ninepm 0.61.0 → 0.65.0

package/README.md

@@ -21,6 +21,8 @@ Authenticate in your own browser. The CLI stores the token in native protected s
 9pm doctor
 ```
 
+Running `9pm login` again keeps a credential that still works instead of minting another; `9pm login --fresh` replaces it and revokes the old one.
+
 For CI, set `NINEPM_API_KEY` yourself in the CI secret store. `--token` and `NINEPM_API_KEY` still override the stored login token.
 
 A key for CI or a server is minted from a signed-in machine with `9pm api-key create --name <name>`; the token is printed once. `9pm api-key ls` lists your active keys and `9pm api-key revoke <key-id>` retires one. Each account holds at most 10 such keys at a time (login tokens do not count). Store the key under any name but `NINEPM_*` when it lives in a 9pm app's own environment, and pass it with `--token`.
@@ -99,11 +101,13 @@ Share links are **owner-only by default**: the link opens only for you, signed i
 Deploy a first-class Worker runtime app:
 
 ```sh
-9pm deploy ./examples/worker-app --name worker-app --slug worker-app --runtime worker --entry src/index.js --with-db
+9pm deploy ./examples/worker-app --name worker-app --slug worker-app --runtime worker --entry src/index.js --assets public --with-db
 ```
 
 The `--runtime worker` entry must be a bundled fetch-compatible JavaScript module with a default export. With `--with-db`, the app receives `env.DB` and should use SQLite-compatible prepared statements.
 
+Choose which files are public with `--assets <dir>`: only the files under that directory are served, from the app's root (`public/index.html` answers on `/`), and nothing else in the deploy directory is uploaded. Use `--no-assets` when the entry serves every response itself. The app remembers the choice, so later deploys need not repeat the flag; pass the other flag, or another directory, to change it — there is no way back to publishing everything. A worker app that has never chosen serves **every file in the deploy directory except the entry** publicly, server helpers and leftovers like `index.js.orig` included; every deploy of such an app prints a warning naming those files, and `9pm deploy --check` lists every file a deploy would make public.
+
 Deploy a container app from a local Docker build:
 
 ```sh
@@ -179,10 +183,10 @@ Service token secrets returned by `access service create` are also server-side s
 ```sh
 9pm --version
 9pm deploy [directory] --name <name> [--slug <slug>] [--with-db]
-9pm deploy [directory] --check [--runtime worker --entry <path>]
+9pm deploy [directory] --check [--runtime worker --entry <path> (--assets <dir> | --no-assets)]
 9pm deploy [directory] --runtime container --port 8080 [--health-path /health] [--region auto] [--with-db]
 9pm signup
-9pm login
+9pm login [--fresh]
 9pm logout [--api-url <url>] [--local]
 9pm doctor [--json]
 9pm whoami
@@ -193,7 +197,7 @@ Service token secrets returned by `access service create` are also server-side s
 9pm files get <file-id> [--output <path>] [--project <site>]
 9pm files share <file-id> [--expires 24h] [--public] [--project <site>]
 9pm files delete <file-id> [--project <site>]
-9pm deploy [directory] --runtime worker --entry <path> [--with-db]
+9pm deploy [directory] --runtime worker --entry <path> (--assets <dir> | --no-assets) [--with-db]
 9pm delete <site> --confirm <slug>
 9pm access show <site>
 9pm access public <site>
@@ -222,6 +226,8 @@ Options:
 - `--environment <name>` sets deployment environment metadata
 - `--runtime <static|worker|container>` selects static asset hosting, app-owned Worker code, or local Docker container deployment
 - `--entry <path>` selects the Worker runtime server entry file
+- `--assets <dir>` makes only that directory of a worker deploy public (remembered for later deploys)
+- `--no-assets` makes no file of a worker deploy public (remembered for later deploys)
 - `--port <port>` selects the HTTP port exposed by a container app
 - `--health-path <path>` optionally lets 9pm.ai check container health before marking it healthy
 - `--region <region>` optionally selects provider-neutral container placement

package/dist/cli-types.d.ts

@@ -15,6 +15,7 @@ export interface Project {
     activeDeploymentId: string | null;
     createdAt: string;
     updatedAt: string;
+    workerPublicAssets?: string | null;
 }
 export interface AppUserFilesUsage {
     usedBytes: number;

package/dist/deploy-limits.js

@@ -47,8 +47,9 @@ export function assetFileTooLargeMessage(filePath, size) {
 export function oversizedAssets(files) {
     return files.filter((file) => file.size > MAX_STATIC_ASSET_FILE_BYTES);
 }
-// The worker-runtime server entry is the one deploy-directory file inlined into
-// the generated Worker script (`buildHostedAppWorker`), so it — unlike every
+// The worker-runtime server entry is the one deploy-directory file uploaded as part
+// of the generated Worker script (`buildHostedAppWorker`, as its own module beside the
+// wrapper's main module), so it — unlike every
 // other file, which rides the Workers Assets API — counts against the runtime's
 // script-size budget. That budget is enforced on the *compressed* upload, so
 // this limit is measured on gzipped bytes, not raw ones. Measuring raw bytes is
@@ -68,7 +69,8 @@ export const MAX_WORKER_SCRIPT_COMPRESSED_BYTES = 10 * 1_000_000;
 // generates is uploaded as part of the same script. Two consumers spend this reserve,
 // depending on the deploy shape:
 //   - single `--entry` workers: `buildHostedAppWorker` (analytics, end-user auth,
-//     Access/vanity-host checks, asset fallback), inlined around the entry;
+//     Access/vanity-host checks, asset fallback), uploaded as the script's main module
+//     with the entry as a separate module it imports - the same script, so the same budget;
 //   - `--bundle` deploys: `buildBundleWrapperModule`, added as the script's main module
 //     alongside the bundle's own modules.
 // Both were measured, and both are near-flat across feature combinations: the hosted

package/dist/index.d.ts

@@ -17,6 +17,7 @@ export interface DeployOptions {
     bindingName?: string;
     runtime?: AppRuntime;
     entry?: string;
+    publicAssets?: string;
     port?: number;
     healthPath?: string;
     region?: ContainerRegion;
@@ -116,7 +117,7 @@ export interface CreatedServiceToken {
     clientSecret: string;
 }
 export type FetchLike = (input: string | URL | Request, init?: RequestInit) => Promise<Response>;
-export declare const CLI_VERSION = "0.61.0";
+export declare const CLI_VERSION = "0.65.0";
 type CredentialBackend = "macos-keychain" | "windows-dpapi" | "linux-secret-service" | "file-plaintext" | "none";
 export interface StoredCredentialEntry {
     token: string;
@@ -186,6 +187,10 @@ export interface DeployCheckResult {
         compressedBytes: number;
         moduleCount: number;
     };
+    publicFiles?: Array<{
+        path: string;
+        url: string;
+    }>;
 }
 export type DetectedFramework = "nextjs" | "astro" | "sveltekit" | "vite";
 export declare function detectFramework(directory: string): DetectedFramework | null;
@@ -329,30 +334,94 @@ export declare function listSites(options: ApiOptions & {
 export declare function deleteSite(options: DeleteSiteOptions): Promise<DeletedSiteResult>;
 export interface DeviceAuthFeedbackOptions {
     progressStream?: NodeJS.WriteStream;
-    openBrowserFn?: (url: string) => BrowserOpenResult;
+    openBrowserFn?: (url: string) => BrowserOpenResult | Promise<BrowserOpenResult>;
     storeCredentialFn?: (token: string, options: {
         allowFileFallback?: boolean | undefined;
         apiUrl?: string | undefined;
     }) => string;
+    inputStream?: NodeJS.ReadStream;
+    signalTarget?: Pick<NodeJS.EventEmitter, "once" | "removeListener">;
+}
+export declare class DeviceAuthCancelledError extends Error {
+    readonly purpose: "login" | "signup";
+    constructor(purpose: "login" | "signup");
+}
+export declare const CANCELLED_EXIT_CODE = 130;
+export type ReplacedCredential = {
+    kind: "revoked";
+    apiUrl: string;
+} | {
+    kind: "already_invalid";
+    apiUrl: string;
+} | {
+    kind: "failed";
+    apiUrl: string;
+    reason: string;
+} | {
+    kind: "unknown_issuer";
+};
+export interface DeviceAuthResult {
+    email?: string;
+    storage: string;
+    replaced: ReplacedCredential[];
+    trimmedLoginKeys?: {
+        count: number;
+        limit: number;
+    };
 }
 export declare function loginDevice(options: {
     apiUrl: string;
     fetchFn?: FetchLike;
     machineName?: string;
     allowFileCredentialStore?: boolean;
-} & DeviceAuthFeedbackOptions): Promise<{
-    email?: string;
-    storage: string;
-}>;
+} & DeviceAuthFeedbackOptions): Promise<DeviceAuthResult>;
 export declare function signupDevice(options: {
     apiUrl: string;
     fetchFn?: FetchLike;
     machineName?: string;
     allowFileCredentialStore?: boolean;
-} & DeviceAuthFeedbackOptions): Promise<{
+} & DeviceAuthFeedbackOptions): Promise<DeviceAuthResult>;
+/**
+ * Revoke every credential this login's write pushed out of the local stores (#1779).
+ *
+ * "Pushed out" means present before the write and absent after it - not merely
+ * different from the new token. A copy still sitting in another store (a plaintext
+ * fallback beside the keychain) is still reachable from this machine, and a process
+ * that skips the keychain may be using it, so it is left for `9pm logout`.
+ *
+ * Each key is revoked at the control plane that ISSUED it, which is not necessarily
+ * the one this login talked to: a production login overwrites a staging key in the
+ * same slot, and only staging can revoke that. A key with no recorded issuer is not
+ * sent anywhere. Never throws - the login has already succeeded.
+ */
+export declare function retireReplacedCredentials(before: StoredCredentialEntry[], after: StoredCredentialEntry[], newToken: string, fetchFn?: FetchLike): Promise<ReplacedCredential[]>;
+/** The lines a login prints about what it retired, for stderr. Silent when nothing needs saying. */
+export declare function replacedCredentialMessages(result: Pick<DeviceAuthResult, "replaced" | "trimmedLoginKeys">, loginApiUrl: string): string[];
+export type StoredLoginProbe = {
+    kind: "reuse";
     email?: string;
-    storage: string;
-}>;
+} | {
+    kind: "mint";
+} | {
+    kind: "unverifiable";
+    reason: string;
+};
+/**
+ * Whether `9pm login` can keep the credential this machine already holds (#1779).
+ *
+ * Only the credential commands actually authenticate with is considered. One recorded
+ * as issued by another control plane is never sent here. One with no recorded issuer
+ * (stored before 0.42) IS probed here: keys are per database, so a 200 from the plane
+ * this login targets proves it was issued there, and leaving those to mint would keep
+ * the oldest CLIs' machines minting a stray key per run. Only the control plane's own
+ * refusal proves a key dead; a proxy's 401, a 5xx or a timeout proves nothing, so
+ * those come back as unverifiable rather than as permission to mint.
+ */
+export declare function probeStoredLogin(options: {
+    apiUrl: string;
+    fetchFn?: FetchLike;
+    stored?: StoredCredentialEntry[];
+}): Promise<StoredLoginProbe>;
 export declare function expiredDeviceAuthMessage(purpose: string, userCode: string, lifetimeMs: number, verificationUri: string): string;
 export declare function listManagedFiles(options: FileCommandOptions): Promise<ManagedFileListResult>;
 export declare function getAppUserFilesUsage(options: ApiOptions & {
@@ -391,9 +460,12 @@ export interface UploadProgressReporter {
 export declare function createUploadProgressReporter(stream?: NodeJS.WriteStream): UploadProgressReporter;
 export interface DeviceAuthProgressReporter {
     tick(remainingMs: number): void;
+    note(line: string): void;
     stop(): void;
 }
-export declare function createDeviceAuthProgressReporter(stream?: NodeJS.WriteStream): DeviceAuthProgressReporter;
+export declare function createDeviceAuthProgressReporter(stream?: NodeJS.WriteStream, options?: {
+    hint?: string;
+}): DeviceAuthProgressReporter;
 export declare function noteCliOutdatedAdvisory(response: Response, log?: (line: string) => void): void;
 export declare function resetCliOutdatedAdvisoryForTests(): void;
 export declare function dashboardUrlForApiUrl(apiUrl: string): string;
@@ -406,6 +478,7 @@ type CliCommand = {
     kind: "login";
     apiUrl: string;
     allowFileCredentialStore: boolean;
+    fresh: boolean;
 } | {
     kind: "signup";
     apiUrl: string;
@@ -592,6 +665,12 @@ export declare function parseEnvFileEntries(content: string, kind: "secret" | "v
     kind: "secret" | "var";
 }>;
 export declare function healthWithReason(status: string | null | undefined, reason: string | null | undefined): string;
+export declare function workerPublicFiles(paths: readonly string[], serverEntry: string, selection: string | null): Array<{
+    path: string;
+    url: string;
+}>;
+export declare function legacyPublicAssetsWarning(serverEntry: string, publicPaths: readonly string[]): string;
+export declare function privateLookingPublicWarning(paths: readonly string[], selection: string | null): string;
 export declare function storedCredentialTokens(): StoredCredentialEntry[];
 /**
  * Whether a credential provably cannot be stored, decided WITHOUT writing one (#859).

package/dist/index.js

@@ -1,7 +1,7 @@
 #!/usr/bin/env node
 // AUTO-GENERATED by scripts/generate-cli-package.mjs from the in-repo CLI source -- do not edit.
 // Edit src/cli or src/shared instead; this is regenerated on typecheck/test/build/pack.
-import { spawnSync } from "node:child_process";
+import { spawn, spawnSync } from "node:child_process";
 import { createHash } from "node:crypto";
 import os from "node:os";
 import path from "node:path";
@@ -14,8 +14,9 @@ import { MAX_DEPLOY_DESCRIPTION_LENGTH, normalizeDeployDescription } from "./dep
 import { managedHostnamesIn, siblingCallWarning, siblingsOf } from "./sibling-hostnames.js";
 import { MAX_STATIC_ASSET_FILE_BYTES, MAX_WORKER_ENTRY_COMPRESSED_BYTES, MAX_WORKER_SCRIPT_COMPRESSED_BYTES, WORKER_ENTRY_COMPRESSED_WARN_BYTES, assetFileTooLargeMessage, formatMebibytes, formatMegabytes, oversizedAssets, workerBundleNearLimitMessage, workerBundleTooLargeMessage, workerEntryNearLimitMessage, workerEntryTooLargeMessage, } from "./deploy-limits.js";
 import { buildFileManifest, readManifestFile } from "./manifest.js";
+import { NO_PUBLIC_ASSETS, normalizeAssetsDirectory, privateLookingPaths, publicAssetPath } from "./public-assets.js";
 import { API_KEY_HELP, API_URL_HELP, CLI_CLIENT_ID, DEFAULT_API_URL, reportCliError } from "./cli-config.js";
-export const CLI_VERSION = "0.61.0";
+export const CLI_VERSION = "0.65.0";
 const PUBLIC_DASHBOARD_URL = "https://9pm.ai/dashboard";
 const TOKEN_SERVICE = "9pm";
 const TOKEN_ACCOUNT = "default";
@@ -466,12 +467,25 @@ async function runDeploy(initialOptions, slugHolder) {
     if (serverEntry && !manifest.some((file) => file.path === serverEntry)) {
         throw new Error(`Worker runtime entry file was not found in the deploy directory: ${serverEntry}`);
     }
+    if (serverEntry &&
+        options.publicAssets &&
+        options.publicAssets !== NO_PUBLIC_ASSETS &&
+        workerPublicFiles(manifest.map((file) => file.path), serverEntry, options.publicAssets).length === 0) {
+        throw new Error(missingAssetsDirectoryMessage(options.publicAssets));
+    }
     // Reject oversized assets before creating the project (#195): the server's size
     // guard only fires on the later create-deployment call, which would otherwise
     // leave an orphaned no-deploy app holding the slug and a Sites quota slot.
-    const [oversized] = oversizedAssets(manifest);
-    if (oversized) {
-        throw new Error(assetFileTooLargeMessage(oversized.path, oversized.size));
+    // Only files this deploy uploads are held to the limit (#1847): a private file outside
+    // the public directory is never sent. A worker deploy without a flag cannot know its
+    // selection until the project resolves, so its check runs after that instead - a first
+    // deploy it refuses is still rolled back by deployDirectory.
+    const selectionKnown = !serverEntry || options.publicAssets !== undefined;
+    if (selectionKnown) {
+        const [oversized] = oversizedAssets(uploadedFiles(manifest, serverEntry, options.publicAssets ?? null));
+        if (oversized) {
+            throw new Error(assetFileTooLargeMessage(oversized.path, oversized.size));
+        }
     }
     // Same worker-entry budget `--check` applies, on the same compressed dimension, so
     // the two paths agree (#645). This rejects only what the runtime would refuse at
@@ -539,6 +553,38 @@ async function runDeploy(initialOptions, slugHolder) {
     if (siblings.length > 0) {
         console.warn(`Warning: ${siblingCallWarning(siblings)}`);
     }
+    // #1847: after the project resolves, because a choice made on an earlier deploy is the
+    // project's, and the control plane applies it whether or not this deploy repeats it.
+    if (serverEntry) {
+        const selection = options.publicAssets ?? project.workerPublicAssets ?? null;
+        const publicFiles = workerPublicFiles(manifest.map((file) => file.path), serverEntry, selection);
+        if (selection === null) {
+            // Nothing beside the entry means nothing leaks, so there is nothing to warn about.
+            if (publicFiles.length > 0) {
+                console.warn(`Warning: ${legacyPublicAssetsWarning(serverEntry, publicFiles.map((file) => file.path))}`);
+            }
+        }
+        else {
+            if (options.publicAssets === undefined) {
+                const chosen = selection === NO_PUBLIC_ASSETS ? "no public files" : `only ${selection} is public`;
+                console.warn(`Note: ${chosen}, as chosen on an earlier deploy of this app. Pass --assets <dir> or --no-assets to change it.`);
+            }
+            // Files the platform will never serve are not sent at all: the entry is the only
+            // server file it reads, so nothing else outside the public directory leaves this machine.
+            manifest = uploadedFiles(manifest, serverEntry, selection);
+        }
+        const suspicious = privateLookingPaths(publicFiles.map((file) => file.path), serverEntry);
+        if (suspicious.length > 0) {
+            console.warn(`Warning: ${privateLookingPublicWarning(suspicious, selection)}`);
+        }
+    }
+    if (!selectionKnown) {
+        // `manifest` is already narrowed to what this deploy uploads.
+        const [oversized] = oversizedAssets(manifest);
+        if (oversized) {
+            throw new Error(assetFileTooLargeMessage(oversized.path, oversized.size));
+        }
+    }
     const database = options.withDatabase
         ? await createDatabase(fetchFn, apiUrl, options.token, project.id, {
             name: options.databaseName ?? `${project.slug}-db`,
@@ -564,6 +610,7 @@ async function runDeploy(initialOptions, slugHolder) {
             runtime,
             serverEntry: serverEntry ?? null,
             ...(bundle ? { bundle } : {}),
+            ...(serverEntry && options.publicAssets ? { publicAssets: options.publicAssets } : {}),
         },
     });
     let uploaded = 0;
@@ -595,10 +642,11 @@ async function runDeploy(initialOptions, slugHolder) {
     };
 }
 // Measure the worker-runtime entry the way the platform's script-size budget is
-// actually applied: the entry is inlined into the generated Worker script, and the
-// budget is enforced against the compressed upload. gzipped bytes are therefore
-// the comparable figure; the raw size is carried alongside for the error message
-// only, so a report can name both dimensions instead of silently mixing them.
+// actually applied: the entry is uploaded as its own module in the same Worker
+// script, and the budget applies to the compressed upload of that whole script.
+// gzipped bytes are therefore the comparable figure; the raw size is carried
+// alongside for the error message only, so a report can name both dimensions
+// instead of silently mixing them.
 //
 // Deliberately zlib's default level rather than 9: the platform's own compression
 // settings are unknown, and a weaker setting yields a slightly *larger* figure, so
@@ -729,8 +777,9 @@ export async function checkDeployDirectory(options) {
         warnings.push("Static deploy does not contain index.html.");
     }
     // Per-file size limit, matching the server's create-time guard (#194), so an
-    // oversized asset is caught locally instead of failing with a 413 mid-deploy.
-    for (const file of oversizedAssets(manifest)) {
+    // oversized asset is caught locally instead of failing with a 413 mid-deploy. Held to
+    // the files this deploy would upload under its flags (#1847), as the deploy is.
+    for (const file of oversizedAssets(uploadedFiles(manifest, serverEntry, options.publicAssets ?? null))) {
         errors.push(assetFileTooLargeMessage(file.path, file.size));
     }
     if (serverEntry) {
@@ -760,6 +809,23 @@ export async function checkDeployDirectory(options) {
             // people to stop reading it.
         }
     }
+    // #1847: `--check` has no project, so it cannot see a choice made on an earlier deploy;
+    // it reports what this invocation's flags would publish, and says so for the legacy case.
+    let publicFiles;
+    if (serverEntry) {
+        const selection = options.publicAssets ?? null;
+        publicFiles = workerPublicFiles(manifest.map((file) => file.path), serverEntry, selection);
+        if (selection !== null && selection !== NO_PUBLIC_ASSETS && publicFiles.length === 0) {
+            errors.push(missingAssetsDirectoryMessage(selection));
+        }
+        if (selection === null && publicFiles.length > 0) {
+            warnings.push(`${legacyPublicAssetsWarning(serverEntry, publicFiles.map((file) => file.path))}\n  (An app that already chose on an earlier deploy keeps that choice.)`);
+        }
+        const suspicious = privateLookingPaths(publicFiles.map((file) => file.path), serverEntry);
+        if (suspicious.length > 0) {
+            warnings.push(privateLookingPublicWarning(suspicious, selection));
+        }
+    }
     // Same server-code budget the real deploy applies to a bundle (#660), measured the same
     // way — all modules compressed together, assets excluded.
     if (bundle) {
@@ -773,7 +839,15 @@ export async function checkDeployDirectory(options) {
             warnings.push(workerBundleNearLimitMessage(modulePaths.length, rawBytes, compressedBytes));
         }
     }
-    return { ok: errors.length === 0, warnings, errors, files: manifest.length, bytes: totalBytes, ...(serverCode ? { serverCode } : {}) };
+    return {
+        ok: errors.length === 0,
+        warnings,
+        errors,
+        files: manifest.length,
+        bytes: totalBytes,
+        ...(serverCode ? { serverCode } : {}),
+        ...(publicFiles ? { publicFiles } : {}),
+    };
 }
 export async function whoami(options) {
     return apiRequest(options, "/v1/me", { method: "GET" });
@@ -1258,6 +1332,21 @@ export async function deleteSite(options) {
     });
     return payload.deleted;
 }
+// Thrown out of the device flow when the person pressed Ctrl-C while it waited
+// (#1902). It travels to main() like any other failure, so every `finally` on the
+// way has already run when the process sets its exit code; exiting from inside the
+// signal handler would skip them and leave stdin holding the process open.
+export class DeviceAuthCancelledError extends Error {
+    purpose;
+    constructor(purpose) {
+        super(`Cancelled. Run "9pm ${purpose}" to start again.`);
+        this.name = "DeviceAuthCancelledError";
+        this.purpose = purpose;
+    }
+}
+// The exit status of a command the person interrupted: 128 + SIGINT, which is what
+// a shell reports for one, so a script can tell a cancel from a failure.
+export const CANCELLED_EXIT_CODE = 130;
 export async function loginDevice(options) {
     return deviceAuthFlow({ ...options, purpose: "login" });
 }
@@ -1316,7 +1405,7 @@ async function deviceAuthFlow(options) {
     // lines above plus the caller's unchanged result line, so anything already
     // reading it is unaffected.
     const progressStream = options.progressStream ?? process.stderr;
-    const browser = (options.openBrowserFn ?? openBrowser)(start.verification_uri);
+    const browser = await (options.openBrowserFn ?? openBrowser)(start.verification_uri);
     if (browser === "failed") {
         // Say it the moment it happens. A swallowed browser failure used to look
         // exactly like a flow nobody had approved yet.
@@ -1328,16 +1417,83 @@ async function deviceAuthFlow(options) {
     progressStream.write("Open the URL above in any browser — on this machine or another — to approve this device.\n");
     const deadline = Date.now() + start.expires_in * 1000;
     const intervalMs = Math.max(1, start.interval ?? 2) * 1000;
+    // #1902: the way out of the wait, said on the line itself. Enter is offered only
+    // when it works - stdin a terminal to read it from, stderr a terminal to answer on
+    // - and is read in the terminal's normal line mode, so no terminal setting changes
+    // and Ctrl-C stays the terminal's own signal.
+    const input = options.inputStream ?? process.stdin;
+    const signals = options.signalTarget ?? process;
+    const interactive = input.isTTY === true && progressStream.isTTY === true;
+    let finished = false;
+    let cancelled = false;
+    let wake;
+    // One reopen at a time: presses made while a launch is still running are
+    // ignored rather than queued into more tabs.
+    let reopening = false;
+    // Registered with `once`: a second Ctrl-C finds no listener and gets Node's
+    // default, which ends the process at once. That is the escape hatch for a poll
+    // request that never answers, since the first press waits for it (below).
+    const onSigint = () => {
+        cancelled = true;
+        wake?.();
+    };
+    const onInput = (chunk) => {
+        if (finished || cancelled || !/[\r\n]/.test(String(chunk)))
+            return;
+        // Every Enter echoes a newline that moves the cursor below the spinner line,
+        // ignored presses included; step back up and clear it so the next redraw lands
+        // where the line was instead of stranding a copy above it.
+        progressStream.write("\x1b[1A\r\x1b[K");
+        if (reopening)
+            return;
+        reopening = true;
+        // Asynchronous and bounded (openBrowserAsync), so a slow launcher stalls
+        // neither the polling nor Ctrl-C while it runs.
+        void Promise.resolve()
+            .then(() => (options.openBrowserFn ?? openBrowserAsync)(start.verification_uri))
+            .catch(() => "failed")
+            .then((reopened) => {
+            reopening = false;
+            if (finished)
+                return;
+            progress.note(reopened === "opened"
+                ? "Opened the page again."
+                : reopened === "failed"
+                    ? "Could not open a browser — use the URL above."
+                    : // "unknown": the launcher ran, but nothing says a page appeared.
+                        "Asked the system to open the page again. If it did not appear, use the URL above.");
+        });
+    };
     // stop() in a finally so no outcome — approval, denial, network throw,
-    // expiry — can leave the spinner timer alive or the line half-drawn.
-    const progress = createDeviceAuthProgressReporter(progressStream);
+    // expiry, cancellation — can leave the spinner timer alive or the line half-drawn.
+    const progress = createDeviceAuthProgressReporter(progressStream, {
+        hint: interactive ? "Enter to reopen the page, Ctrl-C to cancel" : "Ctrl-C to cancel",
+    });
+    signals.once("SIGINT", onSigint);
+    if (interactive)
+        input.on("data", onInput);
     try {
         while (Date.now() < deadline) {
+            // Checked here and after the sleep, never during a poll request: once a poll
+            // is in flight the control plane may already have minted the key, and
+            // abandoning that response would leave a live key nobody holds (#859). An
+            // approval that lands in the same instant as Ctrl-C therefore completes.
+            if (cancelled)
+                throw new DeviceAuthCancelledError(options.purpose);
             // Tick before the sleep so the first feedback is immediate rather than
             // one poll interval late. Remaining time is derived from the deadline the
             // server's expires_in produced, never from a CLI-side constant.
             progress.tick(deadline - Date.now());
-            await sleep(intervalMs);
+            await new Promise((resolve) => {
+                const timer = setTimeout(resolve, intervalMs);
+                wake = () => {
+                    clearTimeout(timer);
+                    resolve();
+                };
+            });
+            wake = undefined;
+            if (cancelled)
+                throw new DeviceAuthCancelledError(options.purpose);
             const pollResponse = await fetchFn(`${apiUrl}/v1/oauth/device/poll`, {
                 method: "POST",
                 headers: { "content-type": "application/json", ...cliVersionHeader() },
@@ -1376,6 +1532,10 @@ async function deviceAuthFlow(options) {
             // login (#514 review). stop() is idempotent, so the finally below stays as
             // the fallback for every other exit path.
             progress.stop();
+            // What the store held before this login wrote over it (#1779). Read only from the
+            // real stores: an injected store replaces the backend wholesale, so the real one
+            // says nothing about what that write displaced.
+            const before = options.storeCredentialFn ? [] : storedCredentialTokens();
             let storage;
             try {
                 storage = (options.storeCredentialFn ?? storeCredential)(poll.token, {
@@ -1431,27 +1591,142 @@ async function deviceAuthFlow(options) {
                 discardRevokedCredential(poll.token);
                 throw new Error(joinSentences("The credential this login created was stored but cannot authenticate.", disposalSentence(revocation)));
             }
+            // The new credential is stored and has not been refused, so whatever it pushed
+            // out of the store can go: nothing on this machine can reach that key any more.
+            const replaced = await retireReplacedCredentials(before, options.storeCredentialFn ? [] : storedCredentialTokens(), poll.token, options.fetchFn);
+            const trimmed = typeof poll.revoked_login_keys === "number" && poll.revoked_login_keys > 0 && typeof poll.login_key_limit === "number"
+                ? { trimmedLoginKeys: { count: poll.revoked_login_keys, limit: poll.login_key_limit } }
+                : {};
             if (!identity?.ok) {
                 // Said out loud rather than swallowed: the login DID succeed, and the user
                 // should know which half of it did not.
                 progressStream.write(`Warning: signed in, but could not read the account name (${identity ? `the control plane answered ${identity.status}` : "the request failed"}).\n`);
-                return { storage };
+                return { storage, replaced, ...trimmed };
             }
             const email = await identity
                 .json()
                 .then((body) => body.user?.email)
                 .catch(() => undefined);
-            return email ? { email, storage } : { storage };
+            return { ...(email ? { email } : {}), storage, replaced, ...trimmed };
         }
     }
     finally {
+        finished = true;
         progress.stop();
+        signals.removeListener("SIGINT", onSigint);
+        if (interactive) {
+            input.removeListener("data", onInput);
+            // Adding the listener put stdin into flowing mode; left flowing, it would
+            // hold the process open after the command is done.
+            input.pause();
+        }
     }
     // Reached only when the client's own deadline elapses without the server having
     // said anything terminal — rarer than the 410 route above, but it must say the
     // same thing, so both share one message.
     throw new Error(expiredDeviceAuthMessage(options.purpose, userCode, start.expires_in * 1000, start.verification_uri));
 }
+/**
+ * Revoke every credential this login's write pushed out of the local stores (#1779).
+ *
+ * "Pushed out" means present before the write and absent after it - not merely
+ * different from the new token. A copy still sitting in another store (a plaintext
+ * fallback beside the keychain) is still reachable from this machine, and a process
+ * that skips the keychain may be using it, so it is left for `9pm logout`.
+ *
+ * Each key is revoked at the control plane that ISSUED it, which is not necessarily
+ * the one this login talked to: a production login overwrites a staging key in the
+ * same slot, and only staging can revoke that. A key with no recorded issuer is not
+ * sent anywhere. Never throws - the login has already succeeded.
+ */
+export async function retireReplacedCredentials(before, after, newToken, fetchFn) {
+    const seen = new Set([newToken]);
+    const outcomes = [];
+    for (const entry of before) {
+        if (seen.has(entry.token) || after.some((kept) => kept.token === entry.token)) {
+            continue;
+        }
+        seen.add(entry.token);
+        if (!entry.apiUrl) {
+            outcomes.push({ kind: "unknown_issuer" });
+            continue;
+        }
+        const apiUrl = normalizeApiUrl(entry.apiUrl);
+        const revocation = await revokeCredential({ apiUrl, token: entry.token, ...(fetchFn ? { fetchFn } : {}) });
+        outcomes.push(revocation.kind === "failed" ? { kind: "failed", apiUrl, reason: revocation.reason } : { kind: revocation.kind, apiUrl });
+    }
+    return outcomes;
+}
+/** The lines a login prints about what it retired, for stderr. Silent when nothing needs saying. */
+export function replacedCredentialMessages(result, loginApiUrl) {
+    const lines = [];
+    const manual = "revoke it from Settings > API keys in the dashboard, or it stays valid until 90 days pass without use.";
+    for (const outcome of result.replaced) {
+        if (outcome.kind === "revoked") {
+            const elsewhere = outcome.apiUrl !== normalizeApiUrl(loginApiUrl) ? ` (issued by ${outcome.apiUrl})` : "";
+            lines.push(`Revoked the credential this login replaced${elsewhere}.`);
+        }
+        else if (outcome.kind === "failed") {
+            lines.push(`Warning: the credential this login replaced could not be revoked at ${outcome.apiUrl} (${outcome.reason}) - ${manual}`);
+        }
+        else if (outcome.kind === "unknown_issuer") {
+            lines.push(`Warning: the credential this login replaced was stored by an older CLI that did not record where it was issued, so it was not revoked - ${manual}`);
+        }
+    }
+    if (result.trimmedLoginKeys) {
+        const { count, limit } = result.trimmedLoginKeys;
+        lines.push(`Revoked ${count} older login key${count === 1 ? "" : "s"} on this account (at most ${limit} stay live).`);
+    }
+    return lines;
+}
+/**
+ * Whether `9pm login` can keep the credential this machine already holds (#1779).
+ *
+ * Only the credential commands actually authenticate with is considered. One recorded
+ * as issued by another control plane is never sent here. One with no recorded issuer
+ * (stored before 0.42) IS probed here: keys are per database, so a 200 from the plane
+ * this login targets proves it was issued there, and leaving those to mint would keep
+ * the oldest CLIs' machines minting a stray key per run. Only the control plane's own
+ * refusal proves a key dead; a proxy's 401, a 5xx or a timeout proves nothing, so
+ * those come back as unverifiable rather than as permission to mint.
+ */
+export async function probeStoredLogin(options) {
+    const apiUrl = normalizeApiUrl(options.apiUrl);
+    const current = (options.stored ?? storedCredentialTokens())[0];
+    if (!current || (current.apiUrl && normalizeApiUrl(current.apiUrl) !== apiUrl)) {
+        return { kind: "mint" };
+    }
+    const fetchFn = options.fetchFn ?? fetch;
+    let response;
+    try {
+        response = await fetchFn(`${apiUrl}/v1/me`, {
+            method: "GET",
+            headers: jsonHeaders(current.token),
+            signal: AbortSignal.timeout(IDENTITY_TIMEOUT_MS),
+        });
+    }
+    catch (error) {
+        const reason = error instanceof Error && error.name === "TimeoutError"
+            ? `the control plane did not answer within ${IDENTITY_TIMEOUT_MS / 1000}s`
+            : error instanceof Error
+                ? error.message
+                : String(error);
+        return { kind: "unverifiable", reason };
+    }
+    if (response.status === 401 || response.status === 403) {
+        return (await isAuthRefusal(response))
+            ? { kind: "mint" }
+            : { kind: "unverifiable", reason: `${response.status} from something other than the control plane's own authentication` };
+    }
+    if (!response.ok) {
+        return { kind: "unverifiable", reason: `the control plane answered ${response.status}` };
+    }
+    const email = await response
+        .json()
+        .then((body) => body.user?.email)
+        .catch(() => undefined);
+    return email ? { kind: "reuse", email } : { kind: "reuse" };
+}
 // The actionable timeout guidance, shared by both routes out of an unapproved
 // device flow (the server's 410 and the client's own deadline) so they can never
 // drift into saying different things.
@@ -1932,14 +2207,26 @@ export function createUploadProgressReporter(stream = process.stderr) {
 }
 // Off-TTY ceiling: at most one line per 30s of the window (~20 lines over 600s).
 const DEVICE_AUTH_PROGRESS_LINE_INTERVAL_MS = 30_000;
-export function createDeviceAuthProgressReporter(stream = process.stderr) {
+export function createDeviceAuthProgressReporter(stream = process.stderr, options = {}) {
     const isTty = stream.isTTY === true;
     let timer;
     let frame = 0;
     let finished = false;
     let remainingMs;
     let lastLineRemainingMs;
-    const label = (ms) => `Waiting for approval… ${formatRemainingForCli(ms)} left`;
+    const base = (ms) => `Waiting for approval… ${formatRemainingForCli(ms)} left`;
+    // The hint (#1902) rides the TTY line only: off a TTY nobody is at a keyboard to
+    // act on it. It is dropped when the line would not fit, because a wrapped line
+    // defeats the `\r` redraw and the spinner would stack a copy per frame.
+    const label = (ms) => {
+        const plain = base(ms);
+        if (!isTty || !options.hint)
+            return plain;
+        const full = `${plain} — ${options.hint}`;
+        const width = typeof stream.columns === "number" ? stream.columns : 0;
+        // +2 for the spinner glyph and its space.
+        return width > 0 && full.length + 2 >= width ? plain : full;
+    };
     const redraw = () => {
         if (remainingMs === undefined)
             return;
@@ -1978,6 +2265,16 @@ export function createDeviceAuthProgressReporter(stream = process.stderr) {
             lastLineRemainingMs = nextRemainingMs;
             stream.write(`${label(nextRemainingMs)}\n`);
         },
+        note(line) {
+            if (finished)
+                return;
+            if (!isTty) {
+                stream.write(`${line}\n`);
+                return;
+            }
+            stream.write(`\r\x1b[K${line}\n`);
+            redraw();
+        },
         // Idempotent; called from a finally around the poll loop. On a TTY it erases
         // the in-place line and writes nothing in its place: unlike the upload
         // reporter this deliberately leaves no ✓/✗ summary, because the flow's own
@@ -2238,6 +2535,8 @@ const VALID_DEPLOY_FLAGS = new Set([
     "memory",
     "no-build",
     "bundle",
+    "assets",
+    "no-assets",
 ]);
 export function parseArgs(argv) {
     const command = argv[0];
@@ -2264,7 +2563,12 @@ export function parseArgs(argv) {
     }
     if (command === "login") {
         const flags = parseFlags(argv);
-        return { kind: "login", apiUrl: readApiUrl(flags, DEFAULT_API_URL), allowFileCredentialStore: flags.has("allow-file-credential-store") };
+        return {
+            kind: "login",
+            apiUrl: readApiUrl(flags, DEFAULT_API_URL),
+            allowFileCredentialStore: flags.has("allow-file-credential-store"),
+            fresh: flags.has("fresh"),
+        };
     }
     if (command === "signup") {
         const flags = parseFlags(argv);
@@ -2466,6 +2770,23 @@ export function parseArgs(argv) {
         options.runtime = "worker";
         options.bundleDir = bundleDir;
     }
+    const assetsFlag = flags.get("assets");
+    if (assetsFlag !== undefined || flags.has("no-assets")) {
+        if (assetsFlag !== undefined && flags.has("no-assets")) {
+            throw new Error("--assets and --no-assets cannot be combined.");
+        }
+        if (assetsFlag === true || assetsFlag === "") {
+            throw new Error("--assets needs a directory, for example --assets public. Use --no-assets if nothing should be public.");
+        }
+        if (options.bundleDir) {
+            throw new Error("--assets and --no-assets apply to --entry worker deploys; a --bundle deploy already serves only its assets directory.");
+        }
+        const workerRuntime = options.runtime === "worker" || (options.runtime === undefined && options.entry !== undefined);
+        if (!workerRuntime) {
+            throw new Error("--assets and --no-assets apply to worker deploys (--runtime worker --entry <file>); a static site serves every file.");
+        }
+        options.publicAssets = typeof assetsFlag === "string" ? normalizeAssetsDirectory(assetsFlag) : NO_PUBLIC_ASSETS;
+    }
     if (options.runtime === "container" && !options.port) {
         throw new Error("Container deploys require --port <port>.");
     }
@@ -3173,6 +3494,48 @@ function parseDurationSeconds(value) {
     const seconds = unit === "d" ? amount * 24 * 60 * 60 : unit === "h" ? amount * 60 * 60 : unit === "m" ? amount * 60 : amount;
     return Math.min(seconds, 7 * 24 * 60 * 60);
 }
+// #1847: what an entry-based worker deploy publishes. Shown on every deploy that still
+// uses the legacy shape rather than only under `--check`, because the app that leaks is
+// the one whose author never thought to check.
+const PUBLIC_FILE_LIST_LIMIT = 10;
+export function workerPublicFiles(paths, serverEntry, selection) {
+    const files = [];
+    for (const filePath of paths) {
+        const url = publicAssetPath(filePath, serverEntry, selection);
+        if (url !== null) {
+            files.push({ path: filePath, url });
+        }
+    }
+    return files;
+}
+export function legacyPublicAssetsWarning(serverEntry, publicPaths) {
+    const shown = publicPaths.slice(0, PUBLIC_FILE_LIST_LIMIT);
+    const more = publicPaths.length - shown.length;
+    return [
+        `this worker app serves every file in the deploy directory except its entry (${serverEntry}) at a public URL - ${publicPaths.length} file(s).`,
+        "Choose what is public with --assets <dir> (only that directory is served; for example --assets public) or --no-assets. The app remembers the choice for later deploys.",
+        `Public now: ${shown.length > 0 ? shown.join(", ") : "none"}${more > 0 ? `, and ${more} more (9pm deploy --check lists them all)` : ""}`,
+    ].join("\n  ");
+}
+export function privateLookingPublicWarning(paths, selection) {
+    const shown = paths.slice(0, PUBLIC_FILE_LIST_LIMIT);
+    const more = paths.length - shown.length;
+    const remedy = selection === null
+        ? "Choose a public directory with --assets <dir>, or move them out of the deploy directory."
+        : `Move them out of ${selection}.`;
+    return `these files look like server code or leftovers, and anyone can download them: ${shown.join(", ")}${more > 0 ? `, and ${more} more` : ""}. ${remedy}`;
+}
+// The files a deploy sends: everything, unless a worker selection narrows it to the entry
+// and the public files. The same set the server holds to the per-file limit.
+function uploadedFiles(manifest, serverEntry, selection) {
+    if (!serverEntry || selection === null) {
+        return manifest;
+    }
+    return manifest.filter((file) => file.path === serverEntry || publicAssetPath(file.path, serverEntry, selection) !== null);
+}
+function missingAssetsDirectoryMessage(selection) {
+    return `--assets ${selection.slice(0, -1)}: no files were found under ${selection} in the deploy directory.`;
+}
 function normalizeServerEntry(value) {
     const normalized = value.trim().replaceAll("\\", "/").replace(/^\.\/+/, "");
     if (!normalized || normalized.startsWith("/") || normalized.split("/").includes("..")) {
@@ -3186,18 +3549,17 @@ async function validateWorkerEntrySource(source, filePath) {
     if (/\bfrom\s+["'][^"']+["']/.test(source) || /\bimport\s*\(/.test(source) || /(^|\n)\s*import\s+["'][^"']+["']/.test(source)) {
         errors.push("Worker runtime entry must be bundled into one module with no external imports.");
     }
-    const hasLiteralDefault = /\bexport\s+default\b/.test(source);
-    const hasDefaultReexport = /export\s*\{\s*([A-Za-z_$][\w$]*)\s+as\s+default\s*,?\s*\}\s*;?\s*$/.test(source);
-    if (!hasLiteralDefault && !hasDefaultReexport) {
-        errors.push(`Worker runtime entry ${filePath} must export a default fetch handler.`);
-    }
+    // Whether the entry has a default export is decided by evaluating it as an ES module,
+    // which is what the server uploads unmodified, not by matching its text:
+    // `export { handler as default, helper }`, a comment before `default`, and a string or
+    // escaped export name are all valid defaults a text match would refuse (#1851).
     if (errors.length === 0) {
-        const transformed = hasLiteralDefault
-            ? source
-            : `${source.replace(/export\s*\{\s*([A-Za-z_$][\w$]*)\s+as\s+default\s*,?\s*\}\s*;?\s*$/, "export default $1;")}`;
         try {
-            const module = await import(`data:text/javascript;base64,${Buffer.from(transformed).toString("base64")}`);
-            if (typeof module.default?.fetch !== "function" && typeof module.default !== "function") {
+            const module = await import(`data:text/javascript;base64,${Buffer.from(source).toString("base64")}`);
+            if (!("default" in module)) {
+                errors.push(`Worker runtime entry ${filePath} must export a default fetch handler.`);
+            }
+            else if (typeof module.default?.fetch !== "function" && typeof module.default !== "function") {
                 errors.push("Default export must be a function or an object with fetch(request, env, ctx).");
             }
         }
@@ -3910,6 +4272,41 @@ function openBrowser(url) {
         ...(result.error ? { error: result.error } : {}),
     });
 }
+// How long a reopen waits for the launcher to say how it went (#1902). `open` and
+// `xdg-open` hand off and return in well under a second; one still running after
+// this is left to finish on its own, and the person is pointed at the URL instead.
+const BROWSER_LAUNCH_TIMEOUT_MS = 5_000;
+// openBrowser without blocking: the reopen on Enter runs while the login waits,
+// and spawnSync there would freeze the poll loop and the Ctrl-C handler for as long
+// as the launcher took. Same platform choice and verdicts as openBrowser.
+function openBrowserAsync(url) {
+    if (hasNoGraphicalDisplay(process.platform, process.env)) {
+        return Promise.resolve("failed");
+    }
+    const command = process.platform === "darwin" ? "open" : process.platform === "win32" ? "cmd" : "xdg-open";
+    const args = process.platform === "win32" ? ["/c", "start", "", url] : [url];
+    return new Promise((resolve) => {
+        let settled = false;
+        const settle = (result) => {
+            if (settled)
+                return;
+            settled = true;
+            clearTimeout(timer);
+            resolve(result);
+        };
+        const child = spawn(command, args, { stdio: "ignore" });
+        // Unref'd at once, not when the wait below runs out: a launcher still running
+        // when the login ends (Ctrl-C, approval) must not keep the CLI alive behind it.
+        // Its exit event still arrives while the CLI is running for another reason.
+        child.unref();
+        // A launcher that has not answered in time may still open the page, so this
+        // is "unknown" rather than "failed".
+        const timer = setTimeout(() => settle("unknown"), BROWSER_LAUNCH_TIMEOUT_MS);
+        timer.unref();
+        child.once("error", (error) => settle(classifyBrowserOpen({ platform: process.platform, status: null, error })));
+        child.once("exit", (status) => settle(classifyBrowserOpen({ platform: process.platform, status })));
+    });
+}
 function sleep(ms) {
     return new Promise((resolve) => setTimeout(resolve, ms));
 }
@@ -4001,6 +4398,12 @@ async function main() {
                         const subject = moduleCount === 1 ? "entry" : `${moduleCount} server modules`;
                         console.log(`Server code (${subject}): ${compressedBytes.toLocaleString("en-US")} bytes compressed of ${MAX_WORKER_ENTRY_COMPRESSED_BYTES.toLocaleString("en-US")} allowed.`);
                     }
+                    if (check.publicFiles) {
+                        console.log(check.publicFiles.length > 0 ? `Public files (${check.publicFiles.length}):` : "Public files: none.");
+                        for (const file of check.publicFiles) {
+                            console.log(`  ${file.path} -> ${file.url}`);
+                        }
+                    }
                 }
                 return;
             }
@@ -4054,13 +4457,30 @@ async function main() {
             return;
         }
         if (command.kind === "login") {
+            // Each login used to mint another full-scope key (#1779); keep a working one.
+            if (!command.fresh) {
+                const probe = await probeStoredLogin({ apiUrl: command.apiUrl });
+                if (probe.kind === "reuse") {
+                    console.log(`Already logged in${probe.email ? ` as ${probe.email}` : ""}. Run "9pm login --fresh" to replace this machine's credential.`);
+                    return;
+                }
+                if (probe.kind === "unverifiable") {
+                    throw new Error(`Could not check the credential already stored on this machine (${probe.reason}). Retry, or run "9pm login --fresh" to replace it.`);
+                }
+            }
             const result = await loginDevice({ apiUrl: command.apiUrl, allowFileCredentialStore: command.allowFileCredentialStore });
             console.log(`Logged in${result.email ? ` as ${result.email}` : ""}. Credential stored in ${result.storage}.`);
+            for (const line of replacedCredentialMessages(result, command.apiUrl)) {
+                console.error(line);
+            }
             return;
         }
         if (command.kind === "signup") {
             const result = await signupDevice({ apiUrl: command.apiUrl, allowFileCredentialStore: command.allowFileCredentialStore });
             console.log(`Signed up${result.email ? ` as ${result.email}` : ""}. Credential stored in ${result.storage}.`);
+            for (const line of replacedCredentialMessages(result, command.apiUrl)) {
+                console.error(line);
+            }
             return;
         }
         if (command.kind === "logout") {
@@ -4289,6 +4709,13 @@ async function main() {
             process.exitCode = 0;
             return;
         }
+        if (error instanceof DeviceAuthCancelledError) {
+            // The person asked for this, so it is said plainly rather than reported as a
+            // failure with whatever decoration reportCliError adds.
+            console.error(error.message);
+            process.exitCode = CANCELLED_EXIT_CODE;
+            return;
+        }
         reportCliError(error);
         process.exitCode = 1;
     }
@@ -4534,14 +4961,14 @@ function printUsage() {
     console.log(`Usage:
   9pm --version
   9pm deploy [directory] --name <site-name> [--slug <slug>] [--owner <organisation>] [--description "<note>"] [--with-db] [--with-auth] [--with-email]
-  9pm deploy [directory] --runtime worker --entry src/index.js [--with-db]
+  9pm deploy [directory] --runtime worker --entry src/index.js (--assets <dir> | --no-assets) [--with-db]
   9pm deploy [directory] --runtime container --port 8080 [--health-path /health] [--region auto] [--with-db] [--always-on] [--volume <gb> | --no-volume] [--cpus <n>] [--memory <size>]
   9pm deploy [directory]                   framework projects (Next.js, Vite) are detected and built automatically; --no-build skips
   9pm deploy [directory] --bundle <dir>    deploy a pre-built Cloudflare framework bundle (e.g. .open-next)
   9pm deploy [directory] --description "<note>"   optional short note shown next to the version in the dashboard
   9pm deploy [directory] --check
   9pm signup
-  9pm login
+  9pm login [--fresh]                     keeps a working stored credential; --fresh replaces it and revokes the old one
   9pm logout [--api-url <url>] [--local]   revokes the credential server-side, then removes it from this machine (--local skips the revoke)
   9pm doctor [--json]
   9pm whoami [--json]
@@ -4584,10 +5011,18 @@ Size limits:
   Individual files are limited to ${formatMebibytes(MAX_STATIC_ASSET_FILE_BYTES)}.
   Worker runtime: server code is limited to ${formatMegabytes(MAX_WORKER_ENTRY_COMPRESSED_BYTES)} compressed (gzip) — the ${formatMegabytes(MAX_WORKER_SCRIPT_COMPRESSED_BYTES)} script limit
   less a small reserve for the generated wrapper. That budget covers the --entry module, or
-  with --bundle every server module together, since they deploy as one script. Every other
-  file in the directory is served from the asset store instead, so it does not count toward
-  that limit — keep large images, fonts and datasets as sibling files rather than inlining
-  them into the entry. Apps needing more server code than that should deploy as containers.
+  with --bundle every server module together, since they deploy as one script. Public files
+  are served from the asset store instead, so they do not count toward that limit — keep large
+  images, fonts and datasets as public files rather than inlining them into the entry. Apps
+  needing more server code than that should deploy as containers.
+
+Worker public files:
+  --assets <dir>   only the files under <dir> are public, served from the app's root
+                   (<dir>/index.html answers on /). Nothing else in the directory is uploaded.
+  --no-assets      nothing is public; the entry answers every request.
+  The app remembers the choice, so later deploys need not repeat it; pass the other flag to
+  change it. A worker app that never chose serves EVERY file except its entry publicly, and
+  each deploy warns about it. --check lists the files a deploy would make public.
 
 Container deploys:
   Requires Docker locally. The CLI builds linux/amd64, exports the image, uploads it through a short-lived session, then finalizes a queued deployment.

package/dist/public-assets.d.ts

@@ -0,0 +1,5 @@
+export declare const NO_PUBLIC_ASSETS = "none";
+export declare function normalizeAssetsDirectory(value: string): string;
+export declare function parsePublicAssetsSelection(value: unknown): string | null;
+export declare function publicAssetPath(filePath: string, serverEntry: string | null, selection: string | null): string | null;
+export declare function privateLookingPaths(filePaths: readonly string[], serverEntry: string | null): string[];

package/dist/public-assets.js

@@ -0,0 +1,91 @@
+// AUTO-GENERATED by scripts/generate-cli-package.mjs from the in-repo CLI source -- do not edit.
+// Edit src/cli or src/shared instead; this is regenerated on typecheck/test/build/pack.
+// Which files of a worker-runtime deploy become public URLs (#1847). Shared by the control
+// plane, which enforces it at publish, and the CLI, which warns and trims what it uploads.
+// Keep this module dependency-free: it is copied verbatim into the shipped ninepm tarball.
+//
+// A selection is one of two strings, and the same string is used everywhere it travels -
+// the `--assets`/`--no-assets` flags, `metadata.publicAssets` on a deployment, and the
+// project's `worker_public_assets` column:
+//   - a relative directory prefix ending in "/" (e.g. "public/"): only files under it are
+//     served, at their path below it, so `public/index.html` answers on `/index.html`;
+//   - NO_PUBLIC_ASSETS: nothing is served from the deploy directory at all.
+// Absence (null) is the legacy shape every app had before this existed: every file except
+// the entry is served at its own path. It is never a value a client can send, so once an
+// app has chosen, no later deploy can widen it back to legacy by omission.
+export const NO_PUBLIC_ASSETS = "none";
+// Turns what a person typed after `--assets` into the canonical prefix, or throws with a
+// message that names the problem. The deploy root itself is refused: the entry lives
+// there, so "everything" is the legacy shape rather than a selection, and allowing it
+// would let a flag meant to narrow publication silently reproduce the problem it fixes.
+export function normalizeAssetsDirectory(value) {
+    const trimmed = value.trim();
+    if (trimmed.includes("\\")) {
+        throw new Error(`--assets must use "/" between directory names: ${value}`);
+    }
+    if (trimmed.startsWith("/")) {
+        throw new Error(`--assets must be a directory inside the deploy directory, not an absolute path: ${value}`);
+    }
+    const segments = trimmed.split("/").filter((segment, index) => segment !== "" && !(index === 0 && segment === "."));
+    if (segments.length === 0) {
+        throw new Error("--assets must name a subdirectory (for example --assets public). The deploy directory itself holds your server code; use --no-assets if nothing should be public.");
+    }
+    if (segments.some((segment) => segment === "." || segment === "..")) {
+        throw new Error(`--assets must be a directory inside the deploy directory: ${value}`);
+    }
+    return `${segments.join("/")}/`;
+}
+// The server's reading of a stored or client-sent selection: the canonical form only,
+// never a lenient one, so the value that was validated is byte for byte the value used.
+export function parsePublicAssetsSelection(value) {
+    if (value === NO_PUBLIC_ASSETS) {
+        return NO_PUBLIC_ASSETS;
+    }
+    if (typeof value !== "string" || !value.endsWith("/")) {
+        return null;
+    }
+    try {
+        return normalizeAssetsDirectory(value) === value ? value : null;
+    }
+    catch {
+        return null;
+    }
+}
+// The URL path a deploy file is served on, or null when it must not be public. The entry
+// is never public under any selection: it is uploaded as the Worker's own module.
+export function publicAssetPath(filePath, serverEntry, selection) {
+    if (serverEntry !== null && filePath === serverEntry) {
+        return null;
+    }
+    if (selection === null) {
+        return filePath.startsWith("/") ? filePath : `/${filePath}`;
+    }
+    if (selection === NO_PUBLIC_ASSETS || !filePath.startsWith(selection)) {
+        return null;
+    }
+    return `/${filePath.slice(selection.length)}`;
+}
+const SCRIPT_EXTENSION = /\.(js|mjs|cjs|ts|mts|cts|jsx|tsx)$/i;
+const LEFTOVER_FILE = /(\.(orig|bak|old|rej|swp|swo|tmp)|~)$/i;
+// Public files that look like they were never meant to be: editor and merge leftovers,
+// dotfiles, and other script files in the entry's own directory (which is where server
+// helpers live). A heuristic for a warning, never a filter - a client script beside the
+// entry is legitimate, which is why the fix is a selection and not this list.
+export function privateLookingPaths(filePaths, serverEntry) {
+    const entryDirectory = serverEntry !== null && serverEntry.includes("/") ? serverEntry.slice(0, serverEntry.lastIndexOf("/") + 1) : "";
+    return filePaths.filter((filePath) => {
+        if (filePath === serverEntry) {
+            return false;
+        }
+        const name = filePath.slice(filePath.lastIndexOf("/") + 1);
+        if (LEFTOVER_FILE.test(name) || filePath.split("/").some((segment) => segment.startsWith(".") && segment !== ".well-known")) {
+            return true;
+        }
+        if (!SCRIPT_EXTENSION.test(name)) {
+            return false;
+        }
+        // Beside the entry: under its directory when it has one, or directly at the root
+        // when the entry itself sits there (a root-level entry says nothing about subfolders).
+        return entryDirectory === "" ? !filePath.includes("/") : filePath.startsWith(entryDirectory);
+    });
+}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "ninepm",
-  "version": "0.61.0",
+  "version": "0.65.0",
   "description": "CLI for deploying built apps to 9pm.ai.",
   "homepage": "https://9pm.ai",
   "keywords": [