wawesome 0.21.1 → 0.23.0

package/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 wawesome.io
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

package/dist/assets-CtoyN8P3.mjs

@@ -0,0 +1,333 @@
+import fs from "node:fs";
+import path from "node:path";
+import os from "node:os";
+import crypto from "node:crypto";
+//#region src/errors.ts
+/**
+* A rejection carrying the gateway's own prose and, where given, its reason.
+*
+* The call's trace id rides in the message itself, on a line of its own, so
+* every place that prints a refusal prints the one thing support can search by.
+*/
+var GatewayError = class extends Error {
+	status;
+	reason;
+	/** The raw response, for `--verbose` to print when the prose is not enough. */
+	body;
+	traceId;
+	constructor(message, status, reason, body = "", traceId) {
+		super(traceId ? `${message}\n${traceLine(traceId)}` : message);
+		this.name = "GatewayError";
+		this.status = status;
+		this.reason = reason;
+		this.body = body;
+		this.traceId = traceId;
+	}
+};
+function traceLine(traceId) {
+	return `Trace ID: ${traceId}`;
+}
+/**
+* Read a failed response into a `GatewayError`.
+*
+* `fallback` is used only when the response carries no prose of its own — a
+* proxy's HTML error page, or an empty body. A 401 is deliberately *not* special
+* cased here: what to say about an expired session depends on what the caller
+* was doing, so callers handle it before reaching this.
+*/
+async function asGatewayError(res, fallback) {
+	const traceId = res.headers?.get("x-wawesome-trace-id") ?? void 0;
+	return rejectionOf(await res.text().catch(() => ""), res.status, fallback, traceId);
+}
+/**
+* The same reading, for a caller that has already taken the body off the wire.
+* `traceId` is the header's, for a body that never made it here as JSON.
+*/
+function rejectionOf(body, status, fallback, traceId) {
+	try {
+		const parsed = JSON.parse(body);
+		return new GatewayError(parsed.error || fallback, status, parsed.reason, body, parsed.trace_id || traceId);
+	} catch {
+		return new GatewayError(fallback, status, void 0, body, traceId);
+	}
+}
+/** Why the gateway refused, where what was thrown might not be a refusal at all. */
+function reasonOf(err) {
+	return err instanceof GatewayError ? err.reason : void 0;
+}
+/** What went wrong, as text, whatever was thrown. */
+function errorText(err) {
+	return err instanceof Error ? err.message : String(err);
+}
+//#endregion
+//#region src/credential.ts
+const CREDENTIAL_ENV_VAR = "WAWESOME_DEPLOY_CREDENTIAL";
+const SECRET_PREFIX = "wawe_";
+function credentialFromEnvironment() {
+	const secret = process.env[CREDENTIAL_ENV_VAR]?.trim();
+	return secret ? secret : null;
+}
+/** Enough to match a credential against the one in a CI settings page, and no more. */
+function credentialPrefix(secret) {
+	return secret.slice(0, 11);
+}
+/**
+* A credential has no session behind it, so the platform's own reason — unknown,
+* revoked, expired, or a scope it does not carry — is the whole answer, and
+* "sign in again" names a door a CI runner cannot open.
+*/
+function unauthorizedMessage(status, body) {
+	const secret = credentialFromEnvironment();
+	if (!secret) {
+		const refusal = rejectionOf(body, status, `The platform refused this request (HTTP ${status}).`);
+		if (status !== 401) return refusal.message;
+		const expired = "Authentication expired. Run 'wawesome login' again.";
+		return refusal.traceId ? `${expired}\n${traceLine(refusal.traceId)}` : expired;
+	}
+	return rejectionOf(body, status, `The deploy credential ${credentialPrefix(secret)} was refused (HTTP ${status}).`).message;
+}
+function reportSessionCommandRefused(secret, consequence) {
+	console.error(`[wawesome] Error: ${CREDENTIAL_ENV_VAR} is set, so this CLI authenticates as deploy credential ${credentialPrefix(secret)}.`);
+	console.error(`[wawesome] ${consequence} Unset ${CREDENTIAL_ENV_VAR} first.`);
+}
+//#endregion
+//#region src/config.ts
+/** Path to the user-level settings file (~/.wawesome/settings.json) */
+function getSettingsPath() {
+	return path.join(os.homedir(), ".wawesome", "settings.json");
+}
+/**
+* Read stored user settings from ~/.wawesome/settings.json.
+*/
+function readSettings() {
+	const settingsPath = getSettingsPath();
+	if (!fs.existsSync(settingsPath)) return {};
+	try {
+		const raw = fs.readFileSync(settingsPath, "utf-8");
+		return JSON.parse(raw);
+	} catch {
+		return {};
+	}
+}
+const GATEWAY_ENV_NAMES = ["GATEWAY_URL", "WAWESOME_GATEWAY_URL"];
+const DASHBOARD_ENV_NAMES = ["DASHBOARD_URL", "WAWESOME_DASHBOARD_URL"];
+const GATEWAY_URL_FALLBACK = "https://api.wawesome.io";
+const DASHBOARD_URL_FALLBACK = "https://dashboard.wawesome.io";
+function resolveAddress(overrideUrl, envNames, settingsKey, stored, fallback) {
+	if (overrideUrl) return overrideUrl;
+	for (const name of envNames) {
+		const fromEnv = process.env[name];
+		if (fromEnv) return fromEnv;
+	}
+	const configured = readSettings()[settingsKey];
+	if (configured && typeof configured === "string") return configured;
+	return stored || fallback;
+}
+function getGatewayUrl(overrideUrl) {
+	return resolveAddress(overrideUrl, GATEWAY_ENV_NAMES, "gateway_url", readStoredCredentials()?.gateway_url, GATEWAY_URL_FALLBACK);
+}
+/**
+* A tenant token is only valid at the gateway that issued it, so every other
+* command has to follow the credentials. A login holds no token yet, and
+* reading that rung here made a local gateway outlive the removal of every
+* documented override, since only `logout` clears it. A **Deploy credential**
+* reads the same rungs, and for a sharper reason: following a stale file would
+* present it at a gateway that never minted it.
+*/
+function resolveGatewayUrlWithoutSession(overrideUrl) {
+	return resolveAddress(overrideUrl, GATEWAY_ENV_NAMES, "gateway_url", void 0, GATEWAY_URL_FALLBACK);
+}
+getGatewayUrl();
+function getDashboardUrl(overrideUrl) {
+	return resolveAddress(overrideUrl, DASHBOARD_ENV_NAMES, "dashboard_url", readStoredCredentials()?.dashboard_url, DASHBOARD_URL_FALLBACK);
+}
+/**
+* The dashboard for the environment this login is going to.
+*
+* Taken from the address the platform handed back to open, so a login that
+* configures nothing stores the dashboard belonging to the gateway it signed
+* into. An explicit flag, `DASHBOARD_URL` or a settings file still outrank it,
+* on the rung they outrank every other address on.
+*/
+function resolveDashboardUrlForLogin(overrideUrl, signInUrl) {
+	return resolveAddress(overrideUrl, DASHBOARD_ENV_NAMES, "dashboard_url", originOf(signInUrl), DASHBOARD_URL_FALLBACK);
+}
+/** Undefined rather than throwing: an unreadable address falls to the rung below. */
+function originOf(url) {
+	try {
+		return new URL(url).origin;
+	} catch {
+		return;
+	}
+}
+const LOGIN_CALLBACK_PORT = 9999;
+/** Path to the user-level credentials file */
+function getCredentialsPath() {
+	return path.join(os.homedir(), ".wawesome", "credentials.json");
+}
+/**
+* What this process authenticates with: the **Deploy credential** in the
+* environment where one is set, and otherwise the session `login` left on disk.
+*
+* The environment wins outright rather than filling a gap, so a CI runner
+* carrying a stale cached home directory still authenticates as itself.
+*/
+function readCredentials() {
+	const secret = credentialFromEnvironment();
+	return secret ? environmentCredential(secret) : readStoredCredentials();
+}
+/**
+* A credential wears the shape of a session so that every command reaches the
+* platform the same way. What it does not carry is the point: no refresh token,
+* because there is nothing behind it to renew, and no Tenant, because the
+* platform resolves that from the credential.
+*/
+function environmentCredential(secret) {
+	return {
+		gateway_url: resolveGatewayUrlWithoutSession(void 0),
+		tenant_jwt: secret,
+		credential_prefix: credentialPrefix(secret)
+	};
+}
+/** The session on disk, whatever the environment says. */
+function readStoredCredentials() {
+	const credPath = getCredentialsPath();
+	if (!fs.existsSync(credPath)) return null;
+	try {
+		const raw = fs.readFileSync(credPath, "utf-8");
+		return JSON.parse(raw);
+	} catch {
+		return null;
+	}
+}
+/**
+* Write credentials to disk, creating the directory if needed.
+*
+* Owner-only, because the file holds a refresh token. The `chmod` is what
+* tightens a file an older CLI left world-readable; a mode passed to
+* `writeFileSync` applies only where it creates the file.
+*/
+function writeCredentials(creds) {
+	if (credentialFromEnvironment()) return;
+	const credPath = getCredentialsPath();
+	const dir = path.dirname(credPath);
+	fs.mkdirSync(dir, {
+		recursive: true,
+		mode: 448
+	});
+	fs.writeFileSync(credPath, JSON.stringify(creds, null, 2), {
+		encoding: "utf-8",
+		mode: 384
+	});
+	fs.chmodSync(credPath, 384);
+}
+/**
+* Delete stored credentials.
+*/
+function deleteCredentials() {
+	const credPath = getCredentialsPath();
+	if (fs.existsSync(credPath)) {
+		fs.rmSync(credPath, { force: true });
+		return true;
+	}
+	return false;
+}
+function getFunctionConfigPath(projectDir) {
+	return path.join(projectDir || process.cwd(), "wawesome-function.json");
+}
+function readFunctionConfig(projectDir) {
+	const configPath = getFunctionConfigPath(projectDir);
+	if (!fs.existsSync(configPath)) return null;
+	try {
+		const raw = fs.readFileSync(configPath, "utf-8");
+		return JSON.parse(raw);
+	} catch {
+		return null;
+	}
+}
+//#endregion
+//#region src/assets.ts
+/**
+* The files under `dir`, hashed.
+*
+* Hashes are read off disk in a stream rather than by reading each file whole:
+* a client build's largest chunk is not something to hold in memory just to
+* find out the platform already has it.
+*/
+function collectAssets(dir) {
+	return listFiles(dir).map((file) => ({
+		...file,
+		content_hash: hashFile(file.source)
+	}));
+}
+/** The files a deploy of `dir` carries, before any is read. */
+function listFiles(dir) {
+	if (!fs.existsSync(dir)) return [];
+	const files = [];
+	const walk = (current, prefix) => {
+		for (const entry of fs.readdirSync(current, { withFileTypes: true }).sort((a, b) => a.name.localeCompare(b.name))) {
+			const absolute = path.join(current, entry.name);
+			const relative = prefix ? `${prefix}/${entry.name}` : entry.name;
+			if (entry.isDirectory()) walk(absolute, relative);
+			else if (entry.isFile()) files.push({
+				path: relative,
+				size_bytes: fs.statSync(absolute).size,
+				source: absolute
+			});
+		}
+	};
+	walk(dir, "");
+	return files;
+}
+/**
+* A **Static asset** a browser renders as a page. Read off the extension, as the
+* content type the platform records is — mirrors `content_type_for_path` in
+* `server/crates/core/src/features/assets/content_type.rs`.
+*/
+function isDocument(assetPath) {
+	const name = assetPath.split("/").pop() ?? "";
+	const dot = name.lastIndexOf(".");
+	const extension = dot === -1 ? "" : name.slice(dot + 1).toLowerCase();
+	return extension === "html" || extension === "htm";
+}
+function hashFile(file) {
+	return sha256(fs.readFileSync(file));
+}
+function sha256(bytes) {
+	return crypto.createHash("sha256").update(bytes).digest("hex");
+}
+/**
+* What this deploy *is*: the server bundle together with the sorted set of
+* asset path and content-hash pairs, the same set for its **Private file**s
+* marked apart, and the **Fallback document** it declares.
+*
+* Computed here, before anything is uploaded, so a deploy that changed nothing
+* is refused before a byte moves. Mirrors `deploy_digest` in
+* `server/crates/core/src/features/assets/identity.rs` — the gateway recomputes
+* it from what actually arrives, so the two have to agree exactly.
+*
+* A deploy declaring no fallback and no private files contributes nothing here
+* for either rather than a stated absence, so every digest computed before
+* they existed is unmoved.
+*/
+const DEPLOY_DIGEST_DOMAIN = "wawesome-deploy-v1";
+function deployDigest(bundle, assets, fallback, privateFiles = []) {
+	const byPath = (files) => [...files].sort((a, b) => a.path < b.path ? -1 : a.path > b.path ? 1 : 0);
+	const digest = crypto.createHash("sha256");
+	digest.update(`${DEPLOY_DIGEST_DOMAIN}\n`);
+	digest.update(`${sha256(bundle)}\n`);
+	for (const asset of byPath(assets)) digest.update(`${asset.path}\0${asset.content_hash}\n`);
+	for (const file of byPath(privateFiles)) digest.update(`private\0${file.path}\0${file.content_hash}\n`);
+	if (fallback) digest.update(`fallback\0${fallback.path}\0${fallback.status}\n`);
+	return digest.digest("hex");
+}
+/** The manifest as the gateway reads it — the bytes on disk are the CLI's business. */
+function manifestOf(assets) {
+	return assets.map(({ path, content_hash, size_bytes }) => ({
+		path,
+		content_hash,
+		size_bytes
+	}));
+}
+//#endregion
+export { asGatewayError as C, rejectionOf as E, GatewayError as S, reasonOf as T, SECRET_PREFIX as _, manifestOf as a, reportSessionCommandRefused as b, getDashboardUrl as c, readCredentials as d, readFunctionConfig as f, CREDENTIAL_ENV_VAR as g, writeCredentials as h, listFiles as i, getFunctionConfigPath as l, resolveGatewayUrlWithoutSession as m, deployDigest as n, LOGIN_CALLBACK_PORT as o, resolveDashboardUrlForLogin as p, isDocument as r, deleteCredentials as s, collectAssets as t, getGatewayUrl as u, credentialFromEnvironment as v, errorText as w, unauthorizedMessage as x, credentialPrefix as y };

package/dist/{guest-parity-W61MH7Fb.mjs → guest-parity-DA7x-8BC.mjs}

@@ -1,4 +1,4 @@
-import { a as unsupportedGlobals, i as shimmedGlobals, n as methodRemedy, r as polyfilledGlobals, t as declaredMethods } from "./guest-surface-D5X-IMAN.mjs";
+import { a as shimmedGlobals, i as polyfilledGlobals, o as unsupportedGlobals, r as methodRemedy, t as declaredMethods } from "./guest-surface-BwrNP2Cz.mjs";
 //#region ../../server/guest-surface/message-channel.js
 const ENTANGLED = Symbol("entangled");
 const QUEUE = Symbol("queue");

package/dist/guest-parity.mjs

@@ -1,2 +1,2 @@
-import { t as applyGuestParity } from "./guest-parity-W61MH7Fb.mjs";
+import { t as applyGuestParity } from "./guest-parity-DA7x-8BC.mjs";
 export { applyGuestParity };

package/dist/{guest-surface-D5X-IMAN.mjs → guest-surface-BwrNP2Cz.mjs}

@@ -130,6 +130,11 @@ var globals = [
 		"remedy": "the guest runs one thread and shares memory with nothing; use an ArrayBuffer"
 	}
 ];
+var modules = [{
+	"specifiers": ["node:fs/promises", "fs/promises"],
+	"shim": "fs-promises",
+	"why": "Reads the private files the Version carries. The platform writes the module into the guest folder, so a bundler must leave the import alone."
+}];
 var methods = [
 	{
 		"target": "Number.prototype",
@@ -159,6 +164,9 @@ var methods = [
 var methodRemedy$1 = "the engine carries no ICU, so it ignores the locale and returns an unlocalised string; format the value yourself, or bundle a formatting library and call it directly";
 //#endregion
 //#region src/guest-surface.ts
+function declaredModules() {
+	return modules;
+}
 function declaredGlobals() {
 	return globals;
 }
@@ -205,4 +213,4 @@ function declaredPackages(projectDir) {
 	});
 }
 //#endregion
-export { unsupportedGlobals as a, shimmedGlobals as i, methodRemedy as n, polyfilledGlobals as r, declaredMethods as t };
+export { shimmedGlobals as a, polyfilledGlobals as i, declaredModules as n, unsupportedGlobals as o, methodRemedy as r, declaredMethods as t };

package/dist/index.mjs

@@ -1,4 +1,5 @@
-import { a as unsupportedGlobals, n as methodRemedy, r as polyfilledGlobals, t as declaredMethods } from "./guest-surface-D5X-IMAN.mjs";
+import { C as asGatewayError, E as rejectionOf, S as GatewayError, T as reasonOf, a as manifestOf, b as reportSessionCommandRefused, c as getDashboardUrl, d as readCredentials, f as readFunctionConfig, g as CREDENTIAL_ENV_VAR, h as writeCredentials, l as getFunctionConfigPath, m as resolveGatewayUrlWithoutSession, n as deployDigest, o as LOGIN_CALLBACK_PORT, p as resolveDashboardUrlForLogin, r as isDocument, s as deleteCredentials, t as collectAssets, u as getGatewayUrl, v as credentialFromEnvironment, w as errorText, x as unauthorizedMessage, y as credentialPrefix } from "./assets-CtoyN8P3.mjs";
+import { i as polyfilledGlobals, n as declaredModules, o as unsupportedGlobals, r as methodRemedy, t as declaredMethods } from "./guest-surface-BwrNP2Cz.mjs";
 import cac from "cac";
 import fs from "node:fs";
 import path from "node:path";
@@ -26,230 +27,6 @@ function lockup(stream = process.stdout, env = process.env) {
 }
 const LOCKUP_HTML = "<div style=\"margin-bottom: 24px; font: 700 20px/1 ui-monospace, SFMono-Regular, Menlo, Consolas, monospace; letter-spacing: -0.02em; color: #e8eaf0\"><span style=\"font-size: 22px; letter-spacing: -0.06em\"><span style=\"color: #6b7cff\">[</span>w<span style=\"color: #6b7cff\">]</span></span>&nbsp;wawesome</div>";
 //#endregion
-//#region src/errors.ts
-/** A rejection carrying the gateway's own prose and, where given, its reason. */
-var GatewayError = class extends Error {
-	status;
-	reason;
-	/** The raw response, for `--verbose` to print when the prose is not enough. */
-	body;
-	constructor(message, status, reason, body = "") {
-		super(message);
-		this.name = "GatewayError";
-		this.status = status;
-		this.reason = reason;
-		this.body = body;
-	}
-};
-/**
-* Read a failed response into a `GatewayError`.
-*
-* `fallback` is used only when the response carries no prose of its own — a
-* proxy's HTML error page, or an empty body. A 401 is deliberately *not* special
-* cased here: what to say about an expired session depends on what the caller
-* was doing, so callers handle it before reaching this.
-*/
-async function asGatewayError(res, fallback) {
-	return rejectionOf(await res.text().catch(() => ""), res.status, fallback);
-}
-/** The same reading, for a caller that has already taken the body off the wire. */
-function rejectionOf(body, status, fallback) {
-	try {
-		const parsed = JSON.parse(body);
-		return new GatewayError(parsed.error || fallback, status, parsed.reason, body);
-	} catch {
-		return new GatewayError(fallback, status, void 0, body);
-	}
-}
-/** Why the gateway refused, where what was thrown might not be a refusal at all. */
-function reasonOf(err) {
-	return err instanceof GatewayError ? err.reason : void 0;
-}
-/** What went wrong, as text, whatever was thrown. */
-function errorText(err) {
-	return err instanceof Error ? err.message : String(err);
-}
-//#endregion
-//#region src/credential.ts
-const CREDENTIAL_ENV_VAR = "WAWESOME_DEPLOY_CREDENTIAL";
-function credentialFromEnvironment() {
-	const secret = process.env[CREDENTIAL_ENV_VAR]?.trim();
-	return secret ? secret : null;
-}
-/** Enough to match a credential against the one in a CI settings page, and no more. */
-function credentialPrefix(secret) {
-	return secret.slice(0, 11);
-}
-/**
-* A credential has no session behind it, so the platform's own reason — unknown,
-* revoked, expired, or a scope it does not carry — is the whole answer, and
-* "sign in again" names a door a CI runner cannot open.
-*/
-function unauthorizedMessage(status, body) {
-	const secret = credentialFromEnvironment();
-	if (!secret) return status === 401 ? "Authentication expired. Run 'wawesome login' again." : rejectionOf(body, status, `The platform refused this request (HTTP ${status}).`).message;
-	return rejectionOf(body, status, `The deploy credential ${credentialPrefix(secret)} was refused (HTTP ${status}).`).message;
-}
-function reportSessionCommandRefused(secret, consequence) {
-	console.error(`[wawesome] Error: ${CREDENTIAL_ENV_VAR} is set, so this CLI authenticates as deploy credential ${credentialPrefix(secret)}.`);
-	console.error(`[wawesome] ${consequence} Unset ${CREDENTIAL_ENV_VAR} first.`);
-}
-//#endregion
-//#region src/config.ts
-/** Path to the user-level settings file (~/.wawesome/settings.json) */
-function getSettingsPath() {
-	return path.join(os.homedir(), ".wawesome", "settings.json");
-}
-/**
-* Read stored user settings from ~/.wawesome/settings.json.
-*/
-function readSettings() {
-	const settingsPath = getSettingsPath();
-	if (!fs.existsSync(settingsPath)) return {};
-	try {
-		const raw = fs.readFileSync(settingsPath, "utf-8");
-		return JSON.parse(raw);
-	} catch {
-		return {};
-	}
-}
-const GATEWAY_ENV_NAMES = ["GATEWAY_URL", "WAWESOME_GATEWAY_URL"];
-const DASHBOARD_ENV_NAMES = ["DASHBOARD_URL", "WAWESOME_DASHBOARD_URL"];
-const GATEWAY_URL_FALLBACK = "https://api.wawesome.io";
-const DASHBOARD_URL_FALLBACK = "https://dashboard.wawesome.io";
-function resolveAddress(overrideUrl, envNames, settingsKey, stored, fallback) {
-	if (overrideUrl) return overrideUrl;
-	for (const name of envNames) {
-		const fromEnv = process.env[name];
-		if (fromEnv) return fromEnv;
-	}
-	const configured = readSettings()[settingsKey];
-	if (configured && typeof configured === "string") return configured;
-	return stored || fallback;
-}
-function getGatewayUrl(overrideUrl) {
-	return resolveAddress(overrideUrl, GATEWAY_ENV_NAMES, "gateway_url", readStoredCredentials()?.gateway_url, GATEWAY_URL_FALLBACK);
-}
-/**
-* A tenant token is only valid at the gateway that issued it, so every other
-* command has to follow the credentials. A login holds no token yet, and
-* reading that rung here made a local gateway outlive the removal of every
-* documented override, since only `logout` clears it. A **Deploy credential**
-* reads the same rungs, and for a sharper reason: following a stale file would
-* present it at a gateway that never minted it.
-*/
-function resolveGatewayUrlWithoutSession(overrideUrl) {
-	return resolveAddress(overrideUrl, GATEWAY_ENV_NAMES, "gateway_url", void 0, GATEWAY_URL_FALLBACK);
-}
-getGatewayUrl();
-function getDashboardUrl(overrideUrl) {
-	return resolveAddress(overrideUrl, DASHBOARD_ENV_NAMES, "dashboard_url", readStoredCredentials()?.dashboard_url, DASHBOARD_URL_FALLBACK);
-}
-/**
-* The dashboard for the environment this login is going to.
-*
-* Taken from the address the platform handed back to open, so a login that
-* configures nothing stores the dashboard belonging to the gateway it signed
-* into. An explicit flag, `DASHBOARD_URL` or a settings file still outrank it,
-* on the rung they outrank every other address on.
-*/
-function resolveDashboardUrlForLogin(overrideUrl, signInUrl) {
-	return resolveAddress(overrideUrl, DASHBOARD_ENV_NAMES, "dashboard_url", originOf(signInUrl), DASHBOARD_URL_FALLBACK);
-}
-/** Undefined rather than throwing: an unreadable address falls to the rung below. */
-function originOf(url) {
-	try {
-		return new URL(url).origin;
-	} catch {
-		return;
-	}
-}
-const LOGIN_CALLBACK_PORT = 9999;
-/** Path to the user-level credentials file */
-function getCredentialsPath() {
-	return path.join(os.homedir(), ".wawesome", "credentials.json");
-}
-/**
-* What this process authenticates with: the **Deploy credential** in the
-* environment where one is set, and otherwise the session `login` left on disk.
-*
-* The environment wins outright rather than filling a gap, so a CI runner
-* carrying a stale cached home directory still authenticates as itself.
-*/
-function readCredentials() {
-	const secret = credentialFromEnvironment();
-	return secret ? environmentCredential(secret) : readStoredCredentials();
-}
-/**
-* A credential wears the shape of a session so that every command reaches the
-* platform the same way. What it does not carry is the point: no refresh token,
-* because there is nothing behind it to renew, and no Tenant, because the
-* platform resolves that from the credential.
-*/
-function environmentCredential(secret) {
-	return {
-		gateway_url: resolveGatewayUrlWithoutSession(void 0),
-		tenant_jwt: secret,
-		credential_prefix: credentialPrefix(secret)
-	};
-}
-/** The session on disk, whatever the environment says. */
-function readStoredCredentials() {
-	const credPath = getCredentialsPath();
-	if (!fs.existsSync(credPath)) return null;
-	try {
-		const raw = fs.readFileSync(credPath, "utf-8");
-		return JSON.parse(raw);
-	} catch {
-		return null;
-	}
-}
-/**
-* Write credentials to disk, creating the directory if needed.
-*
-* Owner-only, because the file holds a refresh token. The `chmod` is what
-* tightens a file an older CLI left world-readable; a mode passed to
-* `writeFileSync` applies only where it creates the file.
-*/
-function writeCredentials(creds) {
-	if (credentialFromEnvironment()) return;
-	const credPath = getCredentialsPath();
-	const dir = path.dirname(credPath);
-	fs.mkdirSync(dir, {
-		recursive: true,
-		mode: 448
-	});
-	fs.writeFileSync(credPath, JSON.stringify(creds, null, 2), {
-		encoding: "utf-8",
-		mode: 384
-	});
-	fs.chmodSync(credPath, 384);
-}
-/**
-* Delete stored credentials.
-*/
-function deleteCredentials() {
-	const credPath = getCredentialsPath();
-	if (fs.existsSync(credPath)) {
-		fs.rmSync(credPath, { force: true });
-		return true;
-	}
-	return false;
-}
-function getFunctionConfigPath(projectDir) {
-	return path.join(projectDir || process.cwd(), "wawesome-function.json");
-}
-function readFunctionConfig(projectDir) {
-	const configPath = getFunctionConfigPath(projectDir);
-	if (!fs.existsSync(configPath)) return null;
-	try {
-		const raw = fs.readFileSync(configPath, "utf-8");
-		return JSON.parse(raw);
-	} catch {
-		return null;
-	}
-}
-//#endregion
 //#region src/sourcemap.ts
 const BASE64 = "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/";
 const NO_POSITION = () => null;
@@ -861,6 +638,7 @@ async function buildHandler(entryInput, config, options) {
 				"worker",
 				"browser"
 			],
+			external: declaredModules().flatMap((module) => module.specifiers),
 			target: "es2022",
 			treeShaking: true,
 			minify: true,
@@ -909,7 +687,7 @@ async function buildHandler(entryInput, config, options) {
 * that has to name this version — `--version`, the dependency a scaffolded
 * project pins — reads it here, so a release bumps one file.
 */
-const CLI_VERSION = "0.21.1";
+const CLI_VERSION = "0.23.0";
 //#endregion
 //#region src/cli-login.ts
 const START_PATH = "/v1/cli/login/start";
@@ -1592,8 +1370,15 @@ function planLimitAdvice(reason) {
 //#region src/report.ts
 /** Where a value sits in the deploy's summary block, so every line under one label agrees. */
 const VALUE_COLUMN = " ".repeat(14);
-/** The platform's own prose, kept inside the block it is printed in. */
+/**
+* The platform's own prose, kept inside the block it is printed in. A line
+* break it already carries stays one, which keeps a refusal's trace id on a
+* line of its own.
+*/
 function wrapped(said) {
+	return said.split("\n").flatMap(wrappedLine);
+}
+function wrappedLine(said) {
 	const width = 64;
 	const lines = [];
 	let line = "";
@@ -2034,6 +1819,13 @@ function attachedDomainLines(domain, printedBy = "deploy") {
 		`${VALUE_COLUMN}Remove 'domain' from wawesome-function.json, or deploy again`,
 		`${VALUE_COLUMN}once it is gone to attach it afresh.`
 	];
+	if (domain.withdrawn) return [
+		"",
+		`  Domain:     \x1b[33m${hostname}: stopped, because the plan does not include custom domains\x1b[0m`,
+		`${VALUE_COLUMN}It is still attached, and its records and certificate are kept.`,
+		`${VALUE_COLUMN}Move to a paid plan and it answers again within the hour.`,
+		`${VALUE_COLUMN}This app's own address still answers.`
+	];
 	const legs = domain.legs ?? [];
 	if (legs.length > 1) return pairLines(domain, legs, printedBy);
 	const lines = ["", `  Domain:     \x1b[36m${hostname}\x1b[0m: ${whereItGotTo(domain)}`];
@@ -2281,80 +2073,6 @@ function widest(values) {
 	return values.reduce((longest, value) => Math.max(longest, value.length), 0);
 }
 //#endregion
-//#region src/assets.ts
-/**
-* The files under `dir`, hashed.
-*
-* Hashes are read off disk in a stream rather than by reading each file whole:
-* a client build's largest chunk is not something to hold in memory just to
-* find out the platform already has it.
-*/
-function collectAssets(dir) {
-	if (!fs.existsSync(dir)) return [];
-	const assets = [];
-	const walk = (current, prefix) => {
-		for (const entry of fs.readdirSync(current, { withFileTypes: true }).sort((a, b) => a.name.localeCompare(b.name))) {
-			const absolute = path.join(current, entry.name);
-			const relative = prefix ? `${prefix}/${entry.name}` : entry.name;
-			if (entry.isDirectory()) walk(absolute, relative);
-			else if (entry.isFile()) assets.push({
-				path: relative,
-				content_hash: hashFile(absolute),
-				size_bytes: fs.statSync(absolute).size,
-				source: absolute
-			});
-		}
-	};
-	walk(dir, "");
-	return assets;
-}
-/**
-* A **Static asset** a browser renders as a page. Read off the extension, as the
-* content type the platform records is — mirrors `content_type_for_path` in
-* `server/crates/core/src/features/assets/content_type.rs`.
-*/
-function isDocument(assetPath) {
-	const name = assetPath.split("/").pop() ?? "";
-	const dot = name.lastIndexOf(".");
-	const extension = dot === -1 ? "" : name.slice(dot + 1).toLowerCase();
-	return extension === "html" || extension === "htm";
-}
-function hashFile(file) {
-	return sha256(fs.readFileSync(file));
-}
-function sha256(bytes) {
-	return crypto.createHash("sha256").update(bytes).digest("hex");
-}
-/**
-* What this deploy *is*: the server bundle together with the sorted set of
-* asset path and content-hash pairs, and the **Fallback document** it declares.
-*
-* Computed here, before anything is uploaded, so a deploy that changed nothing
-* is refused before a byte moves. Mirrors `deploy_digest` in
-* `server/crates/core/src/features/assets/identity.rs` — the gateway recomputes
-* it from what actually arrives, so the two have to agree exactly.
-*
-* A deploy declaring no fallback contributes nothing here rather than a stated
-* absence, so every digest computed before fallbacks existed is unmoved.
-*/
-const DEPLOY_DIGEST_DOMAIN = "wawesome-deploy-v1";
-function deployDigest(bundle, assets, fallback) {
-	const digest = crypto.createHash("sha256");
-	digest.update(`${DEPLOY_DIGEST_DOMAIN}\n`);
-	digest.update(`${sha256(bundle)}\n`);
-	for (const asset of [...assets].sort((a, b) => a.path < b.path ? -1 : a.path > b.path ? 1 : 0)) digest.update(`${asset.path}\0${asset.content_hash}\n`);
-	if (fallback) digest.update(`fallback\0${fallback.path}\0${fallback.status}\n`);
-	return digest.digest("hex");
-}
-/** The manifest as the gateway reads it — the bytes on disk are the CLI's business. */
-function manifestOf(assets) {
-	return assets.map(({ path, content_hash, size_bytes }) => ({
-		path,
-		content_hash,
-		size_bytes
-	}));
-}
-//#endregion
 //#region src/prompt.ts
 /**
 * Open a prompt session on stdin, queueing lines as they arrive.
@@ -3329,6 +3047,7 @@ async function deploy(entryInput, options) {
 	const declaresSchedules = config.schedules !== void 0;
 	const declaresFallback = declared.fallback !== void 0;
 	const assets = config.assets ? collectAssets(path.resolve(config.assets)) : [];
+	const privateFiles = config.files ? collectAssets(path.resolve(config.files)) : [];
 	const documents = assets.filter((asset) => isDocument(asset.path));
 	if (jsCode === null && documents.length === 0) {
 		console.error(`[wawesome] Error: Entry file '${DEFAULT_ENTRY}' not found, and this project carries no pages.`);
@@ -3337,7 +3056,10 @@ async function deploy(entryInput, options) {
 		console.error("[wawesome] \x1B[36m\"assets\"\x1B[0m at a directory holding an index.html.");
 		process.exit(1);
 	}
-	if (assets.length > 0) await uploadAssets(creds, app, funcName, jsCode ?? "", assets, declared, isVerbose, declaresSchedules);
+	if (assets.length > 0 || privateFiles.length > 0) await uploadAssets(creds, app, funcName, jsCode ?? "", {
+		assets,
+		privateFiles
+	}, declared, isVerbose, declaresSchedules || domainName !== void 0);
 	console.log(`[wawesome] Uploading code for ${app}/${funcName}...`);
 	const uploadUrl = `${creds.gateway_url}/v1/apps/${encodeURIComponent(app)}/functions/${encodeURIComponent(funcName)}/code`;
 	if (isVerbose) console.log(`[wawesome:verbose] POST ${uploadUrl}`);
@@ -3345,7 +3067,7 @@ async function deploy(entryInput, options) {
 		...declaredFields(declared),
 		...declared.message ? { message: declared.message } : {}
 	};
-	const uploadRes = assets.length > 0 || declaresSchedules || declaresFallback || Object.keys(declaredOnTheWire).length > 0 || jsCode === null ? await authorizedFetch(uploadUrl, {
+	const uploadRes = assets.length > 0 || privateFiles.length > 0 || declaresSchedules || declaresFallback || domainName !== void 0 || Object.keys(declaredOnTheWire).length > 0 || jsCode === null ? await authorizedFetch(uploadUrl, {
 		method: "POST",
 		headers: {
 			Authorization: `Bearer ${creds.tenant_jwt}`,
@@ -3354,8 +3076,10 @@ async function deploy(entryInput, options) {
 		body: JSON.stringify({
 			...jsCode !== null ? { code: jsCode } : {},
 			...assets.length > 0 ? { assets: manifestOf(assets) } : {},
+			...privateFiles.length > 0 ? { files: manifestOf(privateFiles) } : {},
 			...declaresSchedules ? { schedules: config.schedules } : {},
 			...declaresFallback ? { fallback: declared.fallback } : {},
+			...domainName !== void 0 ? { domain: domainName } : {},
 			...declaredOnTheWire
 		})
 	}) : await authorizedFetch(uploadUrl, {
@@ -3461,6 +3185,7 @@ async function deploy(entryInput, options) {
 	if (version !== void 0) console.log(`  Version:    ${version}${nothingBuilt ? " (already live, nothing promoted)" : ""}`);
 	for (const line of handlerLines(bundlePath)) console.log(line);
 	if (assets.length > 0) console.log(`  Assets:     ${assets.length}${pageCount(documents.length)}`);
+	if (privateFiles.length > 0) console.log(`  Private:    ${privateFiles.length}`);
 	console.log(`  Visibility: ${visibility}`);
 	if (schedules.length > 0) {
 		console.log("");
@@ -3510,7 +3235,7 @@ function pageCount(pages) {
 * The identity of the whole deploy goes with the question, so a redeploy that
 * changed nothing at all is refused here — before a byte of it has moved.
 */
-async function uploadAssets(creds, app, funcName, bundle, assets, declared, isVerbose, continueWhenUnchanged) {
+async function uploadAssets(creds, app, funcName, bundle, { assets, privateFiles }, declared, isVerbose, continueWhenUnchanged) {
 	const manifestRes = await authorizedFetch(`${creds.gateway_url}/v1/apps/${encodeURIComponent(app)}/functions/${encodeURIComponent(funcName)}/assets/manifest`, {
 		method: "POST",
 		headers: {
@@ -3518,8 +3243,9 @@ async function uploadAssets(creds, app, funcName, bundle, assets, declared, isVe
 			"Content-Type": "application/json"
 		},
 		body: JSON.stringify({
-			deploy_digest: deployDigest(Buffer.from(bundle, "utf-8"), assets, declared.fallback),
+			deploy_digest: deployDigest(Buffer.from(bundle, "utf-8"), assets, declared.fallback, privateFiles),
 			assets: manifestOf(assets),
+			...privateFiles.length > 0 ? { files: manifestOf(privateFiles) } : {},
 			...declaredFields(declared)
 		})
 	});
@@ -3528,7 +3254,7 @@ async function uploadAssets(creds, app, funcName, bundle, assets, declared, isVe
 		if (manifestRes.status === 401 || manifestRes.status === 403) console.error(`[wawesome] Error: ${unauthorizedMessage(manifestRes.status, errorBody)}`);
 		else if (manifestRes.status === 409) {
 			if (continueWhenUnchanged) {
-				console.log("[wawesome] Code and files unchanged since the last deploy; applying schedules.");
+				console.log("[wawesome] Code and files unchanged since the last deploy; applying the config file.");
 				return;
 			}
 			const refusal = rejectionOf(errorBody, manifestRes.status, "This deploy is already deployed.");
@@ -3546,12 +3272,13 @@ async function uploadAssets(creds, app, funcName, bundle, assets, declared, isVe
 		process.exit(1);
 	}
 	const { missing = [] } = await manifestRes.json();
-	const toUpload = assets.filter((asset) => missing.includes(asset.content_hash));
+	const carried = [...assets, ...privateFiles];
+	const toUpload = [...new Map(carried.filter((file) => missing.includes(file.content_hash)).map((file) => [file.content_hash, file])).values()];
 	if (toUpload.length === 0) {
-		console.log(`[wawesome] ✅ ${assets.length} asset(s) already on the platform, nothing to upload.`);
+		console.log(`[wawesome] ✅ ${carried.length} file(s) already on the platform, nothing to upload.`);
 		return;
 	}
-	console.log(`[wawesome] Uploading ${toUpload.length} of ${assets.length} asset(s)...`);
+	console.log(`[wawesome] Uploading ${toUpload.length} of ${carried.length} file(s)...`);
 	for (const asset of toUpload) {
 		if (isVerbose) console.log(`[wawesome:verbose] PUT ${asset.path} (${asset.size_bytes} bytes)`);
 		const res = await authorizedFetch(`${creds.gateway_url}/v1/assets/${asset.content_hash}`, () => ({
@@ -3574,7 +3301,7 @@ async function uploadAssets(creds, app, funcName, bundle, assets, declared, isVe
 			process.exit(1);
 		}
 	}
-	console.log(`[wawesome] ✅ ${toUpload.length} asset(s) uploaded.`);
+	console.log(`[wawesome] ✅ ${toUpload.length} file(s) uploaded.`);
 }
 //#endregion
 //#region src/opens-host.ts
@@ -4438,7 +4165,8 @@ async function promptForDeclaredEnv(session, declared) {
 		console.log(`  \x1b[1m${variable.key}\x1b[0m \x1b[90m(${flags.join(", ")})\x1b[0m`);
 		console.log(`    ${variable.description}`);
 		console.log(`    \x1b[90mWhere to find it: ${variable.where_to_find}\x1b[0m`);
-		const value = await session.ask(`  ${variable.key}?`, "");
+		const later = variable.required ? " (leave blank to set it after the deploy)" : "";
+		const value = await session.ask(`  ${variable.key}?${later}`, "");
 		console.log("");
 		answers.push({
 			declared: variable,
@@ -5111,6 +4839,20 @@ async function fetchInvocationLogBody(gatewayUrl, tenantJwt, invocationId, isVer
 	}
 	const body = await res.text();
 	process.stdout.write(body.endsWith("\n") ? body : body + "\n");
+	const remediation = await fetchRemediation(gatewayUrl, tenantJwt, invocationId);
+	if (remediation?.cause === "egress-blocked") console.log(`[wawesome] An outbound call was blocked (egress-blocked). Open its host under Egress: ${remediation.dashboard_url}`);
+}
+async function fetchRemediation(gatewayUrl, tenantJwt, invocationId) {
+	try {
+		const res = await authorizedFetch(`${gatewayUrl}/v1/invocations/${encodeURIComponent(invocationId)}`, {
+			method: "GET",
+			headers: { Authorization: `Bearer ${tenantJwt}` }
+		});
+		if (!res.ok) return void 0;
+		return (await res.json()).remediation;
+	} catch {
+		return;
+	}
 }
 /**
 * List recent invocations for a function.

package/dist/local-modules-CAHr4SPW.mjs

@@ -0,0 +1,225 @@
+import { f as readFunctionConfig, i as listFiles } from "./assets-CtoyN8P3.mjs";
+import fs from "node:fs";
+import path from "node:path";
+//#region ../../server/guest-surface/private-files.js
+const constants = Object.freeze({
+	F_OK: 0,
+	R_OK: 4,
+	W_OK: 2,
+	X_OK: 1
+});
+function fsError(code, description, syscall, path) {
+	const error = /* @__PURE__ */ new Error(`${code}: ${description}, ${syscall} '${path}'`);
+	error.code = code;
+	error.syscall = syscall;
+	error.path = path;
+	return error;
+}
+function pathOf(path) {
+	if (path instanceof URL) return decodeURIComponent(path.pathname);
+	return String(path);
+}
+function keyOf(path) {
+	const segments = [];
+	for (const segment of path.split("/")) {
+		if (segment === "" || segment === ".") continue;
+		if (segment === "..") segments.pop();
+		else segments.push(segment);
+	}
+	return segments.join("/");
+}
+var Kind = class {
+	#folder;
+	constructor(folder) {
+		this.#folder = folder;
+	}
+	isFile() {
+		return !this.#folder;
+	}
+	isDirectory() {
+		return this.#folder;
+	}
+	isSymbolicLink() {
+		return false;
+	}
+	isBlockDevice() {
+		return false;
+	}
+	isCharacterDevice() {
+		return false;
+	}
+	isFIFO() {
+		return false;
+	}
+	isSocket() {
+		return false;
+	}
+};
+var Stats = class extends Kind {
+	constructor(entry) {
+		super(entry.folder);
+		this.size = entry.size;
+		this.mode = entry.folder ? 16749 : 33060;
+	}
+};
+var Dirent = class extends Kind {
+	constructor(name, parentPath, folder) {
+		super(folder);
+		this.name = name;
+		this.parentPath = parentPath;
+		this.path = parentPath;
+	}
+};
+function readOnly(syscall) {
+	return async (path) => {
+		throw fsError("EROFS", "read-only file system", syscall, pathOf(path));
+	};
+}
+/**
+* `listing` is `[path, size]` pairs. `fetchFile(path)` answers a Response:
+* 200 with the bytes, 404 for a file that is gone, 413 with the reason for a
+* read past the invocation's cap.
+*/
+function privateFiles(listing, fetchFile) {
+	const sizes = new Map(listing);
+	const folders = /* @__PURE__ */ new Map([["", /* @__PURE__ */ new Set()]]);
+	for (const path of sizes.keys()) {
+		const segments = path.split("/");
+		for (let depth = 0; depth < segments.length; depth++) {
+			const parent = segments.slice(0, depth).join("/");
+			if (!folders.has(parent)) folders.set(parent, /* @__PURE__ */ new Set());
+			folders.get(parent).add(segments[depth]);
+		}
+	}
+	function entryAt(name, syscall) {
+		const key = keyOf(name);
+		if (sizes.has(key)) return {
+			key,
+			folder: false,
+			size: sizes.get(key)
+		};
+		if (folders.has(key)) return {
+			key,
+			folder: true,
+			size: 0
+		};
+		throw fsError("ENOENT", "no such file or directory", syscall, name);
+	}
+	async function readFile(path, options) {
+		const name = pathOf(path);
+		const encoding = typeof options === "string" ? options : options?.encoding;
+		const entry = entryAt(name, "open");
+		if (entry.folder) throw fsError("EISDIR", "illegal operation on a directory", "read", name);
+		const response = await fetchFile(entry.key);
+		if (response.status === 404) throw fsError("ENOENT", "no such file or directory", "open", name);
+		if (response.status === 413) throw fsError("EFBIG", await response.text(), "read", name);
+		if (!response.ok) throw fsError("EIO", "i/o error", "read", name);
+		if (encoding == null) return new Uint8Array(await response.arrayBuffer());
+		if (/^utf-?8$/i.test(encoding)) return response.text();
+		return new TextDecoder(encoding).decode(await response.arrayBuffer());
+	}
+	async function readdir(path, options) {
+		const name = pathOf(path);
+		const entry = entryAt(name, "scandir");
+		if (!entry.folder) throw fsError("ENOTDIR", "not a directory", "scandir", name);
+		const listed = [];
+		const walk = (key, relative, parentPath) => {
+			for (const child of [...folders.get(key)].sort()) {
+				const childKey = key === "" ? child : `${key}/${child}`;
+				const folder = folders.has(childKey);
+				const childRelative = relative === "" ? child : `${relative}/${child}`;
+				listed.push(options?.withFileTypes ? new Dirent(child, parentPath, folder) : childRelative);
+				if (options?.recursive && folder) walk(childKey, childRelative, `${parentPath}/${child}`);
+			}
+		};
+		walk(entry.key, "", name);
+		return listed;
+	}
+	async function stat(path) {
+		return new Stats(entryAt(pathOf(path), "stat"));
+	}
+	async function lstat(path) {
+		return new Stats(entryAt(pathOf(path), "lstat"));
+	}
+	async function access(path, mode = constants.F_OK) {
+		const name = pathOf(path);
+		const entry = entryAt(name, "access");
+		if (mode & constants.W_OK) throw fsError("EROFS", "read-only file system", "access", name);
+		if (mode & constants.X_OK && !entry.folder) throw fsError("EACCES", "permission denied", "access", name);
+	}
+	return {
+		constants,
+		readFile,
+		readdir,
+		stat,
+		lstat,
+		access,
+		appendFile: readOnly("open"),
+		chmod: readOnly("chmod"),
+		chown: readOnly("chown"),
+		copyFile: readOnly("copyfile"),
+		cp: readOnly("cp"),
+		lchown: readOnly("lchown"),
+		link: readOnly("link"),
+		lutimes: readOnly("lutime"),
+		mkdir: readOnly("mkdir"),
+		mkdtemp: readOnly("mkdtemp"),
+		rename: readOnly("rename"),
+		rm: readOnly("rm"),
+		rmdir: readOnly("rmdir"),
+		symlink: readOnly("symlink"),
+		truncate: readOnly("open"),
+		unlink: readOnly("unlink"),
+		utimes: readOnly("utime"),
+		writeFile: readOnly("open")
+	};
+}
+//#endregion
+//#region src/local-modules.ts
+/**
+* `DEFAULT_MAX_PRIVATE_FILE_READ_BYTES` in the runner. Production counts it over
+* every read of one invocation; a local run has no invocation, so it holds for
+* each read alone.
+*/
+const MAX_PRIVATE_FILE_READ_BYTES = 8388608;
+const LOCAL_MODULES = { "fs-promises": localFsPromises };
+/** A declared module as the guest gets it, backed by the project on disk. */
+function localModule(shim, projectDir) {
+	const create = LOCAL_MODULES[shim];
+	if (!create) throw new Error(`wawesome: the guest surface declares the module '${shim}', and no local implementation is registered for it.`);
+	const exports = create(projectDir);
+	return {
+		...exports,
+		default: exports
+	};
+}
+/** Where `wawesome deploy` would take the private files from, if anywhere. */
+function privateFilesDir(projectDir) {
+	const files = readFunctionConfig(projectDir)?.files;
+	return files ? path.resolve(projectDir, files) : null;
+}
+/**
+* The platform's own rules over a listing read fresh on every call, so a file
+* edited while the dev server runs is what the next request reads.
+*/
+function localFsPromises(projectDir) {
+	const dir = privateFilesDir(projectDir);
+	const current = () => onDisk(dir);
+	return Object.fromEntries(Object.entries(onDisk(null)).map(([name, value]) => [name, typeof value === "function" ? (...args) => current()[name](...args) : value]));
+}
+function onDisk(dir) {
+	const files = dir ? listFiles(dir) : [];
+	const byPath = new Map(files.map((file) => [file.path, file]));
+	return privateFiles(files.map((file) => [file.path, file.size_bytes]), async (key) => {
+		const file = byPath.get(key);
+		if (!file) return new Response(null, { status: 404 });
+		if (file.size_bytes > 8388608) return new Response(`one invocation may read at most ${MAX_PRIVATE_FILE_READ_BYTES} bytes of private files`, { status: 413 });
+		try {
+			return new Response(await fs.promises.readFile(file.source));
+		} catch {
+			return new Response(null, { status: 404 });
+		}
+	});
+}
+//#endregion
+export { localModule as n, privateFilesDir as r, MAX_PRIVATE_FILE_READ_BYTES as t };

package/dist/local-modules.d.mts

@@ -0,0 +1,16 @@
+//#region src/local-modules.d.ts
+type LocalModule = Record<string, unknown> & {
+  default: Record<string, unknown>;
+};
+/**
+ * `DEFAULT_MAX_PRIVATE_FILE_READ_BYTES` in the runner. Production counts it over
+ * every read of one invocation; a local run has no invocation, so it holds for
+ * each read alone.
+ */
+declare const MAX_PRIVATE_FILE_READ_BYTES: number;
+/** A declared module as the guest gets it, backed by the project on disk. */
+declare function localModule(shim: string, projectDir: string): LocalModule;
+/** Where `wawesome deploy` would take the private files from, if anywhere. */
+declare function privateFilesDir(projectDir: string): string | null;
+//#endregion
+export { LocalModule, MAX_PRIVATE_FILE_READ_BYTES, localModule, privateFilesDir };

package/dist/local-modules.mjs

@@ -0,0 +1,2 @@
+import { n as localModule, r as privateFilesDir, t as MAX_PRIVATE_FILE_READ_BYTES } from "./local-modules-CAHr4SPW.mjs";
+export { MAX_PRIVATE_FILE_READ_BYTES, localModule, privateFilesDir };

package/dist/vite.d.mts

@@ -18,6 +18,12 @@ interface WawesomeReactOptions {
  * route and answer with an empty shell that fails to hydrate. Every URL it
  * carries is a **Request-time base** away from the mount.
  */
-declare function wawesomeReact(options?: WawesomeReactOptions): Plugin;
+declare function wawesomeReact(options?: WawesomeReactOptions): Plugin[];
+/**
+ * Hands the server code the dev server runs the platform's `node:fs/promises`,
+ * reading the project's `files` folder. Only the build leaves the import for
+ * the platform, so this is a no-op there.
+ */
+declare function wawesomePrivateFiles(): Plugin;
 //#endregion
-export { WawesomeReactOptions, wawesomeReact as default, wawesomeReact };
+export { WawesomeReactOptions, wawesomeReact as default, wawesomeReact, wawesomePrivateFiles };

package/dist/vite.mjs

@@ -1,7 +1,11 @@
-import { a as unsupportedGlobals, n as methodRemedy, r as polyfilledGlobals, t as declaredMethods } from "./guest-surface-D5X-IMAN.mjs";
+import { i as polyfilledGlobals, n as declaredModules, o as unsupportedGlobals, r as methodRemedy, t as declaredMethods } from "./guest-surface-BwrNP2Cz.mjs";
+import { n as localModule, r as privateFilesDir, t as MAX_PRIVATE_FILE_READ_BYTES } from "./local-modules-CAHr4SPW.mjs";
 import fs from "node:fs";
 import path from "node:path";
+import { fileURLToPath } from "node:url";
 //#region src/vite.ts
+const LOCAL_MODULE_PREFIX = "\0wawesome:module:";
+const LOCAL_MODULES_FILE = fileURLToPath(new URL(`./local-modules${path.extname(fileURLToPath(import.meta.url))}`, import.meta.url));
 const DOCUMENT_MODULE_ID = "virtual:wawesome/document";
 const BASE_MODULE_ID = "virtual:wawesome/base";
 const RESOLVED_DOCUMENT = `\0${DOCUMENT_MODULE_ID}`;
@@ -32,7 +36,7 @@ function wawesomeReact(options = {}) {
 	let root = process.cwd();
 	let dev = null;
 	let clientBuild = null;
-	return {
+	return [wawesomePrivateFiles(), {
 		name: "wawesome:react-ssr",
 		config(_userConfig, env) {
 			const building = env.command === "build";
@@ -124,6 +128,52 @@ function wawesomeReact(options = {}) {
 			}
 			return documentModule(html, clientEntry, clientBuild);
 		}
+	}];
+}
+/**
+* Hands the server code the dev server runs the platform's `node:fs/promises`,
+* reading the project's `files` folder. Only the build leaves the import for
+* the platform, so this is a no-op there.
+*/
+function wawesomePrivateFiles() {
+	const shims = new Map(declaredModules().flatMap((module) => module.specifiers.map((specifier) => [specifier, module.shim])));
+	let root = process.cwd();
+	return {
+		name: "wawesome:private-files",
+		apply: "serve",
+		enforce: "pre",
+		config() {
+			return { resolve: { alias: [...shims.keys()].map((specifier) => ({
+				find: new RegExp(`^${specifier.replace(/[.*+?^${}()|[\]\\]/g, "\\$&")}$`),
+				replacement: specifier
+			})) } };
+		},
+		configResolved(config) {
+			root = config.root;
+		},
+		configureServer(server) {
+			const dir = privateFilesDir(root);
+			if (!dir) return;
+			server.config.logger.info(`  wawesome  node:fs/promises reads ${path.relative(root, dir) || "."} here, as on the guest`);
+			server.config.logger.warn(`            each read here may take ${MAX_PRIVATE_FILE_READ_BYTES / 1024 / 1024} MiB; the guest counts that over a whole invocation`);
+		},
+		resolveId(id) {
+			if (this.environment.config.consumer !== "server") return;
+			const shim = shims.get(id);
+			if (shim) return LOCAL_MODULE_PREFIX + shim;
+		},
+		load(id) {
+			if (!id.startsWith(LOCAL_MODULE_PREFIX)) return;
+			const shim = id.slice(17);
+			const names = Object.keys(localModule(shim, root)).filter((name) => name !== "default");
+			return [
+				`import { localModule } from ${JSON.stringify(LOCAL_MODULES_FILE)};`,
+				`const module = localModule(${JSON.stringify(shim)}, ${JSON.stringify(root)});`,
+				`export const { ${names.join(", ")} } = module;`,
+				"export default module.default;",
+				""
+			].join("\n");
+		}
 	};
 }
 /**
@@ -244,4 +294,4 @@ function normalize(file) {
 	return file.replace(/\\/g, "/").replace(/^\.?\//, "");
 }
 //#endregion
-export { wawesomeReact as default, wawesomeReact };
+export { wawesomeReact as default, wawesomeReact, wawesomePrivateFiles };

package/dist/vitest-setup.mjs

@@ -1,5 +1,12 @@
-import { t as applyGuestParity } from "./guest-parity-W61MH7Fb.mjs";
+import { n as declaredModules } from "./guest-surface-BwrNP2Cz.mjs";
+import { t as applyGuestParity } from "./guest-parity-DA7x-8BC.mjs";
+import { n as localModule } from "./local-modules-CAHr4SPW.mjs";
+import { vi } from "vitest";
 //#region src/vitest-setup.ts
 applyGuestParity();
+for (const declared of declaredModules()) {
+	const module = localModule(declared.shim, process.cwd());
+	for (const specifier of declared.specifiers) vi.doMock(specifier, () => module);
+}
 //#endregion
 export {};

package/package.json

@@ -1,7 +1,8 @@
 {
   "name": "wawesome",
-  "version": "0.21.1",
+  "version": "0.23.0",
   "description": "CLI tool for building and deploying serverless functions on wawesome.io platform",
+  "license": "MIT",
   "type": "module",
   "bin": {
     "wawesome": "bin/wawesome.js"
@@ -68,11 +69,15 @@
     "vitest": "^4.1.10"
   },
   "peerDependencies": {
-    "vite": "^8.0.0"
+    "vite": "^8.0.0",
+    "vitest": "^4.0.0"
   },
   "peerDependenciesMeta": {
     "vite": {
       "optional": true
+    },
+    "vitest": {
+      "optional": true
     }
   }
 }