@abide/abide 0.121.0 → 0.122.0

package/ABIDE.md

@@ -57,6 +57,10 @@ affected code saying what it did, and tell the user.
   scripts, the CLI and MCP alike.
 - A `.abide` cannot export. A `<script server>` in one holds that file's private handlers
   (`const save = POST(…)`), callable by that file alone, and its hooks (`onStart`, `middleware`, …).
+- A rung shared between handlers or layouts is typed `Middleware` and nothing else:
+  `export const signedIn: Middleware = async (next) => (await principal.authenticated) ? next() : refuse(401)`
+  fits a handler's `middleware: […]` and a layout's `middleware(…)` alike (RULEBOOK 37.14). No
+  `<Ctx, Result>` of its own, and no `as` on a `refuse`.
 - A directory holds addresses, tests, benches, `.d.ts` declarations and two fenced directories
   alone: `lib/` for components and modules, and `public/` for files served as they are. Anything
   else beside the pages is a build error.

package/CHANGELOG.md

@@ -1,5 +1,21 @@
 # @abide/abide
 
+## 0.122.0
+
+### Minor Changes
+
+- a2144de: `Middleware` is one type for a rung shared between handlers and layouts: `const signedIn: Middleware = async (next) => …` fits a handler's `middleware: […]` and a layout's `middleware(…)` alike, with no `<Ctx, Result>` of its own. `Middleware<Response>` is a rung that answers with a `Response` of its own, and `Middleware<never, { args: () => unknown }>` one that reads a handler's args. A `refuse(…)` a layout's rung returns is now answered in its lane — the nearest error page over a page, Problem Details over a handler, and by what the request accepts before routing — and the rung outside it is handed that `Response` (RULEBOOK 37.14, 37.15). BREAKING: `Middleware<Ctx, Result>` written with a context type first no longer reads that way; annotate `next` instead, or use the forms above.
+
+### Patch Changes
+
+- 44e9f1d: ABIDE.md names the one-word Middleware form for a shared rung (RULEBOOK 37.14) ([`0699004`](https://github.com/briancray/abide/commit/0699004266bf8174263d1820cee2e9946eeee8a3))
+
+## 0.121.1
+
+### Patch Changes
+
+- 7d6571d: a pairing link written into an href survives the URL scheme check — abide-bridge: joins the safe set, and the render warning names the set it checked against (RULEBOOK 32.20, 44.40) ([`aaba479`](https://github.com/briancray/abide/commit/aaba479a86b318d2441e920b6f7cfd124cb6c75e))
+
 ## 0.121.0
 
 ### Minor Changes

package/docs/REGISTRY.md

@@ -218,7 +218,7 @@ type Gated<Gate, Accepted> = [Schema<Accepted>] extends [Gate] ? never : Failed<
 | `Value` | `unknown` | What the addressed `Reactive` holds. | 16.3, 16.30 |
 | `Produced` | `unknown` | What it yields, per the unit rule. | 1.2, 16.3 |
 | `Args` | `Record<string, JsonValue> \| undefined` | The arguments, in the body on a mutation and in the URL on a `GET` or `DELETE`. | 11.24, 16.18, 19.15 |
-| `Middleware` | `<Ctx, Result>(next: (ctx?: Ctx) => Promise<Result>, ctx: Ctx) => Result \| Promise<Result>` | One rung of `middleware`. | 16.14, 16.15, 16.16, 16.21 |
+| `Middleware` | `Middleware<Answer = never, Extra extends object = object> = <Given extends { request: Request } & Extra, Result>(next: (ctx?: Given) => Promise<Result>, ctx: Given) => Result \| Answer \| Failed<string, unknown> \| Promise<Result \| Answer \| Failed<string, unknown>>` | One rung, written once for every lane whose context carries `Extra`. | 16.14, 16.15, 16.16, 16.21, 37.14, 37.15 |
 | `GET` | `<Value, Args, Failures, RungFailures, Produced = Value>(handler: Reactive<Value, Value, Failures, Produced> \| Keyed<Value, Args, Value, Failures, Produced>, options?: RpcOptions<Args, RungFailures>) => Rpc<Value, Args, Failures \| RungFailures, Produced>` | Declares a read any surface may call. | 16.1, 16.2, 16.5, 16.6, 16.30, 16.31, 16.32, 16.68, 16.76, 16.34, 16.35, 16.36, 16.37, 16.39, 16.44, 16.45, 16.46, 16.47, 16.75, 16.50, 16.51, 16.52, 16.64, 18.1, 18.3, 18.6, 18.8, 18.10, 18.12, 18.21, 18.24, 18.27 |
 | `GET` | `<Value, Args, Failures, RungFailures, Produced = Value>(handler: (args?: Args) => Value, options?: RpcOptions<Args, RungFailures> & ReactiveOptions<Value, Value, Failures, Args>) => Rpc<Value, Args, Failures \| RungFailures, Produced>` | The plain-function overload, whose `ReactiveOptions` (`ttl`, `global`, `debounce` and the rest) build the value it becomes beside its address. | 16.1, 16.6, 16.7 |
 | `GET` | `<Value, Failures, RungFailures>(handler: Value \| PromiseLike<Value>, options?: RpcOptions<undefined, RungFailures> & ReactiveOptions<Value, Value, Failures>) => Rpc<Value, undefined, Failures \| RungFailures>` | The value overload, for what the handler owns outright, whose `ReactiveOptions` build the value it becomes. | 16.1, 16.6, 16.7 |
@@ -240,7 +240,7 @@ type Gated<Gate, Accepted> = [Schema<Accepted>] extends [Gate] ? never : Failed<
 | Name | Signature | Meaning | Rules |
 | --- | --- | --- | --- |
 | `description` | `string` | The human description carried onto every generated surface. | 16.28 |
-| `middleware` | `Middleware<{ request: Request; args: () => Args }, Value \| Failures>[]` | The rungs run per call. | 16.11, 16.12, 16.16, 16.17, 16.18, 16.19, 16.20 |
+| `middleware` | `((next: (ctx?: { request: Request; args: () => Args }) => Promise<unknown>, ctx: { request: Request; args: () => Args }) => unknown)[]` | The rungs run per call. | 16.11, 16.12, 16.16, 16.17, 16.18, 16.19, 16.20 |
 | `timeout` | `number` | How long the call may go without progress. | 16.22, 16.58, 16.59, 16.60, 16.61, 16.77 |
 | `clients` | `Clients` | Which surfaces carry this handler. | 16.37, 20.3 |
 | `crossOrigin` | `boolean \| string[]` | Whether other origins may call it, or follow it over the mux. | 16.24, 18.2, 21.19 |
@@ -351,7 +351,7 @@ type Gated<Gate, Accepted> = [Schema<Accepted>] extends [Gate] ? never : Failed<
 | --- | --- | --- | --- |
 | `claudeCode` | `(config?: ClaudeCodeConfig) => Provider` | The visitor's own Claude Code, reached through the bridge paired with their browser, as a provider. | 44.5, 44.13, 44.17, 44.18, 44.19, 44.24, 44.25, 44.27, 44.30, 44.33 |
 | `ClaudeCodeConfig` | `{ model?: string; fallbackModel?: string; systemPrompt?: string; appendSystemPrompt?: string; effort?: 'low' \| 'medium' \| 'high' \| 'xhigh' \| 'max'; maxBudgetUsd?: number; betas?: string[]; disallowedTools?: string[]; tools?: string[] }` | The Claude Code options a site may set for a turn, and the built-in tools it asks the visitor for. | 44.16, 44.29 |
-| `claudeCode.bridgeCommand` | `(options?: { tools?: string[] }) => { command: string; link: string; expires: number }` | The command and the link that pair a bridge with this browser, granting the built-in tools it is given. | 44.14, 44.32, 44.33, 44.40, 44.41, 44.42, 44.43 |
+| `claudeCode.bridgeCommand` | `(options?: { tools?: string[] }) => { command: string; link: string; expires: number }` | The command and the link that pair a bridge with this browser, granting the built-in tools it is given. | 44.14, 44.32, 44.33, 44.40, 44.41, 44.42, 44.43, 44.44 |
 | `claudeCode.bridge` | `(options?: { tools?: string[] }) => AsyncGenerator<BridgeStatus>` | This browser's pairing, as it changes. | 44.20, 44.22, 44.32, 44.33, 44.34, 44.40 |
 | `BridgeStatus` | `{ paired: boolean; command: string \| undefined; link: string \| undefined }` | Whether a bridge is paired, and the command and the link that pair one where none is. | 44.20, 44.40 |
 | `/__abide/bridge` | `GET`, `POST` | Where a bridge pairs, and is relayed its turns. | 36.7, 44.14, 44.15, 44.19, 44.23, 44.26, 16.57, 16.78 |
@@ -499,7 +499,7 @@ type Gated<Gate, Accepted> = [Schema<Accepted>] extends [Gate] ? never : Failed<
 
 | Name | Signature | Meaning | Rules |
 | --- | --- | --- | --- |
-| `csp` | `(sources?: Record<string, string[]>) => Middleware` | The rung that sets `content-security-policy`. | 29.1, 29.2, 29.5, 29.6, 29.7, 29.8 |
+| `csp` | `(sources?: Record<string, string[]>) => (next: (ctx?: { request: Request }) => Promise<Response>, ctx: { request: Request }) => Promise<Response>` | The rung that sets `content-security-policy`. | 29.1, 29.2, 29.5, 29.6, 29.7, 29.8 |
 | `csp.nonce` | `() => string` | This response's nonce, for the app's own inline script. | 29.3, 29.4, 29.9, 29.11 |
 
 ## `url`
@@ -702,7 +702,7 @@ type Gated<Gate, Accepted> = [Schema<Accepted>] extends [Gate] ? never : Failed<
 
 | Name | Signature | Meaning | Rules |
 | --- | --- | --- | --- |
-| `middleware` | `(...rungs: Middleware<{ request: Request }, Response>[]) => () => void` | The per-request lane at the calling file's route. | 18.26, 37.2, 37.3, 37.13 |
+| `middleware` | `(...rungs: ((next: (ctx?: { request: Request }) => Promise<Response>, ctx: { request: Request }) => Response \| Failed<string, unknown> \| Promise<Response \| Failed<string, unknown>>)[]) => () => void` | The per-request lane at the calling file's route. | 18.26, 37.2, 37.3, 37.13, 37.14, 37.15 |
 | `onStart` | `(fn: (start: () => Promise<void>) => void \| Promise<void>) => () => void` | Wraps the boot. | 37.4, 37.6, 37.13 |
 | `onStop` | `(fn: (stop: () => Promise<void>) => void \| Promise<void>) => () => void` | Mirrors it for teardown. | 37.4, 37.6, 37.13 |
 | `onError` | `(fn: (error: unknown) => unknown) => () => void` | Runs on an unexpected error at the calling file's route. | 37.5, 37.8, 37.13 |

package/docs/RULEBOOK.md

@@ -1959,8 +1959,8 @@ body.
 MUST NOT be built as a string.
 
 32.20 An interpolation in a URL-typed attribute MUST be scheme-checked, and a scheme outside
-`http:`, `https:`, `mailto:`, `tel:`, `blob:`, `data:` or a relative reference MUST be dropped and warned on
-`abide:render`, naming the attribute and not the value.
+`http:`, `https:`, `mailto:`, `tel:`, `blob:`, `data:`, `abide-bridge:` (44.40) or a relative
+reference MUST be dropped and warned on `abide:render`, naming the attribute and not the value.
 
 32.21 A control block MUST bind each reactive read and probe call in its subject once for the body.
 
@@ -2454,6 +2454,13 @@ through `App.stop`, and the process MUST then exit with 0.
 37.13 A lifecycle hook called in a module of the app's own that is neither a `.abide` nor a handler
 file MUST be a build error naming the module and the hook.
 
+37.14 A `Failed` a `middleware` rung returns MUST be answered in the lane the rung is filed over: by
+the nearest `error.abide` per 35.2 over a page, as 15.21 states over a handler, and as 15.22 paints
+a 405 for a rung filed at the root route.
+
+37.15 A `middleware` rung outside one that returned a `Failed` MUST be handed 37.14's answer from
+`next`, and MUST NOT be handed the `Failed`.
+
 # 38. Commands
 
 ## The commands
@@ -3409,12 +3416,17 @@ a link in the `abide-bridge` scheme naming the same site, code, bridge release a
 whose release is a version alone, and MUST run the release it names.
 
 44.42 A bridge opening an `abide-bridge` link MUST ask the visitor before it pairs, every time, naming
-the site, the built-in tools and the bridge release the link asks for.
+the site, the built-in tools and the bridge release the link asks for, and the options and the names
+of the variables `abide-bridge install` kept (44.44).
 
 44.43 `abide-bridge install` MUST write the app that opens links under the visitor's own Application
 Support and register it there, and `abide-bridge uninstall` MUST unregister it and remove all
 install wrote.
 
+44.44 `abide-bridge install` MUST keep the Claude Code options after its `--` and each `--env
+NAME=VALUE` it is given, and a bridge opening an `abide-bridge` link MUST run Claude Code with those
+options ahead of the link's built-in tools and with those variables set, and a link MUST NOT set either.
+
 # 45. Offline
 
 45.1 Where `ABIDE_OFFLINE` is on, a page `abide build` built MUST register the worker

package/docs/abide.md

@@ -4227,24 +4227,28 @@ async function exportAll() {
 ```
 
 ```ts src/account/exportContacts.handler.ts
-import { principal, refuse } from '@abide/abide'
 import { POST } from '@abide/abide/server'
 
 import { CONTACTS } from '../contacts/lib/CONTACTS.server.ts'
+import { adminsOnly } from './lib/adminsOnly.ts'
 
 export default POST(async () => CONTACTS, {
     description: 'Every contact, for an admin to export.',
-    middleware: [
-        // Runs before the handler, on every call, in process or not.
-        async (next, ctx) => {
-            const { role } = await principal.resolved
-            if (role !== 'admin') return refuse(403, 'Admins only.')
-            return next(ctx)
-        },
-    ],
+    // Runs before the handler, on every call, in process or not.
+    middleware: [adminsOnly],
 })
 ```
 
+```ts src/account/lib/adminsOnly.ts
+import { type Middleware, principal, refuse } from '@abide/abide'
+
+// One rung for a handler's `middleware` and a layout's alike.
+export const adminsOnly: Middleware = async (next) => {
+    const { role } = await principal.resolved
+    return role === 'admin' ? next() : refuse(403, 'Admins only.')
+}
+```
+
 ```ts src/account/lib/ExportContacts.test.ts
 import { expect, test } from 'bun:test'
 
@@ -4278,22 +4282,18 @@ test('sales and a signed-out caller are refused 403', async () => {
 })
 ```
 
-A rung is a `Middleware`: it is handed `next` and the call's context, and either returns `next(ctx)` or answers in the handler's place. Returning `refuse(403, …)` refuses, and neither the handler nor any rung after it runs. A throw escapes every rung rather than unwinding through them.
+A rung is a `Middleware`: it is handed `next` and the call's context, and either returns `next()` or answers in the handler's place. Returning `refuse(403, …)` refuses, and neither the handler nor any rung after it runs. A throw escapes every rung rather than unwinding through them.
 
 The rung sits on the handler, so it runs on every call: from a browser, from another handler, and from a page rendering on the server. It reads arguments through `ctx.args()`, which parses the body on its first call. So a rung that never asks refuses a signed-out caller before their body is parsed or checked.
 
-To guard a whole section, call `middleware(…)` in its `layout.abide`, such as `src/account/admin/layout.abide`. That rung runs over every page and handler below it, and it has the request and nothing else:
+To guard a whole section, call `middleware(…)` in its `layout.abide`, such as `src/account/admin/layout.abide`. That rung runs over every page and handler below it, and it has the request and nothing else. The same `adminsOnly` fits there, and its refusal is painted by the section's `error.abide` over a page and answered as Problem Details over a handler:
 
 ```abide abide
 <script server>
-import { principal } from '@abide/abide'
 import { middleware } from '@abide/abide/server'
+import { adminsOnly } from '#src/account/lib/adminsOnly.ts'
 
-middleware(async (next) => {
-    const { role } = await principal.resolved
-    if (role !== 'admin') return new Response('Admins only.', { status: 403 })
-    return next()
-})
+middleware(adminsOnly)
 </script>
 
 <slot/>
@@ -7776,7 +7776,7 @@ Reactive primitives: what is written in place rather than imported.
 
 | Name | Signature | Meaning | Rules |
 | --- | --- | --- | --- |
-| `Middleware` | `<Ctx, Result>(next: (ctx?: Ctx) => Promise<Result>, ctx: Ctx) => Result \| Promise<Result>` | One rung of `middleware`. | [16.14](/rulebook#16.14), [16.15](/rulebook#16.15), [16.16](/rulebook#16.16), [16.21](/rulebook#16.21) |
+| `Middleware` | `Middleware<Answer = never, Extra extends object = object> = <Given extends { request: Request } & Extra, Result>(next: (ctx?: Given) => Promise<Result>, ctx: Given) => Result \| Answer \| Failed<string, unknown> \| Promise<Result \| Answer \| Failed<string, unknown>>` | One rung, written once for every lane whose context carries `Extra`. | [16.14](/rulebook#16.14), [16.15](/rulebook#16.15), [16.16](/rulebook#16.16), [16.21](/rulebook#16.21), [37.14](/rulebook#37.14), [37.15](/rulebook#37.15) |
 
 ## Taught in
 
@@ -7851,7 +7851,7 @@ Reactive primitives: what is written in place rather than imported.
 | Name | Signature | Meaning | Rules |
 | --- | --- | --- | --- |
 | `description` | `string` | The human description carried onto every generated surface. | [16.28](/rulebook#16.28) |
-| `middleware` | `Middleware<{ request: Request; args: () => Args }, Value \| Failures>[]` | The rungs run per call. | [16.11](/rulebook#16.11), [16.12](/rulebook#16.12), [16.16](/rulebook#16.16), [16.17](/rulebook#16.17), [16.18](/rulebook#16.18), [16.19](/rulebook#16.19), [16.20](/rulebook#16.20) |
+| `middleware` | `((next: (ctx?: { request: Request; args: () => Args }) => Promise<unknown>, ctx: { request: Request; args: () => Args }) => unknown)[]` | The rungs run per call. | [16.11](/rulebook#16.11), [16.12](/rulebook#16.12), [16.16](/rulebook#16.16), [16.17](/rulebook#16.17), [16.18](/rulebook#16.18), [16.19](/rulebook#16.19), [16.20](/rulebook#16.20) |
 | `timeout` | `number` | How long the call may go without progress. | [16.22](/rulebook#16.22), [16.58](/rulebook#16.58), [16.59](/rulebook#16.59), [16.60](/rulebook#16.60), [16.61](/rulebook#16.61), [16.77](/rulebook#16.77) |
 | `clients` | `Clients` | Which surfaces carry this handler. | [16.37](/rulebook#16.37), [20.3](/rulebook#20.3) |
 | `crossOrigin` | `boolean \| string[]` | Whether other origins may call it, or follow it over the mux. | [16.24](/rulebook#16.24), [18.2](/rulebook#18.2), [21.19](/rulebook#21.19) |
@@ -8419,7 +8419,7 @@ Generated surfaces: what is written in place rather than imported.
 | Name | Signature | Meaning | Rules |
 | --- | --- | --- | --- |
 | `claudeCode` | `(config?: ClaudeCodeConfig) => Provider` | The visitor's own Claude Code, reached through the bridge paired with their browser, as a provider. | [44.5](/rulebook#44.5), [44.13](/rulebook#44.13), [44.17](/rulebook#44.17), [44.18](/rulebook#44.18), [44.19](/rulebook#44.19), [44.24](/rulebook#44.24), [44.25](/rulebook#44.25), [44.27](/rulebook#44.27), [44.30](/rulebook#44.30), [44.33](/rulebook#44.33) |
-| `claudeCode.bridgeCommand` | `(options?: { tools?: string[] }) => { command: string; link: string; expires: number }` | The command and the link that pair a bridge with this browser, granting the built-in tools it is given. | [44.14](/rulebook#44.14), [44.32](/rulebook#44.32), [44.33](/rulebook#44.33), [44.40](/rulebook#44.40), [44.41](/rulebook#44.41), [44.42](/rulebook#44.42), [44.43](/rulebook#44.43) |
+| `claudeCode.bridgeCommand` | `(options?: { tools?: string[] }) => { command: string; link: string; expires: number }` | The command and the link that pair a bridge with this browser, granting the built-in tools it is given. | [44.14](/rulebook#44.14), [44.32](/rulebook#44.32), [44.33](/rulebook#44.33), [44.40](/rulebook#44.40), [44.41](/rulebook#44.41), [44.42](/rulebook#44.42), [44.43](/rulebook#44.43), [44.44](/rulebook#44.44) |
 | `claudeCode.bridge` | `(options?: { tools?: string[] }) => AsyncGenerator<BridgeStatus>` | This browser's pairing, as it changes. | [44.20](/rulebook#44.20), [44.22](/rulebook#44.22), [44.32](/rulebook#44.32), [44.33](/rulebook#44.33), [44.34](/rulebook#44.34), [44.40](/rulebook#44.40) |
 | `/__abide/bridge` | `GET`, `POST` | Where a bridge pairs, and is relayed its turns. | [36.7](/rulebook#36.7), [44.14](/rulebook#44.14), [44.15](/rulebook#44.15), [44.19](/rulebook#44.19), [44.23](/rulebook#44.23), [44.26](/rulebook#44.26), [16.57](/rulebook#16.57), [16.78](/rulebook#16.78) |
 
@@ -8977,7 +8977,7 @@ Generated surfaces: what is written in place rather than imported.
 
 | Name | Signature | Meaning | Rules |
 | --- | --- | --- | --- |
-| `csp` | `(sources?: Record<string, string[]>) => Middleware` | The rung that sets `content-security-policy`. | [29.1](/rulebook#29.1), [29.2](/rulebook#29.2), [29.5](/rulebook#29.5), [29.6](/rulebook#29.6), [29.7](/rulebook#29.7), [29.8](/rulebook#29.8) |
+| `csp` | `(sources?: Record<string, string[]>) => (next: (ctx?: { request: Request }) => Promise<Response>, ctx: { request: Request }) => Promise<Response>` | The rung that sets `content-security-policy`. | [29.1](/rulebook#29.1), [29.2](/rulebook#29.2), [29.5](/rulebook#29.5), [29.6](/rulebook#29.6), [29.7](/rulebook#29.7), [29.8](/rulebook#29.8) |
 | `csp.nonce` | `() => string` | This response's nonce, for the app's own inline script. | [29.3](/rulebook#29.3), [29.4](/rulebook#29.4), [29.9](/rulebook#29.9), [29.11](/rulebook#29.11) |
 
 ## Taught in
@@ -9511,7 +9511,7 @@ Configuration: what is written in place rather than imported.
 
 | Name | Signature | Meaning | Rules |
 | --- | --- | --- | --- |
-| `middleware` | `(...rungs: Middleware<{ request: Request }, Response>[]) => () => void` | The per-request lane at the calling file's route. | [18.26](/rulebook#18.26), [37.2](/rulebook#37.2), [37.3](/rulebook#37.3), [37.13](/rulebook#37.13) |
+| `middleware` | `(...rungs: ((next: (ctx?: { request: Request }) => Promise<Response>, ctx: { request: Request }) => Response \| Failed<string, unknown> \| Promise<Response \| Failed<string, unknown>>)[]) => () => void` | The per-request lane at the calling file's route. | [18.26](/rulebook#18.26), [37.2](/rulebook#37.2), [37.3](/rulebook#37.3), [37.13](/rulebook#37.13), [37.14](/rulebook#37.14), [37.15](/rulebook#37.15) |
 
 ## Taught in
 

package/package.json

@@ -1,6 +1,6 @@
 {
     "name": "@abide/abide",
-    "version": "0.121.0",
+    "version": "0.122.0",
     "type": "module",
     "description": "Isomorphic type-safe framework for reactive async interfaces for humans and machines",
     "license": "MIT",

package/src/server/BRIDGE_VERSION.ts

@@ -1,3 +1,3 @@
 // The `abide-bridge` release a pairing command names, so a visitor's `bunx` runs the relay this
 // server speaks. `packages/abide/tests/claudeCode.test.ts` holds it to the bridge package's own.
-export const BRIDGE_VERSION = '0.4.0'
+export const BRIDGE_VERSION = '0.5.0'

package/src/server/answerFailure.ts

@@ -10,6 +10,7 @@ import { coversRoute, parseRoutePattern } from '#shared/routePattern.ts'
 
 import type { AppSources } from './answerRequest.ts'
 import { DOCUMENT_HEADERS } from './DOCUMENT_HEADERS.ts'
+import { prefers } from './prefers.ts'
 import { boundPage, renderDocument } from './render.ts'
 import { beginRender, currentRequestScope } from './requestScope.ts'
 
@@ -100,3 +101,18 @@ export async function answerFailure(
     headers.set('content-type', 'text/plain; charset=utf-8')
     return new Response(failure.message, { status, headers })
 }
+
+/**
+ * A failure at an address whose lane only the request can say: a page's, painted, where it prefers
+ * a document, and a handler's otherwise. 15.22.
+ */
+export function laneFailure(
+    app: ErrorPages,
+    pathname: string,
+    failure: Failed<string, unknown>,
+    request: Request,
+): Response | Promise<Response> {
+    return prefers(request, 'text/html', 'application/json')
+        ? answerFailure(app, pathname, failure)
+        : answered(failure)
+}

package/src/server/answerRequest.ts

@@ -22,7 +22,7 @@ import { DEBUG_META } from '#shared/DEBUG_META.ts'
 import { decodedOrKept } from '#shared/decodedOrKept.ts'
 import { ERROR_META } from '#shared/ERROR_META.ts'
 import { escapeAttribute } from '#shared/escapeText.ts'
-import { type Failed, isFailed } from '#shared/Failed.ts'
+import { isFailed } from '#shared/Failed.ts'
 import { HandlerRoute } from '#shared/HandlerRoute.ts'
 import { health } from '#shared/health.ts'
 import { KEEP_HEADER } from '#shared/KEEP_HEADER.ts'
@@ -45,7 +45,7 @@ import {
 import type { Method, Rpc } from '#shared/rpc.ts'
 import { rpcRequest } from '#shared/rpcRequest.ts'
 
-import { answered, answerFailure } from './answerFailure.ts'
+import { answerFailure, laneFailure } from './answerFailure.ts'
 import {
     answerRpc,
     type Mounted,
@@ -64,12 +64,11 @@ import { settingOn } from './config.ts'
 import { noteCallInRender } from './deferredBuilds.ts'
 import { DOCUMENT_HEADERS } from './DOCUMENT_HEADERS.ts'
 import { answerMcp, openApi } from './generatedSurfaces.ts'
-import { type AppRung, failureOf, rungsOver } from './hooks.ts'
+import { failureOf, type LaneRung, rungsOver } from './hooks.ts'
 import { chunksOf, type Manifest } from './manifestOf.ts'
 import { muxAdmission } from './muxUpgrade.ts'
 import { OFFLINE_STALE } from './OFFLINE_STALE.ts'
 import { plainAnswer } from './plainAnswer.ts'
-import { prefers } from './prefers.ts'
 import { PRINCIPAL_MOUNT } from './principal.ts'
 import {
     boundPage,
@@ -625,7 +624,18 @@ export async function appSources(parts: SourceParts): Promise<AppSources> {
         if (row.page !== undefined)
             row.answers.set(
                 row.page,
-                answerInside(sources, row.page, rungsOver(row.pattern)),
+                answerInside(
+                    sources,
+                    row.page,
+                    // 37.14 — a page's lane paints a refusal as its error page does (35.2).
+                    rungsOver(row.pattern, (failure, request) =>
+                        answerFailure(
+                            sources,
+                            new URL(request.url).pathname,
+                            failure,
+                        ),
+                    ),
+                ),
             )
         for (const handler of row.handlers.values())
             row.answers.set(
@@ -640,7 +650,7 @@ export async function appSources(parts: SourceParts): Promise<AppSources> {
 function answerInside(
     app: AppSources,
     found: Ranked | Mounted,
-    rungs: AppRung[],
+    rungs: LaneRung[],
 ): (ctx: { request: Request }) => Promise<Response> {
     return compose(rungs, ({ request }) => answerMatched(app, request, found))
 }
@@ -774,21 +784,6 @@ async function methodRefused(
     return answer
 }
 
-/**
- * A failure at an address whose lane only the request can say: a page's, painted, where it prefers
- * a document, and a handler's otherwise. 15.22.
- */
-function laneFailure(
-    app: AppSources,
-    pathname: string,
-    failure: Failed<string, unknown>,
-    request: Request,
-): Response | Promise<Response> {
-    return prefers(request, 'text/html', 'application/json')
-        ? answerFailure(app, pathname, failure)
-        : answered(failure)
-}
-
 /**
  * A public file's answer, conditional and range-aware off the etag read at boot.
  *

package/src/server/answerRpc.ts

@@ -44,7 +44,7 @@ import {
     crossingOrigin,
     crossingRefusal,
 } from './crossingOrigin.ts'
-import { type AppRung, failureOf, rungsOver } from './hooks.ts'
+import { failureOf, type LaneRung, rungsOver } from './hooks.ts'
 import { OFFLINE_STALE } from './OFFLINE_STALE.ts'
 import { prefers } from './prefers.ts'
 import {
@@ -120,7 +120,7 @@ export type Mounted = Mount & {
      * The rungs filed over `scope`, read once at mount (16.14) — what an http call and a socket
      * subscription to it both pass through (37.2, 18.26).
      */
-    rungs: AppRung[]
+    rungs: LaneRung[]
     handler: Rpc<unknown, unknown> & Gated<unknown> & HeldToAnnotation
     /**
      * The args' JSON Schema, probed once at mount.
@@ -203,7 +203,8 @@ export async function mountHandlers(
             ...mount,
             // 37.1, 16.72 — the route its file's hooks are filed at, which the build read off
             // where the file answers (23.19's mount for a package's), never its place on disk.
-            rungs: rungsOver(mount.scope),
+            // 37.14 — a handler's lane answers a refusal as Problem Details (15.1).
+            rungs: rungsOver(mount.scope, answered),
             handler,
             argsDocument: declared ?? (mount.args as Document | undefined),
         })

package/src/server/claudeCode.ts

@@ -8,6 +8,7 @@
 // directory, settings — is not an option here at all, and its built-in `tools` are a request the visitor
 // grants or does not: the bridge decides (44.15, 44.16, 44.29).
 
+import { BRIDGE_SCHEME } from '#shared/BRIDGE_SCHEME.ts'
 import { mounted } from '#shared/mount.ts'
 import { refuse } from '#shared/refuse.ts'
 
@@ -19,7 +20,6 @@ import {
     forwardOf,
     type Provider,
 } from './assistant.ts'
-import { BRIDGE_SCHEME } from './BRIDGE_SCHEME.ts'
 import { BRIDGE_VERSION } from './BRIDGE_VERSION.ts'
 import {
     followSignIn,

package/src/server/createApp.ts

@@ -17,6 +17,7 @@ import { PRINCIPAL_HEADER } from '#shared/PRINCIPAL_HEADER.ts'
 import { RPC_SERVER } from '#shared/RPC_SERVER.ts'
 
 import { servedTable } from './abideModules.ts'
+import { laneFailure } from './answerFailure.ts'
 import { answerRequest, type AppSources } from './answerRequest.ts'
 import type { Mount } from './answerRpc.ts'
 import { Mux, type MuxConnection } from './answerSocket.ts'
@@ -278,7 +279,10 @@ export async function bootEntered(
     // 16.14, 37.3 — THE APP LANE'S ONION, composed once over the whole request path: the root
     // route's rungs, the ones below it running after routing (37.2, `answerRequest`). 21.20 — the
     // center takes its own time back out of what `fetch` counts for the whole onion.
-    const rungs = rootRungs()
+    // 37.14 — before routing, the lane is the request's to say (15.22).
+    const rungs = rootRungs((failure, request) =>
+        laneFailure(booted, new URL(request.url).pathname, failure, request),
+    )
     const answer = compose(rungs, async ({ request }) => {
         const began = performance.now()
         const answered = await answerRequest(booted, request)

package/src/server/csp.ts

@@ -5,7 +5,7 @@
 // THE NONCE IS MINTED BY WHICHEVER ASKS FIRST — a page reading `csp.nonce` while it renders, or this
 // rung writing a document's header — so the two agree, and an answer that is not a document mints none.
 
-import type { Middleware } from '#shared/Middleware.ts'
+import type { Rung } from '#shared/Middleware.ts'
 
 import { randomToken } from './randomToken.ts'
 import { EARLY_CALL_HASH } from './render.ts'
@@ -64,7 +64,7 @@ function policy(
 
 export function cspRung(
     sources: Record<string, string[]> | undefined,
-): Middleware<{ request: Request }, Response> {
+): Rung<{ request: Request }, Response> {
     const written = policy(sources)
     return async (next) => {
         const answer = await next()

package/src/server/hooks.ts

@@ -13,7 +13,7 @@
 
 import { type Failed, isFailed } from '#shared/Failed.ts'
 import { namedLogger } from '#shared/log.ts'
-import type { Middleware } from '#shared/Middleware.ts'
+import type { Rung } from '#shared/Middleware.ts'
 import { aborted, refuse } from '#shared/refuse.ts'
 import {
     coversRoute,
@@ -26,7 +26,25 @@ import { config } from './config.ts'
 import type { LauncherOptions } from './launcherOptions.ts'
 import { currentRequestScope } from './requestScope.ts'
 
-export type AppRung = Middleware<{ request: Request }, Response>
+type AppContext = { request: Request }
+
+/** A rung `middleware` files: what `next` answered passed on, or a refusal in its place (37.14). */
+export type AppRung = (
+    next: (ctx?: AppContext) => Promise<Response>,
+    ctx: AppContext,
+) =>
+    | Response
+    | Failed<string, unknown>
+    | Promise<Response | Failed<string, unknown>>
+
+/** An app rung as its lane composes it, a refusal it returned already answered (37.14). */
+export type LaneRung = Rung<AppContext, Response>
+
+/** How a lane answers a refusal one of its rungs returned, in that lane's representation (37.14). */
+export type RefusalAnswer = (
+    failure: Failed<string, unknown>,
+    request: Request,
+) => Response | Promise<Response>
 
 export type Env = Record<string, string | undefined>
 export type ConfigDefaults = (env: Env) => unknown
@@ -106,11 +124,24 @@ export function inOrder<T>(list: readonly Filed<T>[]): T[] {
     return items
 }
 
+/**
+ * `rung` with a refusal it returns answered by `answer`.
+ *
+ * 37.14, 37.15 — PER LINK, not at the onion's edge: a rung outside this one is handed the answer
+ * from `next`, so one that reads a `Response` (29.2's) reads one whichever rung inside it refused.
+ */
+function answering(rung: AppRung, answer: RefusalAnswer): LaneRung {
+    return async (next, ctx) => {
+        const result = await rung(next, ctx)
+        return isFailed(result) ? answer(result, ctx.request) : result
+    }
+}
+
 /** The rungs filed at the root route, which run before routing. 37.3. */
-export function rootRungs(): AppRung[] {
-    const rungs: AppRung[] = []
+export function rootRungs(answer: RefusalAnswer): LaneRung[] {
+    const rungs: LaneRung[] = []
     for (const entry of HOOKS.rungs)
-        if (entry.route === ROOT) rungs.push(entry.item)
+        if (entry.route === ROOT) rungs.push(answering(entry.item, answer))
     return rungs
 }
 
@@ -120,12 +151,12 @@ export function rootRungs(): AppRung[] {
  * 37.2 — every rung filed at `route` or at a route that is its front, the root's aside: those ran
  * before routing (37.3).
  */
-export function rungsOver(route: string): AppRung[] {
+export function rungsOver(route: string, answer: RefusalAnswer): LaneRung[] {
     const segments = parseRoutePattern(route)
-    const rungs: AppRung[] = []
+    const rungs: LaneRung[] = []
     for (const entry of HOOKS.rungs)
         if (entry.route !== ROOT && coversRoute(entry.segments, segments))
-            rungs.push(entry.item)
+            rungs.push(answering(entry.item, answer))
     return rungs
 }
 

package/src/{server → shared}/BRIDGE_SCHEME.ts

@@ -1,3 +1,5 @@
 // 44.40 — the scheme a pairing link is written in, which the handler `abide-bridge install` registers
-// opens. The bridge spells it out as `PAIRING_SCHEME`, and a test holds the two equal.
+// opens. The bridge spells it out as `PAIRING_SCHEME`, and a test holds the two equal. A leaf in
+// #shared because both seams read it: the server mints the link, and 32.20's `safeUrl` lets a page
+// write it into an `href`.
 export const BRIDGE_SCHEME = 'abide-bridge'

package/src/shared/Middleware.ts

@@ -1,7 +1,27 @@
 // ONE RUNG OF AN ONION, and the onion. The app lane's `middleware` (37.3) and a handler's rungs
 // (16.11) are the same shape over a different `Ctx`, so they compose through the one function.
 
-export type Middleware<Ctx, Result> = (
+import type { Failed } from './Failed.ts'
+
+/**
+ * A rung written once for every lane whose context carries `Extra`: generic over the context it is
+ * handed and over what `next` answers, so it passes `next()`'s answer on, refuses in its place, or
+ * answers with an `Answer` of its own.
+ */
+export type Middleware<Answer = never, Extra extends object = object> = <
+    Given extends { request: Request } & Extra,
+    Result,
+>(
+    next: (ctx?: Given) => Promise<Result>,
+    ctx: Given,
+) =>
+    | Result
+    | Answer
+    | Failed<string, unknown>
+    | Promise<Result | Answer | Failed<string, unknown>>
+
+/** A rung as one lane composes it, over that lane's context and what its center answers. */
+export type Rung<Ctx, Result> = (
     next: (ctx?: Ctx) => Promise<Result>,
     ctx: Ctx,
 ) => Result | Promise<Result>
@@ -17,17 +37,17 @@ export type Middleware<Ctx, Result> = (
  * `next()` with no argument hands the inner link the ctx this rung was given.
  */
 export function compose<Ctx, Result>(
-    rungs: readonly Middleware<Ctx, Result>[],
+    rungs: readonly Rung<Ctx, Result>[],
     terminal: (ctx: Ctx) => Promise<Result>,
 ): (ctx: Ctx) => Promise<Result> {
     let link = terminal
     for (let at = rungs.length - 1; at >= 0; at -= 1)
-        link = linkOf(rungs[at] as Middleware<Ctx, Result>, link)
+        link = linkOf(rungs[at] as Rung<Ctx, Result>, link)
     return link
 }
 
 function linkOf<Ctx, Result>(
-    rung: Middleware<Ctx, Result>,
+    rung: Rung<Ctx, Result>,
     inner: (ctx: Ctx) => Promise<Result>,
 ): (ctx: Ctx) => Promise<Result> {
     return async (ctx) => rung((given) => inner(given ?? ctx), ctx)

package/src/shared/attributeText.ts

@@ -10,7 +10,7 @@ import { BOOLEAN_ATTRIBUTES } from './BOOLEAN_ATTRIBUTES.ts'
 import { escapeAttribute } from './escapeText.ts'
 import { RENDER_LOG } from './log.ts'
 import { textOf } from './Raw.ts'
-import { safeUrl } from './safeUrl.ts'
+import { SAFE_SCHEMES, safeUrl } from './safeUrl.ts'
 import { URL_ATTRIBUTES } from './URL_ATTRIBUTES.ts'
 
 /**
@@ -31,7 +31,7 @@ export function attributeText(name: string, value: unknown): string | null {
     const safe = safeUrl(text)
     if (safe !== text)
         RENDER_LOG.warning(
-            `abide: \`${name}\` was handed a URL whose scheme is not http:, https:, mailto:, tel:, blob: or data:, and is written empty. RULEBOOK 32.20.`,
+            `abide: \`${name}\` was handed a URL whose scheme is not one of ${[...SAFE_SCHEMES].join(' ')}, and is written empty. RULEBOOK 32.20.`,
         )
     return safe
 }

package/src/shared/csp.ts

@@ -3,9 +3,9 @@
 // mint one for, so `csp.nonce` answers the one its document was served with, which is what a
 // binding that wrote it on the server hydrates to.
 
-import type { Middleware } from './Middleware.ts'
+import type { Rung as LaneRung } from './Middleware.ts'
 
-type Rung = Middleware<{ request: Request }, Response>
+type Rung = LaneRung<{ request: Request }, Response>
 
 /**
  * The server's content-security-policy half, as slots `#server/installServer.ts` fills from

package/src/shared/rpc.ts

@@ -19,7 +19,7 @@ import { GLOBAL_GETS } from './GLOBAL_GETS.ts'
 import { HandlerRoute } from './HandlerRoute.ts'
 import { IN_PROCESS_ORIGIN } from './IN_PROCESS_ORIGIN.ts'
 import type { Issues } from './Issues.ts'
-import { compose, type Middleware } from './Middleware.ts'
+import { compose, type Rung } from './Middleware.ts'
 import { outbox, type QueuedCall, sendingFor } from './outbox.ts'
 import { principalRotated } from './principalRotated.ts'
 import {
@@ -192,7 +192,7 @@ const SENT: unique symbol = Symbol('abide.sent')
 
 export type RpcOptions<Args = unknown> = {
     description?: string
-    middleware?: Middleware<RpcContext<Args>, unknown>[]
+    middleware?: Rung<RpcContext<Args>, unknown>[]
     timeout?: number
     clients?: Clients
     crossOrigin?: boolean | string[]

package/src/shared/safeUrl.ts

@@ -6,15 +6,22 @@
 //
 // The warning on `abide:render` the clause also asks for is `attributeText`'s, which knows the
 // attribute's name.
+//
+// `abide-bridge:` IS IN THE SET because abide mints it: a pairing's `link` (44.40) is written into an
+// `href` or the visitor cannot open it, and the docs' own pairing page does exactly that. It is the
+// one scheme, not custom schemes generally — what it opens asks the visitor before it does anything,
+// every time, naming the site it pairs with (44.42), so a link from anywhere can do no more than ask.
+import { BRIDGE_SCHEME } from './BRIDGE_SCHEME.ts'
 import { textOf } from './Raw.ts'
 
-const SAFE_SCHEMES = new Set([
+export const SAFE_SCHEMES = new Set([
     'http:',
     'https:',
     'mailto:',
     'tel:',
     'blob:',
     'data:',
+    `${BRIDGE_SCHEME}:`,
 ])
 
 /** A URL attribute's text, or `''` where its scheme is outside the safe set. */