@runeditrun/rer 0.2.2 → 0.2.4

package/global/launch/facts.mjs

@@ -76,14 +76,20 @@ async function bindable(host, port) {
  finally { if (socket.listening) await new Promise(resolve => socket.close(resolve)); }
 }
 
-// The first port from 8787 (RER_DEV_PORT_FROM moves the start) that no
-// registered server holds, nothing listens on, binds on both 127.0.0.1 and ::1
-// (a browser that tries ::1 first never reaches another server) and that
-// `claim` secures against another launch choosing it at the same time.
-export async function freePort(servers, claim, env = process.env) {
+// Whether something now listens on a port or keeps it from binding.
+export async function portTaken(port) {
+ return (await listeningPorts()).has(port) || !await bindable('127.0.0.1', port) || !await bindable('::1', port);
+}
+
+// The first port from 8787 (RER_DEV_PORT_FROM moves the start) that is not
+// `held` (by a registered server, or saved by another checkout that is stopped),
+// nothing listens on, binds on both 127.0.0.1 and ::1 (a browser that tries
+// ::1 first never reaches another server) and that `claim` secures against
+// another launch choosing it at the same time.
+export async function freePort(ports, claim, env = process.env) {
  const from = Number(env.RER_DEV_PORT_FROM ?? 8787);
  if (!Number.isInteger(from) || from < 1 || from > 65535) throw new LaunchFailure(2, 'RER_DEV_PORT_FROM must be a port number.');
- const held = new Set(servers.map(record => record.port).filter(Boolean)), busy = await listeningPorts();
+ const held = new Set(ports.filter(Boolean)), busy = await listeningPorts();
  for (let port = from; port <= 65535; port++) {
   if (held.has(port) || busy.has(port)) continue;
   if (!await bindable('127.0.0.1', port) || !await bindable('::1', port)) continue;

package/global/launch/install-pinned.mjs

@@ -1,19 +1,43 @@
 // A checkout that pins the @runeditrun/rer package runs its own rer once
 // node_modules holds the pinned version; until then none of it can run (its
 // adapter imports the package). So its first dependency install is this
-// launcher's: the frozen pnpm install that `rer install` runs.
+// launcher's: the frozen pnpm install that `rer install` runs. Like every
+// dependency install, it runs with an allowlisted environment. Verbs started
+// at once share one install: each takes the checkout's install claim and
+// installs only if the pin is still missing once it holds it.
 import { spawn } from 'node:child_process';
+import { realpath } from 'node:fs/promises';
+import { dependencyEnvironment } from '../../onboarding/dependency-environment.mjs';
 import { pinnedPackage } from '../checkout.mjs';
 import { packageName } from '../package-info.mjs';
 import { ensureProjectPnpm } from '../../cli/project-pnpm.mjs';
 import { RerError } from '../../cli/errors.mjs';
 import { LaunchFailure } from './failure.mjs';
+import { claimPinInstall, settledPinInstall } from './state.mjs';
+
+const waiting = (root, output) => pid => output(`Another rer (PID ${pid}) is installing ${root}'s pinned ${packageName}; waiting for it.\n`);
 
 export async function installPinned(root, { env = process.env, output = text => process.stderr.write(text), children, signal } = {}) {
  signal?.throwIfAborted();
+ const release = await claimPinInstall(await realpath(root), { env, signal, onWait: waiting(root, output) });
+ try {
+  const pinned = pinnedPackage(root);
+  if (pinned?.ready) return;
+  if (pinned?.installed) output(`${root} pins ${packageName} ${pinned.declared}, but node_modules holds ${pinned.installed}; installing the pinned version first.\n`);
+  await install(root, { env, output, children, signal });
+ } finally { await release(); }
+}
+
+// A verb on a checkout whose pin looks installed still waits for an install
+// another verb is running there: node_modules is not complete until it ends.
+export async function settledPin(root, { env = process.env, output = text => process.stderr.write(text), signal } = {}) {
+ await settledPinInstall(await realpath(root), { env, signal, onWait: waiting(root, output) });
+}
+
+async function install(root, { env, output, children, signal }) {
  try { await ensureProjectPnpm(root, { env, signal, report: text => output(text + '\n') }); }
  catch (error) { if (error instanceof RerError) throw new LaunchFailure(error.exitCode, error.message); throw error; }
- const child = spawn('pnpm', ['install', '--frozen-lockfile'], { cwd: root, env: { ...env, CI: 'true' }, stdio: ['ignore', 'pipe', 'pipe'] });
+ const child = spawn('pnpm', ['install', '--frozen-lockfile'], { cwd: root, env: { ...dependencyEnvironment(env), CI: 'true' }, stdio: ['ignore', 'pipe', 'pipe'] });
  children?.add(child);
  if (signal?.aborted) child.kill('SIGTERM');
  let tail = '';

package/global/launch/prepare.mjs

@@ -10,8 +10,8 @@ import { liveServers } from '../registry.mjs';
 import { checkCapacity, personEnvironment, pinPolicy } from './capacity.mjs';
 import { bringBackDoor, doorPlan } from './door.mjs';
 import { LaunchFailure } from './failure.mjs';
-import { describeCheckout, freePort, localOwner, needsInstall, setupNeeded } from './facts.mjs';
-import { claimPort, installState, setupState } from './state.mjs';
+import { describeCheckout, freePort, localOwner, needsInstall, portTaken, setupNeeded } from './facts.mjs';
+import { claimPort, installState, savedPorts, setupState } from './state.mjs';
 import { runVerb } from './steps.mjs';
 import { localDefaults } from './local-defaults.mjs';
 import { installPinned } from './install-pinned.mjs';
@@ -74,13 +74,25 @@ export async function prepare({ root, args, env, report, directory, log, childre
   return { entry, added };
  } else if (setup === 'fresh') {
   // An interrupted setup resumes on the port it chose while that port is free.
+  // A port another process takes between choosing it and setup refusing it is
+  // passed over for the next free one; a port the person passed is kept.
   const owner = localOwner(checkout), explicit = flagValue(args, '--port');
-  const { port, release } = explicit ? { port: Number(explicit) } : await freePort(await liveServers(childEnv), port => claimPort(port, childEnv), last?.port ? { ...childEnv, RER_DEV_PORT_FROM: String(last.port) } : childEnv);
-  report({ phase: 'setup', message: `setting up a local owner (${owner}) on port ${port}` });
-  try { await step(setupState, ['setup', '--owner-email', owner, '--port', String(port), ...hostArgs], { port, owner }, setupEnv); }
-  catch (failure) { await release?.(); throw failure; }
-  // The claim lasts until the server registers the port: the caller releases it.
-  return { entry, added, release };
+  let from = last?.port;
+  for (let attempt = 1; ; attempt++) {
+   const held = explicit ? [] : [...(await liveServers(childEnv)).map(record => record.port), ...await savedPorts(checkout, childEnv)];
+   const { port, release } = explicit ? { port: Number(explicit) } : await freePort(held, port => claimPort(port, childEnv), from ? { ...childEnv, RER_DEV_PORT_FROM: String(from) } : childEnv);
+   report({ phase: 'setup', message: `setting up a local owner (${owner}) on port ${port}` });
+   try { await step(setupState, ['setup', '--owner-email', owner, '--port', String(port), ...hostArgs], { port, owner }, setupEnv); }
+   catch (failure) {
+    await release?.();
+    if (explicit || attempt === 3 || failure.exitCode !== 4 || !await portTaken(port)) throw failure;
+    report({ phase: 'note', message: `port ${port} was taken by another process; choosing another free port` });
+    from = port + 1;
+    continue;
+   }
+   // The claim lasts until the server registers the port: the caller releases it.
+   return { entry, added, release };
+  }
  }
  await bringBackDoor(plan, env, report);
  return { entry, added };

package/global/launch/state.mjs

@@ -8,8 +8,9 @@
 //   server.log    the private log of the server rer started
 //   server.json   that server's PID and start time, and the process rer spawned
 //   stop.json     when rer dev --stop last ran: a launch requested before it stops
+//   pin-install.json  the process installing the checkout's pinned rer package
 import { createHash } from 'node:crypto';
-import { appendFile, mkdir, readFile, readdir, rm, writeFile } from 'node:fs/promises';
+import { appendFile, link, mkdir, readFile, readdir, rm, writeFile } from 'node:fs/promises';
 import { basename, join } from 'node:path';
 import { processInfo } from '../../modules/job-queue/processes.mjs';
 import { serversDirectory } from '../registry.mjs';
@@ -55,6 +56,43 @@ export async function claimPort(port, env = process.env) {
  return undefined;
 }
 
+// One pinned-package install per checkout at a time: two verbs started at once
+// after a pin change share it. claimPinInstall resolves to a release function
+// once this process holds the claim; both wait (onWait once) while another
+// live process holds it.
+const pinInstallPath = (checkout, env) => join(launchPath(checkout, env), 'pin-install.json');
+const pause = () => new Promise(resolveWait => setTimeout(resolveWait, 200));
+
+export async function claimPinInstall(checkout, { env = process.env, signal, onWait } = {}) {
+ await launchDirectory(checkout, env);
+ const path = pinInstallPath(checkout, env), { start } = await processInfo(process.pid);
+ for (let waited = false; ; ) {
+  signal?.throwIfAborted();
+  // Linked complete, so a waiter never reads a claim still being written.
+  const written = `${path}.${process.pid}`;
+  await writeFile(written, JSON.stringify({ pid: process.pid, start }), { mode: 0o600 });
+  try {
+   await link(written, path);
+   return async () => { if ((await readJson(path))?.pid === process.pid) await rm(path, { force: true }); };
+  } catch (error) { if (error.code !== 'EEXIST') throw error; }
+  finally { await rm(written, { force: true }); }
+  const holder = await readJson(path);
+  if (!await live(holder)) { await rm(path, { force: true }); continue; }
+  if (!waited) { waited = true; onWait?.(holder.pid); }
+  await pause();
+ }
+}
+
+export async function settledPinInstall(checkout, { env = process.env, signal, onWait } = {}) {
+ for (let waited = false; ; ) {
+  signal?.throwIfAborted();
+  const holder = await readJson(pinInstallPath(checkout, env));
+  if (!await live(holder)) return;
+  if (!waited) { waited = true; onWait?.(holder.pid); }
+  await pause();
+ }
+}
+
 // The worker claims the checkout's launch; a second worker started at the
 // same moment finds the first and leaves.
 export async function claimLaunch(directory, token) {
@@ -92,6 +130,21 @@ const stepRecord = name => ({
 });
 export const installState = stepRecord('install'), setupState = stepRecord('setup');
 
+// The ports other checkouts were set up on by this launcher. A stopped
+// checkout keeps its saved origin, so a fresh launch must not take its port.
+export async function savedPorts(checkout, env = process.env) {
+ const launches = join(serversDirectory(env), 'launches'), own = launchPath(checkout, env);
+ let entries = [];
+ try { entries = await readdir(launches, { withFileTypes: true }); } catch (error) { if (error.code !== 'ENOENT') throw error; }
+ const ports = [];
+ for (const entry of entries) {
+  if (!entry.isDirectory() || join(launches, entry.name) === own) continue;
+  const port = (await setupState.read(join(launches, entry.name)))?.port;
+  if (Number.isInteger(port)) ports.push(port);
+ }
+ return ports;
+}
+
 // A stop asks every launch started before it to end. A worker reads this right
 // after it claims the launch; a stop that ran before the claim found no worker
 // to signal, so the worker ends itself here instead of starting anything.

package/global/main.mjs

@@ -1,14 +1,14 @@
+import { verbs } from '../cli/contract.mjs';
 import { dispatcher, locate, pinnedPackage, unsupportedMessage } from './checkout.mjs';
 import { delegate } from './delegate.mjs';
 import { localDefaults } from './launch/local-defaults.mjs';
 import { handleBrokenPipes } from './output.mjs';
-import { packageName as pinnedName } from './package-info.mjs';
 
 const help = `Usage: rer VERB [FLAGS]
 
 Inside a project (the nearest OPERATIONS.json at or above this folder, or --cwd DIR),
 every verb runs that checkout's own pinned rer: the @runeditrun/rer version its package.json
-pins (installed first by rer install, rer setup or rer dev), else its vendored scripts/rer.mjs.
+pins (installed first by any verb when node_modules holds another), else its vendored scripts/rer.mjs.
 
   rer dev              Launch a first-party checkout with no setup steps: installs dependencies,
                        sets up a local owner and a free port when needed, starts the app and prints
@@ -30,12 +30,13 @@ pins (installed first by rer install, rer setup or rer dev), else its vendored s
                        Run COMMAND once this computer's job queue admits it (heavy package scripts
                        of a checkout that pins the rer package use it).
 
-Checkout verbs: install, setup, dev, preview, build, verify, reset, deploy, export, import,
+Checkout verbs: install, setup, dev, demo, preview, build, verify, reset, deploy, export, import,
 outbox, doctor, describe, check, release. Run rer VERB --help in a checkout for its flags.
 `;
 
-// The verbs that install an uninstalled pinned package before they run.
-const installsFirst = new Set(['install', 'setup', 'check', 'describe']);
+// The checkout verbs that install the pinned package before they run when
+// node_modules holds another version or none (dev installs it in its launch).
+const installsFirst = new Set([...Object.keys(verbs), 'release'].filter(verb => verb !== 'dev'));
 
 export async function main(argv) {
  handleBrokenPipes();
@@ -86,23 +87,20 @@ export async function main(argv) {
   return (await import('../onboarding/queued-entry.mjs')).queuedCommandLine(argv.slice(1));
  }
  // A checkout that pins its own rer package runs all of it, launching included.
- // Until node_modules holds the pinned version, install, setup, check and describe
- // install it with the frozen lockfile (then run the pinned verb, so a fresh
- // clone checks with the pinned bytes), the zero-setup launch installs it
- // first, and every other verb says to install.
+ // Until node_modules holds the pinned version (a fresh clone, or a pulled pin
+ // change), every checkout verb installs it with the frozen lockfile and then
+ // runs the pinned verb, so a fresh clone checks and a changed pin deploys with
+ // the pinned bytes; the zero-setup launch installs it first.
+ // Verbs started at once share one install, and one whose pin already looks
+ // installed waits for an install still running.
  const pinned = first && mode !== 'package' ? pinnedPackage(target.root) : undefined;
- if (pinned && !pinned.ready && !argv.includes('--help')) {
-  if (installsFirst.has(verb)) {
-   const { installPinned } = await import('./launch/install-pinned.mjs'), { LaunchFailure } = await import('./launch/failure.mjs');
-   try { await installPinned(target.root); }
-   catch (failure) { if (!(failure instanceof LaunchFailure)) throw failure; process.stderr.write(failure.message + '\n'); return failure.exitCode; }
-   return delegate(target, target.args);
-  }
-  if (verb !== 'dev') {
-   process.stderr.write(`${target.root} pins ${pinnedName} ${pinned.declared}, ${pinned.installed ? `but node_modules holds ${pinned.installed}` : 'which is not installed yet'}. Run rer install, then rer ${verb} again.\n`);
-   return 3;
-  }
+ if (pinned && !pinned.ready && !argv.includes('--help') && installsFirst.has(verb)) {
+  const { installPinned } = await import('./launch/install-pinned.mjs'), { LaunchFailure } = await import('./launch/failure.mjs');
+  try { await installPinned(target.root); }
+  catch (failure) { if (!(failure instanceof LaunchFailure)) throw failure; process.stderr.write(failure.message + '\n'); return failure.exitCode; }
+  return delegate(target, target.args);
  }
+ if (mode === 'package' && installsFirst.has(verb)) await (await import('./launch/install-pinned.mjs')).settledPin(target.root);
  if (verb === 'dev' && mode && mode !== 'package' && !argv.includes('--help')) return (await import('./launch/dev.mjs')).launchDev(target);
  // Every other server start or queued job on a vendored pin gets the person
  // defaults too (a pinned package applies its own).

package/global/update/command.mjs

@@ -8,6 +8,7 @@ import { spawn } from 'node:child_process';
 import { mkdtemp, readFile, rm } from 'node:fs/promises';
 import { tmpdir } from 'node:os';
 import { basename, dirname, join } from 'node:path';
+import { dependencyEnvironment } from '../../onboarding/dependency-environment.mjs';
 import { layout } from '../cli/layout.mjs';
 import { channelOf } from '../cli/status.mjs';
 import { ownManifest, ownRoot, packageDigest, packageName } from '../package-info.mjs';
@@ -47,7 +48,7 @@ async function npmGlobal(version) {
  const command = `npm ${args.map(arg => /^[\w@./:=-]+$/.test(arg) ? arg : JSON.stringify(arg)).join(' ')}`;
  process.stdout.write(`Updating the npm global rer: ${command}\n`);
  let code;
- try { code = await run('npm', args); } catch (error) { code = 127; process.stderr.write(`Could not run npm (${error.code ?? error.message}).\n`); }
+ try { code = await run('npm', args, dependencyEnvironment()); } catch (error) { code = 127; process.stderr.write(`Could not run npm (${error.code ?? error.message}).\n`); }
  if (code !== 0) {
   process.stderr.write(`npm could not update rer (exit ${code}); rer is unchanged. Fix the problem npm reports (for example, a prefix you cannot write), then run:\n  ${command}\n`);
   return code || 1;

package/modules/container/build.mjs

@@ -6,6 +6,7 @@ import { createHash } from 'node:crypto';
 import { parseJsonc } from '../../cli/jsonc.mjs';
 import { portabilityPlan } from './portability-schema.mjs';
 import { checkBoundary } from './boundary.mjs';
+import { readMigrationRewrites, withRewrites } from '../deploy-kit/migrations.mjs';
 const hash = source => createHash('sha256').update(source).digest('hex');
 export async function buildContainer(root, options={}) {
  const previous=process.cwd();process.chdir(root);
@@ -36,12 +37,13 @@ async function buildImage(root, { output = join(root,'.rer/container/image'), en
  if (engine === 'workerd') workerConfig = JSON.parse(await readFile(join(root,'dist/server/wrangler.json'),'utf8'));
  else workerConfig = parseJsonc(await readFile(join(root,'wrangler.jsonc'),'utf8'));
  const { unstable_splitSqlQuery:split } = require('wrangler');
- const migrations = {};
+ const migrations = {}, rewrites = await readMigrationRewrites(root);
  for (const db of workerConfig.d1_databases ?? []) {
   let directory = resolve(root,db.migrations_dir ?? 'migrations');
   try { await readdir(directory); } catch { directory = resolve(root,'dist/server',db.migrations_dir); }
   migrations[db.binding] = [];
   for (const name of (await readdir(directory)).filter(name => name.endsWith('.sql')).sort()) { const sql = await readFile(join(directory,name),'utf8'); migrations[db.binding].push({ name,sql,sha256:hash(sql),statements:split(sql) }); }
+  migrations[db.binding] = withRewrites(migrations[db.binding], rewrites, { partial:true });
  }
  const entry = engine === 'workerd' ? 'dist/server/'+workerConfig.main : 'dist/server/index.mjs';
  await readFile(join(root,entry));
@@ -62,4 +64,4 @@ async function buildImage(root, { output = join(root,'.rer/container/image'), en
  await writeFile(join(output,'Dockerfile'),`FROM node:26.8.1-bookworm-slim\nRUN apt-get update && apt-get install -y --no-install-recommends util-linux ca-certificates && apt-get clean\nRUN mkdir -p /private /archive\nWORKDIR /runtime\nCOPY runtime/package.json ./package.json\nRUN npm install --omit=dev --no-audit --no-fund\nCOPY runtime/ /runtime/\nCOPY app/ /app/\nENV NODE_ENV=production PORT=8080 WRANGLER_SEND_METRICS=false\nEXPOSE 8080\nVOLUME /data\nENTRYPOINT ["sh", "/runtime/modules/container/entrypoint.sh"]\n`);
  return { output,manifest };
 }
-if (process.argv[1] === import.meta.filename) { try { const result=await buildContainer(resolve(process.argv[2])); console.log(JSON.stringify({output:result.output,engine:result.manifest.engine})); } catch(cause) { console.error(cause.message); if(cause.failures)console.error(JSON.stringify(cause.failures));process.exitCode=1; } }
+if (process.argv[1] === import.meta.filename) { try { const {output,engine}=JSON.parse(process.argv[3]??'{}'),result=await buildContainer(resolve(process.argv[2]),{...(output?{output:resolve(output)}:{}),...(engine?{engine}:{})}); console.log(JSON.stringify({output:result.output,engine:result.manifest.engine})); } catch(cause) { console.error(cause.message); if(cause.failures)console.error(JSON.stringify(cause.failures));process.exitCode=1; } }

package/modules/container/host.mjs

@@ -18,7 +18,7 @@ export async function startHost({ root = '/app', data = '/data', settings = proc
   server = createServer(async (req, res) => {
    try {
     lastRequest=Date.now();
-    const request = await incoming(req, { trustedProxy:settings.TRUSTED_PROXY, maxRequestBytes:manifest.maxRequestBytes });
+    const request = await incoming(req, { trustedProxy:settings.TRUSTED_PROXY, origin:settings.RER_INGRESS_ORIGIN, maxRequestBytes:manifest.maxRequestBytes });
     let response = await engine.fetch(request);
     if (new URL(request.url).pathname === '/health' && response.ok) {
      const body = await response.json(); const deadJobs = engine.dead();

package/modules/container/ingress.mjs

@@ -1,12 +1,15 @@
 import { Readable } from 'node:stream';
 import { lookup } from 'node:dns/promises';
 import { isIP } from 'node:net';
-export async function incoming(req, { trustedProxy, maxRequestBytes = 25 * 1024 * 1024 } = {}) {
+// `origin` (RER_INGRESS_ORIGIN) fixes the public origin for a container whose only
+// peer is its own front, such as a hosted demo's Durable Object.
+export async function incoming(req, { trustedProxy, origin, maxRequestBytes = 25 * 1024 * 1024 } = {}) {
  const headers = new Headers(); for (const [name, value] of Object.entries(req.headers)) if (value !== undefined) headers.set(name, Array.isArray(value) ? value.join(',') : value);
  const peer = req.socket.remoteAddress?.replace('::ffff:', '') ?? '';
  const trusted = trustedProxy && (isIP(trustedProxy) ? peer===trustedProxy : (await lookup(trustedProxy,{all:true})).some(item=>item.address.replace('::ffff:','')===peer));
  let host = req.headers.host, proto = 'http', address = peer;
  if (trusted) { host = req.headers['x-forwarded-host'] ?? host; proto = req.headers['x-forwarded-proto'] ?? proto; address = req.headers['x-forwarded-for']?.split(',').at(-1)?.trim() ?? peer; }
+ if (origin) { const fixed = new URL(origin); host = fixed.host; proto = fixed.protocol.slice(0, -1); }
  for (const name of ['cf-connecting-ip','x-forwarded-host','x-forwarded-proto','x-forwarded-for','forwarded','x-rer-original-url']) headers.delete(name);
  if (!['http', 'https'].includes(proto) || typeof host !== 'string' || !/^(?:[a-zA-Z0-9.-]+|\[[0-9a-fA-F:]+\])(?::[0-9]+)?$/.test(host)) throw new Error('Invalid ingress origin');
  headers.set('cf-connecting-ip', address); headers.set('host', host);

package/modules/container/migrations.mjs

@@ -1,10 +1,11 @@
 import { validateMigrations } from '../deploy-kit/migrations.mjs';
+import { recorded } from '../deploy-kit/migration-ledger.mjs';
 export async function migrate(db, migrations, { ledger = '_rer_deploy_migrations' } = {}) {
  if (!['_rer_deploy_migrations', '_rer_portability_migrations'].includes(ledger)) throw new Error('Invalid migration ledger');
  validateMigrations(migrations);
  await db.prepare(`CREATE TABLE IF NOT EXISTS ${ledger}(name TEXT PRIMARY KEY,sha256 TEXT NOT NULL,state TEXT NOT NULL CHECK(state IN ('applying','applied')))`).run();
  const history = (await db.prepare(`SELECT name,sha256,state FROM ${ledger} ORDER BY name`).all()).results;
- if (history.some((row, i) => row.name !== migrations[i]?.name || row.sha256 !== migrations[i]?.sha256 || row.state !== 'applied')) throw new Error('changed-or-uncertain-migration-history');
+ if (history.some((row, i) => !recorded(row, migrations[i]) || row.state !== 'applied')) throw new Error('changed-or-uncertain-migration-history');
  const legacy = await db.prepare("SELECT name FROM sqlite_master WHERE type='table' AND name='d1_migrations'").first();
  if (ledger === '_rer_deploy_migrations' && legacy && (await db.prepare('SELECT name FROM d1_migrations ORDER BY id').all()).results.some(row => !history.some(prior => prior.name === row.name))) throw new Error('legacy-migration-history-needs-reviewed-hash-adoption');
  for (const migration of migrations.slice(history.length)) {

package/modules/container/worker-engine.mjs

@@ -19,7 +19,9 @@ export async function workerEngine({ root, data, manifest, settings, edge }) {
  };
  const mf = new Miniflare(convertV4MiniflareOptions({ host:'127.0.0.1',port:0,cf:false,resourcePersistencePath:data,unsafeLocalExplorer:false,
   workers:[{ name:'ingress',modules:true,script:`export default {fetch(request,env){const observed=request.headers.get('x-rer-original-url');if(!observed)return new Response(null,{status:400});const url=new URL(observed),headers=new Headers(request.headers);headers.delete('x-rer-original-url');headers.set('host',url.host);return env.APP.fetch(new Request(url,{method:request.method,headers,redirect:'manual',...(!['GET','HEAD'].includes(request.method)?{body:request.body}:{})}))}}`,serviceBindings:{ APP:'app' } }, app,
-   { name:'egress',modules:true,script:'export default {fetch(request,env){return env.NETWORK.fetch(request)}}',serviceBindings:{ NETWORK:{ network:{ allow:['public'],tlsOptions:{ trustBrowserCas:true,trustedCertificates:[...rootCertificates] } } } } }],
+   // A demo (RER_DEMO=1) sends nothing: its egress worker refuses every request.
+   settings.RER_DEMO === '1' ? { name:'egress',modules:true,script:"export default {fetch(request){throw new TypeError('fetch failed: demo egress is denied ('+new URL(request.url).host+')')}}" }
+    : { name:'egress',modules:true,script:'export default {fetch(request,env){return env.NETWORK.fetch(request)}}',serviceBindings:{ NETWORK:{ network:{ allow:['public'],tlsOptions:{ trustBrowserCas:true,trustedCertificates:[...rootCertificates] } } } } }],
  }));
  await mf.ready; const databases = {}, objects = {};
  for (const [binding, plan] of Object.entries(manifest.migrations)) { const db = await mf.getD1Database(binding, 'app'); databases[binding] = db; await migrate(db, plan); await ensurePortabilitySchema(db, manifest.portabilityMigrations); }

package/modules/demo-host/README.md

@@ -0,0 +1,30 @@
+# Hosted demo
+
+The front Worker `rer deploy --demo` deploys at `demo.<domain>` for a seed
+that adopted demo mode (`withDemo`, export/DEMO.md). `plan.mjs` turns `deploy-demo.json`
+into the Worker's Wrangler configuration; the CLI (`cli/demo-host.mjs`) writes
+it with these files and the seed's container image folder (workerd engine) to
+`.rer/demo-host/` and runs `wrangler deploy` there.
+
+- `worker.mjs`: `GET /` is the start page; `POST /__demo/start` checks the
+  exact Origin, the `STARTS` rate limit (3 per IP per 60 s), Turnstile's
+  siteverify and capacity, then starts the visitor's demo and answers with the
+  owner claim's 303, its session cookie and the `rer_demo` cookie. A request
+  with that cookie goes to the visitor's Durable Object; nothing else reaches
+  a container.
+- `container.mjs`: `DemoContainer`, one per visitor (`newUniqueId`, checked
+  with `idFromString`). It starts the container with `enableInternet: false`,
+  `RER_DEMO=1`, the fixed origin (`RER_INGRESS_ORIGIN` and the seed's origin
+  variable), fresh `SESSION_SECRET` and `SETUP_TOKEN`,
+  `OWNER_EMAIL=owner@demo.invalid` and the owner claim's issuer, installation
+  id and public key; waits for `/health`; and posts a five-minute ES256 claim
+  (`claim.mjs`) to `/auth/owner-claim`. Its alarm ends the demo at its hour or
+  after 15 idle minutes: `destroy()`, `deleteAll()` and the place released. A
+  container that stops by itself ends its demo too.
+- `capacity.mjs`: `DemoCapacity` admits at most `max_instances` live demos.
+- `pages.mjs`: the start and ended pages (12ui designs), strict CSP.
+
+`node --test modules/demo-host/tests/*.test.mjs` runs the Worker in workerd
+with its real Durable Objects and rate limit; Turnstile and the container
+platform are the only fakes. The end-to-end proof (`wrangler dev` with Docker)
+is in DEMO.md.

package/modules/demo-host/capacity.mjs

@@ -0,0 +1,19 @@
+import { DurableObject } from 'cloudflare:workers';
+
+// One per demo Worker (idFromName('capacity')): the running demos and their
+// ends. A start is admitted while fewer than max_instances demos are live; a
+// demo releases its place when it ends, and a place past its end is free anyway.
+export class DemoCapacity extends DurableObject {
+  async acquire(id, ends, max) {
+    const now = Date.now(), places = await this.ctx.storage.list();
+    const over = [...places].filter(([, until]) => until <= now).map(([key]) => key);
+    if (over.length) await this.ctx.storage.delete(over);
+    if (places.size - over.length >= max) return false;
+    await this.ctx.storage.put(id, ends);
+    return true;
+  }
+
+  async release(id) {
+    await this.ctx.storage.delete(id);
+  }
+}

package/modules/demo-host/claim.mjs

@@ -0,0 +1,21 @@
+// The signed owner claim (modules/owner-claim) a demo's front Worker makes for
+// its container: one ES256 key pair per container, its public JWK given to the
+// container at start, and one five-minute claim signed with the private key,
+// which is never stored.
+const base64url = bytes => btoa(String.fromCharCode(...new Uint8Array(bytes))).replaceAll('+', '-').replaceAll('/', '_').replace(/=+$/, '');
+const segment = value => base64url(new TextEncoder().encode(JSON.stringify(value)));
+
+export async function claimKeys() {
+  const pair = await crypto.subtle.generateKey({ name: 'ECDSA', namedCurve: 'P-256' }, true, ['sign', 'verify']);
+  const { kty, crv, x, y } = await crypto.subtle.exportKey('jwk', pair.publicKey);
+  const kid = crypto.randomUUID().replaceAll('-', '');
+  return { kid, privateKey: pair.privateKey, publicKeys: { [kid]: { kty, crv, x, y, kid, alg: 'ES256', use: 'sig' } } };
+}
+
+/** The compact JWS /auth/owner-claim verifies: issuer and audience are the demo's own origin. */
+export async function signClaim({ kid, privateKey }, { origin, installationId, email, now }) {
+  const iat = Math.floor(now / 1000);
+  const signed = `${segment({ alg: 'ES256', typ: 'rer-owner-claim+jwt', kid })}.${segment({ v: 1, iss: origin, aud: origin, installationId, email, jti: crypto.randomUUID(), iat, exp: iat + 300 })}`;
+  const signature = await crypto.subtle.sign({ name: 'ECDSA', hash: 'SHA-256' }, privateKey, new TextEncoder().encode(signed));
+  return `${signed}.${base64url(signature)}`;
+}

package/modules/demo-host/container.mjs

@@ -0,0 +1,74 @@
+import { DurableObject } from 'cloudflare:workers';
+import { claimKeys, signClaim } from './claim.mjs';
+import { endedPage, clearCookie } from './pages.mjs';
+
+// One visitor's demo: a Durable Object (newUniqueId) and its container, the
+// seed's image from `rer build --platform container` on the workerd engine.
+// The container starts with no internet and in demo mode, so withDemo and the
+// engine's egress worker refuse every send. The front signs the owner in
+// through the existing signed owner claim. The demo ends at its hour or after
+// 15 idle minutes: the alarm destroys the container and deletes everything.
+const PORT = 8080, IDLE = 15 * 60_000, OWNER = 'owner@demo.invalid';
+// The container's port speaks plain HTTP; the app takes its public origin from RER_INGRESS_ORIGIN.
+const inside = url => `http://container${url.pathname}${url.search}`;
+const random = () => [...crypto.getRandomValues(new Uint8Array(32))].map(byte => byte.toString(16).padStart(2, '0')).join('');
+
+export class DemoContainer extends DurableObject {
+  idle = IDLE;
+  get container() { return this.ctx.container; }
+  port() { return this.container.getTcpPort(PORT); }
+
+  /** Start the container, wait for /health, claim the owner; returns the claim's 303. */
+  async start({ origin, originVar, ends, endsLocal, settings }) {
+    const id = this.ctx.id.toString(), keys = await claimKeys(), now = Date.now();
+    await this.ctx.storage.put({ ends, seen: now });
+    await this.ctx.storage.setAlarm(Math.min(ends, now + this.idle));
+    this.container.start({ enableInternet: false, env: { ...settings, RER_DEMO: '1', [originVar]: origin, RER_INGRESS_ORIGIN: origin,
+      SESSION_SECRET: random(), SETUP_TOKEN: random(), OWNER_EMAIL: OWNER, RER_OWNER_CLAIM_ISSUER: origin, RER_OWNER_CLAIM_INSTALLATION_ID: id,
+      RER_OWNER_CLAIM_PUBLIC_KEYS: JSON.stringify(keys.publicKeys), RER_DEMO_EXPIRES: endsLocal } });
+    // A container that stops by itself ends the demo too.
+    this.container.monitor().then(() => this.end(), () => this.end());
+    await this.healthy();
+    const token = await signClaim(keys, { origin, installationId: id, email: OWNER, now: Date.now() });
+    const claimed = await this.port().fetch('http://container/auth/owner-claim', { method: 'POST', redirect: 'manual',
+      headers: { origin, 'content-type': 'application/x-www-form-urlencoded' }, body: new URLSearchParams({ token }) });
+    await claimed.body?.cancel();
+    if (claimed.status !== 303) throw new Error(`owner claim answered ${claimed.status}`);
+    return { location: claimed.headers.get('location'), cookies: claimed.headers.getSetCookie() };
+  }
+
+  async healthy() {
+    for (const deadline = Date.now() + 120_000; ;) {
+      try {
+        const response = await this.port().fetch('http://container/health');
+        await response.body?.cancel();
+        if (response.ok) return;
+      } catch { /* The container is still starting. */ }
+      if (Date.now() > deadline) throw new Error('demo container never became healthy');
+      await new Promise(resolve => setTimeout(resolve, 250));
+    }
+  }
+
+  /** Every request carrying this demo's cookie: proxied while the demo lives, else the ended page. */
+  async fetch(request) {
+    const state = await this.ctx.storage.get(['ends', 'seen']), now = Date.now();
+    if (!(state.get('ends') > now)) return endedPage(this.env, { status: 410, headers: { 'set-cookie': clearCookie(this.env) } });
+    if (now - state.get('seen') > 60_000) await this.ctx.storage.put('seen', now);
+    return this.port().fetch(new Request(inside(new URL(request.url)), request));
+  }
+
+  async alarm() {
+    const state = await this.ctx.storage.get(['ends', 'seen']), now = Date.now();
+    if (!state.get('ends')) return;
+    if (now >= state.get('ends') || now - state.get('seen') >= this.idle) return this.end();
+    await this.ctx.storage.setAlarm(Math.min(state.get('ends'), state.get('seen') + this.idle));
+  }
+
+  /** Destroy the container and delete this demo's state and place; safe to repeat. */
+  async end() {
+    if (this.container.running) await this.container.destroy().catch(() => { /* Already stopping. */ });
+    await this.ctx.storage.deleteAlarm();
+    await this.ctx.storage.deleteAll();
+    await this.env.CAPACITY.get(this.env.CAPACITY.idFromName('capacity')).release(this.ctx.id.toString());
+  }
+}

package/modules/demo-host/pages.mjs

@@ -0,0 +1,56 @@
+// The demo host's two pages, from their 12ui designs: the start page (the
+// Turnstile managed widget submits the form by itself) and the ended page.
+// Both are one card in the family's quiet sign-in style.
+const escape = value => String(value).replace(/[&<>"']/g, character => `&#${character.charCodeAt(0)};`);
+
+const STYLE = `*{box-sizing:border-box}body{margin:0;background:#f2f5f7;color:#192333;font-family:system-ui,-apple-system,'Segoe UI',Arial,sans-serif;-webkit-font-smoothing:antialiased}
+main{width:666px;margin:clamp(32px,18vh,184px) auto 48px}.card{padding:40px 42px 44px;background:#fff;border:1px solid #d6dfe9;border-radius:18px;box-shadow:0 12px 45px rgba(42,65,86,.05)}
+.mark{width:35px;height:6px;border-radius:4px;background:#20574d;margin:0 0 20px}.brand{font-size:18px;line-height:22px;font-weight:600;color:#527875;margin:0 0 14px}
+h1{font-size:42px;line-height:50px;letter-spacing:-1.3px;margin:0 0 14px;font-weight:700}.intro{font-size:20px;line-height:28px;color:#41516a;margin:0}
+ul{padding:0;margin:23px 0 35px;list-style:none;color:#31415a;font-size:18px;line-height:33px}li{position:relative;padding-left:33px}li:before{content:'';position:absolute;left:7px;top:14px;width:7px;height:7px;background:#2b7864;border-radius:50%}
+.notice{margin:0 0 16px;padding:12px 16px;border-radius:8px;background:#fdf6ec;color:#6b3d0f;font-size:16px;line-height:22px}
+.cf-turnstile{min-height:65px}.button{display:block;width:100%;margin-top:28px;min-height:58px;border:1px solid #86a49f;border-radius:11px;background:linear-gradient(110deg,#225b51,#1e5148 60%,#20584d);color:#fff;font:inherit;font-size:20px;font-weight:700;line-height:26px;padding:15px;text-align:center;text-decoration:none;cursor:pointer}
+.button:disabled{opacity:.7;cursor:progress}.button:focus-visible,a:focus-visible{outline:3px solid #388c77;outline-offset:4px}
+.note{font-size:15px;line-height:21px;color:#50617e;text-align:center;margin:21px 0 0}.secondary{text-align:center;margin:22px 0 0;font-size:18px;line-height:24px;font-weight:600}.secondary a{color:#1b554e;text-underline-offset:3px}
+.back{text-align:center;margin:32px 0 0;font-size:15px;line-height:22px}.back a{color:#1b554e;text-underline-offset:3px}
+.ended main{width:min(560px,calc(100% - 32px));margin-top:clamp(32px,26vh,262px)}.ended .card{padding:28px 36px 42px}.ended .brand{font-size:16px;margin-bottom:26px}.ended h1{font-size:36px;line-height:44px;margin-bottom:22px}.ended .intro{margin-bottom:36px}.ended .button{margin-top:0;font-size:18px}
+@media(min-width:600px) and (max-width:1023px){main{width:calc(100% - 64px);max-width:666px;margin:100px auto 48px}.card{padding:36px}h1{font-size:38px;line-height:46px}.intro{font-size:18px;line-height:27px}}
+@media(max-width:599px){main,.ended main{width:calc(100% - 32px);margin:32px auto}.ended .card{padding:26px 22px}.ended h1{font-size:29px;line-height:36px}.ended .intro{font-size:17px;line-height:25px;margin-bottom:28px}.card{padding:26px 22px;border-radius:16px}.brand{font-size:16px}h1{font-size:34px;line-height:41px;letter-spacing:-.8px}.intro{font-size:17px;line-height:25px}ul{font-size:16px;line-height:25px;margin:22px 0 26px}li{padding-left:22px;margin-bottom:9px}li:before{left:2px;top:9px}.button{font-size:18px;margin-top:22px}.note{font-size:13px;line-height:20px}.back{margin-top:24px;font-size:14px}}`;
+
+// Starts the demo once Turnstile has passed: the widget put its token in the form.
+// After a refused start the page waits for the visitor's own click instead.
+const SCRIPT = `function rerDemoBusy(){document.querySelector('#start button').disabled=true;document.getElementById('status').textContent='Starting your demo…'}
+function rerDemoStart(){rerDemoBusy();document.getElementById('start').submit()}
+function rerDemoReady(){document.querySelector('#start button').disabled=false}
+addEventListener('DOMContentLoaded',()=>document.getElementById('start').addEventListener('submit',rerDemoBusy))`;
+
+function html(env, { page, title, body, status = 200, headers = {}, turnstile = false }) {
+  const nonce = crypto.randomUUID().replaceAll('-', ''), site = new URL(env.DEMO_SITE);
+  const policy = `default-src 'none'; style-src 'nonce-${nonce}'; img-src 'self'; form-action 'self'; base-uri 'none'; frame-ancestors 'none'${turnstile ? `; script-src 'nonce-${nonce}' https://challenges.cloudflare.com; frame-src https://challenges.cloudflare.com; connect-src https://challenges.cloudflare.com` : ''}`;
+  return new Response(`<!DOCTYPE html><html lang="en"><head><meta charset="utf-8"><meta name="viewport" content="width=device-width,initial-scale=1"><meta name="robots" content="noindex"><title>${escape(title)}</title><style nonce="${nonce}">${STYLE}</style>${turnstile ? `<script nonce="${nonce}">${SCRIPT}</script><script nonce="${nonce}" src="https://challenges.cloudflare.com/turnstile/v0/api.js" async defer></script>` : ''}</head>
+<body class="${page}"><main><section class="card" aria-labelledby="title"><div class="mark" aria-hidden="true"></div><p class="brand">${escape(env.DEMO_NAME)}</p>${body}</section><nav class="back" aria-label="Return"><a href="${escape(site.origin)}/">Back to ${escape(site.host)}</a></nav></main></body></html>`,
+  { status, headers: { 'content-type': 'text/html; charset=utf-8', 'cache-control': 'no-store', 'content-security-policy': policy, 'referrer-policy': 'strict-origin', 'x-content-type-options': 'nosniff', ...headers } });
+}
+
+/** GET /: the visitor proves they are human and their demo starts. `notice` explains a refused start. */
+export function startPage(env, { status = 200, notice } = {}) {
+  const name = escape(env.DEMO_NAME);
+  return html(env, { page: 'start', title: `Try ${env.DEMO_NAME}`, status, turnstile: true, body: `<h1 id="title">Try ${name}</h1>
+<p class="intro">Your own copy of ${name}, signed in as its owner, with sample data.</p>
+<ul><li>Nothing is sent: mail stays in an outbox.</li><li>It ends after an hour, or 15 idle minutes.</li><li>Then it is deleted. Nobody else can see it.</li></ul>
+${notice ? `<p class="notice" role="alert">${escape(notice)}</p>` : ''}<form id="start" method="post" action="/__demo/start"><div class="cf-turnstile" data-sitekey="${escape(env.TURNSTILE_SITE_KEY)}" data-size="flexible" data-callback="${notice ? 'rerDemoReady' : 'rerDemoStart'}"></div>
+<button class="button" type="submit" disabled>Start the demo</button><p class="note" id="status" role="status">Starts by itself once the check passes. Takes about ten seconds.</p></form>` });
+}
+
+/** A demo whose hour or idle time is up: its container and data are gone. */
+export function endedPage(env, { status = 410, headers = {} } = {}) {
+  const name = escape(env.DEMO_NAME);
+  return html(env, { page: 'ended', title: 'This demo has ended', status, headers, body: `<h1 id="title">This demo has ended</h1>
+<p class="intro">Demos last an hour, or until 15 minutes pass with nothing happening. Its copy of ${name} and everything in it have been deleted.</p>
+<a class="button" href="/">Start a new demo</a><p class="secondary"><a href="${escape(new URL(env.DEMO_SITE).origin)}/run">Run ${name} yourself</a></p>` });
+}
+
+const cookie = (env, value, seconds) => `rer_demo=${value}; Domain=${new URL(env.DEMO_ORIGIN).hostname}; Path=/; Max-Age=${seconds}; HttpOnly; Secure; SameSite=Lax`;
+/** The visitor's demo: HttpOnly, Secure, SameSite=Lax, for demo.<domain> and its subdomains, one hour. */
+export const demoCookie = (env, id) => cookie(env, id, 3600);
+export const clearCookie = env => cookie(env, '', 0);