@fougere/app 0.5.0-alpha.1 → 0.7.0-alpha.0

package/dist/serve.d.ts

@@ -1,16 +1,4 @@
-/**
- * The three doors, decided — and nothing about how a request arrives.
- *
- * A host (Nuxt, Next) owns exactly two translations: read the request into the
- * plain values below, and write the outcome back out. Everything between — which
- * operation a verb and a path name, which audience a segment selects, what a
- * refusal becomes — is decided here, once, for every host.
- *
- * The split matters because the alternative was measured in this repo: two copies
- * of a REST rule drifted until the Nuxt door answered differently from
- * `schema-rest` on the verb, the path AND the exposure. A second host would have
- * been a third copy.
- */
+/** The three doors, decided — and nothing about how a request arrives. */
 import { type App, type FrondCall, type InvocationContext } from '@fougere/core';
 /** What a host must read off the request before any decision is possible. */
 export interface DoorRequest {
@@ -19,11 +7,7 @@ export interface DoorRequest {
     path: string;
     query: Record<string, string>;
     body?: unknown;
-    /**
-     * The server-resolved session. Stamped by the host from what IT resolved —
-     * never taken from the wire, which is the whole trust boundary of the browser
-     * door (`transport/http/src/server.ts` carries the same warning for the split).
-     */
+    /** The server-resolved session. */
     state: Record<string, unknown>;
 }
 /** What a host must write back. `pass` is the one that keeps a door additive. */
@@ -43,27 +27,12 @@ export type Outcome =
     } & Record<string, unknown>;
     headers?: Record<string, string>;
 };
-/**
- * The audience this door serves — the path segment after `/_fougere/call`.
- *
- * The envelope is a surface like REST and GraphQL, so it selects its audience like
- * they do; the difference is only that it takes it from the path instead of an
- * option, because a door is mounted, not called. The same word names the directory
- * (`handlers/public/`), the config key (`surfaces: { public: [...] }`) and this
- * segment — derived, never configured.
- *
- * No escalation to guard: a named surface serves the entities it names and nothing
- * else (closed by naming), so every one of them is a subset of what the bare path
- * already serves.
- */
+/** The audience this door serves — the path segment after `/_fougere/call`. */
 export declare function surfaceOf(path: string): string | undefined;
 /**
- * Receiving end for the browser — same wire as process-to-process (JSON-RPC),
- * different trust boundary: the browser sits outside the topology, so `state` is
- * whatever the host resolved server-side, never what the payload claims.
- *
- * The runner follows the app's topology: local façades and remote doublures alike
- * — the browser never knows where a Frond lives.
+ * Receiving end for the browser — same wire as process-to-process (JSON-RPC), different trust
+ * boundary: the browser sits outside the topology, so `state` is whatever the host resolved
+ * server-side, never what the payload claims.
  */
 export declare function serveRpc(app: App, request: Pick<DoorRequest, 'path' | 'body' | 'state'>): Promise<unknown>;
 /** The answer a host returns when it could not even parse the payload. */
@@ -76,34 +45,18 @@ export declare function rpcParseError(): {
     };
 };
 /**
- * Match the URL against the canonical table, invoke the call it names, shape the
- * result for HTTP. The decision lives in `rest.ts`; dispatch belongs to the runner.
- *
- * `path` is what follows the REST mount point, so `/api/blog/posts/1` arrives as
- * `blog/posts/1`. A path this door does not serve returns `pass`, and that is what
- * lets an app keep its own `/api/*` handlers.
+ * Match the URL against the canonical table, invoke the call it names, shape the result for HTTP.
  */
 export declare function serveRest(app: App, request: DoorRequest): Promise<Outcome>;
-/**
- * What an operation's return becomes on the wire.
- *
- * Separate from `serveRest` because it is a DECISION and dispatch is not: it can be
- * pinned without a runner, and both hosts get it whether the call ran in memory or
- * came back over JSON-RPC.
- */
+/** What an operation's return becomes on the wire. */
 export declare function shapeRest(operationName: string, result: unknown): Outcome;
 type EntityClass = {
     name: string;
 };
 type CallInput = Partial<InvocationContext>;
 /**
- * Name a call server-side and let the runner place it — local façade → direct
- * in-memory execution, a frond in `remotes` → JSON-RPC on the wire. The caller
- * never knows which.
- *
- * `state` is explicit here. Each host wraps this with its own way of finding the
- * current request (Nitro's async context, Next's `headers()` scope), because that
- * is the one part a host actually owns.
+ * Name a call server-side and let the runner place it — local façade → direct in-memory execution,
+ * a frond in `remotes` → JSON-RPC on the wire.
  */
 export declare function invokeOn<T = unknown>(app: App, target: EntityClass | FrondCall, opOrInput?: string | CallInput, input?: CallInput, state?: Record<string, unknown>): Promise<T>;
 export {};

package/dist/serve.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"serve.d.ts","sourceRoot":"","sources":["../src/serve.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AACH,OAAO,EAIL,KAAK,GAAG,EACR,KAAK,SAAS,EACd,KAAK,iBAAiB,EACvB,MAAM,eAAe,CAAC;AAIvB,6EAA6E;AAC7E,MAAM,WAAW,WAAW;IAC1B,MAAM,EAAE,MAAM,CAAC;IACf,6EAA6E;IAC7E,IAAI,EAAE,MAAM,CAAC;IACb,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAC9B,IAAI,CAAC,EAAE,OAAO,CAAC;IACf;;;;OAIG;IACH,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CAChC;AAED,iFAAiF;AACjF,MAAM,MAAM,OAAO;AACjB,uEAAuE;AACrE;IAAE,IAAI,EAAE,MAAM,CAAA;CAAE,GAChB;IAAE,IAAI,EAAE,IAAI,CAAC;IAAC,MAAM,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,OAAO,CAAA;CAAE,GAC7C;IAAE,IAAI,EAAE,OAAO,CAAC;IAAC,MAAM,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE;QAAE,OAAO,EAAE,MAAM,CAAA;KAAE,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAAC,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAA;CAAE,CAAC;AAI7H;;;;;;;;;;;;GAYG;AACH,wBAAgB,SAAS,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS,CAG1D;AAED;;;;;;;GAOG;AACH,wBAAsB,QAAQ,CAAC,GAAG,EAAE,GAAG,EAAE,OAAO,EAAE,IAAI,CAAC,WAAW,EAAE,MAAM,GAAG,MAAM,GAAG,OAAO,CAAC,GAAG,OAAO,CAAC,OAAO,CAAC,CAGhH;AAED,0EAA0E;AAC1E,wBAAgB,aAAa;aACT,KAAK;;;;;;EACxB;AAID;;;;;;;GAOG;AACH,wBAAsB,SAAS,CAAC,GAAG,EAAE,GAAG,EAAE,OAAO,EAAE,WAAW,GAAG,OAAO,CAAC,OAAO,CAAC,CAyChF;AAED;;;;;;GAMG;AACH,wBAAgB,SAAS,CAAC,aAAa,EAAE,MAAM,EAAE,MAAM,EAAE,OAAO,GAAG,OAAO,CAkBzE;AAID,KAAK,WAAW,GAAG;IAAE,IAAI,EAAE,MAAM,CAAA;CAAE,CAAC;AACpC,KAAK,SAAS,GAAG,OAAO,CAAC,iBAAiB,CAAC,CAAC;AAE5C;;;;;;;;GAQG;AACH,wBAAsB,QAAQ,CAAC,CAAC,GAAG,OAAO,EACxC,GAAG,EAAE,GAAG,EACR,MAAM,EAAE,WAAW,GAAG,SAAS,EAC/B,SAAS,CAAC,EAAE,MAAM,GAAG,SAAS,EAC9B,KAAK,CAAC,EAAE,SAAS,EACjB,KAAK,GAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAM,GAClC,OAAO,CAAC,CAAC,CAAC,CAMZ"}
+{"version":3,"file":"serve.d.ts","sourceRoot":"","sources":["../src/serve.ts"],"names":[],"mappings":"AAAA,0EAA0E;AAC1E,OAAO,EAIL,KAAK,GAAG,EACR,KAAK,SAAS,EACd,KAAK,iBAAiB,EACvB,MAAM,eAAe,CAAC;AAIvB,6EAA6E;AAC7E,MAAM,WAAW,WAAW;IAC1B,MAAM,EAAE,MAAM,CAAC;IACf,6EAA6E;IAC7E,IAAI,EAAE,MAAM,CAAC;IACb,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAC9B,IAAI,CAAC,EAAE,OAAO,CAAC;IACf,mCAAmC;IACnC,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CAChC;AAED,iFAAiF;AACjF,MAAM,MAAM,OAAO;AACjB,uEAAuE;AACrE;IAAE,IAAI,EAAE,MAAM,CAAA;CAAE,GAChB;IAAE,IAAI,EAAE,IAAI,CAAC;IAAC,MAAM,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,OAAO,CAAA;CAAE,GAC7C;IAAE,IAAI,EAAE,OAAO,CAAC;IAAC,MAAM,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE;QAAE,OAAO,EAAE,MAAM,CAAA;KAAE,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAAC,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAA;CAAE,CAAC;AAI7H,+EAA+E;AAC/E,wBAAgB,SAAS,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS,CAG1D;AAED;;;;GAIG;AACH,wBAAsB,QAAQ,CAAC,GAAG,EAAE,GAAG,EAAE,OAAO,EAAE,IAAI,CAAC,WAAW,EAAE,MAAM,GAAG,MAAM,GAAG,OAAO,CAAC,GAAG,OAAO,CAAC,OAAO,CAAC,CAGhH;AAED,0EAA0E;AAC1E,wBAAgB,aAAa;aACT,KAAK;;;;;;EACxB;AAID;;GAEG;AACH,wBAAsB,SAAS,CAAC,GAAG,EAAE,GAAG,EAAE,OAAO,EAAE,WAAW,GAAG,OAAO,CAAC,OAAO,CAAC,CAyChF;AAED,sDAAsD;AACtD,wBAAgB,SAAS,CAAC,aAAa,EAAE,MAAM,EAAE,MAAM,EAAE,OAAO,GAAG,OAAO,CAkBzE;AAID,KAAK,WAAW,GAAG;IAAE,IAAI,EAAE,MAAM,CAAA;CAAE,CAAC;AACpC,KAAK,SAAS,GAAG,OAAO,CAAC,iBAAiB,CAAC,CAAC;AAE5C;;;GAGG;AACH,wBAAsB,QAAQ,CAAC,CAAC,GAAG,OAAO,EACxC,GAAG,EAAE,GAAG,EACR,MAAM,EAAE,WAAW,GAAG,SAAS,EAC/B,SAAS,CAAC,EAAE,MAAM,GAAG,SAAS,EAC9B,KAAK,CAAC,EAAE,SAAS,EACjB,KAAK,GAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAM,GAClC,OAAO,CAAC,CAAC,CAAC,CAMZ"}

package/dist/serve.js

@@ -1,44 +1,17 @@
-/**
- * The three doors, decided — and nothing about how a request arrives.
- *
- * A host (Nuxt, Next) owns exactly two translations: read the request into the
- * plain values below, and write the outcome back out. Everything between — which
- * operation a verb and a path name, which audience a segment selects, what a
- * refusal becomes — is decided here, once, for every host.
- *
- * The split matters because the alternative was measured in this repo: two copies
- * of a REST rule drifted until the Nuxt door answered differently from
- * `schema-rest` on the verb, the path AND the exposure. A second host would have
- * been a third copy.
- */
+/** The three doors, decided — and nothing about how a request arrives. */
 import { createAppRunner, callValueOf, toHttpError, } from '@fougere/core';
 import { handleRpc, PARSE_ERROR } from '@fougere/transport-http';
 import { matchRoute, tableOf } from './rest.js';
 // ── The call envelope ────────────────────────────
-/**
- * The audience this door serves — the path segment after `/_fougere/call`.
- *
- * The envelope is a surface like REST and GraphQL, so it selects its audience like
- * they do; the difference is only that it takes it from the path instead of an
- * option, because a door is mounted, not called. The same word names the directory
- * (`handlers/public/`), the config key (`surfaces: { public: [...] }`) and this
- * segment — derived, never configured.
- *
- * No escalation to guard: a named surface serves the entities it names and nothing
- * else (closed by naming), so every one of them is a subset of what the bare path
- * already serves.
- */
+/** The audience this door serves — the path segment after `/_fougere/call`. */
 export function surfaceOf(path) {
     const named = /^\/_fougere\/call\/([A-Za-z0-9_-]+)/.exec(path.replace(/\?.*$/, ''));
     return named?.[1];
 }
 /**
- * Receiving end for the browser — same wire as process-to-process (JSON-RPC),
- * different trust boundary: the browser sits outside the topology, so `state` is
- * whatever the host resolved server-side, never what the payload claims.
- *
- * The runner follows the app's topology: local façades and remote doublures alike
- * — the browser never knows where a Frond lives.
+ * Receiving end for the browser — same wire as process-to-process (JSON-RPC), different trust
+ * boundary: the browser sits outside the topology, so `state` is whatever the host resolved
+ * server-side, never what the payload claims.
  */
 export async function serveRpc(app, request) {
     const runner = createAppRunner(app, surfaceOf(request.path));
@@ -50,12 +23,7 @@ export function rpcParseError() {
 }
 // ── REST ─────────────────────────────────────────
 /**
- * Match the URL against the canonical table, invoke the call it names, shape the
- * result for HTTP. The decision lives in `rest.ts`; dispatch belongs to the runner.
- *
- * `path` is what follows the REST mount point, so `/api/blog/posts/1` arrives as
- * `blog/posts/1`. A path this door does not serve returns `pass`, and that is what
- * lets an app keep its own `/api/*` handlers.
+ * Match the URL against the canonical table, invoke the call it names, shape the result for HTTP.
  */
 export async function serveRest(app, request) {
     // The app decides, not the host. A route file may exist and a middleware may be
@@ -84,7 +52,7 @@ export async function serveRest(app, request) {
     const { route, params } = match;
     let result;
     try {
-        result = await invokeOn(app, { entity: route.entityName, op: route.operationName }, { params, query: request.query, body: request.body }, undefined, request.state);
+        result = await invokeOn(app, { entity: route.entityName, op: route.operationName }, { params, query: request.query, input: request.body }, undefined, request.state);
     }
     catch (err) {
         const { status, body } = toHttpError(err);
@@ -92,13 +60,7 @@ export async function serveRest(app, request) {
     }
     return shapeRest(route.operationName, result);
 }
-/**
- * What an operation's return becomes on the wire.
- *
- * Separate from `serveRest` because it is a DECISION and dispatch is not: it can be
- * pinned without a runner, and both hosts get it whether the call ran in memory or
- * came back over JSON-RPC.
- */
+/** What an operation's return becomes on the wire. */
 export function shapeRest(operationName, result) {
     if (result === null)
         return { kind: 'error', status: 404, body: { message: 'Not found' } };
@@ -118,19 +80,14 @@ export function shapeRest(operationName, result) {
     return { kind: 'ok', status: 200, body: result };
 }
 /**
- * Name a call server-side and let the runner place it — local façade → direct
- * in-memory execution, a frond in `remotes` → JSON-RPC on the wire. The caller
- * never knows which.
- *
- * `state` is explicit here. Each host wraps this with its own way of finding the
- * current request (Nitro's async context, Next's `headers()` scope), because that
- * is the one part a host actually owns.
+ * Name a call server-side and let the runner place it — local façade → direct in-memory execution,
+ * a frond in `remotes` → JSON-RPC on the wire.
  */
 export async function invokeOn(app, target, opOrInput, input, state = {}) {
     const { call, invocation } = callValueOf(target, opOrInput, input);
     // An explicit `state` on the input wins over the request's — the caller who spells
     // it is answering for it, which is what makes a call outside any request possible.
-    const given = typeof opOrInput === 'string' ? input : opOrInput;
-    return (await createAppRunner(app)(call, { ...invocation, state: given?.state ?? state }));
+    const explicit = typeof opOrInput === 'string' ? input : opOrInput;
+    return (await createAppRunner(app)(call, { ...invocation, state: explicit?.state ?? state }));
 }
 //# sourceMappingURL=serve.js.map

package/dist/serve.js.map

@@ -1 +1 @@
-{"version":3,"file":"serve.js","sourceRoot":"","sources":["../src/serve.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AACH,OAAO,EACL,eAAe,EACf,WAAW,EACX,WAAW,GAIZ,MAAM,eAAe,CAAC;AACvB,OAAO,EAAE,SAAS,EAAE,WAAW,EAAE,MAAM,yBAAyB,CAAC;AACjE,OAAO,EAAE,UAAU,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAwBhD,oDAAoD;AAEpD;;;;;;;;;;;;GAYG;AACH,MAAM,UAAU,SAAS,CAAC,IAAY;IACpC,MAAM,KAAK,GAAG,qCAAqC,CAAC,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC,CAAC;IACpF,OAAO,KAAK,EAAE,CAAC,CAAC,CAAC,CAAC;AACpB,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,CAAC,KAAK,UAAU,QAAQ,CAAC,GAAQ,EAAE,OAAqD;IAC5F,MAAM,MAAM,GAAG,eAAe,CAAC,GAAG,EAAE,SAAS,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC;IAC7D,OAAO,SAAS,CAAC,CAAC,IAAI,EAAE,UAAU,EAAE,EAAE,CAAC,MAAM,CAAC,IAAI,EAAE,EAAE,GAAG,UAAU,EAAE,KAAK,EAAE,OAAO,CAAC,KAAK,EAAE,CAAC,EAAE,OAAO,CAAC,IAAI,CAAC,CAAC;AAC9G,CAAC;AAED,0EAA0E;AAC1E,MAAM,UAAU,aAAa;IAC3B,OAAO,EAAE,OAAO,EAAE,KAAc,EAAE,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,WAAW,EAAE,OAAO,EAAE,aAAa,EAAE,EAAE,CAAC;AACrG,CAAC;AAED,oDAAoD;AAEpD;;;;;;;GAOG;AACH,MAAM,CAAC,KAAK,UAAU,SAAS,CAAC,GAAQ,EAAE,OAAoB;IAC5D,gFAAgF;IAChF,iFAAiF;IACjF,oFAAoF;IACpF,IAAI,CAAC,GAAG,CAAC,QAAQ,EAAE,IAAI;QAAE,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC;IAEjD,MAAM,QAAQ,GAAG,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;IACzD,IAAI,QAAQ,CAAC,MAAM,GAAG,CAAC;QAAE,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC;IAEjD,MAAM,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,WAAW,EAAE,CAAC;IAC5C,MAAM,KAAK,GAAG,UAAU,CAAC,OAAO,CAAC,GAAG,CAAC,EAAE,MAAM,EAAE,QAAQ,CAAC,CAAC;IACzD,IAAI,CAAC,KAAK;QAAE,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC;IAEpC,IAAI,KAAK,CAAC,IAAI,KAAK,oBAAoB,EAAE,CAAC;QACxC,OAAO;YACL,IAAI,EAAE,OAAO;YACb,MAAM,EAAE,GAAG;YACX,IAAI,EAAE;gBACJ,OAAO,EAAE,UAAU,MAAM,oBAAoB,OAAO,CAAC,IAAI,UAAU,KAAK,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE;gBAC3F,KAAK,EAAE,KAAK,CAAC,KAAK;aACnB;YACD,OAAO,EAAE,EAAE,KAAK,EAAE,KAAK,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE;SAC3C,CAAC;IACJ,CAAC;IAED,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,GAAG,KAAK,CAAC;IAChC,IAAI,MAAe,CAAC;IACpB,IAAI,CAAC;QACH,MAAM,GAAG,MAAM,QAAQ,CACrB,GAAG,EACH,EAAE,MAAM,EAAE,KAAK,CAAC,UAAU,EAAE,EAAE,EAAE,KAAK,CAAC,aAAa,EAAE,EACrD,EAAE,MAAM,EAAE,KAAK,EAAE,OAAO,CAAC,KAAK,EAAE,IAAI,EAAE,OAAO,CAAC,IAAI,EAAE,EACpD,SAAS,EACT,OAAO,CAAC,KAAK,CACd,CAAC;IACJ,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,GAAG,WAAW,CAAC,GAAG,CAAC,CAAC;QAC1C,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,IAAqD,EAAE,CAAC;IAChG,CAAC;IAED,OAAO,SAAS,CAAC,KAAK,CAAC,aAAa,EAAE,MAAM,CAAC,CAAC;AAChD,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,SAAS,CAAC,aAAqB,EAAE,MAAe;IAC9D,IAAI,MAAM,KAAK,IAAI;QAAE,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,MAAM,EAAE,GAAG,EAAE,IAAI,EAAE,EAAE,OAAO,EAAE,WAAW,EAAE,EAAE,CAAC;IAE3F,oFAAoF;IACpF,6EAA6E;IAC7E,IAAI,aAAa,KAAK,MAAM,IAAI,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC;QACtD,MAAM,IAAI,GAAG,MAA8E,CAAC;QAC5F,OAAO;YACL,IAAI,EAAE,IAAI;YACV,MAAM,EAAE,GAAG;YACX,IAAI,EAAE,EAAE,KAAK,EAAE,CAAC,GAAG,MAAM,CAAC,EAAE,KAAK,EAAE,IAAI,CAAC,KAAK,EAAE,OAAO,EAAE,IAAI,CAAC,OAAO,EAAE,SAAS,EAAE,IAAI,CAAC,SAAS,EAAE;SAClG,CAAC;IACJ,CAAC;IAED,oFAAoF;IACpF,oFAAoF;IACpF,6EAA6E;IAC7E,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,MAAM,EAAE,GAAG,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC;AACnD,CAAC;AAOD;;;;;;;;GAQG;AACH,MAAM,CAAC,KAAK,UAAU,QAAQ,CAC5B,GAAQ,EACR,MAA+B,EAC/B,SAA8B,EAC9B,KAAiB,EACjB,KAAK,GAA4B,EAAE;IAEnC,MAAM,EAAE,IAAI,EAAE,UAAU,EAAE,GAAG,WAAW,CAAC,MAAM,EAAE,SAAS,EAAE,KAAK,CAAC,CAAC;IACnE,mFAAmF;IACnF,mFAAmF;IACnF,MAAM,KAAK,GAAG,OAAO,SAAS,KAAK,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,SAAS,CAAC;IAChE,OAAO,CAAC,MAAM,eAAe,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,GAAG,UAAU,EAAE,KAAK,EAAE,KAAK,EAAE,KAAK,IAAI,KAAK,EAAE,CAAC,CAAM,CAAC;AAClG,CAAC"}
+{"version":3,"file":"serve.js","sourceRoot":"","sources":["../src/serve.ts"],"names":[],"mappings":"AAAA,0EAA0E;AAC1E,OAAO,EACL,eAAe,EACf,WAAW,EACX,WAAW,GAIZ,MAAM,eAAe,CAAC;AACvB,OAAO,EAAE,SAAS,EAAE,WAAW,EAAE,MAAM,yBAAyB,CAAC;AACjE,OAAO,EAAE,UAAU,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAoBhD,oDAAoD;AAEpD,+EAA+E;AAC/E,MAAM,UAAU,SAAS,CAAC,IAAY;IACpC,MAAM,KAAK,GAAG,qCAAqC,CAAC,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC,CAAC;IACpF,OAAO,KAAK,EAAE,CAAC,CAAC,CAAC,CAAC;AACpB,CAAC;AAED;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,QAAQ,CAAC,GAAQ,EAAE,OAAqD;IAC5F,MAAM,MAAM,GAAG,eAAe,CAAC,GAAG,EAAE,SAAS,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC;IAC7D,OAAO,SAAS,CAAC,CAAC,IAAI,EAAE,UAAU,EAAE,EAAE,CAAC,MAAM,CAAC,IAAI,EAAE,EAAE,GAAG,UAAU,EAAE,KAAK,EAAE,OAAO,CAAC,KAAK,EAAE,CAAC,EAAE,OAAO,CAAC,IAAI,CAAC,CAAC;AAC9G,CAAC;AAED,0EAA0E;AAC1E,MAAM,UAAU,aAAa;IAC3B,OAAO,EAAE,OAAO,EAAE,KAAc,EAAE,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,WAAW,EAAE,OAAO,EAAE,aAAa,EAAE,EAAE,CAAC;AACrG,CAAC;AAED,oDAAoD;AAEpD;;GAEG;AACH,MAAM,CAAC,KAAK,UAAU,SAAS,CAAC,GAAQ,EAAE,OAAoB;IAC5D,gFAAgF;IAChF,iFAAiF;IACjF,oFAAoF;IACpF,IAAI,CAAC,GAAG,CAAC,QAAQ,EAAE,IAAI;QAAE,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC;IAEjD,MAAM,QAAQ,GAAG,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;IACzD,IAAI,QAAQ,CAAC,MAAM,GAAG,CAAC;QAAE,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC;IAEjD,MAAM,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,WAAW,EAAE,CAAC;IAC5C,MAAM,KAAK,GAAG,UAAU,CAAC,OAAO,CAAC,GAAG,CAAC,EAAE,MAAM,EAAE,QAAQ,CAAC,CAAC;IACzD,IAAI,CAAC,KAAK;QAAE,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC;IAEpC,IAAI,KAAK,CAAC,IAAI,KAAK,oBAAoB,EAAE,CAAC;QACxC,OAAO;YACL,IAAI,EAAE,OAAO;YACb,MAAM,EAAE,GAAG;YACX,IAAI,EAAE;gBACJ,OAAO,EAAE,UAAU,MAAM,oBAAoB,OAAO,CAAC,IAAI,UAAU,KAAK,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE;gBAC3F,KAAK,EAAE,KAAK,CAAC,KAAK;aACnB;YACD,OAAO,EAAE,EAAE,KAAK,EAAE,KAAK,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE;SAC3C,CAAC;IACJ,CAAC;IAED,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,GAAG,KAAK,CAAC;IAChC,IAAI,MAAe,CAAC;IACpB,IAAI,CAAC;QACH,MAAM,GAAG,MAAM,QAAQ,CACrB,GAAG,EACH,EAAE,MAAM,EAAE,KAAK,CAAC,UAAU,EAAE,EAAE,EAAE,KAAK,CAAC,aAAa,EAAE,EACrD,EAAE,MAAM,EAAE,KAAK,EAAE,OAAO,CAAC,KAAK,EAAE,KAAK,EAAE,OAAO,CAAC,IAAI,EAAE,EACrD,SAAS,EACT,OAAO,CAAC,KAAK,CACd,CAAC;IACJ,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,GAAG,WAAW,CAAC,GAAG,CAAC,CAAC;QAC1C,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,IAAqD,EAAE,CAAC;IAChG,CAAC;IAED,OAAO,SAAS,CAAC,KAAK,CAAC,aAAa,EAAE,MAAM,CAAC,CAAC;AAChD,CAAC;AAED,sDAAsD;AACtD,MAAM,UAAU,SAAS,CAAC,aAAqB,EAAE,MAAe;IAC9D,IAAI,MAAM,KAAK,IAAI;QAAE,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,MAAM,EAAE,GAAG,EAAE,IAAI,EAAE,EAAE,OAAO,EAAE,WAAW,EAAE,EAAE,CAAC;IAE3F,oFAAoF;IACpF,6EAA6E;IAC7E,IAAI,aAAa,KAAK,MAAM,IAAI,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC;QACtD,MAAM,IAAI,GAAG,MAA8E,CAAC;QAC5F,OAAO;YACL,IAAI,EAAE,IAAI;YACV,MAAM,EAAE,GAAG;YACX,IAAI,EAAE,EAAE,KAAK,EAAE,CAAC,GAAG,MAAM,CAAC,EAAE,KAAK,EAAE,IAAI,CAAC,KAAK,EAAE,OAAO,EAAE,IAAI,CAAC,OAAO,EAAE,SAAS,EAAE,IAAI,CAAC,SAAS,EAAE;SAClG,CAAC;IACJ,CAAC;IAED,oFAAoF;IACpF,oFAAoF;IACpF,6EAA6E;IAC7E,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,MAAM,EAAE,GAAG,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC;AACnD,CAAC;AAOD;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,QAAQ,CAC5B,GAAQ,EACR,MAA+B,EAC/B,SAA8B,EAC9B,KAAiB,EACjB,KAAK,GAA4B,EAAE;IAEnC,MAAM,EAAE,IAAI,EAAE,UAAU,EAAE,GAAG,WAAW,CAAC,MAAM,EAAE,SAAS,EAAE,KAAK,CAAC,CAAC;IACnE,mFAAmF;IACnF,mFAAmF;IACnF,MAAM,QAAQ,GAAG,OAAO,SAAS,KAAK,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,SAAS,CAAC;IACnE,OAAO,CAAC,MAAM,eAAe,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,GAAG,UAAU,EAAE,KAAK,EAAE,QAAQ,EAAE,KAAK,IAAI,KAAK,EAAE,CAAC,CAAM,CAAC;AACrG,CAAC"}

package/dist/session.d.ts

@@ -1,11 +1,6 @@
 /**
- * The session view — the one place that turns the server-resolved
- * request context (filled by the auth middleware) into what the client
- * is allowed to see. One resolution, three readers: the page by
- * hydration, the refresh route over the wire, handlers by invocation.
- *
- * The app-declared context (viewer enrichment) will attach here when
- * a real case lands — this function is the seam.
+ * The session view — the one place that turns the server-resolved request context (filled by the
+ * auth middleware) into what the client is allowed to see.
  */
 export interface SessionView {
     user: Record<string, unknown> | null;

package/dist/session.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"session.d.ts","sourceRoot":"","sources":["../src/session.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAEH,MAAM,WAAW,WAAW;IAC1B,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,IAAI,CAAC;CACtC;AAED,wBAAgB,aAAa,CAAC,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,WAAW,CAK3E"}
+{"version":3,"file":"session.d.ts","sourceRoot":"","sources":["../src/session.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH,MAAM,WAAW,WAAW;IAC1B,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,IAAI,CAAC;CACtC;AAED,wBAAgB,aAAa,CAAC,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,WAAW,CAK3E"}

package/dist/session.js

@@ -1,11 +1,6 @@
 /**
- * The session view — the one place that turns the server-resolved
- * request context (filled by the auth middleware) into what the client
- * is allowed to see. One resolution, three readers: the page by
- * hydration, the refresh route over the wire, handlers by invocation.
- *
- * The app-declared context (viewer enrichment) will attach here when
- * a real case lands — this function is the seam.
+ * The session view — the one place that turns the server-resolved request context (filled by the
+ * auth middleware) into what the client is allowed to see.
  */
 export function sessionViewOf(context) {
     const raw = context.user;

package/dist/session.js.map

@@ -1 +1 @@
-{"version":3,"file":"session.js","sourceRoot":"","sources":["../src/session.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAMH,MAAM,UAAU,aAAa,CAAC,OAAgC;IAC5D,MAAM,GAAG,GAAG,OAAO,CAAC,IAA2C,CAAC;IAChE,IAAI,CAAC,GAAG;QAAE,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC;IAChC,MAAM,EAAE,YAAY,EAAE,aAAa,EAAE,GAAG,IAAI,EAAE,GAAG,GAAG,CAAC;IACrD,OAAO,EAAE,IAAI,EAAE,CAAC;AAClB,CAAC"}
+{"version":3,"file":"session.js","sourceRoot":"","sources":["../src/session.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAMH,MAAM,UAAU,aAAa,CAAC,OAAgC;IAC5D,MAAM,GAAG,GAAG,OAAO,CAAC,IAA2C,CAAC;IAChE,IAAI,CAAC,GAAG;QAAE,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC;IAChC,MAAM,EAAE,YAAY,EAAE,aAAa,EAAE,GAAG,IAAI,EAAE,GAAG,GAAG,CAAC;IACrD,OAAO,EAAE,IAAI,EAAE,CAAC;AAClB,CAAC"}

package/dist/state.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"state.d.ts","sourceRoot":"","sources":["../src/state.ts"],"names":[],"mappings":"AAiBA,mGAAmG;AACnG,wBAAsB,QAAQ,CAAC,OAAO,EAAE,OAAO,GAAG,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAcjF"}
+{"version":3,"file":"state.d.ts","sourceRoot":"","sources":["../src/state.ts"],"names":[],"mappings":"AAOA,mGAAmG;AACnG,wBAAsB,QAAQ,CAAC,OAAO,EAAE,OAAO,GAAG,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAcjF"}

package/dist/state.js

@@ -1,14 +1,4 @@
-/**
- * Who the caller is, resolved server-side from the request's own headers.
- *
- * Nuxt answers this with a Nitro middleware that stamps `event.context`; a
- * Web-standard host has no such seam on a route handler, so it resolves here
- * instead. Same source (the auth runtime mounted on `app.auth`), same result shape
- * (`{ user, session }`), so `serveRpc` and `serveRest` cannot tell hosts apart.
- *
- * What must stay true in both: this is what the SERVER resolved. A browser sits
- * outside the topology, so nothing here may come from the payload.
- */
+/** Who the caller is, resolved server-side from the request's own headers. */
 import { useFougereApp } from './boot.js';
 /** The request state for these headers. Empty when no auth is declared, or nobody is signed in. */
 export async function stateFor(headers) {

package/dist/state.js.map

@@ -1 +1 @@
-{"version":3,"file":"state.js","sourceRoot":"","sources":["../src/state.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AACH,OAAO,EAAE,aAAa,EAAE,MAAM,WAAW,CAAC;AAM1C,mGAAmG;AACnG,MAAM,CAAC,KAAK,UAAU,QAAQ,CAAC,OAAgB;IAC7C,MAAM,GAAG,GAAG,MAAM,aAAa,EAAE,CAAC;IAClC,IAAI,CAAC,GAAG,CAAC,IAAI;QAAE,OAAO,EAAE,CAAC;IACzB,wFAAwF;IACxF,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,QAAQ,CAAC;QAAE,OAAO,EAAE,CAAC;IAEtC,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,MAAO,GAAG,CAAC,IAAI,CAAC,GAA6B,CAAC,UAAU,CAAC,EAAE,OAAO,EAAE,CAAC,CAAC;QACrF,IAAI,MAAM,EAAE,OAAO,IAAI,MAAM,EAAE,IAAI;YAAE,OAAO,EAAE,IAAI,EAAE,MAAM,CAAC,IAAI,EAAE,OAAO,EAAE,MAAM,CAAC,OAAO,EAAE,CAAC;IAC7F,CAAC;IAAC,MAAM,CAAC;QACP,8EAA8E;QAC9E,wEAAwE;IAC1E,CAAC;IACD,OAAO,EAAE,CAAC;AACZ,CAAC"}
+{"version":3,"file":"state.js","sourceRoot":"","sources":["../src/state.ts"],"names":[],"mappings":"AAAA,8EAA8E;AAC9E,OAAO,EAAE,aAAa,EAAE,MAAM,WAAW,CAAC;AAM1C,mGAAmG;AACnG,MAAM,CAAC,KAAK,UAAU,QAAQ,CAAC,OAAgB;IAC7C,MAAM,GAAG,GAAG,MAAM,aAAa,EAAE,CAAC;IAClC,IAAI,CAAC,GAAG,CAAC,IAAI;QAAE,OAAO,EAAE,CAAC;IACzB,wFAAwF;IACxF,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,QAAQ,CAAC;QAAE,OAAO,EAAE,CAAC;IAEtC,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,MAAO,GAAG,CAAC,IAAI,CAAC,GAA6B,CAAC,UAAU,CAAC,EAAE,OAAO,EAAE,CAAC,CAAC;QACrF,IAAI,MAAM,EAAE,OAAO,IAAI,MAAM,EAAE,IAAI;YAAE,OAAO,EAAE,IAAI,EAAE,MAAM,CAAC,IAAI,EAAE,OAAO,EAAE,MAAM,CAAC,OAAO,EAAE,CAAC;IAC7F,CAAC;IAAC,MAAM,CAAC;QACP,8EAA8E;QAC9E,wEAAwE;IAC1E,CAAC;IACD,OAAO,EAAE,CAAC;AACZ,CAAC"}

package/dist/web.d.ts

@@ -1,25 +1,9 @@
-/**
- * The call envelope. A named surface is the path segment after the door —
- * `/_fougere/call/public` serves the `public` audience — and `surfaceOf` reads it,
- * so a host only has to mount this at a path that keeps the segments.
- */
+/** The call envelope. */
 export declare function fougereCall(request: Request): Promise<Response>;
-/**
- * The REST projection, mounted under `/api`.
- *
- * `pass` — a path this app does not serve — becomes a 404 here rather than a
- * fall-through, because a Web handler has nobody to fall through to. Hosts that
- * resolve a static route before a catch-all (Next does) still let an app keep its
- * own `/api/*` handlers: they are reached BEFORE this one, not after.
- */
+/** The REST projection, mounted under `/api`. */
 export declare function fougereRest(request: Request): Promise<Response>;
 /** The session view over the wire, for a client refreshing after login or logout. */
 export declare function fougereSession(request: Request): Promise<Response>;
-/**
- * GraphQL, at whatever path the host mounted it — `/graphql` by convention.
- *
- * Answers `404` when the app declares no GraphQL adapter, because unlike REST this
- * door is mounted at a path of its own: there is no app route underneath it to pass to.
- */
+/** GraphQL, at whatever path the host mounted it — `/graphql` by convention. */
 export declare function fougereGraphQL(request: Request): Promise<Response>;
 //# sourceMappingURL=web.d.ts.map

package/dist/web.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"web.d.ts","sourceRoot":"","sources":["../src/web.ts"],"names":[],"mappings":"AAoBA;;;;GAIG;AACH,wBAAsB,WAAW,CAAC,OAAO,EAAE,OAAO,GAAG,OAAO,CAAC,QAAQ,CAAC,CAqBrE;AAED;;;;;;;GAOG;AACH,wBAAsB,WAAW,CAAC,OAAO,EAAE,OAAO,GAAG,OAAO,CAAC,QAAQ,CAAC,CAoBrE;AAED,qFAAqF;AACrF,wBAAsB,cAAc,CAAC,OAAO,EAAE,OAAO,GAAG,OAAO,CAAC,QAAQ,CAAC,CAExE;AAED;;;;;GAKG;AACH,wBAAsB,cAAc,CAAC,OAAO,EAAE,OAAO,GAAG,OAAO,CAAC,QAAQ,CAAC,CAkBxE"}
+{"version":3,"file":"web.d.ts","sourceRoot":"","sources":["../src/web.ts"],"names":[],"mappings":"AAQA,yBAAyB;AACzB,wBAAsB,WAAW,CAAC,OAAO,EAAE,OAAO,GAAG,OAAO,CAAC,QAAQ,CAAC,CAqBrE;AAED,iDAAiD;AACjD,wBAAsB,WAAW,CAAC,OAAO,EAAE,OAAO,GAAG,OAAO,CAAC,QAAQ,CAAC,CAoBrE;AAED,qFAAqF;AACrF,wBAAsB,cAAc,CAAC,OAAO,EAAE,OAAO,GAAG,OAAO,CAAC,QAAQ,CAAC,CAExE;AAED,gFAAgF;AAChF,wBAAsB,cAAc,CAAC,OAAO,EAAE,OAAO,GAAG,OAAO,CAAC,QAAQ,CAAC,CAkBxE"}

package/dist/web.js

@@ -1,26 +1,10 @@
-/**
- * The three doors as Web-standard handlers: `Request` in, `Response` out.
- *
- * This is the whole server surface for any host built on fetch semantics — Next
- * route handlers, TanStack Start server routes, Hono, a bare `Deno.serve`. Such a
- * host mounts these; it does not translate anything, because there is nothing left
- * to translate.
- *
- * Nuxt is the exception and keeps its own translation, for a reason worth stating:
- * an h3 event is not a `Request`, and reading its body has to straddle two h3
- * majors (`server/routes/call.post.ts` carries that hundred lines). That file is
- * what a NON-Web-standard host costs.
- */
+/** The three doors as Web-standard handlers: `Request` in, `Response` out. */
 import { serveRest, serveRpc, rpcParseError, useFougereApp, serveGraphQL } from './index.js';
 import { MAX_BODY_BYTES } from '@fougere/core';
 import { sessionViewOf } from './session.js';
 import { stateFor } from './state.js';
 const WITH_BODY = new Set(['POST', 'PUT', 'PATCH']);
-/**
- * The call envelope. A named surface is the path segment after the door —
- * `/_fougere/call/public` serves the `public` audience — and `surfaceOf` reads it,
- * so a host only has to mount this at a path that keeps the segments.
- */
+/** The call envelope. */
 export async function fougereCall(request) {
     const declared = Number(request.headers.get('content-length'));
     if (Number.isFinite(declared) && declared > MAX_BODY_BYTES) {
@@ -40,14 +24,7 @@ export async function fougereCall(request) {
         state: await stateFor(request.headers),
     }));
 }
-/**
- * The REST projection, mounted under `/api`.
- *
- * `pass` — a path this app does not serve — becomes a 404 here rather than a
- * fall-through, because a Web handler has nobody to fall through to. Hosts that
- * resolve a static route before a catch-all (Next does) still let an app keep its
- * own `/api/*` handlers: they are reached BEFORE this one, not after.
- */
+/** The REST projection, mounted under `/api`. */
 export async function fougereRest(request) {
     const app = await useFougereApp();
     const url = new URL(request.url);
@@ -71,12 +48,7 @@ export async function fougereRest(request) {
 export async function fougereSession(request) {
     return Response.json(sessionViewOf(await stateFor(request.headers)));
 }
-/**
- * GraphQL, at whatever path the host mounted it — `/graphql` by convention.
- *
- * Answers `404` when the app declares no GraphQL adapter, because unlike REST this
- * door is mounted at a path of its own: there is no app route underneath it to pass to.
- */
+/** GraphQL, at whatever path the host mounted it — `/graphql` by convention. */
 export async function fougereGraphQL(request) {
     const app = await useFougereApp();
     const body = (await request.json().catch(() => ({})));

package/dist/web.js.map

@@ -1 +1 @@
-{"version":3,"file":"web.js","sourceRoot":"","sources":["../src/web.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AACH,OAAO,EAAE,SAAS,EAAE,QAAQ,EAAE,aAAa,EAAE,aAAa,EAAE,YAAY,EAAE,MAAM,YAAY,CAAC;AAC7F,OAAO,EAAE,cAAc,EAAE,MAAM,eAAe,CAAC;AAC/C,OAAO,EAAE,aAAa,EAAE,MAAM,cAAc,CAAC;AAC7C,OAAO,EAAE,QAAQ,EAAE,MAAM,YAAY,CAAC;AAEtC,MAAM,SAAS,GAAG,IAAI,GAAG,CAAC,CAAC,MAAM,EAAE,KAAK,EAAE,OAAO,CAAC,CAAC,CAAC;AAEpD;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,WAAW,CAAC,OAAgB;IAChD,MAAM,QAAQ,GAAG,MAAM,CAAC,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,gBAAgB,CAAC,CAAC,CAAC;IAC/D,IAAI,MAAM,CAAC,QAAQ,CAAC,QAAQ,CAAC,IAAI,QAAQ,GAAG,cAAc,EAAE,CAAC;QAC3D,OAAO,QAAQ,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,mBAAmB,EAAE,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC,CAAC;IAC1E,CAAC;IAED,MAAM,GAAG,GAAG,MAAM,aAAa,EAAE,CAAC;IAClC,IAAI,IAAa,CAAC;IAClB,IAAI,CAAC;QACH,IAAI,GAAG,MAAM,OAAO,CAAC,IAAI,EAAE,CAAC;IAC9B,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,QAAQ,CAAC,IAAI,CAAC,aAAa,EAAE,CAAC,CAAC;IACxC,CAAC;IAED,OAAO,QAAQ,CAAC,IAAI,CAClB,MAAM,QAAQ,CAAC,GAAG,EAAE;QAClB,IAAI,EAAE,IAAI,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,QAAQ;QACnC,IAAI;QACJ,KAAK,EAAE,MAAM,QAAQ,CAAC,OAAO,CAAC,OAAO,CAAC;KACvC,CAAC,CACH,CAAC;AACJ,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,CAAC,KAAK,UAAU,WAAW,CAAC,OAAgB;IAChD,MAAM,GAAG,GAAG,MAAM,aAAa,EAAE,CAAC;IAClC,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;IACjC,MAAM,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,WAAW,EAAE,CAAC;IAE5C,MAAM,OAAO,GAAG,MAAM,SAAS,CAAC,GAAG,EAAE;QACnC,MAAM;QACN,IAAI,EAAE,GAAG,CAAC,QAAQ,CAAC,OAAO,CAAC,UAAU,EAAE,EAAE,CAAC;QAC1C,KAAK,EAAE,MAAM,CAAC,WAAW,CAAC,GAAG,CAAC,YAAY,CAAC;QAC3C,IAAI,EAAE,SAAS,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,MAAM,OAAO,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,SAAS;QACrF,KAAK,EAAE,MAAM,QAAQ,CAAC,OAAO,CAAC,OAAO,CAAC;KACvC,CAAC,CAAC;IAEH,IAAI,OAAO,CAAC,IAAI,KAAK,MAAM,EAAE,CAAC;QAC5B,OAAO,QAAQ,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,gBAAgB,MAAM,IAAI,GAAG,CAAC,QAAQ,EAAE,EAAE,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC,CAAC;IAC/F,CAAC;IACD,IAAI,OAAO,CAAC,IAAI,KAAK,OAAO,EAAE,CAAC;QAC7B,OAAO,QAAQ,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,EAAE,EAAE,MAAM,EAAE,OAAO,CAAC,MAAM,EAAE,OAAO,EAAE,OAAO,CAAC,OAAO,EAAE,CAAC,CAAC;IAC3F,CAAC;IACD,OAAO,QAAQ,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,EAAE,EAAE,MAAM,EAAE,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC;AACjE,CAAC;AAED,qFAAqF;AACrF,MAAM,CAAC,KAAK,UAAU,cAAc,CAAC,OAAgB;IACnD,OAAO,QAAQ,CAAC,IAAI,CAAC,aAAa,CAAC,MAAM,QAAQ,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC;AACvE,CAAC;AAED;;;;;GAKG;AACH,MAAM,CAAC,KAAK,UAAU,cAAc,CAAC,OAAgB;IACnD,MAAM,GAAG,GAAG,MAAM,aAAa,EAAE,CAAC;IAClC,MAAM,IAAI,GAAG,CAAC,MAAM,OAAO,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,CAAC,EAAE,CAAC,CAAC,CAInD,CAAC;IAEF,MAAM,OAAO,GAAG,MAAM,YAAY,CAAC,GAAG,EAAE;QACtC,GAAG,IAAI;QACP,OAAO,EAAE,IAAI,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC;QACpE,KAAK,EAAE,MAAM,QAAQ,CAAC,OAAO,CAAC,OAAO,CAAC;KACvC,CAAC,CAAC;IAEH,IAAI,OAAO,CAAC,IAAI,KAAK,MAAM,EAAE,CAAC;QAC5B,OAAO,QAAQ,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,mCAAmC,EAAE,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC,CAAC;IAC1F,CAAC;IACD,OAAO,QAAQ,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,EAAE,EAAE,MAAM,EAAE,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC;AACjE,CAAC"}
+{"version":3,"file":"web.js","sourceRoot":"","sources":["../src/web.ts"],"names":[],"mappings":"AAAA,8EAA8E;AAC9E,OAAO,EAAE,SAAS,EAAE,QAAQ,EAAE,aAAa,EAAE,aAAa,EAAE,YAAY,EAAE,MAAM,YAAY,CAAC;AAC7F,OAAO,EAAE,cAAc,EAAE,MAAM,eAAe,CAAC;AAC/C,OAAO,EAAE,aAAa,EAAE,MAAM,cAAc,CAAC;AAC7C,OAAO,EAAE,QAAQ,EAAE,MAAM,YAAY,CAAC;AAEtC,MAAM,SAAS,GAAG,IAAI,GAAG,CAAC,CAAC,MAAM,EAAE,KAAK,EAAE,OAAO,CAAC,CAAC,CAAC;AAEpD,yBAAyB;AACzB,MAAM,CAAC,KAAK,UAAU,WAAW,CAAC,OAAgB;IAChD,MAAM,QAAQ,GAAG,MAAM,CAAC,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,gBAAgB,CAAC,CAAC,CAAC;IAC/D,IAAI,MAAM,CAAC,QAAQ,CAAC,QAAQ,CAAC,IAAI,QAAQ,GAAG,cAAc,EAAE,CAAC;QAC3D,OAAO,QAAQ,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,mBAAmB,EAAE,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC,CAAC;IAC1E,CAAC;IAED,MAAM,GAAG,GAAG,MAAM,aAAa,EAAE,CAAC;IAClC,IAAI,IAAa,CAAC;IAClB,IAAI,CAAC;QACH,IAAI,GAAG,MAAM,OAAO,CAAC,IAAI,EAAE,CAAC;IAC9B,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,QAAQ,CAAC,IAAI,CAAC,aAAa,EAAE,CAAC,CAAC;IACxC,CAAC;IAED,OAAO,QAAQ,CAAC,IAAI,CAClB,MAAM,QAAQ,CAAC,GAAG,EAAE;QAClB,IAAI,EAAE,IAAI,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,QAAQ;QACnC,IAAI;QACJ,KAAK,EAAE,MAAM,QAAQ,CAAC,OAAO,CAAC,OAAO,CAAC;KACvC,CAAC,CACH,CAAC;AACJ,CAAC;AAED,iDAAiD;AACjD,MAAM,CAAC,KAAK,UAAU,WAAW,CAAC,OAAgB;IAChD,MAAM,GAAG,GAAG,MAAM,aAAa,EAAE,CAAC;IAClC,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;IACjC,MAAM,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,WAAW,EAAE,CAAC;IAE5C,MAAM,OAAO,GAAG,MAAM,SAAS,CAAC,GAAG,EAAE;QACnC,MAAM;QACN,IAAI,EAAE,GAAG,CAAC,QAAQ,CAAC,OAAO,CAAC,UAAU,EAAE,EAAE,CAAC;QAC1C,KAAK,EAAE,MAAM,CAAC,WAAW,CAAC,GAAG,CAAC,YAAY,CAAC;QAC3C,IAAI,EAAE,SAAS,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,MAAM,OAAO,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,SAAS;QACrF,KAAK,EAAE,MAAM,QAAQ,CAAC,OAAO,CAAC,OAAO,CAAC;KACvC,CAAC,CAAC;IAEH,IAAI,OAAO,CAAC,IAAI,KAAK,MAAM,EAAE,CAAC;QAC5B,OAAO,QAAQ,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,gBAAgB,MAAM,IAAI,GAAG,CAAC,QAAQ,EAAE,EAAE,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC,CAAC;IAC/F,CAAC;IACD,IAAI,OAAO,CAAC,IAAI,KAAK,OAAO,EAAE,CAAC;QAC7B,OAAO,QAAQ,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,EAAE,EAAE,MAAM,EAAE,OAAO,CAAC,MAAM,EAAE,OAAO,EAAE,OAAO,CAAC,OAAO,EAAE,CAAC,CAAC;IAC3F,CAAC;IACD,OAAO,QAAQ,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,EAAE,EAAE,MAAM,EAAE,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC;AACjE,CAAC;AAED,qFAAqF;AACrF,MAAM,CAAC,KAAK,UAAU,cAAc,CAAC,OAAgB;IACnD,OAAO,QAAQ,CAAC,IAAI,CAAC,aAAa,CAAC,MAAM,QAAQ,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC;AACvE,CAAC;AAED,gFAAgF;AAChF,MAAM,CAAC,KAAK,UAAU,cAAc,CAAC,OAAgB;IACnD,MAAM,GAAG,GAAG,MAAM,aAAa,EAAE,CAAC;IAClC,MAAM,IAAI,GAAG,CAAC,MAAM,OAAO,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,CAAC,EAAE,CAAC,CAAC,CAInD,CAAC;IAEF,MAAM,OAAO,GAAG,MAAM,YAAY,CAAC,GAAG,EAAE;QACtC,GAAG,IAAI;QACP,OAAO,EAAE,IAAI,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC;QACpE,KAAK,EAAE,MAAM,QAAQ,CAAC,OAAO,CAAC,OAAO,CAAC;KACvC,CAAC,CAAC;IAEH,IAAI,OAAO,CAAC,IAAI,KAAK,MAAM,EAAE,CAAC;QAC5B,OAAO,QAAQ,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,mCAAmC,EAAE,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC,CAAC;IAC1F,CAAC;IACD,OAAO,QAAQ,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,EAAE,EAAE,MAAM,EAAE,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC;AACjE,CAAC"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@fougere/app",
-  "version": "0.5.0-alpha.1",
+  "version": "0.7.0-alpha.0",
   "description": "The host-independent half of a Fougere app: boot, call envelope, REST table, form contract.",
   "keywords": [
     "fougere",
@@ -42,23 +42,24 @@
   ],
   "dependencies": {
     "jiti": "^2.6.1",
-    "@fougere/core": "0.5.0-alpha.1",
-    "@fougere/schema": "0.5.0-alpha.1",
-    "@fougere/transport-http": "0.5.0-alpha.1",
-    "@fougere/container": "0.5.0-alpha.1",
-    "@fougere/defaults": "0.5.0-alpha.1",
-    "@fougere/http": "0.5.0-alpha.1",
-    "@fougere/adapter-rest": "0.5.0-alpha.1"
+    "@fougere/core": "0.7.0-alpha.0",
+    "@fougere/adapter-rest": "0.7.0-alpha.0",
+    "@fougere/defaults": "0.7.0-alpha.0",
+    "@fougere/schema": "0.7.0-alpha.0",
+    "@fougere/http": "0.7.0-alpha.0",
+    "@fougere/container": "0.7.0-alpha.0",
+    "@fougere/adapter-memory": "0.7.0-alpha.0",
+    "@fougere/transport-http": "0.7.0-alpha.0"
   },
   "devDependencies": {
     "vitest": "^4.1.0",
-    "@fougere/adapter-graphql": "0.5.0-alpha.1"
+    "@fougere/adapter-graphql": "0.7.0-alpha.0"
   },
   "publishConfig": {
     "access": "public"
   },
   "peerDependencies": {
-    "@fougere/adapter-graphql": "0.5.0-alpha.1"
+    "@fougere/adapter-graphql": "0.7.0-alpha.0"
   },
   "peerDependenciesMeta": {
     "@fougere/adapter-graphql": {

package/src/auth.ts

@@ -1,10 +1,4 @@
-/**
- * Auth accessor — reads the AuthRuntime that the core mounted on the app.
- *
- * Auth is no longer a separate singleton: it lives on `app.auth`, built once
- * during boot from the `auth` field of fougere.config.ts. This accessor is a
- * thin async helper for server code (middleware, routes, /api/me).
- */
+/** Auth accessor — reads the AuthRuntime that the core mounted on the app. */
 import type { AuthRuntime } from '@fougere/core';
 import { useFougereApp } from './boot.js';