flags: the run site is static files on an assets-only Worker.');
  if(['image','bindAddress','httpPort','httpsPort'].some(key=>options[key]!==undefined)&&options.platform!=='container')throw invalid('Container image and ingress flags require --platform container.');
  if(options.platform !== undefined && !['workers','container'].includes(options.platform))throw invalid('Platform must be workers or container.');
- if (options.host !== undefined && !(verb === 'deploy' && options.platform === 'container') && !loopback(options.host)) throw refuse('Host must be exactly 127.0.0.1, localhost or ::1.');
+ if (options.host !== undefined && !(verb === 'deploy' && options.platform === 'container') && !listenHost(options.host)) throw refuse('Host must be exactly 127.0.0.1, localhost or ::1.');
  if (options.ownerEmail !== undefined) { if (!mailbox(options.ownerEmail)) throw invalid('Provide a valid plain owner mailbox.'); options.ownerEmail = options.ownerEmail.toLowerCase(); }
  if (options.ownerName !== undefined && (options.ownerName.length > 200 || /[\p{Cc}\p{Cf}]/u.test(options.ownerName))) throw invalid('Provide a valid owner name.');
  if (options.target !== undefined && !['local', 'remote'].includes(options.target)) throw invalid('Target must be local or remote.');

package/cli/pnpm-runtime.mjs

@@ -0,0 +1,96 @@
+import { createHash } from 'node:crypto';
+import { createReadStream, createWriteStream } from 'node:fs';
+import { chmod, lstat, mkdir, mkdtemp, readFile, rename, rm, writeFile } from 'node:fs/promises';
+import { homedir } from 'node:os';
+import { join } from 'node:path';
+import { pipeline } from 'node:stream/promises';
+import { Transform } from 'node:stream';
+import { spawn } from 'node:child_process';
+import { missing } from './errors.mjs';
+import { shellQuote } from './node-runtime-cache.mjs';
+
+// The project's pinned pnpm, provided the way rer provides its pinned Node:
+// fetched once from the npm registry, its tarball checked against the
+// registry's sha512 integrity before anything is extracted or run, and kept in
+// rer's own cache (~/.rer/pnpm/pnpm-VERSION). Only rer's own commands for the
+// project put it on their PATH; nothing global changes, and it is used only
+// when the person's PATH has no pnpm of the pinned version.
+export const pnpmCache = () => join(homedir(), '.rer', 'pnpm');
+const directoryOf = version => join(pnpmCache(), `pnpm-${version}`);
+const shim = version => join(directoryOf(version), 'shim');
+const receipt = version => join(directoryOf(version), '.rer-verified.json');
+const entry = version => join(directoryOf(version), 'bin', 'pnpm.cjs');
+
+async function digest(path, algorithm, encoding) {
+ const hash = createHash(algorithm);
+ for await (const chunk of createReadStream(path)) hash.update(chunk);
+ return hash.digest(encoding);
+}
+async function owned(path, directory) {
+ const stat = await lstat(path);
+ if (stat.isSymbolicLink() || (directory ? !stat.isDirectory() : !stat.isFile()) || (process.getuid && stat.uid !== process.getuid()) || (stat.mode & 0o022)) throw Error('Unsafe pnpm cache placement.');
+}
+async function prepareCache() {
+ for (const path of [join(homedir(), '.rer'), pnpmCache()]) {
+  await mkdir(path, { mode: 0o700 }).catch(error => { if (error.code !== 'EEXIST') throw error; });
+  try { await owned(path, true); } catch { throw missing(`The pnpm cache directory must be an owned, non-linked directory without group/other write access: ${path}. Correct its placement and permissions before retrying.`); }
+ }
+ return pnpmCache();
+}
+
+/** The verified cached pnpm's PATH directory, or undefined when none is cached. */
+export async function cachedPnpm(version) {
+ try { await lstat(directoryOf(version)); } catch (error) { if (error.code === 'ENOENT') return; throw error; }
+ try {
+  for (const path of [join(homedir(), '.rer'), pnpmCache(), directoryOf(version), shim(version)]) await owned(path, true);
+  for (const path of [receipt(version), entry(version), join(shim(version), 'pnpm')]) await owned(path, false);
+  const record = JSON.parse(await readFile(receipt(version), 'utf8'));
+  if (record.version !== version || !/^sha512-/.test(record.integrity) || record.entrySha256 !== await digest(entry(version), 'sha256', 'hex')) throw Error('pnpm cache integrity mismatch.');
+  return shim(version);
+ } catch {
+  throw missing(`The cached pnpm is unsafe or incomplete. Preserve it for inspection with: mv ${shellQuote(directoryOf(version))} ${shellQuote(directoryOf(version) + '.quarantine-' + Date.now())}. Then rerun the original rer command to fetch a verified release.`);
+ }
+}
+
+async function download(url, destination, limit, signal) {
+ const response = await fetch(url, { signal, redirect: 'error' });
+ if (!response.ok || !response.body) throw Error('The pnpm release could not be downloaded.');
+ let bytes = 0;
+ const bounded = new Transform({ transform(chunk, encoding, callback) { bytes += chunk.length; callback(bytes > limit ? Error('pnpm release download exceeds its size limit.') : null, chunk); } });
+ await pipeline(response.body, bounded, createWriteStream(destination, { flags: 'wx', mode: 0o600 }), { signal });
+}
+function extract(archive, directory, signal) {
+ const child = spawn('tar', ['-xzf', archive, '-C', directory], { stdio: 'ignore', signal });
+ return new Promise((resolve, reject) => {
+  let failure;
+  child.once('error', error => { failure = error; });
+  child.once('close', code => code === 0 && !failure ? resolve() : reject(failure ?? Error('Verified pnpm release extraction failed.')));
+ });
+}
+
+/** Fetch, verify and cache pnpm VERSION; returns its PATH directory. `registry` is the npm registry origin. */
+export async function downloadPnpm(version, cancellation, { registry = 'https://registry.npmjs.org' } = {}) {
+ const cache = await prepareCache(), temporary = await mkdtemp(join(cache, '.download-'));
+ const signal = AbortSignal.any([cancellation, AbortSignal.timeout(60000)].filter(Boolean));
+ try {
+  const metadata = join(temporary, 'release.json'), archive = join(temporary, 'pnpm.tgz');
+  await download(`${registry}/pnpm/${version}`, metadata, 1024 * 1024, signal);
+  const release = JSON.parse(await readFile(metadata, 'utf8'));
+  const integrity = release?.dist?.integrity;
+  if (release?.version !== version || typeof integrity !== 'string' || !/^sha512-[A-Za-z0-9+/]{86}==$/.test(integrity)) throw Error('The pnpm release integrity is missing.');
+  await download(`${registry}/pnpm/-/pnpm-${version}.tgz`, archive, 64 * 1024 * 1024, signal);
+  if (`sha512-${await digest(archive, 'sha512', 'base64')}` !== integrity) throw Error('pnpm release integrity verification failed; nothing was extracted or run.');
+  // This is the first point at which any downloaded content can be run.
+  await extract(archive, temporary, signal);
+  const extracted = join(temporary, 'package');
+  if (JSON.parse(await readFile(join(extracted, 'package.json'), 'utf8')).version !== version) throw Error('Verified pnpm release did not name the project pin.');
+  await mkdir(join(extracted, 'shim'), { mode: 0o700 });
+  // `node` is rer's own: the command puts its Node first on PATH beside this.
+  await writeFile(join(extracted, 'shim', 'pnpm'), `#!/bin/sh\nexec node ${shellQuote(entry(version))} "$@"\n`, { mode: 0o700 });
+  await writeFile(join(extracted, '.rer-verified.json'), JSON.stringify({ version, integrity, entrySha256: await digest(join(extracted, 'bin', 'pnpm.cjs'), 'sha256', 'hex') }) + '\n', { flag: 'wx', mode: 0o600 });
+  await chmod(extracted, 0o700);
+  try { await rename(extracted, directoryOf(version)); }
+  catch (error) { if (!['EEXIST', 'ENOTEMPTY'].includes(error.code) || !(await cachedPnpm(version))) throw error; }
+  return shim(version);
+ } finally { await rm(temporary, { recursive: true, force: true }); }
+}

package/cli/portability-worker.mjs

@@ -2,7 +2,7 @@ import { portabilityPlan, ensurePortabilitySchema } from '../modules/container/p
 import { exportArchive, importArchive, fileRecords } from '../modules/portability/files.mjs';
 import { readLegacyArchive } from '../modules/portability/format.mjs';
 import { recoverLegacyArchive } from '../modules/portability/legacy-files.mjs';
-import { legacyEmptyTables, requireLegacyEmpty } from '../modules/portability/legacy-safety.mjs';
+import { legacyTargetState, requireLegacyEmpty } from '../modules/portability/legacy-safety.mjs';
 import { migrationReplay } from '../modules/portability/migration-history.mjs';
 import { join } from 'node:path';
 import { readFile } from 'node:fs/promises';
@@ -33,7 +33,7 @@ async function run(direction, { root, path, journal, binding, buckets, policy, t
   const migrations=async()=>migrationReplay(await appliedMigrations(root,proxy.env[binding],binding,unstable_splitSqlQuery),policy);
   const options={ db: proxy.env[binding], buckets: Object.fromEntries(Object.entries(buckets).map(([name, binding]) => [name, proxy.env[binding]])), policy, migrations };
   if(direction==='legacy-preflight') {
-   await requireLegacyEmpty(options,await legacyEmptyTables(options.db));
+   await requireLegacyEmpty(options,await legacyTargetState(options.db,options.migrations));
    return {checkedEmpty:true};
   }
   await ensurePortabilitySchema(proxy.env[binding], await portabilityPlan(unstable_splitSqlQuery));

package/cli/release.mjs

@@ -1,5 +1,6 @@
 // Preserve release's accepted parser, producer, receipt and validation exits.
 export async function dispatchRelease(args) {
+ if (['sign', 'receipt', 'keygen'].includes(args[0])) return (await import('../modules/release/signing-cli.mjs')).dispatchSigning(args[0], args.slice(1));
  try {
   const options = {};
   for (let index = 0; index < args.length; index++) {

package/cli/runtime-front-door.mjs

@@ -7,10 +7,12 @@ import { trafficProxy } from './server-proxy.mjs';
 // All public serving, including setup's bounded runtime, uses this listener.
 // The adapter receives a separate loopback port and keeps the public origin
 // for application URLs, cookies and sign-in links.
-export async function runtimeFrontDoor({ host, port, activity }) {
+// In door mode (`door`) the listener is 127.0.0.1 on a port the OS assigns,
+// and only the machine's front door reaches it.
+export async function runtimeFrontDoor({ host, port, activity, door, devKey, origin }) {
  const runtimePort = await runtimeLoopbackPort(port);
  const observer = activity ?? { begin: () => () => {}, touch: () => {} };
- const proxy = await trafficProxy({ host, port, target: runtimePort, activity: observer });
+ const proxy = await trafficProxy({ host, port, target: runtimePort, activity: observer, door, devKey, origin });
  return { ...proxy, runtimePort };
 }
 

package/cli/server-proxy.mjs

@@ -1,18 +1,33 @@
 import http from 'node:http';
 import net from 'node:net';
-import { randomUUID } from 'node:crypto';
+import { createHmac, randomUUID, timingSafeEqual } from 'node:crypto';
 import { posix } from 'node:path';
 import { refuse } from './errors.mjs';
+import { loopback } from './parse.mjs';
 import { fontResponseHeaders } from './font-cache.mjs';
 
 // The public listener observes transport lifetime without buffering or replacing
 // application responses. Preserve Host, Origin, cookies, status and streaming.
 // Each request opens its own loopback connection: a pooled keep-alive socket
 // that the runtime has already dropped would otherwise fail a fresh request.
-export async function trafficProxy({host,port,target,activity}) {
- const probe=randomUUID(),sockets=new Set();
+// In door mode (`door`: {host, header, secret}) it answers only requests whose
+// Host is its own `<name>.localhost:<port>` (or a subdomain) and that carry the
+// per-start secret the front door adds; cookies are not scoped by port, so
+// anything else could bring another site's cookies here.
+// Vite's /@fs/<absolute path> answers only a request holding the checkout's dev
+// key (devKey: the key gate's header or cookie); anything else gets 404, so
+// Vite's refusal page, which lists the serving allow list, never answers it: a
+// 403 carrying that page for any other path (a checkout-root file) is turned
+// into the same 404.
+// A Host that is neither loopback, a `*.localhost` name nor the configured
+// origin's (origin) gets a plain 421 here: the application would refuse it
+// anyway, and an auth check that throws on it must not answer with a crash page.
+export async function trafficProxy({host,port,target,activity,door,devKey,origin}) {
+ const probe=randomUUID(),sockets=new Set(),keyed=keyHolder(devKey),configured=origin?new URL(origin).host:null;
  const server=http.createServer((req,res)=>{
-  if(!publicPath(req.url)){req.resume();notFound(res);return;}
+  if(door&&!doorAdmits(req,door)){req.resume();res.writeHead(403,{'content-type':'text/plain; charset=utf-8'});res.end('This checkout answers only through its front door.');return;}
+  if(!hostAdmits(req,configured)){req.resume();res.writeHead(421,{'content-type':'text/plain; charset=utf-8'});res.end('This local server answers only its own host.');return;}
+  if(!publicPath(req.url)||fsPath(req.url)&&!keyed(req)){req.resume();notFound(res);return;}
   const internal=req.headers['x-rer-probe']===probe;delete req.headers['x-rer-probe'];
   const finish=internal?()=>{}:activity.begin();
   let requestEnded=req.complete,responseEnded=false;
@@ -20,6 +35,20 @@ export async function trafficProxy({host,port,target,activity}) {
   req.once('end',()=>{requestEnded=true;completed();});req.once('aborted',finish);
   res.once('close',()=>{responseEnded=true;if(req.destroyed)finish();else completed();});res.once('finish',()=>{responseEnded=true;completed();});
   const upstream=http.request({host:'127.0.0.1',port:target,path:req.url,method:req.method,headers:req.headers,agent:false},reply=>{
+   // Vite answers a path outside its serving allow list with a 403 page that lists the
+   // allow list (checkout and home paths); a request without the dev key gets 404 instead.
+   // Any other 403 is the application's own and passes through.
+   if(reply.statusCode===403&&!keyed(req)){
+    const parts=[];
+    reply.on('data',chunk=>parts.push(chunk));
+    reply.once('end',()=>{
+     const body=Buffer.concat(parts);
+     if(body.includes(restrictedPage)){notFound(res);return;}
+     res.writeHead(reply.statusCode,fontResponseHeaders(req.url,reply.statusCode,reply.rawHeaders,req.headers));res.end(body);
+    });
+    reply.once('error',()=>res.destroy());
+    return;
+   }
    res.writeHead(reply.statusCode,fontResponseHeaders(req.url,reply.statusCode,reply.rawHeaders,req.headers));reply.pipe(res);
   });
   req.once('aborted',()=>upstream.destroy());res.once('close',()=>upstream.destroy());
@@ -27,7 +56,9 @@ export async function trafficProxy({host,port,target,activity}) {
  });
  server.on('connection',socket=>{sockets.add(socket);socket.on('close',()=>sockets.delete(socket));});
  server.on('upgrade',(req,socket,head)=>{
-  if(!publicPath(req.url)){socket.end('HTTP/1.1 404 Not Found\r\nConnection: close\r\nContent-Length: 0\r\n\r\n');return;}
+  if(door&&!doorAdmits(req,door)){socket.end('HTTP/1.1 403 Forbidden\r\nConnection: close\r\nContent-Length: 0\r\n\r\n');return;}
+  if(!hostAdmits(req,configured)){socket.end('HTTP/1.1 421 Misdirected Request\r\nConnection: close\r\nContent-Length: 0\r\n\r\n');return;}
+  if(!publicPath(req.url)||fsPath(req.url)&&!keyed(req)){socket.end('HTTP/1.1 404 Not Found\r\nConnection: close\r\nContent-Length: 0\r\n\r\n');return;}
   const hmr=String(req.headers['sec-websocket-protocol']??'').split(',').map(s=>s.trim()).includes('vite-hmr');
   const upstream=net.connect(target,'127.0.0.1',()=>{
    upstream.write(`${req.method} ${req.url} HTTP/${req.httpVersion}\r\n${req.rawHeaders.reduce((lines,value,i)=>i%2?lines:lines+value+': '+req.rawHeaders[i+1]+'\r\n','')}\r\n`);
@@ -55,6 +86,33 @@ export async function trafficProxy({host,port,target,activity}) {
  }
  return {probe,port:server.address().port,async close(){for(const socket of sockets)socket.destroy();await new Promise(resolve=>server.close(resolve));}};
 }
+function doorAdmits(req,door){
+ const host=String(req.headers.host??'').toLowerCase(),given=Buffer.from(String(req.headers[door.header]??'')),secret=Buffer.from(door.secret);
+ // The secret never reaches the application.
+ delete req.headers[door.header];
+ for(let i=req.rawHeaders.length-2;i>=0;i-=2)if(req.rawHeaders[i].toLowerCase()===door.header)req.rawHeaders.splice(i,2);
+ return (host===door.host||host.endsWith('.'+door.host))&&given.length===secret.length&&timingSafeEqual(given,secret);
+}
+function hostAdmits(req,configured){
+ const host=req.headers.host;
+ if(host===undefined)return true;
+ let url;try{url=new URL(`http://${host}`);}catch{return false;}
+ if(url.username||url.password||url.pathname!=='/'||url.search||url.hash)return false;
+ return loopback(url.hostname)||url.host===configured;
+}
+// The key gate's own credentials (modules/operator-auth/dev-gate.mjs): the
+// x-rer-dev-key header, or the browser's rer_dev_gate_<port> cookie.
+function keyHolder(key){
+ if(!key)return ()=>false;
+ const same=(a,b)=>{a=Buffer.from(a);b=Buffer.from(b);return a.length===b.length&&timingSafeEqual(a,b);};
+ const cookie=createHmac('sha256',key).update('rer-dev-gate\0cookie').digest('hex');
+ return req=>{
+  const header=req.headers['x-rer-dev-key'];
+  if(header!==undefined)return same(String(header),key);
+  return String(req.headers.cookie??'').split(';').map(part=>part.trim()).some(part=>/^rer_dev_gate_\d+=/.test(part)&&same(part.slice(part.indexOf('=')+1),cookie));
+ };
+}
+const restrictedPage=Buffer.from('<h1>403 Restricted</h1>');
 function notFound(res){res.writeHead(404,{'content-type':'text/plain; charset=utf-8'});res.end('Not found');}
 // The runtime's built-in routes (/cdn-cgi/*: Local Explorer, trigger handlers,
 // R2 and platform proxies), the checkout's private files and export archives
@@ -73,6 +131,12 @@ export function publicPath(url){
  const served=posix.normalize('/'+segments.join('/')).split('/').filter(Boolean),exports=segment=>/^exports$/i.test(segment);
  return !exports(served[0])&&!(served[0]?.startsWith('@')&&served.some(exports));
 }
+// Vite's /@fs/ prefix in any spelling publicPath decodes.
+export function fsPath(url){
+ let path=String(url).split(/[?#]/)[0];
+ for(let round=0;round<4;round++){let decoded;try{decoded=decodeURIComponent(path);}catch{return true;}if(decoded===path)break;path=decoded;}
+ return /^@fs$/i.test(posix.normalize('/'+path.replace(/\\/g,'/').split('/').map(segment=>segment.trim()).join('/')).split('/').filter(Boolean)[0]??'');
+}
 // Count application data frames, not protocol ping/pong or an open control
 // socket. Parse lengths incrementally without retaining application payloads.
 export function frameObserver(touch) {