@runeditrun/rer 0.2.0 → 0.2.1

package/README.md

@@ -247,7 +247,7 @@ line that still names it. A later refresh is a version bump:
 | `@runeditrun/rer/server-resources` | managed server resource readings (runtime journeys) | `scripts/base-cli/cli/server-resources.mjs` |
 | `@runeditrun/rer/operations` | OPERATIONS describe and check | `scripts/base-cli/operations/operations.mjs` |
 | `@runeditrun/rer/modules/portability`, `/catalogue`, `/cli`, `/cli-options`, `/files`, `/format`, `/http`, `/import`, `/journal`, `/legacy-safety`, `/migration-history`, `/storage` | portability module | `scripts/base-cli/modules/portability/*.mjs` |
-| `@runeditrun/rer/modules/release/export`, `/publication-scan`, `/source` | release export and publication scan | `scripts/base-cli/modules/release/*.mjs` |
+| `@runeditrun/rer/modules/release/export`, `/publication-scan`, `/source`, `/signature` | release export, publication scan and shared signature verifier | `scripts/base-cli/modules/release/*.mjs` |
 | `@runeditrun/rer/modules/deploy-kit/owner`, `/owner-cli`, `/prepare`, `/provider` | deploy kit | `scripts/base-cli/modules/deploy-kit/*.mjs` |
 | `@runeditrun/rer/modules/operator-auth`, `/dev`, `/dev/badge`, `/dev-admission`, `/accounts/native`, `/identity/email-link` | operator auth | `scripts/base-cli/modules/operator-auth/index.mjs`, `dev/index.mjs`, `dev/badge.mjs`, `dev-admission.mjs`, `accounts/native.mjs`, `identity/email-link/index.mjs` |
 | `@runeditrun/rer/modules/erasure/fence` | erasure fence statements | `scripts/base-cli/modules/erasure/fence.mjs` |
@@ -260,7 +260,8 @@ In a checkout, every verb runs that checkout's own pinned `rer`; `rer VERB --hel
 there lists its flags:
 
 `install`, `setup`, `dev`, `preview`, `build`, `verify`, `reset --yes`, `deploy`,
-`export`, `import`, `outbox`, `doctor`, `describe`, `check`, `release`.
+`export`, `import`, `outbox`, `doctor`, `describe`, `check`, `release`,
+`release sign`, `release receipt` and `release keygen`.
 
 Anywhere: `rer list [DIR]`, `rer cli status|install|uninstall`, `rer update`,
 `rer queue NAME -- COMMAND`, `rer --version` and `rer --help`.

package/cli/README.md

@@ -131,8 +131,10 @@ Existing seeds receive this policy by refreshing `scripts/base-cli/` with
 onboarding copy). For production, adopt the persistent root-head stylesheet,
 primary preload and matched fallback described in `export/UI-CONVENTIONS.md`.
 
-Both are managed foreground servers; their first invocation stays active while
-serving. A compatible repeated invocation verifies the registered application,
+Both are managed servers. `--detach` returns after readiness, leaving the server
+running; `--foreground` keeps the invocation active while serving. Preview
+refreshes changed built assets and their ETags; source edits need a restart and
+rebuild. A compatible repeated invocation verifies the registered application,
 prints its safe ready/outbox URLs and exits without a new build or sign-in.
 Explicit conflicting host, port or timeout, or the other mode, refuses with
 exit 4 and the correct stop command. `--stop` is idempotent;

package/cli/contract.mjs

@@ -6,8 +6,8 @@ export const commonFlags = ['--help', '--cwd', '--non-interactive', '--json'];
 const definitions = {
  install: [[], 'Frozen dependency installation; no setup or global tool changes.'],
  setup: [['--owner-email', '--owner-name', '--port', '--host', '--answers', '--door'], 'Build, migrate, prepare private settings and first owner; stop the temporary app. --door sets a fresh checkout up at its front-door origin http://NAME.localhost:PORT (after rer door enable).'],
- dev: [['--port', '--host', '--idle-timeout', '--stop', '--as', '--login', '--models', '--models-service', '--door', '--direct'], 'Foreground development with assets, HMR and the declared scheduled triggers run locally on their schedule. With devIdentity it opens signed in as the owner (--as PERSONA picks another start, --login uses the outbox sign-in instead); otherwise ordinary owner sign-in through the outbox. --door moves this checkout to its front-door origin http://NAME.localhost:PORT, keeping its data; --direct moves it back; --port and --host serve directly.'],
- preview: [['--port', '--host', '--idle-timeout', '--stop'], 'Foreground fixed production output; reuse intact build, preserve owner/state, idle timeout and explicit stop.'],
+ dev: [['--port', '--host', '--idle-timeout', '--stop', '--detach', '--foreground', '--as', '--login', '--models', '--models-service', '--door', '--direct'], 'Development with assets, HMR and the declared scheduled triggers run locally on their schedule. --detach returns once ready; --foreground keeps this command serving. With devIdentity it opens signed in as the owner (--as PERSONA picks another start, --login uses the outbox sign-in instead); otherwise ordinary owner sign-in through the outbox. --door moves this checkout to its front-door origin http://NAME.localhost:PORT, keeping its data; --direct moves it back; --port and --host serve directly.'],
+ preview: [['--port', '--host', '--idle-timeout', '--stop', '--detach', '--foreground'], 'Production output; --detach returns once ready, --foreground keeps this command serving. Reuse intact build, refresh changed assets, preserve owner/state, idle timeout and explicit stop.'],
  build: [['--site'], 'Production build with private local settings excluded and restored. --site instead writes the static run site (homepage, /run, docs) to its declared folder and prints that folder.'],
  verify: [[], 'Run the complete internal verification target.'],
  reset: [['--yes'], 'Confirmed removal of the declared local inventory only.'],

package/cli/deploy.mjs

@@ -1,5 +1,7 @@
 import { readFile } from 'node:fs/promises';
 import { resolve } from 'node:path';
+import { deployDiagnostic } from '../modules/deploy-kit/diagnostics.mjs';
+import { shared } from './shared.mjs';
 import { contained } from './project.mjs';
 import { missing, invalid, refuse } from './errors.mjs';
 import { ownerPlan, ownerWorkerName, localOnlyBinding } from '../modules/deploy-kit/owner.mjs';
@@ -30,8 +32,20 @@ export function ownerDeploy(declarationPath, lifecycle) {
   if (names.some(name => !process.env[name]?.trim())) throw missing('CLOUDFLARE_ACCOUNT_ID and CLOUDFLARE_API_TOKEN are required. See the deploy-kit owner-account instructions.');
   const { main } = await import('../modules/deploy-kit/owner-cli.mjs');
   const argv = ['deploy', '--declaration', declarationPath, '--environment', environment];
-  const result = await main(argv, process.env, { cwd: root, localOnlyKeys, notice: line => store.report(line) });
-  await main(['health', ...argv.slice(1)], process.env, { cwd: root, localOnlyKeys });
-  return { deployed: true, origin: result.origin };
+  const {createRedaction,credentialValues} = await shared('redaction.mjs');
+  const redaction = createRedaction();
+  redaction.addSecrets([...credentialValues(process.env),process.env.CLOUDFLARE_ACCOUNT_ID,...(declaration.secrets ?? []).map(item=>process.env[item.environment]).filter(Boolean)]);
+  // Keep confirmed creation events across deploy and the independent health call.
+  const created = [];
+  try {
+   const result = await main(argv, process.env, { cwd: root, localOnlyKeys, notice: line => store.report(line), onCreated: resource => created.push(redaction.redact(resource)) });
+   await main(['health', ...argv.slice(1)], process.env, { cwd: root, localOnlyKeys });
+   return { deployed: true, origin: result.origin };
+  } catch (error) {
+   const diagnostic = deployDiagnostic(error,redaction.redact);
+   const code = /^[a-zA-Z0-9_-]{1,120}$/.test(error.message) ? redaction.redact(error.message) : 'deploy-failed';
+   const {commandFailure} = await shared('failures.mjs');
+   throw commandFailure(`Deploy failed at ${diagnostic?.step ?? 'prepare deploy'}: ${diagnostic?.code ?? code}${diagnostic?.providerCodes?.length ? ` (provider ${diagnostic.providerCodes.join(', ')})` : ''}.\nFirst redacted output lines:\n${diagnostic?.output ?? '(no provider output)'}\nResources created this attempt: ${created.join(', ') || 'none recorded'}.`);
+  }
  }, { declaration: declarationPath });
 }

package/cli/detached-server.mjs

@@ -0,0 +1,51 @@
+import { spawn } from 'node:child_process';
+import { randomUUID } from 'node:crypto';
+import { open, readFile } from 'node:fs/promises';
+import { join } from 'node:path';
+import { fileURLToPath } from 'node:url';
+import { setTimeout as delay } from 'node:timers/promises';
+import { shared } from './shared.mjs';
+import { ready } from './managed-server.mjs';
+import { RerError } from './errors.mjs';
+
+// The actual dispatcher owns the server, registry and shutdown. Only its
+// lifetime changes: its parent follows private JSON events until readiness,
+// then leaves that process serving. A failed/interrupted start stops its child.
+export async function detachedServer(options, argv, out) {
+ const {privateDirectory} = await shared('private-files.mjs');
+ const directory = await privateDirectory(options.cwd,['.rer','local']);
+ const log = join(directory,`${options.verb}-launch-${randomUUID()}.log`), handle = await open(log,'wx',0o600);
+ const args = argv.filter(arg => !['--detach','--foreground','--json'].includes(arg));
+ let child, exit, spawnError, keep = false;
+ const stop = () => child?.kill('SIGTERM');
+ for (const signal of ['SIGINT','SIGTERM']) process.once(signal,stop);
+ try {
+  child = spawn(process.execPath,[fileURLToPath(new URL('../bin/rer.mjs',import.meta.url)),...args,'--foreground','--json'], {cwd:options.cwd, env:process.env, detached:true, stdio:['ignore',handle.fd,handle.fd]});
+  child.once('error',error => {spawnError=error;exit=1;});
+  child.once('exit',(code,signal) => {exit=code ?? (signal ? 128 : 1);});
+  await handle.close();
+  let offset=0, pending='', failure;
+  for (;;) {
+   const bytes = await readFile(log), text = bytes.subarray(offset).toString('utf8'); offset=bytes.length;
+   pending += text;
+   const lines=pending.split('\n');pending=lines.pop();
+   for (const line of lines) {
+    let event; try { event=JSON.parse(line); } catch { continue; }
+    if (event.event==='error') failure=event;
+    if (event.event==='ready') {
+     keep=true;child.unref();
+     const dev = event.openUrl ? {openUrl:event.openUrl,identity:options.verb === 'dev' && !options.login,signedInAs:event.signedInAs,ownerLeft:options.verb === 'dev' && !options.login && event.signedInAs === null} : undefined;
+     ready(out,event.url,dev,options.json,Boolean(event.signInUrl),event.siteUrl);
+     return 0;
+    }
+    if (event.event==='waiting' || event.event==='warning') out.event(event.event,event);
+   }
+   if (exit!==undefined) throw new RerError(failure?.code ?? 'command_failed',failure?.message ?? `The ${options.verb} server stopped before readiness (${spawnError?.code ?? exit}); inspect ${log}.`,failure?.exitCode ?? (exit || 1));
+   await delay(200);
+  }
+ } finally {
+  await handle.close().catch(() => {});
+  for (const signal of ['SIGINT','SIGTERM']) process.off(signal,stop);
+  if (!keep) stop();
+ }
+}

package/cli/hosted-output.mjs

@@ -1,4 +1,4 @@
-import { readFile, readdir } from 'node:fs/promises';
+import { readFile, readdir, realpath } from 'node:fs/promises';
 import { createRequire } from 'node:module';
 import { createHash, randomBytes } from 'node:crypto';
 import { join, resolve, extname } from 'node:path';
@@ -114,7 +114,7 @@ export async function checkHostedOutput(root, options) {
  } finally { await hosted.close(); }
 }
 
-if (process.argv[1] && import.meta.url === pathToFileURL(resolve(process.argv[1])).href) {
+if (process.argv[1] && await realpath(new URL(import.meta.url)) === await realpath(process.argv[1])) {
  try { console.log(JSON.stringify(await checkHostedOutput(resolve(process.argv[2] ?? '.'), { declaration: process.argv[3] }))); }
  catch (error) { console.error(error.message); process.exitCode = 1; }
 }

package/cli/hydration/check.mjs

@@ -7,7 +7,7 @@
 // is replaced, an intro replays, a frame loses a section, recovery is noisy or
 // uncounted, or a hydrated page's document lacks Cache-Control: no-transform.
 import { resolve } from 'node:path';
-import { pathToFileURL } from 'node:url';
+import { realpath } from 'node:fs/promises';
 import { RerError } from '../errors.mjs';
 import { hostedServer, launchChromium, originServer, pool, runLoad } from './browser.mjs';
 import { cloudflareRewrite, describeCase, planCases, selectPages } from './cases.mjs';
@@ -90,7 +90,7 @@ async function declaredPages(root) {
  catch { return {}; }
 }
 
-if (process.argv[1] && import.meta.url === pathToFileURL(resolve(process.argv[1])).href) {
+if (process.argv[1] && await realpath(new URL(import.meta.url)) === await realpath(process.argv[1])) {
  const args = process.argv.slice(2), flag = name => { const at = args.indexOf(name); return at < 0 ? undefined : args.splice(at, 2)[1]; };
  const origin = flag('--origin'), pages = flag('--pages')?.split(',').filter(Boolean), details = args.includes('--details');
  const root = resolve(args.find(arg => !arg.startsWith('--')) ?? '.'), declared = await declaredPages(root);

package/cli/inspect.mjs

@@ -31,7 +31,7 @@ export async function describe(project) {
  };
  const capabilities = project.adapter?.verbs ?? {};
  return { contractVersion: 1, ...versioned, profile: 'first-party', defaults, pins: { node: pkg.engines?.node, pnpm: pkg.packageManager?.replace(/^pnpm@/, '') },
-  verbs: Object.fromEntries(Object.entries(capabilities).map(([verb, capability]) => [verb, { flags: (verbs[verb]?.flags ?? releaseFlags).filter(flag => capability.flags?.includes(flag)), effects: verbs[verb]?.effects ?? 'Existing Base release producer.' }])),
+  verbs: Object.fromEntries(Object.entries(capabilities).map(([verb, capability]) => [verb, { flags: (verbs[verb]?.flags ?? releaseFlags).filter(flag => capability.flags?.includes(flag)), effects: verbs[verb]?.effects ?? 'Produce releases; keygen writes a public anchor and, on success, its private key to non-terminal stdout; sign writes a detached signature and prints (but does not execute) the GitHub upload command; receipt verifies against local anchors offline.' }])),
   aliases: Object.fromEntries(Object.entries(aliases).filter(([alias, verb]) => pkg.scripts?.[alias] === commandLine(verb, declaredPackage(pkg) !== undefined))),
   local: { state: project.adapter?.state, settings: project.adapter?.settings ?? [], installerState: '.seed/installer', outbox: '/__dev/outbox', ...await localState(project), origin: await savedOrigin(project), ...(project.adapter?.devIdentity ? { devIdentity: true, devKey: '.rer/local/dev-key.env' } : {}) },
   // This pin serves a checkout through the machine's front door (rer door).

package/cli/main.mjs

@@ -27,6 +27,7 @@ export async function main(argv = process.argv.slice(2)) {
   if (project.profile === 'independent' && !['describe', 'check', 'doctor'].includes(options.verb)) options = parse(argv, process.cwd(), { independent: true });
   else if (options.forwarded.length) throw invalid('First-party commands accept only the documented flags, without forwarded arguments.');
   out = output(options);
+  if (project.profile === 'first-party' && options.detach && ['dev','preview'].includes(options.verb)) return (await import('./detached-server.mjs')).detachedServer(options, argv, out);
   if (options.verb === 'describe') { const result = await describe(project); out.human(options.json ? JSON.stringify(result) : JSON.stringify(result, null, 2)); return 0; }
   if (options.verb === 'check') {
    const result = await check(project, options.profile);

package/cli/managed-server.mjs

@@ -131,8 +131,14 @@ export async function managedServer(project,options,out,{clock={}}={}){
   const outbox=await outboxServed(selected.url,devKey,controller.signal);
   if(options.verb==='dev'&&project.adapter.site){
    const {devSite}=await import('./site.mjs');
-   site=await devSite(project,store,controller.signal,{host:selected.host,port:selected.port});
-   await registry.update({siteUrl:site.url});
+   try {
+    site=await devSite(project,store,controller.signal,{host:selected.host,port:selected.port});
+    await registry.update({siteUrl:site.url});
+   } catch(error) {
+    if(error.code!=='site_private_data')throw error;
+    const message=`Run site preview refused: ${error.message} The app is running; fix the site and run rer build --site before publishing it.`;
+    if(options.json)out.event('warning',{code:error.code,message});else out.progress(`Warning: ${message}\n`);
+   }
   }
   activity.ready();await emitReady(out,options,project.root,selected.url,dev,outbox,site?.url);
   if(crons.length){
@@ -147,8 +153,9 @@ export async function managedServer(project,options,out,{clock={}}={}){
  }catch(error){if(termination)throw new RerError('cancelled',`Stopped by ${termination} after owned children were stopped.`,termination==='SIGINT'?130:143);if(['idle timeout','explicit stop'].includes(reason))return {};throw await lifecycleError(error,store);}finally{await cleanup();cleaned();while(activityWriting)await activityWrites;await registry.close();for(const [name,handler]of handlers)process.off(name,handler);}
 }
 function reportScheduled(out,options,run){
- const at=new Date().toISOString().replace(/\.\d+Z$/,'Z'),outcome=run.skipped?`skipped (${run.error})`:run.ok?`ok ${run.ms}ms`:`failed (${run.status?`HTTP ${run.status}`:run.error}) ${run.ms}ms`;
- if(options.json)out.event('scheduled',{at,cron:run.cron,ok:run.ok,skipped:Boolean(run.skipped),status:run.status,ms:run.ms});else out.human(`RER_SCHEDULED ${at} "${run.cron}" ${outcome}`);
+ const error=options.verb==='preview'&&run.status===404 ? 'The preview target does not expose /cdn-cgi/local/scheduled. Forward the adapter context scheduled flag to previewTarget, or set RER_RUNTIME_TRIGGERS=1 in a custom target using the shared production runtime. For another runtime, expose that internal trigger endpoint or declare scheduled:false.' : run.error;
+ const at=new Date().toISOString().replace(/\.\d+Z$/,'Z'),outcome=run.skipped?`skipped (${error})`:run.ok?`ok ${run.ms}ms`:`failed (${run.status?`HTTP ${run.status}`:error}) ${run.ms}ms`;
+ if(options.json)out.event('scheduled',{at,cron:run.cron,ok:run.ok,skipped:Boolean(run.skipped),status:run.status,ms:run.ms,...(error?{error}:{})});else out.human(`RER_SCHEDULED ${at} "${run.cron}" ${outcome}${error&&run.status?` — ${error}`:''}`);
 }
 // GET, not HEAD: a seed's outbox route need not answer HEAD. The body is never read.
 async function outboxServed(url,devKey,signal){
@@ -169,7 +176,7 @@ async function emitReady(out,options,root,url,dev,outbox,siteUrl){
 }
 async function devReady(url,key,options,signal){
  if(options.verb==='preview')return {openUrl:openUrl(url,key,{path:'/__dev/key',next:'/__dev/outbox'})};
- if(options.login)return {openUrl:openUrl(url,key,{next:'/__dev/outbox'})};
+ if(options.login)return {openUrl:openUrl(url,key,{path:'/__dev/key',next:'/__dev/outbox'})};
  const as=options.as??'owner',persona=await resolvePersona(url,key,as,signal);
  // The owner persona names the owner the session will actually have (the
  // remaining owner once the setup owner has left), or none when none is left.

package/cli/parse.mjs

@@ -2,7 +2,7 @@ import { resolve } from 'node:path';
 import { commonFlags, serverDefaults, verbs } from './contract.mjs';
 import { invalid, refuse } from './errors.mjs';
 import { isLoopbackHost } from '../modules/operator-auth/loopback.mjs';
-const booleans = new Set(['--help', '--json', '--non-interactive', '--yes', '--dry-run', '--open', '--stop', '--no-queue', '--login', '--legacy-v1', '--acknowledge-unverified-metadata', '--door', '--direct', '--site']);
+const booleans = new Set(['--help', '--json', '--non-interactive', '--yes', '--dry-run', '--open', '--stop', '--detach', '--foreground', '--no-queue', '--login', '--legacy-v1', '--acknowledge-unverified-metadata', '--door', '--direct', '--site']);
 export const mailbox = value => typeof value === 'string' && value.length <= 254 && /^[a-zA-Z0-9.!+_%\-]+@[a-zA-Z0-9\-]+(?:\.[a-zA-Z0-9\-]+)+$/.test(value);
 // A loopback host: the shared predicate (including `*.localhost` door names),
 // plus `::1` as --host and a bracket-stripped hostname spell it.
@@ -45,7 +45,8 @@ export function parse(argv, cwd = process.cwd(), { independent = false, deferTai
  }
  if (options.help) return options;
  if (deferTail) { options.cwd=resolve(cwd,options.cwd);return options; }
- if(options.stop && ['--port','--host','--idle-timeout','--no-queue','--as','--login','--models','--models-service','--door','--direct'].some(flag=>options.supplied.has(flag)))throw invalid('--stop cannot be combined with start-only flags.');
+ if (options.detach && options.foreground) throw invalid('Choose one of --detach and --foreground.');
+ if(options.stop && ['--port','--host','--idle-timeout','--detach','--foreground','--no-queue','--as','--login','--models','--models-service','--door','--direct'].some(flag=>options.supplied.has(flag)))throw invalid('--stop cannot be combined with start-only flags.');
  // --port and --host always mean direct mode; --door and --direct pick a mode.
  if(options.door&&options.direct)throw invalid('Choose one of --door and --direct.');
  if(options.door&&['--port','--host'].some(flag=>options.supplied.has(flag)))throw invalid('--door cannot be combined with --port or --host, which always serve directly.');

package/cli/release.mjs

@@ -1,5 +1,6 @@
 // Preserve release's accepted parser, producer, receipt and validation exits.
 export async function dispatchRelease(args) {
+ if (['sign', 'receipt', 'keygen'].includes(args[0])) return (await import('../modules/release/signing-cli.mjs')).dispatchSigning(args[0], args.slice(1));
  try {
   const options = {};
   for (let index = 0; index < args.length; index++) {

package/cli/site-bindings.mjs

@@ -0,0 +1,291 @@
+import { walkSyntax, stringValue, memberName } from './site-syntax.mjs';
+import { refuse } from './errors.mjs';
+const finite = (values, key = value => value) => {
+ const unique = [...new Map(values.map(value => [key(value), value])).values()];
+ if (unique.length > 1024) throw refuse('The run site has too many possible values for a browser resource reference to check.');
+ return unique;
+};
+const propertyNames = (node, strings) => {
+ const key = node?.type === 'MemberExpression' ? node.property : node?.key;
+ if (!key) return [];
+ if (!node.computed) return [key.name ?? String(key.value)];
+ return key.type === 'Literal' && typeof key.value === 'number' ? [String(key.value)] : [...strings(key)];
+};
+
+// Keep bindings lexical: a library's parameter or local variable must not take
+// an unrelated same-named value from the island. Resolve finite constant values
+// at a resource sink, rather than treating every URL-shaped string as a fetch.
+export function localValues(tree) {
+ const scopes = new WeakMap(), writesByName = new Map(), computedWrites = [], assigned = new WeakMap(), root = {bindings:new Map(), parent:null, function:true};
+ const writeIndex = name => {
+  if (!writesByName.has(name)) writesByName.set(name, {writes:new Set(), users:new Set()});
+  return writesByName.get(name);
+ };
+ const bind = (scope, name, value) => {
+  if (!scope.bindings.has(name)) scope.bindings.set(name, []);
+  if (value) scope.bindings.get(name).push(value);
+ };
+ const lookup = (node, name) => {
+  let scope = scopes.get(node);
+  while (scope && !scope.bindings.has(name)) scope = scope.parent;
+  return scope?.bindings.get(name);
+ };
+ const bindPattern = (scope, pattern, value) => {
+  if (pattern.type === 'Identifier') { bind(scope, pattern.name, value); return; }
+  if (pattern.type === 'RestElement') { bindPattern(scope, pattern.argument); return; }
+  if (pattern.type === 'AssignmentPattern') { bindPattern(scope, pattern.left, value); bindPattern(scope, pattern.left, pattern.right); return; }
+  for (const [index, item] of (pattern.type === 'ObjectPattern' ? pattern.properties : pattern.elements ?? []).entries()) {
+   if (!item) continue;
+   const target = pattern.type === 'ObjectPattern' ? item.value ?? item.argument : item;
+   const key = pattern.type === 'ObjectPattern' ? item.key : {type:'Literal', value:index};
+   const member = value && key ? {type:'MemberExpression', object:value, property:key, computed:pattern.type !== 'ObjectPattern' || item.computed || key.type === 'Literal'} : null;
+   if (member) scopes.set(member, scope);
+   bindPattern(scope, target, member);
+  }
+ };
+ walkSyntax(tree, (node, path) => {
+  const parent = path.at(-1);
+  let scope = scopes.get(parent) ?? root;
+  if (['FunctionDeclaration','ClassDeclaration'].includes(node.type) && node.id) bind(scope, node.id.name, node);
+  if (node.type === 'ImportDeclaration') for (const specifier of node.specifiers) bind(scope, specifier.local.name);
+  if (/^(?:FunctionExpression|FunctionDeclaration|ArrowFunctionExpression)$/.test(node.type) || node.type === 'BlockStatement' || node.type === 'CatchClause') {
+   scope = {bindings:new Map(), parent:scope, function:node.type !== 'BlockStatement' && node.type !== 'CatchClause'};
+   if (node.type === 'FunctionExpression' && node.id) bind(scope, node.id.name, node);
+   for (const param of node.params ?? (node.param ? [node.param] : [])) bindPattern(scope, param);
+  }
+  scopes.set(node, scope);
+  if (node.type === 'VariableDeclarator') {
+   if (parent.kind === 'var') while (!scope.function && scope.parent) scope = scope.parent;
+   bindPattern(scope, node.id, node.init);
+  }
+ });
+ walkSyntax(tree, node => {
+  if (node.type !== 'AssignmentExpression') return;
+  const operator = node.operator.slice(0, -1);
+  const value = node.operator === '=' ? node.right : {type:['&&','||','??'].includes(operator) ? 'LogicalExpression' : 'BinaryExpression', operator, left:node.left, right:node.right};
+  assigned.set(node, value);
+  if (node.left.type === 'MemberExpression') {
+   const name = memberName(node.left), write = {left:node.left, right:value};
+   if (name === undefined) computedWrites.push(write);
+   else writeIndex(name).writes.add(write);
+  }
+  if (node.left.type !== 'Identifier') return;
+  lookup(node, node.left.name)?.push(value);
+ });
+ // Resolve each expression once into a shared dataflow graph. Dependencies
+ // are re-evaluated only when they gain a value, so cyclic aliases converge
+ // instead of exploring every possible path through member assignments.
+ const expressionResults = new WeakMap(), expressionStates = new WeakMap(), stringStates = new WeakMap(), writeStates = new WeakMap(), pending = new Set();
+ const states = kind => kind === 'strings' ? stringStates : expressionStates;
+ let evaluating;
+ const state = (map, node, kind) => {
+  let result = map.get(node);
+  if (!result) {
+   result = {node, kind, values:new Set(), users:new Set()};
+   map.set(node, result); pending.add(result);
+  }
+  if (evaluating) result.users.add(evaluating);
+  return result;
+ };
+ const read = (node, kind = 'expressions') => node ? state(states(kind), node, kind).values : new Set();
+ const keys = node => propertyNames(node, key => read(key, 'strings'));
+ const memberWrites = name => {
+  const index = writeIndex(name);
+  if (evaluating) index.users.add(evaluating);
+  return index.writes;
+ };
+ // A computed write joins the same fixed point as its key's bindings. Index
+ // each discovered key once and wake only readers of that member name.
+ for (const write of computedWrites) state(writeStates, write, 'writes');
+ function indexWrite(write) {
+  const names = keys(write.left);
+  for (const name of names) {
+   const index = writeIndex(name);
+   if (index.writes.has(write)) continue;
+   index.writes.add(write);
+   for (const user of index.users) pending.add(user);
+  }
+  return names;
+ }
+ const isClass = node => ['ClassDeclaration','ClassExpression'].includes(node.type);
+ function classProperties(constructor, wanted, isStatic, fields, seen = new Set()) {
+  const found = new Map();
+  if (!isClass(constructor) || seen.has(constructor)) return found;
+  seen = new Set(seen).add(constructor);
+  let unknownKey = false;
+  for (const property of constructor.body.body) {
+   if (Boolean(property.static) !== isStatic || (fields !== undefined && (property.type === 'PropertyDefinition') !== fields)) continue;
+   const names = keys(property);
+   if (property.computed && !names.length) unknownKey = true;
+   for (const name of wanted) if (names.includes(name)) {
+    // Static fields initialize after methods even when written before them.
+    const previous = found.get(name)?.[0];
+    if (property.type === 'PropertyDefinition' || previous?.type !== 'PropertyDefinition') found.set(name, [property]);
+   }
+  }
+  const inherited = wanted.filter(name => !found.has(name));
+  // Wait for a computed override's key instead of prematurely retaining the
+  // inherited definition in the monotone graph. Unknown keys stay unknown.
+  if (inherited.length && !unknownKey) for (const parent of read(constructor.superClass)) {
+   for (const [name, properties] of classProperties(parent, inherited, isStatic, fields, seen)) found.set(name, [...(found.get(name) ?? []), ...properties]);
+  }
+  return found;
+ }
+ function classMembers(constructor, names, isStatic) {
+  if (isStatic) return [...classProperties(constructor, names, true).values()].flat();
+  // Instance fields shadow prototype methods, including a method declared by
+  // a subclass. Within each category the nearest declaration wins.
+  const fields = classProperties(constructor, names, false, true);
+  const methods = classProperties(constructor, names.filter(name => !fields.has(name)), false, false);
+  return [...fields.values(), ...methods.values()].flat();
+ }
+ function expressionValues(node) {
+  if (node.type === 'Identifier') {
+   const values = lookup(node, node.name);
+   return values?.length ? values.flatMap(value => [...read(value)]) : [node];
+  }
+  if (node.type === 'MemberExpression') {
+   const names = keys(node);
+   const objects = read(node.object), members = [node];
+   const properties = items => {
+    for (const property of items) if (keys(property).some(key => names.includes(key))) members.push(...read(property.value));
+   };
+   for (const object of objects) {
+    if (object.type === 'ArrayExpression') for (const key of names) members.push(...read(object.elements[Number(key)]));
+    if (object.type === 'ObjectExpression') properties(object.properties);
+    if (isClass(object)) properties(classMembers(object, names, true));
+    if (object.type === 'NewExpression') for (const constructor of read(object.callee)) {
+     if (isClass(constructor)) properties(classMembers(constructor, names, false));
+    }
+   }
+   for (const key of names) for (const write of memberWrites(key)) {
+    if (write.left !== node && [...read(write.left.object)].some(object => objects.has(object))) members.push(...read(write.right));
+   }
+   return members;
+  }
+  if (node.type === 'ConditionalExpression') return [...read(node.consequent), ...read(node.alternate)];
+  if (node.type === 'LogicalExpression') return [...read(node.left), ...read(node.right)];
+  if (node.type === 'SequenceExpression') return read(node.expressions.at(-1));
+  if (node.type === 'AssignmentExpression') return read(assigned.get(node));
+  return [node];
+ }
+ function stringValues(node, seen = new Set()) {
+  if (!node || seen.has(node)) return [];
+  seen = new Set(seen).add(node);
+  const value = stringValue(node);
+  if (value !== undefined) return [value];
+  if (node.type === 'BinaryExpression' && node.operator === '+') return finite(stringValues(node.left, seen).flatMap(left => stringValues(node.right, seen).map(right => left + right)));
+  if (node.type === 'TemplateLiteral') {
+   let values = [node.quasis[0].value.cooked ?? ''];
+   for (let i = 0; i < node.expressions.length; i++) values = finite(values.flatMap(left => stringValues(node.expressions[i], seen).map(right => left + right + (node.quasis[i + 1].value.cooked ?? ''))));
+   return values;
+  }
+  if (node.type === 'CallExpression' && ['decodeURI','decodeURIComponent','atob'].includes(node.callee.name)) return stringValues(node.arguments[0], seen).flatMap(value => {
+   try {return [node.callee.name === 'atob' ? Buffer.from(value,'base64').toString('utf8') : decodeURIComponent(value)];} catch {return [];}
+  });
+  // Expand only the finite syntax graph. Recursive string construction has
+  // an unknown tail, not an ever-growing set of invented complete strings.
+  // Alias states already contain their transitive values; unresolved member
+  // identities contain no additional strings and must not be expanded again.
+  return finite([...read(node)].filter(value => value !== node && !['Identifier','MemberExpression'].includes(value.type)).flatMap(value => stringValues(value, seen)));
+ }
+ function resolve(node, kind) {
+  if (!node) return [];
+  const result = state(states(kind), node, kind);
+  for (const next of pending) {
+   pending.delete(next); evaluating = next;
+   const values = next.kind === 'writes' ? indexWrite(next.node) : next.kind === 'strings' ? stringValues(next.node) : expressionValues(next.node);
+   let changed = false;
+   for (const value of values) if (!next.values.has(value)) { next.values.add(value); changed = true; }
+   if (next.kind === 'strings') finite([...next.values]);
+   if (changed) for (const user of next.users) pending.add(user);
+  }
+  evaluating = undefined;
+  return [...result.values];
+ }
+ function expressions(node) {
+  if (!node) return [];
+  if (expressionResults.has(node)) return expressionResults.get(node);
+  const values = resolve(node, 'expressions').filter(value => {
+   if (value.type !== 'MemberExpression') return true;
+   // A member is its own unresolved identity until a value reaches it. Keep
+   // unresolved cycles, but remove that identity after resolving an alias.
+   return ![...expressionStates.get(value).values].some(other => other !== value && (other.type !== 'MemberExpression' || !expressionStates.get(other)?.values.has(value)));
+  });
+  // Indexing is complete and every dependency has settled before caching.
+  expressionResults.set(node, values);
+  return values;
+ }
+ const strings = node => resolve(node, 'strings');
+ const names = node => propertyNames(node, strings);
+ const origins = expressions;
+ const localClass = node => {
+  const values = expressions(node);
+  return values.length > 0 && values.every(value => {
+   const constructors = value.type === 'NewExpression' ? expressions(value.callee) : [value];
+   return constructors.length > 0 && constructors.every(isClass);
+  });
+ };
+ // Recognize browser globals through aliases without mistaking library methods
+ // or shadowed parameters for those APIs.
+ function global(node, name, seen = new Set()) {
+  if (!node || seen.has(node)) return false;
+  seen = new Set(seen).add(node);
+  return origins(node).some(value => {
+   if (value.type === 'Identifier') return value.name === name && !lookup(value, value.name);
+   return value.type === 'MemberExpression' && names(value).includes(name) && ['window','globalThis','self'].some(root => global(value.object, root, seen));
+  });
+ }
+ // A runtime suffix does not erase a known origin or route at a resource sink.
+ // Retain only the prefix before the first unknown value; later fragments are
+ // not a trustworthy prefix. Complete values still use ordinary file checks.
+ const alternatives = values => finite(values, value => JSON.stringify(value));
+ const combine = (left, right) => alternatives(left.flatMap(start => start.complete ? right.map(end => ({value:start.value + end.value, complete:end.complete})) : [start]));
+ function resources(node, seen = new Set()) {
+  const unknown = [{value:'', complete:false}];
+  if (!node || seen.has(node)) return unknown;
+  seen = new Set(seen).add(node);
+  const value = stringValue(node);
+  if (value !== undefined) return [{value, complete:true}];
+  if (node.type === 'BinaryExpression' && node.operator === '+') return combine(resources(node.left, seen), resources(node.right, seen));
+  if (node.type === 'TemplateLiteral') {
+   let values = [{value:node.quasis[0].value.cooked ?? '', complete:true}];
+   for (let i = 0; i < node.expressions.length; i++) values = combine(combine(values, resources(node.expressions[i], seen)), [{value:node.quasis[i + 1].value.cooked ?? '', complete:true}]);
+   return values;
+  }
+  if (node.type === 'NewExpression' && global(node.callee, 'Request')) return resources(node.arguments[0], seen);
+  if (node.type === 'NewExpression' && global(node.callee, 'URL')) {
+   const targets = resources(node.arguments[0], seen), bases = resources(node.arguments[1], seen);
+   const written = [...memberWrites('href')].filter(write => expressions(write.left.object).includes(node)).flatMap(write => resources(write.right, seen));
+   return alternatives([...written, ...targets.flatMap(target => {
+    // Absolute targets do not depend on the base. Incomplete targets retain
+    // their known prefix, including a foreign origin or an instance subtree.
+    if (/^[a-z][a-z0-9+.-]*:/i.test(target.value)) return [target];
+    if (!node.arguments[1]) return unknown;
+    return bases.flatMap(base => {
+     if (!base.complete) {
+      if (target.value && /^(?:[a-z][a-z0-9+.-]*:|\/\/)/i.test(base.value)) return [base];
+      return target.value.startsWith('/') ? [target] : unknown;
+     }
+     try {
+      if (!target.value && !target.complete) return unknown;
+      return [{value:new URL(target.value, base.value).href, complete:target.complete}];
+     } catch { return unknown; }
+    });
+   })]);
+  }
+  if (node.type === 'MemberExpression' && names(node).some(name => ['href','url'].includes(name))) {
+   const objects = expressions(node.object), values = objects.flatMap(object => object.type === 'NewExpression' && (global(object.callee, 'URL') || global(object.callee, 'Request')) ? resources(object, seen) : []);
+   if (values.length) return alternatives(values);
+  }
+  if (node.type === 'CallExpression' && names(node.callee).some(name => ['toString','toJSON'].includes(name))) {
+   const values = expressions(node.callee.object).flatMap(object => object.type === 'NewExpression' && global(object.callee, 'URL') ? resources(object, seen) : []);
+   if (values.length) return alternatives(values);
+  }
+  const resolved = expressions(node).filter(value => value !== node);
+  if (resolved.length) return alternatives(resolved.flatMap(value => resources(value, seen)));
+  const complete = strings(node);
+  return complete.length ? complete.map(value => ({value, complete:true})) : unknown;
+ }
+ return {strings, names, resources, expressions, origins, global, localClass};
+}

package/cli/site-browser-objects.mjs

@@ -0,0 +1,36 @@
+import { memberName } from './site-syntax.mjs';
+
+// Follow actual browser object provenance. An object's field named `href`,
+// or a URL parser's `href` setter, does not make that object a DOM element.
+export function browserObjects({expressions, origins, strings, global}) {
+ const window = node => ['window','globalThis','self'].some(name => global(node, name));
+ const document = node => global(node, 'document');
+ const location = node => global(node, 'location') || origins(node).some(value => memberName(value) === 'location' && (window(value.object) || document(value.object)));
+ const constructed = (node, name) => expressions(node).some(value => value.type === 'NewExpression' && global(value.callee, name));
+ const queries = new Set(['querySelector','querySelectorAll','getElementById','getElementsByTagName','getElementsByClassName','getElementsByName','createElement','createElementNS']);
+ const children = new Set(['body','head','documentElement','activeElement','firstChild','lastChild','firstElementChild','lastElementChild','nextSibling','previousSibling','nextElementSibling','previousElementSibling','parentNode','parentElement','children','childNodes','forms','images','links','content','contentDocument']);
+ function dom(node, seen = new Set()) {
+  if (!node || seen.has(node)) return false;
+  seen = new Set(seen).add(node);
+  return expressions(node).some(value => {
+   if (document(value)) return true;
+   if (value.type === 'NewExpression') return ['Image','Audio','Option'].some(name => global(value.callee, name));
+   if (value.type === 'CallExpression') {
+    const method = memberName(value.callee), object = value.callee.object;
+    return (queries.has(method) || ['closest','cloneNode','item','namedItem'].includes(method)) && dom(object, seen);
+   }
+   if (value.type !== 'MemberExpression') return false;
+   return (children.has(memberName(value)) || value.computed) && dom(value.object, seen);
+  });
+ }
+ function anchor(node) {
+  return expressions(node).some(value => {
+   if (value.type !== 'CallExpression' || !dom(value.callee.object)) return false;
+   const method = memberName(value.callee);
+   if (['createElement','createElementNS','getElementsByTagName'].includes(method)) return strings(value.arguments[method === 'createElementNS' ? 1 : 0]).some(tag => /^(?:a|area)$/i.test(tag));
+   return ['querySelector','closest'].includes(method) && strings(value.arguments[0]).some(selector => /^(?:a|area)(?:[.#[:]|$)/i.test(selector));
+  });
+ }
+ const style = node => expressions(node).some(value => memberName(value) === 'style' && dom(value.object));
+ return {window, document, location, constructed, dom, anchor, style};
+}