Publish it, serve it, own the name.

Every publish is an immutable, content-addressed deployment; going live is one atomic pointer flip. Readers never see a half-written mix.

Identical bytes are stored once; re-running sync streams only the blobs that actually changed.

Re-activate any previous deployment in a single flip: nothing to rebuild, nothing to re-upload.

Inspect the live deployment and the full history: id, age, and file count.

Named pointers for staging and per-branch previews, plus immutable per-deploy preview hosts.

Run any build tool before publishing, or the in-process Rolldown + lightningcss bundler.

Preview exactly what an upload would change, and validate routing before anything ships.

A project owns many sites plus their functions and compute. A site name is unique only within its project, so two teams can each own a blog; deploys, aliases, crons, and workflow runs stay independent.

Each project is the tenant a handler's row-level scope resolves to: kv, blobstore, sql, and messaging namespaces are scoped to the owning project, so same-named resources never share a data plane.

A Cedar Project resource with project_admin / project_publisher / project_viewer roles; a token scoped to one project is refused (403) on any other.

One RON manifest declares a whole project: its sites (content + build + routing), top-level functions (with their imports, env, and limits), and compute, all reconciled to desired state in a single pass.

apply is create-or-replace and touches only what it names, so declarative and imperative management coexist; --dry-run prints the plan and writes nothing.

Everything that predates projects lives in a reserved default project, so an omitted --project is byte-identical to single-site boatramp. No migration of your URLs or behaviour.

Range requests, conditional GETs, and strong ETags, all automatic, nothing to configure.

HTTP/3 over QUIC served alongside the TLS listener.

Every connection is served through boatramp's own boatramp-http, a hand-rolled HTTP/1.1 codec and a multiplexed HTTP/2 driver (no hyper in the accept path), conformance-gated against h2spec, a differential oracle, and fuzzing.

Redirects, internal rewrites, reverse-proxy targets, header rules, clean URLs, and a trailing-slash policy.

Gate redirects and rewrites on a when predicate (a bounded CEL subset): language, cookie, header, or file_exists, with computed ${…} destinations and automatic Vary. Edge logic without a handler.

SPA fallback and custom error documents, folded into the immutable deployment so they roll back with content.

Sensible Cache-Control + ETag defaults, with per-path immutable overrides.

Serve a cacheable GET/HEAD from a host-level cache without re-instantiating the handler. Opt-in via Cache-Control, keyed per project scope, honoring Vary and never storing a private (Set-Cookie, no-store) response.

Brotli and gzip precompressed at publish; on-the-fly compression for dynamic output.

Existing _redirects and _headers files are folded into the routing manifest on sync.

Attach any number of hostnames (exact and wildcard) to a site, with canonical redirects.

Prove control over a host via HTTP self-verify or a DNS-TXT record before it ever routes.

HTTP-01 certificates requested on first start, cached, and renewed before expiry. No cron, no certbot.

Wildcard certificates via the DNS-01 challenge, plus per-deploy preview certs.

Cloudflare, Route 53, Google, Azure, DigitalOcean, Hetzner, NS1, DNSimple, OCI, and Akamai, plus a manual fallback.

Serve your own certificate, and set HSTS, CSP, and frame-options per site.