ninepm 0.60.0 → 0.64.0

package/README.md

@@ -21,6 +21,8 @@ Authenticate in your own browser. The CLI stores the token in native protected s
 9pm doctor
 ```
 
+Running `9pm login` again keeps a credential that still works instead of minting another; `9pm login --fresh` replaces it and revokes the old one.
+
 For CI, set `NINEPM_API_KEY` yourself in the CI secret store. `--token` and `NINEPM_API_KEY` still override the stored login token.
 
 A key for CI or a server is minted from a signed-in machine with `9pm api-key create --name <name>`; the token is printed once. `9pm api-key ls` lists your active keys and `9pm api-key revoke <key-id>` retires one. Each account holds at most 10 such keys at a time (login tokens do not count). Store the key under any name but `NINEPM_*` when it lives in a 9pm app's own environment, and pass it with `--token`.
@@ -99,11 +101,13 @@ Share links are **owner-only by default**: the link opens only for you, signed i
 Deploy a first-class Worker runtime app:
 
 ```sh
-9pm deploy ./examples/worker-app --name worker-app --slug worker-app --runtime worker --entry src/index.js --with-db
+9pm deploy ./examples/worker-app --name worker-app --slug worker-app --runtime worker --entry src/index.js --assets public --with-db
 ```
 
 The `--runtime worker` entry must be a bundled fetch-compatible JavaScript module with a default export. With `--with-db`, the app receives `env.DB` and should use SQLite-compatible prepared statements.
 
+Choose which files are public with `--assets <dir>`: only the files under that directory are served, from the app's root (`public/index.html` answers on `/`), and nothing else in the deploy directory is uploaded. Use `--no-assets` when the entry serves every response itself. The app remembers the choice, so later deploys need not repeat the flag; pass the other flag, or another directory, to change it — there is no way back to publishing everything. A worker app that has never chosen serves **every file in the deploy directory except the entry** publicly, server helpers and leftovers like `index.js.orig` included; every deploy of such an app prints a warning naming those files, and `9pm deploy --check` lists every file a deploy would make public.
+
 Deploy a container app from a local Docker build:
 
 ```sh
@@ -179,10 +183,10 @@ Service token secrets returned by `access service create` are also server-side s
 ```sh
 9pm --version
 9pm deploy [directory] --name <name> [--slug <slug>] [--with-db]
-9pm deploy [directory] --check [--runtime worker --entry <path>]
+9pm deploy [directory] --check [--runtime worker --entry <path> (--assets <dir> | --no-assets)]
 9pm deploy [directory] --runtime container --port 8080 [--health-path /health] [--region auto] [--with-db]
 9pm signup
-9pm login
+9pm login [--fresh]
 9pm logout [--api-url <url>] [--local]
 9pm doctor [--json]
 9pm whoami
@@ -193,7 +197,7 @@ Service token secrets returned by `access service create` are also server-side s
 9pm files get <file-id> [--output <path>] [--project <site>]
 9pm files share <file-id> [--expires 24h] [--public] [--project <site>]
 9pm files delete <file-id> [--project <site>]
-9pm deploy [directory] --runtime worker --entry <path> [--with-db]
+9pm deploy [directory] --runtime worker --entry <path> (--assets <dir> | --no-assets) [--with-db]
 9pm delete <site> --confirm <slug>
 9pm access show <site>
 9pm access public <site>
@@ -222,6 +226,8 @@ Options:
 - `--environment <name>` sets deployment environment metadata
 - `--runtime <static|worker|container>` selects static asset hosting, app-owned Worker code, or local Docker container deployment
 - `--entry <path>` selects the Worker runtime server entry file
+- `--assets <dir>` makes only that directory of a worker deploy public (remembered for later deploys)
+- `--no-assets` makes no file of a worker deploy public (remembered for later deploys)
 - `--port <port>` selects the HTTP port exposed by a container app
 - `--health-path <path>` optionally lets 9pm.ai check container health before marking it healthy
 - `--region <region>` optionally selects provider-neutral container placement

package/dist/cli-types.d.ts

@@ -15,6 +15,7 @@ export interface Project {
     activeDeploymentId: string | null;
     createdAt: string;
     updatedAt: string;
+    workerPublicAssets?: string | null;
 }
 export interface AppUserFilesUsage {
     usedBytes: number;

package/dist/deploy-limits.js

@@ -47,8 +47,9 @@ export function assetFileTooLargeMessage(filePath, size) {
 export function oversizedAssets(files) {
     return files.filter((file) => file.size > MAX_STATIC_ASSET_FILE_BYTES);
 }
-// The worker-runtime server entry is the one deploy-directory file inlined into
-// the generated Worker script (`buildHostedAppWorker`), so it — unlike every
+// The worker-runtime server entry is the one deploy-directory file uploaded as part
+// of the generated Worker script (`buildHostedAppWorker`, as its own module beside the
+// wrapper's main module), so it — unlike every
 // other file, which rides the Workers Assets API — counts against the runtime's
 // script-size budget. That budget is enforced on the *compressed* upload, so
 // this limit is measured on gzipped bytes, not raw ones. Measuring raw bytes is
@@ -68,7 +69,8 @@ export const MAX_WORKER_SCRIPT_COMPRESSED_BYTES = 10 * 1_000_000;
 // generates is uploaded as part of the same script. Two consumers spend this reserve,
 // depending on the deploy shape:
 //   - single `--entry` workers: `buildHostedAppWorker` (analytics, end-user auth,
-//     Access/vanity-host checks, asset fallback), inlined around the entry;
+//     Access/vanity-host checks, asset fallback), uploaded as the script's main module
+//     with the entry as a separate module it imports - the same script, so the same budget;
 //   - `--bundle` deploys: `buildBundleWrapperModule`, added as the script's main module
 //     alongside the bundle's own modules.
 // Both were measured, and both are near-flat across feature combinations: the hosted

package/dist/index.d.ts

@@ -17,6 +17,7 @@ export interface DeployOptions {
     bindingName?: string;
     runtime?: AppRuntime;
     entry?: string;
+    publicAssets?: string;
     port?: number;
     healthPath?: string;
     region?: ContainerRegion;
@@ -116,7 +117,7 @@ export interface CreatedServiceToken {
     clientSecret: string;
 }
 export type FetchLike = (input: string | URL | Request, init?: RequestInit) => Promise<Response>;
-export declare const CLI_VERSION = "0.60.0";
+export declare const CLI_VERSION = "0.64.0";
 type CredentialBackend = "macos-keychain" | "windows-dpapi" | "linux-secret-service" | "file-plaintext" | "none";
 export interface StoredCredentialEntry {
     token: string;
@@ -186,6 +187,10 @@ export interface DeployCheckResult {
         compressedBytes: number;
         moduleCount: number;
     };
+    publicFiles?: Array<{
+        path: string;
+        url: string;
+    }>;
 }
 export type DetectedFramework = "nextjs" | "astro" | "sveltekit" | "vite";
 export declare function detectFramework(directory: string): DetectedFramework | null;
@@ -335,24 +340,81 @@ export interface DeviceAuthFeedbackOptions {
         apiUrl?: string | undefined;
     }) => string;
 }
+export type ReplacedCredential = {
+    kind: "revoked";
+    apiUrl: string;
+} | {
+    kind: "already_invalid";
+    apiUrl: string;
+} | {
+    kind: "failed";
+    apiUrl: string;
+    reason: string;
+} | {
+    kind: "unknown_issuer";
+};
+export interface DeviceAuthResult {
+    email?: string;
+    storage: string;
+    replaced: ReplacedCredential[];
+    trimmedLoginKeys?: {
+        count: number;
+        limit: number;
+    };
+}
 export declare function loginDevice(options: {
     apiUrl: string;
     fetchFn?: FetchLike;
     machineName?: string;
     allowFileCredentialStore?: boolean;
-} & DeviceAuthFeedbackOptions): Promise<{
-    email?: string;
-    storage: string;
-}>;
+} & DeviceAuthFeedbackOptions): Promise<DeviceAuthResult>;
 export declare function signupDevice(options: {
     apiUrl: string;
     fetchFn?: FetchLike;
     machineName?: string;
     allowFileCredentialStore?: boolean;
-} & DeviceAuthFeedbackOptions): Promise<{
+} & DeviceAuthFeedbackOptions): Promise<DeviceAuthResult>;
+/**
+ * Revoke every credential this login's write pushed out of the local stores (#1779).
+ *
+ * "Pushed out" means present before the write and absent after it - not merely
+ * different from the new token. A copy still sitting in another store (a plaintext
+ * fallback beside the keychain) is still reachable from this machine, and a process
+ * that skips the keychain may be using it, so it is left for `9pm logout`.
+ *
+ * Each key is revoked at the control plane that ISSUED it, which is not necessarily
+ * the one this login talked to: a production login overwrites a staging key in the
+ * same slot, and only staging can revoke that. A key with no recorded issuer is not
+ * sent anywhere. Never throws - the login has already succeeded.
+ */
+export declare function retireReplacedCredentials(before: StoredCredentialEntry[], after: StoredCredentialEntry[], newToken: string, fetchFn?: FetchLike): Promise<ReplacedCredential[]>;
+/** The lines a login prints about what it retired, for stderr. Silent when nothing needs saying. */
+export declare function replacedCredentialMessages(result: Pick<DeviceAuthResult, "replaced" | "trimmedLoginKeys">, loginApiUrl: string): string[];
+export type StoredLoginProbe = {
+    kind: "reuse";
     email?: string;
-    storage: string;
-}>;
+} | {
+    kind: "mint";
+} | {
+    kind: "unverifiable";
+    reason: string;
+};
+/**
+ * Whether `9pm login` can keep the credential this machine already holds (#1779).
+ *
+ * Only the credential commands actually authenticate with is considered. One recorded
+ * as issued by another control plane is never sent here. One with no recorded issuer
+ * (stored before 0.42) IS probed here: keys are per database, so a 200 from the plane
+ * this login targets proves it was issued there, and leaving those to mint would keep
+ * the oldest CLIs' machines minting a stray key per run. Only the control plane's own
+ * refusal proves a key dead; a proxy's 401, a 5xx or a timeout proves nothing, so
+ * those come back as unverifiable rather than as permission to mint.
+ */
+export declare function probeStoredLogin(options: {
+    apiUrl: string;
+    fetchFn?: FetchLike;
+    stored?: StoredCredentialEntry[];
+}): Promise<StoredLoginProbe>;
 export declare function expiredDeviceAuthMessage(purpose: string, userCode: string, lifetimeMs: number, verificationUri: string): string;
 export declare function listManagedFiles(options: FileCommandOptions): Promise<ManagedFileListResult>;
 export declare function getAppUserFilesUsage(options: ApiOptions & {
@@ -396,6 +458,7 @@ export interface DeviceAuthProgressReporter {
 export declare function createDeviceAuthProgressReporter(stream?: NodeJS.WriteStream): DeviceAuthProgressReporter;
 export declare function noteCliOutdatedAdvisory(response: Response, log?: (line: string) => void): void;
 export declare function resetCliOutdatedAdvisoryForTests(): void;
+export declare function dashboardUrlForApiUrl(apiUrl: string): string;
 type CliCommand = {
     kind: "deploy";
     options: DeployOptions;
@@ -405,6 +468,7 @@ type CliCommand = {
     kind: "login";
     apiUrl: string;
     allowFileCredentialStore: boolean;
+    fresh: boolean;
 } | {
     kind: "signup";
     apiUrl: string;
@@ -591,6 +655,12 @@ export declare function parseEnvFileEntries(content: string, kind: "secret" | "v
     kind: "secret" | "var";
 }>;
 export declare function healthWithReason(status: string | null | undefined, reason: string | null | undefined): string;
+export declare function workerPublicFiles(paths: readonly string[], serverEntry: string, selection: string | null): Array<{
+    path: string;
+    url: string;
+}>;
+export declare function legacyPublicAssetsWarning(serverEntry: string, publicPaths: readonly string[]): string;
+export declare function privateLookingPublicWarning(paths: readonly string[], selection: string | null): string;
 export declare function storedCredentialTokens(): StoredCredentialEntry[];
 /**
  * Whether a credential provably cannot be stored, decided WITHOUT writing one (#859).

package/dist/index.js

@@ -14,8 +14,9 @@ import { MAX_DEPLOY_DESCRIPTION_LENGTH, normalizeDeployDescription } from "./dep
 import { managedHostnamesIn, siblingCallWarning, siblingsOf } from "./sibling-hostnames.js";
 import { MAX_STATIC_ASSET_FILE_BYTES, MAX_WORKER_ENTRY_COMPRESSED_BYTES, MAX_WORKER_SCRIPT_COMPRESSED_BYTES, WORKER_ENTRY_COMPRESSED_WARN_BYTES, assetFileTooLargeMessage, formatMebibytes, formatMegabytes, oversizedAssets, workerBundleNearLimitMessage, workerBundleTooLargeMessage, workerEntryNearLimitMessage, workerEntryTooLargeMessage, } from "./deploy-limits.js";
 import { buildFileManifest, readManifestFile } from "./manifest.js";
+import { NO_PUBLIC_ASSETS, normalizeAssetsDirectory, privateLookingPaths, publicAssetPath } from "./public-assets.js";
 import { API_KEY_HELP, API_URL_HELP, CLI_CLIENT_ID, DEFAULT_API_URL, reportCliError } from "./cli-config.js";
-export const CLI_VERSION = "0.60.0";
+export const CLI_VERSION = "0.64.0";
 const PUBLIC_DASHBOARD_URL = "https://9pm.ai/dashboard";
 const TOKEN_SERVICE = "9pm";
 const TOKEN_ACCOUNT = "default";
@@ -466,12 +467,25 @@ async function runDeploy(initialOptions, slugHolder) {
     if (serverEntry && !manifest.some((file) => file.path === serverEntry)) {
         throw new Error(`Worker runtime entry file was not found in the deploy directory: ${serverEntry}`);
     }
+    if (serverEntry &&
+        options.publicAssets &&
+        options.publicAssets !== NO_PUBLIC_ASSETS &&
+        workerPublicFiles(manifest.map((file) => file.path), serverEntry, options.publicAssets).length === 0) {
+        throw new Error(missingAssetsDirectoryMessage(options.publicAssets));
+    }
     // Reject oversized assets before creating the project (#195): the server's size
     // guard only fires on the later create-deployment call, which would otherwise
     // leave an orphaned no-deploy app holding the slug and a Sites quota slot.
-    const [oversized] = oversizedAssets(manifest);
-    if (oversized) {
-        throw new Error(assetFileTooLargeMessage(oversized.path, oversized.size));
+    // Only files this deploy uploads are held to the limit (#1847): a private file outside
+    // the public directory is never sent. A worker deploy without a flag cannot know its
+    // selection until the project resolves, so its check runs after that instead - a first
+    // deploy it refuses is still rolled back by deployDirectory.
+    const selectionKnown = !serverEntry || options.publicAssets !== undefined;
+    if (selectionKnown) {
+        const [oversized] = oversizedAssets(uploadedFiles(manifest, serverEntry, options.publicAssets ?? null));
+        if (oversized) {
+            throw new Error(assetFileTooLargeMessage(oversized.path, oversized.size));
+        }
     }
     // Same worker-entry budget `--check` applies, on the same compressed dimension, so
     // the two paths agree (#645). This rejects only what the runtime would refuse at
@@ -539,6 +553,38 @@ async function runDeploy(initialOptions, slugHolder) {
     if (siblings.length > 0) {
         console.warn(`Warning: ${siblingCallWarning(siblings)}`);
     }
+    // #1847: after the project resolves, because a choice made on an earlier deploy is the
+    // project's, and the control plane applies it whether or not this deploy repeats it.
+    if (serverEntry) {
+        const selection = options.publicAssets ?? project.workerPublicAssets ?? null;
+        const publicFiles = workerPublicFiles(manifest.map((file) => file.path), serverEntry, selection);
+        if (selection === null) {
+            // Nothing beside the entry means nothing leaks, so there is nothing to warn about.
+            if (publicFiles.length > 0) {
+                console.warn(`Warning: ${legacyPublicAssetsWarning(serverEntry, publicFiles.map((file) => file.path))}`);
+            }
+        }
+        else {
+            if (options.publicAssets === undefined) {
+                const chosen = selection === NO_PUBLIC_ASSETS ? "no public files" : `only ${selection} is public`;
+                console.warn(`Note: ${chosen}, as chosen on an earlier deploy of this app. Pass --assets <dir> or --no-assets to change it.`);
+            }
+            // Files the platform will never serve are not sent at all: the entry is the only
+            // server file it reads, so nothing else outside the public directory leaves this machine.
+            manifest = uploadedFiles(manifest, serverEntry, selection);
+        }
+        const suspicious = privateLookingPaths(publicFiles.map((file) => file.path), serverEntry);
+        if (suspicious.length > 0) {
+            console.warn(`Warning: ${privateLookingPublicWarning(suspicious, selection)}`);
+        }
+    }
+    if (!selectionKnown) {
+        // `manifest` is already narrowed to what this deploy uploads.
+        const [oversized] = oversizedAssets(manifest);
+        if (oversized) {
+            throw new Error(assetFileTooLargeMessage(oversized.path, oversized.size));
+        }
+    }
     const database = options.withDatabase
         ? await createDatabase(fetchFn, apiUrl, options.token, project.id, {
             name: options.databaseName ?? `${project.slug}-db`,
@@ -564,6 +610,7 @@ async function runDeploy(initialOptions, slugHolder) {
             runtime,
             serverEntry: serverEntry ?? null,
             ...(bundle ? { bundle } : {}),
+            ...(serverEntry && options.publicAssets ? { publicAssets: options.publicAssets } : {}),
         },
     });
     let uploaded = 0;
@@ -595,10 +642,11 @@ async function runDeploy(initialOptions, slugHolder) {
     };
 }
 // Measure the worker-runtime entry the way the platform's script-size budget is
-// actually applied: the entry is inlined into the generated Worker script, and the
-// budget is enforced against the compressed upload. gzipped bytes are therefore
-// the comparable figure; the raw size is carried alongside for the error message
-// only, so a report can name both dimensions instead of silently mixing them.
+// actually applied: the entry is uploaded as its own module in the same Worker
+// script, and the budget applies to the compressed upload of that whole script.
+// gzipped bytes are therefore the comparable figure; the raw size is carried
+// alongside for the error message only, so a report can name both dimensions
+// instead of silently mixing them.
 //
 // Deliberately zlib's default level rather than 9: the platform's own compression
 // settings are unknown, and a weaker setting yields a slightly *larger* figure, so
@@ -729,8 +777,9 @@ export async function checkDeployDirectory(options) {
         warnings.push("Static deploy does not contain index.html.");
     }
     // Per-file size limit, matching the server's create-time guard (#194), so an
-    // oversized asset is caught locally instead of failing with a 413 mid-deploy.
-    for (const file of oversizedAssets(manifest)) {
+    // oversized asset is caught locally instead of failing with a 413 mid-deploy. Held to
+    // the files this deploy would upload under its flags (#1847), as the deploy is.
+    for (const file of oversizedAssets(uploadedFiles(manifest, serverEntry, options.publicAssets ?? null))) {
         errors.push(assetFileTooLargeMessage(file.path, file.size));
     }
     if (serverEntry) {
@@ -760,6 +809,23 @@ export async function checkDeployDirectory(options) {
             // people to stop reading it.
         }
     }
+    // #1847: `--check` has no project, so it cannot see a choice made on an earlier deploy;
+    // it reports what this invocation's flags would publish, and says so for the legacy case.
+    let publicFiles;
+    if (serverEntry) {
+        const selection = options.publicAssets ?? null;
+        publicFiles = workerPublicFiles(manifest.map((file) => file.path), serverEntry, selection);
+        if (selection !== null && selection !== NO_PUBLIC_ASSETS && publicFiles.length === 0) {
+            errors.push(missingAssetsDirectoryMessage(selection));
+        }
+        if (selection === null && publicFiles.length > 0) {
+            warnings.push(`${legacyPublicAssetsWarning(serverEntry, publicFiles.map((file) => file.path))}\n  (An app that already chose on an earlier deploy keeps that choice.)`);
+        }
+        const suspicious = privateLookingPaths(publicFiles.map((file) => file.path), serverEntry);
+        if (suspicious.length > 0) {
+            warnings.push(privateLookingPublicWarning(suspicious, selection));
+        }
+    }
     // Same server-code budget the real deploy applies to a bundle (#660), measured the same
     // way — all modules compressed together, assets excluded.
     if (bundle) {
@@ -773,7 +839,15 @@ export async function checkDeployDirectory(options) {
             warnings.push(workerBundleNearLimitMessage(modulePaths.length, rawBytes, compressedBytes));
         }
     }
-    return { ok: errors.length === 0, warnings, errors, files: manifest.length, bytes: totalBytes, ...(serverCode ? { serverCode } : {}) };
+    return {
+        ok: errors.length === 0,
+        warnings,
+        errors,
+        files: manifest.length,
+        bytes: totalBytes,
+        ...(serverCode ? { serverCode } : {}),
+        ...(publicFiles ? { publicFiles } : {}),
+    };
 }
 export async function whoami(options) {
     return apiRequest(options, "/v1/me", { method: "GET" });
@@ -1376,6 +1450,10 @@ async function deviceAuthFlow(options) {
             // login (#514 review). stop() is idempotent, so the finally below stays as
             // the fallback for every other exit path.
             progress.stop();
+            // What the store held before this login wrote over it (#1779). Read only from the
+            // real stores: an injected store replaces the backend wholesale, so the real one
+            // says nothing about what that write displaced.
+            const before = options.storeCredentialFn ? [] : storedCredentialTokens();
             let storage;
             try {
                 storage = (options.storeCredentialFn ?? storeCredential)(poll.token, {
@@ -1431,17 +1509,23 @@ async function deviceAuthFlow(options) {
                 discardRevokedCredential(poll.token);
                 throw new Error(joinSentences("The credential this login created was stored but cannot authenticate.", disposalSentence(revocation)));
             }
+            // The new credential is stored and has not been refused, so whatever it pushed
+            // out of the store can go: nothing on this machine can reach that key any more.
+            const replaced = await retireReplacedCredentials(before, options.storeCredentialFn ? [] : storedCredentialTokens(), poll.token, options.fetchFn);
+            const trimmed = typeof poll.revoked_login_keys === "number" && poll.revoked_login_keys > 0 && typeof poll.login_key_limit === "number"
+                ? { trimmedLoginKeys: { count: poll.revoked_login_keys, limit: poll.login_key_limit } }
+                : {};
             if (!identity?.ok) {
                 // Said out loud rather than swallowed: the login DID succeed, and the user
                 // should know which half of it did not.
                 progressStream.write(`Warning: signed in, but could not read the account name (${identity ? `the control plane answered ${identity.status}` : "the request failed"}).\n`);
-                return { storage };
+                return { storage, replaced, ...trimmed };
             }
             const email = await identity
                 .json()
                 .then((body) => body.user?.email)
                 .catch(() => undefined);
-            return email ? { email, storage } : { storage };
+            return { ...(email ? { email } : {}), storage, replaced, ...trimmed };
         }
     }
     finally {
@@ -1452,6 +1536,107 @@ async function deviceAuthFlow(options) {
     // same thing, so both share one message.
     throw new Error(expiredDeviceAuthMessage(options.purpose, userCode, start.expires_in * 1000, start.verification_uri));
 }
+/**
+ * Revoke every credential this login's write pushed out of the local stores (#1779).
+ *
+ * "Pushed out" means present before the write and absent after it - not merely
+ * different from the new token. A copy still sitting in another store (a plaintext
+ * fallback beside the keychain) is still reachable from this machine, and a process
+ * that skips the keychain may be using it, so it is left for `9pm logout`.
+ *
+ * Each key is revoked at the control plane that ISSUED it, which is not necessarily
+ * the one this login talked to: a production login overwrites a staging key in the
+ * same slot, and only staging can revoke that. A key with no recorded issuer is not
+ * sent anywhere. Never throws - the login has already succeeded.
+ */
+export async function retireReplacedCredentials(before, after, newToken, fetchFn) {
+    const seen = new Set([newToken]);
+    const outcomes = [];
+    for (const entry of before) {
+        if (seen.has(entry.token) || after.some((kept) => kept.token === entry.token)) {
+            continue;
+        }
+        seen.add(entry.token);
+        if (!entry.apiUrl) {
+            outcomes.push({ kind: "unknown_issuer" });
+            continue;
+        }
+        const apiUrl = normalizeApiUrl(entry.apiUrl);
+        const revocation = await revokeCredential({ apiUrl, token: entry.token, ...(fetchFn ? { fetchFn } : {}) });
+        outcomes.push(revocation.kind === "failed" ? { kind: "failed", apiUrl, reason: revocation.reason } : { kind: revocation.kind, apiUrl });
+    }
+    return outcomes;
+}
+/** The lines a login prints about what it retired, for stderr. Silent when nothing needs saying. */
+export function replacedCredentialMessages(result, loginApiUrl) {
+    const lines = [];
+    const manual = "revoke it from Settings > API keys in the dashboard, or it stays valid until 90 days pass without use.";
+    for (const outcome of result.replaced) {
+        if (outcome.kind === "revoked") {
+            const elsewhere = outcome.apiUrl !== normalizeApiUrl(loginApiUrl) ? ` (issued by ${outcome.apiUrl})` : "";
+            lines.push(`Revoked the credential this login replaced${elsewhere}.`);
+        }
+        else if (outcome.kind === "failed") {
+            lines.push(`Warning: the credential this login replaced could not be revoked at ${outcome.apiUrl} (${outcome.reason}) - ${manual}`);
+        }
+        else if (outcome.kind === "unknown_issuer") {
+            lines.push(`Warning: the credential this login replaced was stored by an older CLI that did not record where it was issued, so it was not revoked - ${manual}`);
+        }
+    }
+    if (result.trimmedLoginKeys) {
+        const { count, limit } = result.trimmedLoginKeys;
+        lines.push(`Revoked ${count} older login key${count === 1 ? "" : "s"} on this account (at most ${limit} stay live).`);
+    }
+    return lines;
+}
+/**
+ * Whether `9pm login` can keep the credential this machine already holds (#1779).
+ *
+ * Only the credential commands actually authenticate with is considered. One recorded
+ * as issued by another control plane is never sent here. One with no recorded issuer
+ * (stored before 0.42) IS probed here: keys are per database, so a 200 from the plane
+ * this login targets proves it was issued there, and leaving those to mint would keep
+ * the oldest CLIs' machines minting a stray key per run. Only the control plane's own
+ * refusal proves a key dead; a proxy's 401, a 5xx or a timeout proves nothing, so
+ * those come back as unverifiable rather than as permission to mint.
+ */
+export async function probeStoredLogin(options) {
+    const apiUrl = normalizeApiUrl(options.apiUrl);
+    const current = (options.stored ?? storedCredentialTokens())[0];
+    if (!current || (current.apiUrl && normalizeApiUrl(current.apiUrl) !== apiUrl)) {
+        return { kind: "mint" };
+    }
+    const fetchFn = options.fetchFn ?? fetch;
+    let response;
+    try {
+        response = await fetchFn(`${apiUrl}/v1/me`, {
+            method: "GET",
+            headers: jsonHeaders(current.token),
+            signal: AbortSignal.timeout(IDENTITY_TIMEOUT_MS),
+        });
+    }
+    catch (error) {
+        const reason = error instanceof Error && error.name === "TimeoutError"
+            ? `the control plane did not answer within ${IDENTITY_TIMEOUT_MS / 1000}s`
+            : error instanceof Error
+                ? error.message
+                : String(error);
+        return { kind: "unverifiable", reason };
+    }
+    if (response.status === 401 || response.status === 403) {
+        return (await isAuthRefusal(response))
+            ? { kind: "mint" }
+            : { kind: "unverifiable", reason: `${response.status} from something other than the control plane's own authentication` };
+    }
+    if (!response.ok) {
+        return { kind: "unverifiable", reason: `the control plane answered ${response.status}` };
+    }
+    const email = await response
+        .json()
+        .then((body) => body.user?.email)
+        .catch(() => undefined);
+    return email ? { kind: "reuse", email } : { kind: "reuse" };
+}
 // The actionable timeout guidance, shared by both routes out of an unapproved
 // device flow (the server's 410 and the client's own deadline) so they can never
 // drift into saying different things.
@@ -2178,6 +2363,22 @@ function withFetchDiagnostics(fetchFn) {
 function normalizeApiUrl(value) {
     return value.replace(/\/+$/g, "");
 }
+// The dashboard that manages what this CLI just deployed lives on the same
+// control plane as the API it talked to: api-<env>.9pm.ai is served beside
+// <env>.9pm.ai, and api.9pm.ai beside the public site. An origin outside that
+// shape (local dev, an unparseable URL) names production, the only dashboard a
+// tester could hold an account on.
+export function dashboardUrlForApiUrl(apiUrl) {
+    let host;
+    try {
+        host = new URL(normalizeApiUrl(apiUrl)).hostname.toLowerCase();
+    }
+    catch {
+        return PUBLIC_DASHBOARD_URL;
+    }
+    const environment = /^api-([a-z0-9-]+)\.9pm\.ai$/.exec(host);
+    return environment ? `https://${environment[1]}.9pm.ai/dashboard` : PUBLIC_DASHBOARD_URL;
+}
 function pathFromUpload(upload, deploymentId) {
     const marker = `/v1/uploads/${encodeURIComponent(deploymentId)}/`;
     const index = upload.path.indexOf(marker);
@@ -2222,6 +2423,8 @@ const VALID_DEPLOY_FLAGS = new Set([
     "memory",
     "no-build",
     "bundle",
+    "assets",
+    "no-assets",
 ]);
 export function parseArgs(argv) {
     const command = argv[0];
@@ -2248,7 +2451,12 @@ export function parseArgs(argv) {
     }
     if (command === "login") {
         const flags = parseFlags(argv);
-        return { kind: "login", apiUrl: readApiUrl(flags, DEFAULT_API_URL), allowFileCredentialStore: flags.has("allow-file-credential-store") };
+        return {
+            kind: "login",
+            apiUrl: readApiUrl(flags, DEFAULT_API_URL),
+            allowFileCredentialStore: flags.has("allow-file-credential-store"),
+            fresh: flags.has("fresh"),
+        };
     }
     if (command === "signup") {
         const flags = parseFlags(argv);
@@ -2450,6 +2658,23 @@ export function parseArgs(argv) {
         options.runtime = "worker";
         options.bundleDir = bundleDir;
     }
+    const assetsFlag = flags.get("assets");
+    if (assetsFlag !== undefined || flags.has("no-assets")) {
+        if (assetsFlag !== undefined && flags.has("no-assets")) {
+            throw new Error("--assets and --no-assets cannot be combined.");
+        }
+        if (assetsFlag === true || assetsFlag === "") {
+            throw new Error("--assets needs a directory, for example --assets public. Use --no-assets if nothing should be public.");
+        }
+        if (options.bundleDir) {
+            throw new Error("--assets and --no-assets apply to --entry worker deploys; a --bundle deploy already serves only its assets directory.");
+        }
+        const workerRuntime = options.runtime === "worker" || (options.runtime === undefined && options.entry !== undefined);
+        if (!workerRuntime) {
+            throw new Error("--assets and --no-assets apply to worker deploys (--runtime worker --entry <file>); a static site serves every file.");
+        }
+        options.publicAssets = typeof assetsFlag === "string" ? normalizeAssetsDirectory(assetsFlag) : NO_PUBLIC_ASSETS;
+    }
     if (options.runtime === "container" && !options.port) {
         throw new Error("Container deploys require --port <port>.");
     }
@@ -3157,6 +3382,48 @@ function parseDurationSeconds(value) {
     const seconds = unit === "d" ? amount * 24 * 60 * 60 : unit === "h" ? amount * 60 * 60 : unit === "m" ? amount * 60 : amount;
     return Math.min(seconds, 7 * 24 * 60 * 60);
 }
+// #1847: what an entry-based worker deploy publishes. Shown on every deploy that still
+// uses the legacy shape rather than only under `--check`, because the app that leaks is
+// the one whose author never thought to check.
+const PUBLIC_FILE_LIST_LIMIT = 10;
+export function workerPublicFiles(paths, serverEntry, selection) {
+    const files = [];
+    for (const filePath of paths) {
+        const url = publicAssetPath(filePath, serverEntry, selection);
+        if (url !== null) {
+            files.push({ path: filePath, url });
+        }
+    }
+    return files;
+}
+export function legacyPublicAssetsWarning(serverEntry, publicPaths) {
+    const shown = publicPaths.slice(0, PUBLIC_FILE_LIST_LIMIT);
+    const more = publicPaths.length - shown.length;
+    return [
+        `this worker app serves every file in the deploy directory except its entry (${serverEntry}) at a public URL - ${publicPaths.length} file(s).`,
+        "Choose what is public with --assets <dir> (only that directory is served; for example --assets public) or --no-assets. The app remembers the choice for later deploys.",
+        `Public now: ${shown.length > 0 ? shown.join(", ") : "none"}${more > 0 ? `, and ${more} more (9pm deploy --check lists them all)` : ""}`,
+    ].join("\n  ");
+}
+export function privateLookingPublicWarning(paths, selection) {
+    const shown = paths.slice(0, PUBLIC_FILE_LIST_LIMIT);
+    const more = paths.length - shown.length;
+    const remedy = selection === null
+        ? "Choose a public directory with --assets <dir>, or move them out of the deploy directory."
+        : `Move them out of ${selection}.`;
+    return `these files look like server code or leftovers, and anyone can download them: ${shown.join(", ")}${more > 0 ? `, and ${more} more` : ""}. ${remedy}`;
+}
+// The files a deploy sends: everything, unless a worker selection narrows it to the entry
+// and the public files. The same set the server holds to the per-file limit.
+function uploadedFiles(manifest, serverEntry, selection) {
+    if (!serverEntry || selection === null) {
+        return manifest;
+    }
+    return manifest.filter((file) => file.path === serverEntry || publicAssetPath(file.path, serverEntry, selection) !== null);
+}
+function missingAssetsDirectoryMessage(selection) {
+    return `--assets ${selection.slice(0, -1)}: no files were found under ${selection} in the deploy directory.`;
+}
 function normalizeServerEntry(value) {
     const normalized = value.trim().replaceAll("\\", "/").replace(/^\.\/+/, "");
     if (!normalized || normalized.startsWith("/") || normalized.split("/").includes("..")) {
@@ -3170,18 +3437,17 @@ async function validateWorkerEntrySource(source, filePath) {
     if (/\bfrom\s+["'][^"']+["']/.test(source) || /\bimport\s*\(/.test(source) || /(^|\n)\s*import\s+["'][^"']+["']/.test(source)) {
         errors.push("Worker runtime entry must be bundled into one module with no external imports.");
     }
-    const hasLiteralDefault = /\bexport\s+default\b/.test(source);
-    const hasDefaultReexport = /export\s*\{\s*([A-Za-z_$][\w$]*)\s+as\s+default\s*,?\s*\}\s*;?\s*$/.test(source);
-    if (!hasLiteralDefault && !hasDefaultReexport) {
-        errors.push(`Worker runtime entry ${filePath} must export a default fetch handler.`);
-    }
+    // Whether the entry has a default export is decided by evaluating it as an ES module,
+    // which is what the server uploads unmodified, not by matching its text:
+    // `export { handler as default, helper }`, a comment before `default`, and a string or
+    // escaped export name are all valid defaults a text match would refuse (#1851).
     if (errors.length === 0) {
-        const transformed = hasLiteralDefault
-            ? source
-            : `${source.replace(/export\s*\{\s*([A-Za-z_$][\w$]*)\s+as\s+default\s*,?\s*\}\s*;?\s*$/, "export default $1;")}`;
         try {
-            const module = await import(`data:text/javascript;base64,${Buffer.from(transformed).toString("base64")}`);
-            if (typeof module.default?.fetch !== "function" && typeof module.default !== "function") {
+            const module = await import(`data:text/javascript;base64,${Buffer.from(source).toString("base64")}`);
+            if (!("default" in module)) {
+                errors.push(`Worker runtime entry ${filePath} must export a default fetch handler.`);
+            }
+            else if (typeof module.default?.fetch !== "function" && typeof module.default !== "function") {
                 errors.push("Default export must be a function or an object with fetch(request, env, ctx).");
             }
         }
@@ -3985,6 +4251,12 @@ async function main() {
                         const subject = moduleCount === 1 ? "entry" : `${moduleCount} server modules`;
                         console.log(`Server code (${subject}): ${compressedBytes.toLocaleString("en-US")} bytes compressed of ${MAX_WORKER_ENTRY_COMPRESSED_BYTES.toLocaleString("en-US")} allowed.`);
                     }
+                    if (check.publicFiles) {
+                        console.log(check.publicFiles.length > 0 ? `Public files (${check.publicFiles.length}):` : "Public files: none.");
+                        for (const file of check.publicFiles) {
+                            console.log(`  ${file.path} -> ${file.url}`);
+                        }
+                    }
                 }
                 return;
             }
@@ -4026,7 +4298,7 @@ async function main() {
             if (queued) {
                 console.log(`Status: ${result.deployment.status}. Run 9pm apps to check when it becomes active.`);
             }
-            console.log(`Manage: ${PUBLIC_DASHBOARD_URL}${command.options.owner ? `?owner=${encodeURIComponent(command.options.owner)}` : ""}`);
+            console.log(`Manage: ${dashboardUrlForApiUrl(command.options.apiUrl)}${command.options.owner ? `?owner=${encodeURIComponent(command.options.owner)}` : ""}`);
             // Gated the same way as the reachability probe above: a programmatic
             // caller injecting fetchFn opted out of the CLI's own network side trips.
             if (!command.options.fetchFn) {
@@ -4038,13 +4310,30 @@ async function main() {
             return;
         }
         if (command.kind === "login") {
+            // Each login used to mint another full-scope key (#1779); keep a working one.
+            if (!command.fresh) {
+                const probe = await probeStoredLogin({ apiUrl: command.apiUrl });
+                if (probe.kind === "reuse") {
+                    console.log(`Already logged in${probe.email ? ` as ${probe.email}` : ""}. Run "9pm login --fresh" to replace this machine's credential.`);
+                    return;
+                }
+                if (probe.kind === "unverifiable") {
+                    throw new Error(`Could not check the credential already stored on this machine (${probe.reason}). Retry, or run "9pm login --fresh" to replace it.`);
+                }
+            }
             const result = await loginDevice({ apiUrl: command.apiUrl, allowFileCredentialStore: command.allowFileCredentialStore });
             console.log(`Logged in${result.email ? ` as ${result.email}` : ""}. Credential stored in ${result.storage}.`);
+            for (const line of replacedCredentialMessages(result, command.apiUrl)) {
+                console.error(line);
+            }
             return;
         }
         if (command.kind === "signup") {
             const result = await signupDevice({ apiUrl: command.apiUrl, allowFileCredentialStore: command.allowFileCredentialStore });
             console.log(`Signed up${result.email ? ` as ${result.email}` : ""}. Credential stored in ${result.storage}.`);
+            for (const line of replacedCredentialMessages(result, command.apiUrl)) {
+                console.error(line);
+            }
             return;
         }
         if (command.kind === "logout") {
@@ -4518,14 +4807,14 @@ function printUsage() {
     console.log(`Usage:
   9pm --version
   9pm deploy [directory] --name <site-name> [--slug <slug>] [--owner <organisation>] [--description "<note>"] [--with-db] [--with-auth] [--with-email]
-  9pm deploy [directory] --runtime worker --entry src/index.js [--with-db]
+  9pm deploy [directory] --runtime worker --entry src/index.js (--assets <dir> | --no-assets) [--with-db]
   9pm deploy [directory] --runtime container --port 8080 [--health-path /health] [--region auto] [--with-db] [--always-on] [--volume <gb> | --no-volume] [--cpus <n>] [--memory <size>]
   9pm deploy [directory]                   framework projects (Next.js, Vite) are detected and built automatically; --no-build skips
   9pm deploy [directory] --bundle <dir>    deploy a pre-built Cloudflare framework bundle (e.g. .open-next)
   9pm deploy [directory] --description "<note>"   optional short note shown next to the version in the dashboard
   9pm deploy [directory] --check
   9pm signup
-  9pm login
+  9pm login [--fresh]                     keeps a working stored credential; --fresh replaces it and revokes the old one
   9pm logout [--api-url <url>] [--local]   revokes the credential server-side, then removes it from this machine (--local skips the revoke)
   9pm doctor [--json]
   9pm whoami [--json]
@@ -4568,10 +4857,18 @@ Size limits:
   Individual files are limited to ${formatMebibytes(MAX_STATIC_ASSET_FILE_BYTES)}.
   Worker runtime: server code is limited to ${formatMegabytes(MAX_WORKER_ENTRY_COMPRESSED_BYTES)} compressed (gzip) — the ${formatMegabytes(MAX_WORKER_SCRIPT_COMPRESSED_BYTES)} script limit
   less a small reserve for the generated wrapper. That budget covers the --entry module, or
-  with --bundle every server module together, since they deploy as one script. Every other
-  file in the directory is served from the asset store instead, so it does not count toward
-  that limit — keep large images, fonts and datasets as sibling files rather than inlining
-  them into the entry. Apps needing more server code than that should deploy as containers.
+  with --bundle every server module together, since they deploy as one script. Public files
+  are served from the asset store instead, so they do not count toward that limit — keep large
+  images, fonts and datasets as public files rather than inlining them into the entry. Apps
+  needing more server code than that should deploy as containers.
+
+Worker public files:
+  --assets <dir>   only the files under <dir> are public, served from the app's root
+                   (<dir>/index.html answers on /). Nothing else in the directory is uploaded.
+  --no-assets      nothing is public; the entry answers every request.
+  The app remembers the choice, so later deploys need not repeat it; pass the other flag to
+  change it. A worker app that never chose serves EVERY file except its entry publicly, and
+  each deploy warns about it. --check lists the files a deploy would make public.
 
 Container deploys:
   Requires Docker locally. The CLI builds linux/amd64, exports the image, uploads it through a short-lived session, then finalizes a queued deployment.

package/dist/public-assets.d.ts

@@ -0,0 +1,5 @@
+export declare const NO_PUBLIC_ASSETS = "none";
+export declare function normalizeAssetsDirectory(value: string): string;
+export declare function parsePublicAssetsSelection(value: unknown): string | null;
+export declare function publicAssetPath(filePath: string, serverEntry: string | null, selection: string | null): string | null;
+export declare function privateLookingPaths(filePaths: readonly string[], serverEntry: string | null): string[];

package/dist/public-assets.js

@@ -0,0 +1,91 @@
+// AUTO-GENERATED by scripts/generate-cli-package.mjs from the in-repo CLI source -- do not edit.
+// Edit src/cli or src/shared instead; this is regenerated on typecheck/test/build/pack.
+// Which files of a worker-runtime deploy become public URLs (#1847). Shared by the control
+// plane, which enforces it at publish, and the CLI, which warns and trims what it uploads.
+// Keep this module dependency-free: it is copied verbatim into the shipped ninepm tarball.
+//
+// A selection is one of two strings, and the same string is used everywhere it travels -
+// the `--assets`/`--no-assets` flags, `metadata.publicAssets` on a deployment, and the
+// project's `worker_public_assets` column:
+//   - a relative directory prefix ending in "/" (e.g. "public/"): only files under it are
+//     served, at their path below it, so `public/index.html` answers on `/index.html`;
+//   - NO_PUBLIC_ASSETS: nothing is served from the deploy directory at all.
+// Absence (null) is the legacy shape every app had before this existed: every file except
+// the entry is served at its own path. It is never a value a client can send, so once an
+// app has chosen, no later deploy can widen it back to legacy by omission.
+export const NO_PUBLIC_ASSETS = "none";
+// Turns what a person typed after `--assets` into the canonical prefix, or throws with a
+// message that names the problem. The deploy root itself is refused: the entry lives
+// there, so "everything" is the legacy shape rather than a selection, and allowing it
+// would let a flag meant to narrow publication silently reproduce the problem it fixes.
+export function normalizeAssetsDirectory(value) {
+    const trimmed = value.trim();
+    if (trimmed.includes("\\")) {
+        throw new Error(`--assets must use "/" between directory names: ${value}`);
+    }
+    if (trimmed.startsWith("/")) {
+        throw new Error(`--assets must be a directory inside the deploy directory, not an absolute path: ${value}`);
+    }
+    const segments = trimmed.split("/").filter((segment, index) => segment !== "" && !(index === 0 && segment === "."));
+    if (segments.length === 0) {
+        throw new Error("--assets must name a subdirectory (for example --assets public). The deploy directory itself holds your server code; use --no-assets if nothing should be public.");
+    }
+    if (segments.some((segment) => segment === "." || segment === "..")) {
+        throw new Error(`--assets must be a directory inside the deploy directory: ${value}`);
+    }
+    return `${segments.join("/")}/`;
+}
+// The server's reading of a stored or client-sent selection: the canonical form only,
+// never a lenient one, so the value that was validated is byte for byte the value used.
+export function parsePublicAssetsSelection(value) {
+    if (value === NO_PUBLIC_ASSETS) {
+        return NO_PUBLIC_ASSETS;
+    }
+    if (typeof value !== "string" || !value.endsWith("/")) {
+        return null;
+    }
+    try {
+        return normalizeAssetsDirectory(value) === value ? value : null;
+    }
+    catch {
+        return null;
+    }
+}
+// The URL path a deploy file is served on, or null when it must not be public. The entry
+// is never public under any selection: it is uploaded as the Worker's own module.
+export function publicAssetPath(filePath, serverEntry, selection) {
+    if (serverEntry !== null && filePath === serverEntry) {
+        return null;
+    }
+    if (selection === null) {
+        return filePath.startsWith("/") ? filePath : `/${filePath}`;
+    }
+    if (selection === NO_PUBLIC_ASSETS || !filePath.startsWith(selection)) {
+        return null;
+    }
+    return `/${filePath.slice(selection.length)}`;
+}
+const SCRIPT_EXTENSION = /\.(js|mjs|cjs|ts|mts|cts|jsx|tsx)$/i;
+const LEFTOVER_FILE = /(\.(orig|bak|old|rej|swp|swo|tmp)|~)$/i;
+// Public files that look like they were never meant to be: editor and merge leftovers,
+// dotfiles, and other script files in the entry's own directory (which is where server
+// helpers live). A heuristic for a warning, never a filter - a client script beside the
+// entry is legitimate, which is why the fix is a selection and not this list.
+export function privateLookingPaths(filePaths, serverEntry) {
+    const entryDirectory = serverEntry !== null && serverEntry.includes("/") ? serverEntry.slice(0, serverEntry.lastIndexOf("/") + 1) : "";
+    return filePaths.filter((filePath) => {
+        if (filePath === serverEntry) {
+            return false;
+        }
+        const name = filePath.slice(filePath.lastIndexOf("/") + 1);
+        if (LEFTOVER_FILE.test(name) || filePath.split("/").some((segment) => segment.startsWith(".") && segment !== ".well-known")) {
+            return true;
+        }
+        if (!SCRIPT_EXTENSION.test(name)) {
+            return false;
+        }
+        // Beside the entry: under its directory when it has one, or directly at the root
+        // when the entry itself sits there (a root-level entry says nothing about subfolders).
+        return entryDirectory === "" ? !filePath.includes("/") : filePath.startsWith(entryDirectory);
+    });
+}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "ninepm",
-  "version": "0.60.0",
+  "version": "0.64.0",
   "description": "CLI for deploying built apps to 9pm.ai.",
   "homepage": "https://9pm.ai",
   "keywords": [