@runeditrun/rer 0.1.1 → 0.2.1

package/cli/server-registry.mjs

@@ -55,12 +55,13 @@ function memoryMessage(counted,available,floor,mode) {
  const list=counted.length?`Running now:\n${counted.map(listing).join('\n')}\nA dev server holds about 0.5-1.3 GiB and a preview 0.4-0.8 GiB; stopping one with its command above frees that.`:'No dev or preview server is running, so something else is using the memory.';
  return `${head}\n${list}\nTo start anyway, lower the floor, for example RER_SERVERS_MIN_MEMORY_BYTES=${Math.floor(floor/2)} rer ${mode} (0 turns it off).`;
 }
-function limitMessage(counted,cap,limit,mode) {
- const holders=cap<limit?counted.filter(item=>item.explicit&&item.limit===cap):[];
+function limitMessage(counted,cap,explicit,mode) {
+ const holders=explicit?[]:counted.filter(item=>item.explicit&&item.limit===cap);
  const head=`Not started: ${counted.length} dev or preview ${counted.length===1?'server is':'servers are'} running on this computer and the limit is ${cap}.`;
  const list=`Running now:\n${counted.map(listing).join('\n')}`;
  const raise=holders.length
   ?`The limit is ${cap} because ${holders.length===1?'a server was':'servers were'} started with RER_SERVER_LIMIT=${cap} (${holders.map(item=>item.checkout).join(', ')}). Stop ${holders.length===1?'it':'them'} and start again, or start everything with a higher RER_SERVER_LIMIT=N.`
+  :explicit?`This start set RER_SERVER_LIMIT=${cap}; to allow more, start it with a higher RER_SERVER_LIMIT=N.`
   :`To allow more, start this one with a higher limit, for example RER_SERVER_LIMIT=${cap*2} rer ${mode}. Servers started without RER_SERVER_LIMIT allow ${defaultServerLimit}.`;
  return `${head}\n${list}\nTo make room, stop one with its command above. ${raise}`;
 }
@@ -71,9 +72,11 @@ function limitMessage(counted,cap,limit,mode) {
 // before queue admission/local operation. Stop waits for process+state cleanup,
 // which never needs the machine transaction. Generation removal happens last.
 // The limit is 10 unless the person sets RER_SERVER_LIMIT. Every record keeps the
-// limit it started with and whether the person set it. Across the running
-// servers the cap is the lowest limit a person set explicitly, so a deliberate
-// "RER_SERVER_LIMIT=3" keeps holding every start. A recorded default (including
+// limit it started with and whether the person set it. A start that sets
+// RER_SERVER_LIMIT is capped by that value alone, higher or lower than any
+// running server's. A start that sets nothing is capped by the lowest limit a
+// running server's person set explicitly, so a deliberate "RER_SERVER_LIMIT=3"
+// keeps holding starts that do not say otherwise. A recorded default (including
 // the old default of 2 in records written before this rule) never lowers the cap
 // below the current default.
 export const defaultServerLimit=serverDefaults.serverLimit;
@@ -132,8 +135,8 @@ export async function serverRegistry(root,{env=process.env,memory=availableMemor
    const same=state.running.find(item=>item.checkout===checkout);
    if(same)return {existing:same};
    // Journeys are listed but uncounted: they neither use nor lower the cap.
-   const counted=state.running.filter(item=>!item.journey),cap=Math.min(limit,...counted.filter(item=>item.explicit).map(item=>item.limit));
-   if(!journey&&counted.length>=cap)throw refuse(limitMessage(counted,cap,limit,mode));
+   const counted=state.running.filter(item=>!item.journey),cap=explicit?limit:Math.min(limit,...counted.filter(item=>item.explicit).map(item=>item.limit));
+   if(!journey&&counted.length>=cap)throw refuse(limitMessage(counted,cap,explicit,mode));
    // Unreadable memory is not a reason to refuse; only a reading below the floor is.
    const available=journey||floor===0?NaN:await memory();
    if(available<floor)throw refuse(memoryMessage(counted,available,floor,mode));

package/cli/settings.mjs

@@ -1,3 +1,6 @@
+import { missing } from './errors.mjs';
+import { shared } from './shared.mjs';
+
 // Reuse the seed's existing declarations; no parallel auth setting aliases.
 export function localSettingKeys(project) {
  const manifest = project.setupManifest ?? project.setupSeed?.manifest;
@@ -13,3 +16,14 @@ export function requiredLocalSettings(project, values) {
  const manifest=project.setupManifest ?? project.setupSeed?.manifest;
  return [...new Set([keys.email,keys.origin,...(manifest?.fields??[]).filter(field=>field.kind==='secret'&&field.required&&!field.when&&field.input!=='entered'&&field.name!==manifest?.steps.find(step=>step.type==='owner-claim')?.tokenField).map(field=>field.name)])].filter(name=>!values[name]);
 }
+
+// The CLI's own proof to the running application, keyed by the session secret
+// in the seed's private settings: its declared file and format, under the name
+// its adapter declares as sessionSecretKey (default SESSION_SECRET).
+export async function localCliSessionProof(project) {
+ const hooks = project.adapter?.hooks ?? {}, key = hooks.sessionSecretKey ?? 'SESSION_SECRET';
+ const { readSettings } = await shared('adapter-settings.mjs'), { localCliProof } = await shared('adapter-auth.mjs');
+ const secret = (await readSettings(project.root, hooks.secrets ?? {})).values[key];
+ if (typeof secret !== 'string' || !secret) throw missing(`${key} is missing from the private settings.`);
+ return localCliProof(secret);
+}

package/cli/site-bindings.mjs

@@ -0,0 +1,291 @@
+import { walkSyntax, stringValue, memberName } from './site-syntax.mjs';
+import { refuse } from './errors.mjs';
+const finite = (values, key = value => value) => {
+ const unique = [...new Map(values.map(value => [key(value), value])).values()];
+ if (unique.length > 1024) throw refuse('The run site has too many possible values for a browser resource reference to check.');
+ return unique;
+};
+const propertyNames = (node, strings) => {
+ const key = node?.type === 'MemberExpression' ? node.property : node?.key;
+ if (!key) return [];
+ if (!node.computed) return [key.name ?? String(key.value)];
+ return key.type === 'Literal' && typeof key.value === 'number' ? [String(key.value)] : [...strings(key)];
+};
+
+// Keep bindings lexical: a library's parameter or local variable must not take
+// an unrelated same-named value from the island. Resolve finite constant values
+// at a resource sink, rather than treating every URL-shaped string as a fetch.
+export function localValues(tree) {
+ const scopes = new WeakMap(), writesByName = new Map(), computedWrites = [], assigned = new WeakMap(), root = {bindings:new Map(), parent:null, function:true};
+ const writeIndex = name => {
+  if (!writesByName.has(name)) writesByName.set(name, {writes:new Set(), users:new Set()});
+  return writesByName.get(name);
+ };
+ const bind = (scope, name, value) => {
+  if (!scope.bindings.has(name)) scope.bindings.set(name, []);
+  if (value) scope.bindings.get(name).push(value);
+ };
+ const lookup = (node, name) => {
+  let scope = scopes.get(node);
+  while (scope && !scope.bindings.has(name)) scope = scope.parent;
+  return scope?.bindings.get(name);
+ };
+ const bindPattern = (scope, pattern, value) => {
+  if (pattern.type === 'Identifier') { bind(scope, pattern.name, value); return; }
+  if (pattern.type === 'RestElement') { bindPattern(scope, pattern.argument); return; }
+  if (pattern.type === 'AssignmentPattern') { bindPattern(scope, pattern.left, value); bindPattern(scope, pattern.left, pattern.right); return; }
+  for (const [index, item] of (pattern.type === 'ObjectPattern' ? pattern.properties : pattern.elements ?? []).entries()) {
+   if (!item) continue;
+   const target = pattern.type === 'ObjectPattern' ? item.value ?? item.argument : item;
+   const key = pattern.type === 'ObjectPattern' ? item.key : {type:'Literal', value:index};
+   const member = value && key ? {type:'MemberExpression', object:value, property:key, computed:pattern.type !== 'ObjectPattern' || item.computed || key.type === 'Literal'} : null;
+   if (member) scopes.set(member, scope);
+   bindPattern(scope, target, member);
+  }
+ };
+ walkSyntax(tree, (node, path) => {
+  const parent = path.at(-1);
+  let scope = scopes.get(parent) ?? root;
+  if (['FunctionDeclaration','ClassDeclaration'].includes(node.type) && node.id) bind(scope, node.id.name, node);
+  if (node.type === 'ImportDeclaration') for (const specifier of node.specifiers) bind(scope, specifier.local.name);
+  if (/^(?:FunctionExpression|FunctionDeclaration|ArrowFunctionExpression)$/.test(node.type) || node.type === 'BlockStatement' || node.type === 'CatchClause') {
+   scope = {bindings:new Map(), parent:scope, function:node.type !== 'BlockStatement' && node.type !== 'CatchClause'};
+   if (node.type === 'FunctionExpression' && node.id) bind(scope, node.id.name, node);
+   for (const param of node.params ?? (node.param ? [node.param] : [])) bindPattern(scope, param);
+  }
+  scopes.set(node, scope);
+  if (node.type === 'VariableDeclarator') {
+   if (parent.kind === 'var') while (!scope.function && scope.parent) scope = scope.parent;
+   bindPattern(scope, node.id, node.init);
+  }
+ });
+ walkSyntax(tree, node => {
+  if (node.type !== 'AssignmentExpression') return;
+  const operator = node.operator.slice(0, -1);
+  const value = node.operator === '=' ? node.right : {type:['&&','||','??'].includes(operator) ? 'LogicalExpression' : 'BinaryExpression', operator, left:node.left, right:node.right};
+  assigned.set(node, value);
+  if (node.left.type === 'MemberExpression') {
+   const name = memberName(node.left), write = {left:node.left, right:value};
+   if (name === undefined) computedWrites.push(write);
+   else writeIndex(name).writes.add(write);
+  }
+  if (node.left.type !== 'Identifier') return;
+  lookup(node, node.left.name)?.push(value);
+ });
+ // Resolve each expression once into a shared dataflow graph. Dependencies
+ // are re-evaluated only when they gain a value, so cyclic aliases converge
+ // instead of exploring every possible path through member assignments.
+ const expressionResults = new WeakMap(), expressionStates = new WeakMap(), stringStates = new WeakMap(), writeStates = new WeakMap(), pending = new Set();
+ const states = kind => kind === 'strings' ? stringStates : expressionStates;
+ let evaluating;
+ const state = (map, node, kind) => {
+  let result = map.get(node);
+  if (!result) {
+   result = {node, kind, values:new Set(), users:new Set()};
+   map.set(node, result); pending.add(result);
+  }
+  if (evaluating) result.users.add(evaluating);
+  return result;
+ };
+ const read = (node, kind = 'expressions') => node ? state(states(kind), node, kind).values : new Set();
+ const keys = node => propertyNames(node, key => read(key, 'strings'));
+ const memberWrites = name => {
+  const index = writeIndex(name);
+  if (evaluating) index.users.add(evaluating);
+  return index.writes;
+ };
+ // A computed write joins the same fixed point as its key's bindings. Index
+ // each discovered key once and wake only readers of that member name.
+ for (const write of computedWrites) state(writeStates, write, 'writes');
+ function indexWrite(write) {
+  const names = keys(write.left);
+  for (const name of names) {
+   const index = writeIndex(name);
+   if (index.writes.has(write)) continue;
+   index.writes.add(write);
+   for (const user of index.users) pending.add(user);
+  }
+  return names;
+ }
+ const isClass = node => ['ClassDeclaration','ClassExpression'].includes(node.type);
+ function classProperties(constructor, wanted, isStatic, fields, seen = new Set()) {
+  const found = new Map();
+  if (!isClass(constructor) || seen.has(constructor)) return found;
+  seen = new Set(seen).add(constructor);
+  let unknownKey = false;
+  for (const property of constructor.body.body) {
+   if (Boolean(property.static) !== isStatic || (fields !== undefined && (property.type === 'PropertyDefinition') !== fields)) continue;
+   const names = keys(property);
+   if (property.computed && !names.length) unknownKey = true;
+   for (const name of wanted) if (names.includes(name)) {
+    // Static fields initialize after methods even when written before them.
+    const previous = found.get(name)?.[0];
+    if (property.type === 'PropertyDefinition' || previous?.type !== 'PropertyDefinition') found.set(name, [property]);
+   }
+  }
+  const inherited = wanted.filter(name => !found.has(name));
+  // Wait for a computed override's key instead of prematurely retaining the
+  // inherited definition in the monotone graph. Unknown keys stay unknown.
+  if (inherited.length && !unknownKey) for (const parent of read(constructor.superClass)) {
+   for (const [name, properties] of classProperties(parent, inherited, isStatic, fields, seen)) found.set(name, [...(found.get(name) ?? []), ...properties]);
+  }
+  return found;
+ }
+ function classMembers(constructor, names, isStatic) {
+  if (isStatic) return [...classProperties(constructor, names, true).values()].flat();
+  // Instance fields shadow prototype methods, including a method declared by
+  // a subclass. Within each category the nearest declaration wins.
+  const fields = classProperties(constructor, names, false, true);
+  const methods = classProperties(constructor, names.filter(name => !fields.has(name)), false, false);
+  return [...fields.values(), ...methods.values()].flat();
+ }
+ function expressionValues(node) {
+  if (node.type === 'Identifier') {
+   const values = lookup(node, node.name);
+   return values?.length ? values.flatMap(value => [...read(value)]) : [node];
+  }
+  if (node.type === 'MemberExpression') {
+   const names = keys(node);
+   const objects = read(node.object), members = [node];
+   const properties = items => {
+    for (const property of items) if (keys(property).some(key => names.includes(key))) members.push(...read(property.value));
+   };
+   for (const object of objects) {
+    if (object.type === 'ArrayExpression') for (const key of names) members.push(...read(object.elements[Number(key)]));
+    if (object.type === 'ObjectExpression') properties(object.properties);
+    if (isClass(object)) properties(classMembers(object, names, true));
+    if (object.type === 'NewExpression') for (const constructor of read(object.callee)) {
+     if (isClass(constructor)) properties(classMembers(constructor, names, false));
+    }
+   }
+   for (const key of names) for (const write of memberWrites(key)) {
+    if (write.left !== node && [...read(write.left.object)].some(object => objects.has(object))) members.push(...read(write.right));
+   }
+   return members;
+  }
+  if (node.type === 'ConditionalExpression') return [...read(node.consequent), ...read(node.alternate)];
+  if (node.type === 'LogicalExpression') return [...read(node.left), ...read(node.right)];
+  if (node.type === 'SequenceExpression') return read(node.expressions.at(-1));
+  if (node.type === 'AssignmentExpression') return read(assigned.get(node));
+  return [node];
+ }
+ function stringValues(node, seen = new Set()) {
+  if (!node || seen.has(node)) return [];
+  seen = new Set(seen).add(node);
+  const value = stringValue(node);
+  if (value !== undefined) return [value];
+  if (node.type === 'BinaryExpression' && node.operator === '+') return finite(stringValues(node.left, seen).flatMap(left => stringValues(node.right, seen).map(right => left + right)));
+  if (node.type === 'TemplateLiteral') {
+   let values = [node.quasis[0].value.cooked ?? ''];
+   for (let i = 0; i < node.expressions.length; i++) values = finite(values.flatMap(left => stringValues(node.expressions[i], seen).map(right => left + right + (node.quasis[i + 1].value.cooked ?? ''))));
+   return values;
+  }
+  if (node.type === 'CallExpression' && ['decodeURI','decodeURIComponent','atob'].includes(node.callee.name)) return stringValues(node.arguments[0], seen).flatMap(value => {
+   try {return [node.callee.name === 'atob' ? Buffer.from(value,'base64').toString('utf8') : decodeURIComponent(value)];} catch {return [];}
+  });
+  // Expand only the finite syntax graph. Recursive string construction has
+  // an unknown tail, not an ever-growing set of invented complete strings.
+  // Alias states already contain their transitive values; unresolved member
+  // identities contain no additional strings and must not be expanded again.
+  return finite([...read(node)].filter(value => value !== node && !['Identifier','MemberExpression'].includes(value.type)).flatMap(value => stringValues(value, seen)));
+ }
+ function resolve(node, kind) {
+  if (!node) return [];
+  const result = state(states(kind), node, kind);
+  for (const next of pending) {
+   pending.delete(next); evaluating = next;
+   const values = next.kind === 'writes' ? indexWrite(next.node) : next.kind === 'strings' ? stringValues(next.node) : expressionValues(next.node);
+   let changed = false;
+   for (const value of values) if (!next.values.has(value)) { next.values.add(value); changed = true; }
+   if (next.kind === 'strings') finite([...next.values]);
+   if (changed) for (const user of next.users) pending.add(user);
+  }
+  evaluating = undefined;
+  return [...result.values];
+ }
+ function expressions(node) {
+  if (!node) return [];
+  if (expressionResults.has(node)) return expressionResults.get(node);
+  const values = resolve(node, 'expressions').filter(value => {
+   if (value.type !== 'MemberExpression') return true;
+   // A member is its own unresolved identity until a value reaches it. Keep
+   // unresolved cycles, but remove that identity after resolving an alias.
+   return ![...expressionStates.get(value).values].some(other => other !== value && (other.type !== 'MemberExpression' || !expressionStates.get(other)?.values.has(value)));
+  });
+  // Indexing is complete and every dependency has settled before caching.
+  expressionResults.set(node, values);
+  return values;
+ }
+ const strings = node => resolve(node, 'strings');
+ const names = node => propertyNames(node, strings);
+ const origins = expressions;
+ const localClass = node => {
+  const values = expressions(node);
+  return values.length > 0 && values.every(value => {
+   const constructors = value.type === 'NewExpression' ? expressions(value.callee) : [value];
+   return constructors.length > 0 && constructors.every(isClass);
+  });
+ };
+ // Recognize browser globals through aliases without mistaking library methods
+ // or shadowed parameters for those APIs.
+ function global(node, name, seen = new Set()) {
+  if (!node || seen.has(node)) return false;
+  seen = new Set(seen).add(node);
+  return origins(node).some(value => {
+   if (value.type === 'Identifier') return value.name === name && !lookup(value, value.name);
+   return value.type === 'MemberExpression' && names(value).includes(name) && ['window','globalThis','self'].some(root => global(value.object, root, seen));
+  });
+ }
+ // A runtime suffix does not erase a known origin or route at a resource sink.
+ // Retain only the prefix before the first unknown value; later fragments are
+ // not a trustworthy prefix. Complete values still use ordinary file checks.
+ const alternatives = values => finite(values, value => JSON.stringify(value));
+ const combine = (left, right) => alternatives(left.flatMap(start => start.complete ? right.map(end => ({value:start.value + end.value, complete:end.complete})) : [start]));
+ function resources(node, seen = new Set()) {
+  const unknown = [{value:'', complete:false}];
+  if (!node || seen.has(node)) return unknown;
+  seen = new Set(seen).add(node);
+  const value = stringValue(node);
+  if (value !== undefined) return [{value, complete:true}];
+  if (node.type === 'BinaryExpression' && node.operator === '+') return combine(resources(node.left, seen), resources(node.right, seen));
+  if (node.type === 'TemplateLiteral') {
+   let values = [{value:node.quasis[0].value.cooked ?? '', complete:true}];
+   for (let i = 0; i < node.expressions.length; i++) values = combine(combine(values, resources(node.expressions[i], seen)), [{value:node.quasis[i + 1].value.cooked ?? '', complete:true}]);
+   return values;
+  }
+  if (node.type === 'NewExpression' && global(node.callee, 'Request')) return resources(node.arguments[0], seen);
+  if (node.type === 'NewExpression' && global(node.callee, 'URL')) {
+   const targets = resources(node.arguments[0], seen), bases = resources(node.arguments[1], seen);
+   const written = [...memberWrites('href')].filter(write => expressions(write.left.object).includes(node)).flatMap(write => resources(write.right, seen));
+   return alternatives([...written, ...targets.flatMap(target => {
+    // Absolute targets do not depend on the base. Incomplete targets retain
+    // their known prefix, including a foreign origin or an instance subtree.
+    if (/^[a-z][a-z0-9+.-]*:/i.test(target.value)) return [target];
+    if (!node.arguments[1]) return unknown;
+    return bases.flatMap(base => {
+     if (!base.complete) {
+      if (target.value && /^(?:[a-z][a-z0-9+.-]*:|\/\/)/i.test(base.value)) return [base];
+      return target.value.startsWith('/') ? [target] : unknown;
+     }
+     try {
+      if (!target.value && !target.complete) return unknown;
+      return [{value:new URL(target.value, base.value).href, complete:target.complete}];
+     } catch { return unknown; }
+    });
+   })]);
+  }
+  if (node.type === 'MemberExpression' && names(node).some(name => ['href','url'].includes(name))) {
+   const objects = expressions(node.object), values = objects.flatMap(object => object.type === 'NewExpression' && (global(object.callee, 'URL') || global(object.callee, 'Request')) ? resources(object, seen) : []);
+   if (values.length) return alternatives(values);
+  }
+  if (node.type === 'CallExpression' && names(node.callee).some(name => ['toString','toJSON'].includes(name))) {
+   const values = expressions(node.callee.object).flatMap(object => object.type === 'NewExpression' && global(object.callee, 'URL') ? resources(object, seen) : []);
+   if (values.length) return alternatives(values);
+  }
+  const resolved = expressions(node).filter(value => value !== node);
+  if (resolved.length) return alternatives(resolved.flatMap(value => resources(value, seen)));
+  const complete = strings(node);
+  return complete.length ? complete.map(value => ({value, complete:true})) : unknown;
+ }
+ return {strings, names, resources, expressions, origins, global, localClass};
+}

package/cli/site-browser-objects.mjs

@@ -0,0 +1,36 @@
+import { memberName } from './site-syntax.mjs';
+
+// Follow actual browser object provenance. An object's field named `href`,
+// or a URL parser's `href` setter, does not make that object a DOM element.
+export function browserObjects({expressions, origins, strings, global}) {
+ const window = node => ['window','globalThis','self'].some(name => global(node, name));
+ const document = node => global(node, 'document');
+ const location = node => global(node, 'location') || origins(node).some(value => memberName(value) === 'location' && (window(value.object) || document(value.object)));
+ const constructed = (node, name) => expressions(node).some(value => value.type === 'NewExpression' && global(value.callee, name));
+ const queries = new Set(['querySelector','querySelectorAll','getElementById','getElementsByTagName','getElementsByClassName','getElementsByName','createElement','createElementNS']);
+ const children = new Set(['body','head','documentElement','activeElement','firstChild','lastChild','firstElementChild','lastElementChild','nextSibling','previousSibling','nextElementSibling','previousElementSibling','parentNode','parentElement','children','childNodes','forms','images','links','content','contentDocument']);
+ function dom(node, seen = new Set()) {
+  if (!node || seen.has(node)) return false;
+  seen = new Set(seen).add(node);
+  return expressions(node).some(value => {
+   if (document(value)) return true;
+   if (value.type === 'NewExpression') return ['Image','Audio','Option'].some(name => global(value.callee, name));
+   if (value.type === 'CallExpression') {
+    const method = memberName(value.callee), object = value.callee.object;
+    return (queries.has(method) || ['closest','cloneNode','item','namedItem'].includes(method)) && dom(object, seen);
+   }
+   if (value.type !== 'MemberExpression') return false;
+   return (children.has(memberName(value)) || value.computed) && dom(value.object, seen);
+  });
+ }
+ function anchor(node) {
+  return expressions(node).some(value => {
+   if (value.type !== 'CallExpression' || !dom(value.callee.object)) return false;
+   const method = memberName(value.callee);
+   if (['createElement','createElementNS','getElementsByTagName'].includes(method)) return strings(value.arguments[method === 'createElementNS' ? 1 : 0]).some(tag => /^(?:a|area)$/i.test(tag));
+   return ['querySelector','closest'].includes(method) && strings(value.arguments[0]).some(selector => /^(?:a|area)(?:[.#[:]|$)/i.test(selector));
+  });
+ }
+ const style = node => expressions(node).some(value => memberName(value) === 'style' && dom(value.object));
+ return {window, document, location, constructed, dom, anchor, style};
+}

package/cli/site-check.mjs

@@ -0,0 +1,111 @@
+import { lstat, readdir, readFile } from 'node:fs/promises';
+import { join, posix } from 'node:path';
+import { createRequire } from 'node:module';
+import { pathToFileURL } from 'node:url';
+import { privateDataScanner, decodedText } from './site-data.mjs';
+import { javascriptContent } from './site-references.mjs';
+import { javascriptStrings } from './site-syntax.mjs';
+import { markupReferences, markupStrings, htmlElements, cssStrings } from './site-markup.mjs';
+import { refuse, RerError } from './errors.mjs';
+import { DEV_AI_MARKER, DEV_LAYER_MARKER } from './dev-identity.mjs';
+
+// What a run site may hold: static pages and the files they use, served as
+// Cloudflare static assets with default HTML handling. Never server code,
+// Wrangler configuration, migrations, settings, local data or owner data.
+const FORBIDDEN = /^(?:wrangler\.(?:json|jsonc|toml)|_worker\.js|_routes\.json|_headers|_redirects|.*\.(?:sql|rer|db|sqlite|sqlite3|env|map))$/i;
+// Routes that exist only on an installed instance.
+export const INSTANCE_ROUTES = ['/signin', '/sign-in', '/login', '/setup', '/app', '/auth', '/api', '/__dev', '/health', '/.well-known'];
+const MAX_FILE = 25 * 1024 * 1024, MAX_FILES = 20000;
+
+/** Every file, as a site path ("run.html") with its bytes. */
+async function files(folder) {
+ const found = new Map();
+ async function walk(directory, prefix) {
+  for (const name of (await readdir(directory)).sort()) {
+   const path = join(directory, name), site = prefix + name, status = await lstat(path);
+   if (name.startsWith('.')) throw refuse(`The run site holds a hidden file: ${site}. It contains only public pages and their files.`);
+   if (status.isSymbolicLink() || (!status.isFile() && !status.isDirectory())) throw refuse(`The run site holds a link or special file: ${site}.`);
+   if (status.isDirectory()) { await walk(path, site + '/'); continue; }
+   if (FORBIDDEN.test(name)) throw refuse(`The run site holds ${site}, which is not a static page or asset. Server code, configuration, migrations and data never go in it.`);
+   if (status.size > MAX_FILE) throw refuse(`The run site file ${site} is larger than 25 MiB.`);
+   found.set(site, await readFile(path));
+   if (found.size > MAX_FILES) throw refuse('The run site holds more than 20,000 files.');
+  }
+ }
+ await walk(folder, '');
+ return found;
+}
+
+const safeDecode = path => { try { return decodeURI(path); } catch { return path; } };
+
+export function identityPattern(value) {
+ const escaped = value.replace(/[.*+?^${}()|[\]\\]/g, '\\$&');
+ const word = '[\\p{L}\\p{M}\\p{N}_]', mailbox = value.includes('@');
+ const left = mailbox ? "[\\p{L}\\p{M}\\p{N}_.!#$%&'*+/=?^`{|}~@-]" : word;
+ const right = mailbox ? '[\\p{L}\\p{M}\\p{N}_@-]|\\.[\\p{L}\\p{M}\\p{N}_-]' : word;
+ // Paired prose quotes delimit the whole mailbox. An apostrophe inside a
+ // longer local part (prefix'owner@example.test) must keep its old boundary.
+ const quoted = mailbox ? `|(?<!\\\\)'${escaped}'` : '';
+ return {mailbox, pattern:new RegExp(`(?<!${left})(?:${escaped}(?!${right})${quoted})`,mailbox ? 'iu' : 'u')};
+}
+
+/** How Cloudflare's static assets (auto-trailing-slash) answer a path, or null. */
+export function servedFile(names, pathname) {
+ const path = pathname.replace(/^\/+/, '');
+ if (!path) return names.has('index.html') ? 'index.html' : null;
+ if (names.has(path) && !path.endsWith('.html')) return path;
+ const bare = path.replace(/\/$/, '');
+ if (names.has(`${bare}.html`)) return `${bare}.html`;
+ if (names.has(`${bare}/index.html`)) return `${bare}/index.html`;
+ return null;
+}
+
+/**
+ * Refuse a run site folder that is not exactly static pages and the files they
+ * use: an index and a Run page, every same-origin link resolving, no link to an
+ * instance-only route, nothing fetched from another origin, no dev layer, and
+ * none of the given private values (owner identity, secrets, the dev key).
+ */
+export async function checkSite(folder, { privateValues = [], privateIdentities = [], root } = {}) {
+ const all = await files(folder), names = new Set(all.keys());
+ if (!names.has('index.html')) throw refuse('The run site has no index.html (its homepage).');
+ if (!servedFile(names, '/run')) throw refuse('The run site has no /run page.');
+ const markers = [DEV_LAYER_MARKER, DEV_AI_MARKER].map(value => Buffer.from(value));
+ const containsPrivateData = privateDataScanner(privateValues, privateIdentities);
+ let parse;
+ if (root) {
+  const require = createRequire(join(root, 'package.json'));
+  ({parseAst:parse} = await import(pathToFileURL(require.resolve('vite')).href));
+ }
+ const problems = [], unresolved = [];
+ for (const [site, bytes] of all) {
+  if (markers.some(marker => bytes.includes(marker))) throw refuse(`The run site file ${site} contains the local-only dev layer.`);
+  const html = /\.(?:html|svg)$/.test(site), css = site.endsWith('.css'), js = /\.[cm]?js$/.test(site);
+  const text = bytes.toString('utf8'), trees = js && parse ? [parse(text)] : [], literals = css ? cssStrings(text) : html ? markupStrings(text) : [];
+  if (html) for (const {tag, attributes, content} of htmlElements(text)) {
+   if (tag === 'script' && !attributes.has('src') && parse && /^(?:|module|(?:text|application)\/(?:java|ecma)script)$/i.test(attributes.get('type') ?? '')) trees.push(parse(content));
+  }
+  const scripts = trees.map(javascriptContent), strings = trees.flatMap(javascriptStrings);
+  if (containsPrivateData(bytes, [...literals, ...strings, ...strings.flatMap(markupStrings), ...scripts.flatMap(script => script.literals)])) throw new RerError('site_private_data', `The run site file ${site} contains this installation's private data (owner identity or a secret). The run site renders only edition identity.`, 4);
+  if (!html && !css && !js) continue;
+  const refs = [...(js ? [] : markupReferences(text, html)), ...scripts.flatMap(script => script.references)];
+  for (const script of scripts) for (const {kind} of script.unresolved) unresolved.push({asset:site, kind});
+  for (const reference of refs) {
+   const url = decodedText(reference.url), {navigates} = reference;
+   if (!url || /^(?:#|mailto:|tel:|data:|javascript:void)/i.test(url)) continue;
+   if (/^(?:[a-z][a-z0-9+.-]*:|\/\/)/i.test(url)) {
+    if (!navigates) problems.push(`${site} fetches ${url} from another origin`);
+    continue;
+   }
+   const pathPrefix = safeDecode(url.replace(/[?#].*$/, ''));
+   const pathname = posix.resolve(reference.documentRelative ? '/' : '/' + posix.dirname(site), pathPrefix);
+   // An unfinished `/api` could become `/apiculture`; a slash, query or
+   // fragment already fixes the instance path even when its tail is runtime.
+   const boundary = !reference.dynamic || /[?#]/.test(url) || pathPrefix.endsWith('/');
+   if (INSTANCE_ROUTES.some(route => (pathname === route && boundary) || pathname.startsWith(route + '/'))) problems.push(`${site} links to ${pathname}, which exists only on an installed instance`);
+   else if (!reference.dynamic && !servedFile(names, safeDecode(pathname))) problems.push(`${site} links to ${pathname}, which the site does not have`);
+  }
+ }
+ if (problems.length) throw refuse(`The run site has broken or out-of-site references: ${problems.slice(0, 8).join('; ')}${problems.length > 8 ? `; and ${problems.length - 8} more` : ''}.`);
+ return { files: names.size, pages: [...names].filter(name => name.endsWith('.html')).length, references:{unresolved} };
+}

package/cli/site-client.mjs

@@ -0,0 +1,50 @@
+import { mkdir, writeFile, readFile, rm } from 'node:fs/promises';
+import { dirname, join, resolve } from 'node:path';
+import { clientInputGuard } from './site-inputs.mjs';
+
+// A separate browser build, using the seed's plugins. Only the graph reachable
+// from its named entries ships; an external server import in that graph fails.
+export async function writeSiteAsset(folder, name, data) {
+ if (!name.startsWith('site-assets/') || name.split('/').includes('..')) throw Error('Compiled output must stay under site-assets/.');
+ const file = join(folder,name), bytes = Buffer.from(data);
+ await mkdir(dirname(file),{recursive:true});
+ try { await writeFile(file,bytes,{flag:'wx'}); }
+ catch (error) {
+  if (error.code !== 'EEXIST') throw error;
+  if (!bytes.equals(await readFile(file))) throw Error(`Conflicting compiled site asset ${name}.`);
+ }
+}
+
+export async function buildClients(vite, root, folder, { entries = {}, config, privatePaths = [] } = {}) {
+ if (!Object.keys(entries).length) return {clients:{},styles:[]};
+ const guard = await clientInputGuard(root, privatePaths, async code => {
+  await writeFile(`${folder}.refusal`, code);
+  throw Error(code === 'site_private_input' ? 'Run site client imports a private or outside-seed file.' : 'Run site client imports a server-only module.');
+ }, vite);
+ const scratch = `${folder}.client`;
+ try {
+  const built = await vite.build({root, plugins:[guard], configFile:config ? resolve(root,config) : false, envFile:false, logLevel:'error', mode:'production',
+   build:{ssr:false, lib:false, outDir:scratch, write:false, copyPublicDir:false, emptyOutDir:true, assetsDir:'site-assets', sourcemap:false, reportCompressedSize:false, watch:null,
+    rollupOptions:{input:Object.fromEntries(Object.entries(entries).map(([name,path]) => [name,resolve(root,path)])), output:{entryFileNames:'site-assets/[name]-[hash].js',chunkFileNames:'site-assets/[name]-[hash].js'}}}});
+  const output = (Array.isArray(built) ? built : [built]).flatMap(result => result.output ?? []);
+  const chunks = new Map(output.filter(item => item.type === 'chunk').map(item => [item.fileName,item]));
+  const clients = {}, shipped = new Set();
+  const visit = file => {
+   if (shipped.has(file)) return;
+   const chunk = chunks.get(file);
+   if (!chunk) throw Error(`Run site client imports ${file}, which is not bundled for the browser. Remove its server dependency or bundle it in the client config.`);
+   shipped.add(file);
+   for (const dependency of [...chunk.imports,...chunk.dynamicImports]) visit(dependency);
+  };
+  for (const name of Object.keys(entries)) {
+   const entry = output.find(item => item.type === 'chunk' && item.isEntry && item.name === name);
+   if (!entry) throw Error(`Run site client ${name} produced no entry chunk.`);
+   clients[name] = '/' + entry.fileName; visit(entry.fileName);
+  }
+  for (const item of output) {
+   if (item.type === 'chunk' && !shipped.has(item.fileName)) continue;
+   await writeSiteAsset(folder,item.fileName,item.type === 'chunk' ? item.code : item.source);
+  }
+  return {clients,styles:output.filter(item=>item.type==='asset'&&item.fileName.endsWith('.css')).map(item=>'/' + item.fileName)};
+ } finally { await rm(scratch,{recursive:true,force:true}); }
+}

package/cli/site-data.mjs

@@ -0,0 +1,54 @@
+import { identityPattern } from './site-check.mjs';
+
+// HTML Living Standard named character references (Python html.entities.html5).
+import entities from './site-entities.json' with {type:'json'};
+const numericReplacements = {128:8364,130:8218,131:402,132:8222,133:8230,134:8224,135:8225,136:710,137:8240,138:352,139:8249,140:338,142:381,145:8216,146:8217,147:8220,148:8221,149:8226,150:8211,151:8212,152:732,153:8482,154:353,155:8250,156:339,158:382,159:376};
+export function decodedText(text) {
+ return text.replace(/&#(?:x([\da-f]+)|(\d+));?|&([a-z][a-z0-9]*;?)/gi, (match, hex, decimal, name) => {
+  if (name) {
+   for (let length = name.length; length; length--) if (entities[name.slice(0,length)] !== undefined) return entities[name.slice(0,length)] + name.slice(length);
+   return match;
+  }
+  const code = parseInt(hex ?? decimal, hex ? 16 : 10);
+  return String.fromCodePoint(numericReplacements[code] ?? (!code || code > 0x10ffff || (code >= 0xd800 && code <= 0xdfff) ? 0xfffd : code));
+ }).replace(/(?:%[\da-f]{2})+/gi, value => {try {return decodeURIComponent(value);} catch {return value;}})
+  .replace(/\\(?:x([\da-f]{2})|u([\da-f]{4})|u\{([\da-f]+)\})/gi, (match, hex, unicode, point) => {
+   const code = parseInt(hex ?? unicode ?? point,16); return code <= 0x10ffff ? String.fromCodePoint(code) : match;
+  });
+}
+
+// Scan every emitted file, including binary assets. Decode textual forms as well
+// as matching base64 directly, so encoding a registered value cannot publish it.
+export function privateDataScanner(values, identities) {
+ const secrets = values.filter(value => typeof value === 'string' && value.length);
+ const owners = identities.filter(value => typeof value === 'string' && value.length).map(value => ({value, ...identityPattern(value)}));
+ const encodedValues = [...secrets, ...owners.map(item => item.value)].flatMap(value => [Buffer.from(value).toString('base64'), Buffer.from(value).toString('base64').replace(/=+$/, ''), Buffer.from(value).toString('base64url')]);
+ const base64 = encodedValues.map(value => new RegExp(`(?<![A-Za-z0-9+/_-])${value.replace(/[.*+?^${}()|[\]\\]/g, '\\$&')}(?![A-Za-z0-9+/_=-])`));
+ return (bytes, literalValues = []) => {
+  if (secrets.some(value => bytes.includes(Buffer.from(value)))) return true;
+  const raw = bytes.toString('utf8');
+  const forms = new Set([raw, ...literalValues]);
+  for (const value of [raw, ...literalValues]) {
+   let decoded = value;
+   for (let depth = 0; depth < 4; depth++) { decoded = decodedText(decoded); forms.add(decoded); }
+  }
+
+  for (const form of forms) {
+   // Complete string values preserve the whitespace that atob accepts, even
+   // when the payload spans lines or carries encoded whitespace.
+   const compact = form.replace(/[\t\n\f\r ]/g, '');
+   if (/^[A-Za-z0-9+/_-]{8,}={0,2}$/.test(compact) && compact.length % 4 !== 1) {
+    const plain = Buffer.from(compact, 'base64').toString('utf8');
+    forms.add(plain); forms.add(decodedText(plain));
+   }
+   if (secrets.some(value => form.includes(value)) || owners.some(({pattern}) => pattern.test(form))) return true;
+   if (base64.some(pattern => pattern.test(form))) return true;
+   // A base64 payload may include surrounding text, changing its alignment.
+   for (const match of form.matchAll(/[A-Za-z0-9+/_-]{8,}={0,2}/g)) {
+    const plain = Buffer.from(match[0], 'base64').toString('utf8');
+    if (secrets.some(value => plain.includes(value)) || owners.some(({pattern}) => pattern.test(plain))) return true;
+   }
+  }
+  return false;
+ };
+}