Deployment commands

Run only the bundle

A bundled service needs no module loading: esdev build put every package it uses into the bundle, and which packages those may be was decided there, by the project's dependency policy. esrun grants nothing by default, so leave out --allow-imports and nothing but the file you named can run:

Shell

esrun --allow-listen=8080 --allow-read=./public dist/server.js

A bundle that loads code at run time — a dynamic import() the build split into a chunk, or a worker entry — needs --allow-imports, and loads only from inside the project root.

The command is part of the deployment

A permission flag that is ignored would leave a run wider than the command line claims, so the parser never guesses. Each of these fails the run rather than starting one:

TEXT

$ esrun app.js --allow-net
error: --allow-net appears after app.js, where it is the script's own argument
and does nothing to the run.

$ esrun --allow-ne app.js
error: unknown option: --allow-ne

$ esrun --deny-net app.js
error: --deny-net requires --allow-all: every capability is denied by default,
so there is nothing for --deny-net to take away.

$ esrun --allow-env --allow-env=HOME app.js
error: --allow-env=HOME and --allow-env disagree: one narrows the grant to a
list, the other grants it whole.

The consequences for a deployment are worth stating plainly:

Order matters. esrun's flags come before the script; anything after it is the script's own argument. A restriction appended to the end of a command is the classic way to ship an unrestricted service, so this is an error rather than a silent pass-through.
A typo cannot degrade you quietly. An unknown flag stops the run and lists the valid names.
No flag overrides another. There is no precedence to reason about. The two modes — --allow-<name> adding, --allow-all --deny-<name> subtracting — cannot be combined, and granting one capability both whole and narrowed is an error rather than a rule someone has to remember.

Because a malformed command fails loudly, a smoke test that the service starts is also a test that its permission flags parsed.