@fougere/cli 0.2.0-alpha.1 → 0.3.0-alpha.0

package/README.md

@@ -1,10 +1,19 @@
 # @fougere/cli
 > The Fougere CLI
 Compose a workspace (`new`), serve a frond on its own (`serve`), call an operation
-(`call`), read the application graph (`graph`).
+(`call`), inspect its effective contract (`explain`), read the application graph (`graph`).
 
 The CLI is itself a Fougere app: its commands ride on the call contract.
 
+```bash
+fougere explain Post.publish
+fougere explain Post.publish --json
+```
+
+`explain` reads the scanner's resolved operation contract: kind, input/output, parameter
+bindings and collectors, surfaces/adapters, Frond and local/remote placement. It does not
+boot the target application, so introspection does not run migrations or seeds.
+
 ## Installation
 ```bash
 pnpm add @fougere/cli

package/app/commands/BuildCommand.ts

@@ -0,0 +1,39 @@
+import { createAppRunner } from '@fougere/core';
+import type { App } from '@fougere/core';
+import type { ui as createUi } from '../../src/ui.js';
+import type { BuildReport } from '../../fronds/analysis/handlers/BuildHandler.js';
+import pc from 'picocolors';
+
+type Ui = ReturnType<typeof createUi>;
+
+/**
+ * `fougere build` — the scan, written down.
+ *
+ * It reports what the module HOLDS rather than that it was written: a build that found
+ * one frond where the project has three has succeeded at the wrong thing, and the path
+ * alone does not say so.
+ */
+export default class BuildCommand {
+  constructor(private app: App, private ui: Ui) {}
+
+  async run(raw: Record<string, unknown>) {
+    const built = (await createAppRunner(this.app)(
+      { entity: 'build', op: 'execute' },
+      { params: {}, query: {}, body: raw, state: {} },
+    )) as BuildReport;
+
+    if (built.fronds.length === 0) {
+      this.ui.warn('No fronds found. Run this from a Fougere project root.');
+      return;
+    }
+
+    this.ui.success(`${built.path} — ${built.fronds.length} frond(s), ${built.entities} entities, ${built.handlers} handlers`);
+    this.ui.step(built.fronds.map((name) => pc.bold(name)).join(', '));
+
+    // A diagnostic travels INTO the module, so a boot from it says the same thing. Saying
+    // it here too is not a duplicate: this is the moment someone can still fix the source.
+    for (const diagnostic of built.diagnostics) this.ui.warn(diagnostic);
+
+    this.ui.step(pc.dim('hand it to createApp as `scan:` — nothing reads a disk after this'));
+  }
+}

package/app/commands/CallCommand.ts

@@ -1,8 +1,8 @@
 import { createAppRunner } from '@fougere/core';
-import { toRegistrationName } from '@fougere/core/contract';
-import { bootAppFromConfig } from '@fougere/runtime';
+import { registrationKeyOf } from '@fougere/core/contract';
+import { bootAppFromConfig } from '@fougere/defaults';
 import type { App } from '@fougere/core';
-import type { ui as createUi } from '@fougere/cli-ui';
+import type { ui as createUi } from '../../src/ui.js';
 
 type Ui = ReturnType<typeof createUi>;
 
@@ -57,7 +57,7 @@ export default class CallCommand {
     const app = await bootAppFromConfig(process.cwd(), {});
     try {
       const result = await createAppRunner(app)(
-        { entity: toRegistrationName(entityName), op },
+        { entity: registrationKeyOf(entityName), op },
         { params, query: {}, body, state: {} },
       );
       this.ui.note(JSON.stringify(result, null, 2), target);

package/app/commands/CheckCommand.ts

@@ -1,7 +1,7 @@
 import type { CheckResult, Finding } from '../../fronds/analysis/handlers/CheckHandler.js';
 import type { App } from '@fougere/core';
 import { createAppRunner } from '@fougere/core';
-import type { ui as createUi } from '@fougere/cli-ui';
+import type { ui as createUi } from '../../src/ui.js';
 import pc from 'picocolors';
 import { relative } from 'node:path';
 
@@ -45,7 +45,8 @@ export default class CheckCommand {
 function render(f: Finding): string {
   const mark = f.severity === 'blocking' ? pc.red('✗') : pc.yellow('⚠');
   const where = relative(process.cwd(), f.filePath) || f.filePath;
-  return `  ${mark} ${pc.bold(`[${f.code}]`)}\n${wrap(f.message, 76, '    ')}\n    ${pc.dim(where)}`;
+  const what = f.subject ? ` ${f.subject}` : '';
+  return `  ${mark} ${pc.bold(`[${f.code}]`)}${what}\n${wrap(f.message, 76, '    ')}\n    ${pc.dim(where)}`;
 }
 
 /** A box grows to its longest line, so a one-line sentence makes an unreadable box. */

package/app/commands/ExplainCommand.ts

@@ -0,0 +1,77 @@
+import type { App } from '@fougere/core';
+import { createAppRunner } from '@fougere/core';
+import type { ui as createUi } from '../../src/ui.js';
+import type {
+  ExplainResult,
+  ExplainedBinding,
+} from '../../fronds/analysis/handlers/ExplainHandler.js';
+import pc from 'picocolors';
+
+type Ui = ReturnType<typeof createUi>;
+
+export default class ExplainCommand {
+  constructor(private app: App, private ui: Ui) {}
+
+  async run(raw: Record<string, unknown>) {
+    const result = await createAppRunner(this.app)(
+      { entity: 'explain', op: 'execute' },
+      { params: {}, query: {}, body: raw, state: {} },
+    ) as ExplainResult;
+
+    if (raw.json === true) {
+      process.stdout.write(renderExplainJson(result) + '\n');
+      return;
+    }
+
+    this.ui.note(renderExplain(result), result.operation);
+  }
+}
+
+export function renderExplainJson(result: ExplainResult): string {
+  return JSON.stringify(result, null, 2);
+}
+
+export function renderExplain(result: ExplainResult): string {
+  const lines = [
+    `${pc.dim('Handler:')}   ${result.handler.class}.${result.handler.method}`,
+    `${pc.dim('Address:')}   ${result.handler.address}.${result.operation.split('.').at(-1)}`,
+    `${pc.dim('Kind:')}      ${result.kind}`,
+    `${pc.dim('Input:')}     ${result.input ?? '—'}`,
+    `${pc.dim('Output:')}    ${result.output ? `${result.output.type}${result.output.cardinality ? ` (${result.output.cardinality})` : ''}` : '—'}`,
+  ];
+
+  if (result.description) lines.push(`${pc.dim('Purpose:')}   ${result.description}`);
+
+  lines.push('', pc.bold('Parameters'));
+  if (result.parameters.length === 0) lines.push('  —');
+  for (const parameter of result.parameters) {
+    const optional = parameter.optional ? '?' : '';
+    lines.push(`  ${parameter.name}${optional}: ${parameter.type ?? 'unknown'} ${pc.dim('→')} ${bindingName(parameter.binding)}`);
+  }
+
+  lines.push('', pc.bold('Collectors'));
+  if (result.collectors.length === 0) lines.push('  —');
+  for (const collector of result.collectors) {
+    lines.push(`  ${collector.typeName} ${pc.dim('→')} ${collector.class}`);
+  }
+
+  lines.push(
+    '',
+    `${pc.dim('Surfaces:')}  ${result.exposure.surfaces.join(', ') || '—'}`,
+    `${pc.dim('Adapters:')}  ${result.exposure.adapters.join(', ') || '—'}`,
+    `${pc.dim('Placement:')} ${result.placement.frond} / ${result.placement.runtime}${result.placement.remote ? ` (${result.placement.remote})` : ''}`,
+  );
+
+  if (result.handler.file) lines.push(`${pc.dim('Source:')}    ${result.handler.file}`);
+  return lines.join('\n');
+}
+
+function bindingName(binding: ExplainedBinding | null): string {
+  if (!binding) return 'unbound';
+  switch (binding.kind) {
+    case 'collector': return `collector:${binding.typeName}`;
+    case 'fact': return `fact:${binding.factName}`;
+    case 'param': return `param:${binding.name}${binding.coerce ? ` (${binding.coerce})` : ''}`;
+    default: return binding.kind;
+  }
+}

package/app/commands/FreezeCommand.ts

@@ -0,0 +1,107 @@
+import { createAppRunner } from '@fougere/core';
+import type { Change } from '@fougere/schema';
+import type { App } from '@fougere/core';
+import type { ui as createUi } from '../../src/ui.js';
+import type { FreezeInspection } from '../../fronds/analysis/handlers/FreezeHandler.js';
+import pc from 'picocolors';
+
+type Ui = ReturnType<typeof createUi>;
+
+/**
+ * Cutting a version — inspect, ask what only a human knows, then record.
+ *
+ * The question is asked between the two ops and nowhere else: a field gone plus a field
+ * appeared is either a rename or a drop-and-add, the two produce opposite DDL, and the
+ * intent left with the person who made the change. Nothing is written until it is settled.
+ */
+export default class FreezeCommand {
+  constructor(private app: App, private ui: Ui) {}
+
+  async run(raw: Record<string, unknown>) {
+    if (!raw.version) {
+      this.ui.error('Usage: fougere freeze <version>');
+      return;
+    }
+
+    const freeze = (body: Record<string, unknown>) =>
+      createAppRunner(this.app)({ entity: 'freeze', op: 'execute' }, { params: {}, query: {}, body, state: {} }) as Promise<FreezeInspection>;
+
+    // Idempotent while it refuses: this writes when nothing is ambiguous, and reports
+    // otherwise — so the first call is both the inspection and the happy path.
+    const seen = await freeze(raw);
+
+    if (seen.entities.length === 0) {
+      this.ui.warn('No entities found. Run this from a Fougere project root.');
+      return;
+    }
+
+    if (seen.written) {
+      this.report(seen);
+      return;
+    }
+
+    const renamed = await this.settle(seen);
+    if (renamed === undefined) return;
+
+    this.report(await freeze({ ...raw, renamed }));
+  }
+
+  /** Turn every ambiguity into a declaration, or `undefined` when the answer is a refusal. */
+  private async settle(seen: FreezeInspection): Promise<Record<string, Record<string, string>> | undefined> {
+    const renamed: Record<string, Record<string, string>> = {};
+    const pending = Object.entries(seen.ambiguous);
+    if (pending.length === 0) return renamed;
+
+    this.ui.warn('A field left and a field of the same shape appeared. Only you know which.');
+
+    for (const [entity, pairs] of pending) {
+      // Grouped by what LEFT: one departed field is one question, however many
+      // candidates carry its shape.
+      const byRemoved = new Map<string, string[]>();
+      for (const { removed, added } of pairs) byRemoved.set(removed, [...(byRemoved.get(removed) ?? []), added]);
+
+      for (const [removed, candidates] of byRemoved) {
+        const answer = await this.ui.select({
+          message: `${entity}.${pc.bold(removed)} — what happened to it?`,
+          options: [
+            ...candidates.map((added) => ({ value: added, label: `renamed to ${added}`, hint: 'the data moves with it' })),
+            { value: '', label: 'dropped', hint: 'the column goes, and what it held goes with it' },
+          ],
+        });
+        // An empty answer is a cancel as much as a "dropped" — writing on either would
+        // record a decision nobody made.
+        if (!answer) {
+          this.ui.warn(`${entity}.${removed} treated as dropped — say so explicitly if that is right.`);
+          return undefined;
+        }
+        renamed[entity] = { ...(renamed[entity] ?? {}), [removed]: answer };
+      }
+    }
+    return renamed;
+  }
+
+  private report(written: FreezeInspection) {
+    const { step } = written;
+    if (!step) {
+      this.ui.success(`${written.version} recorded — ${written.entities.length} entities, and nothing before it`);
+      return;
+    }
+
+    const moved = Object.entries(step.entities);
+    const count = moved.reduce((total, [, answer]) => total + answer.changes.length, 0);
+
+    this.ui.success(`${written.version} recorded — ${count} change(s) since ${written.previous}`);
+    for (const [entity, answer] of moved) {
+      this.ui.step(`${pc.bold(entity)} — ${answer.changes.map(describeChange).join(', ')}`);
+    }
+    if (step.entitiesAdded.length > 0) this.ui.step(`new: ${step.entitiesAdded.join(', ')}`);
+    if (step.entitiesRemoved.length > 0) this.ui.step(`gone: ${step.entitiesRemoved.join(', ')}`);
+  }
+}
+
+function describeChange(change: Change): string {
+  if (change.kind === 'renamed') return `${change.from} → ${change.to}`;
+  // An axis that moved names WHICH: "restated title" says nothing a reader can act on.
+  if (change.kind === 'restated') return `${change.field}: ${change.axis} moved`;
+  return `${change.kind} ${change.field}`;
+}

package/app/commands/GrantCommand.ts

@@ -0,0 +1,44 @@
+import { readFile } from 'node:fs/promises';
+import { join } from 'node:path';
+import { generateKeyPair, issueGrant } from '@fougere/core/node';
+import type { App } from '@fougere/core';
+import type { ui as createUi } from '../../src/ui.js';
+import { ROOT_KEY, packed } from './grant-material.js';
+
+type Ui = ReturnType<typeof createUi>;
+
+/**
+ * Vouch for one frond: bind its name to a fresh key, signed by the root.
+ *
+ * The key is printed and never stored — it belongs to the deployment, not to the
+ * repository. Re-running issues a NEW key rather than showing the old one, which is
+ * what rotation is: run it again, redeploy that frond, and nobody else's config moves.
+ */
+export default class GrantCommand {
+  constructor(private app: App, private ui: Ui) {}
+
+  async run(raw: Record<string, unknown>) {
+    const frond = raw.frond as string | undefined;
+    if (!frond) {
+      this.ui.error('Usage: fougere grant <frond>');
+      return;
+    }
+
+    let rootPrivateKey: string;
+    try {
+      rootPrivateKey = await readFile(join(process.cwd(), ROOT_KEY), 'utf8');
+    } catch {
+      this.ui.error(`No ${ROOT_KEY} — run \`fougere keys\` first.`);
+      return;
+    }
+
+    const { privateKey, publicKey } = generateKeyPair();
+    const grant = issueGrant(rootPrivateKey, frond, publicKey);
+
+    this.ui.success(`granted — '${frond}' will be admitted by any receiver trusting this root`);
+    this.ui.note(
+      `FOUGERE_KEY=${packed(privateKey)}\nFOUGERE_GRANT=${grant}`,
+      `Inject into '${frond}' at launch — secret, shown once`,
+    );
+  }
+}

package/app/commands/GraphCommand.ts

@@ -1,7 +1,7 @@
 import type { GraphResult } from '../../fronds/analysis/handlers/GraphHandler.js';
 import type { EntityNode, DomainCluster, App } from '@fougere/core';
 import { createAppRunner } from '@fougere/core';
-import type { ui as createUi } from '@fougere/cli-ui';
+import type { ui as createUi } from '../../src/ui.js';
 import pc from 'picocolors';
 
 type Ui = ReturnType<typeof createUi>;

package/app/commands/KeysCommand.ts

@@ -0,0 +1,56 @@
+import { mkdir, readFile, writeFile, appendFile, access } from 'node:fs/promises';
+import { join } from 'node:path';
+import { generateKeyPair } from '@fougere/core/node';
+import type { App } from '@fougere/core';
+import type { ui as createUi } from '../../src/ui.js';
+import { ROOT_KEY, packed } from './grant-material.js';
+
+type Ui = ReturnType<typeof createUi>;
+
+/**
+ * Create the authority — a command, not a service.
+ *
+ * This is the whole of it: it runs at deployment time and exits. Nothing stays alive,
+ * nothing is joined at boot, and no frond reaches anything to prove who it is. What a
+ * receiver ends up holding is ONE public key, so a frond granted tomorrow is admitted
+ * by a receiver deployed today without its config being touched.
+ *
+ * The private key is written and never printed: it signs grants, and a grant is the
+ * only thing that has to travel.
+ */
+export default class KeysCommand {
+  constructor(private app: App, private ui: Ui) {}
+
+  async run() {
+    const path = join(process.cwd(), ROOT_KEY);
+    if (await exists(path)) {
+      this.ui.error(`${ROOT_KEY} already exists — a second root would split the system in two.`);
+      this.ui.info('Delete it deliberately to start over; every grant issued so far stops being recognized.');
+      return;
+    }
+
+    const { privateKey, publicKey } = generateKeyPair();
+    await mkdir(join(process.cwd(), '.fougere'), { recursive: true });
+    await writeFile(path, privateKey, { mode: 0o600 });
+    await ignore(ROOT_KEY);
+
+    this.ui.success(`root created — ${ROOT_KEY} (never commit it; added to .gitignore)`);
+    this.ui.note(
+      `FOUGERE_ROOT=${packed(publicKey)}`,
+      'Every frond that ANSWERS — public, safe in an image or a manifest',
+    );
+    this.ui.info('Then `fougere grant <frond>` for each frond that CALLS.');
+  }
+}
+
+async function exists(path: string): Promise<boolean> {
+  return access(path).then(() => true, () => false);
+}
+
+/** Keep the root out of a commit — the one mistake that cannot be walked back. */
+async function ignore(entry: string): Promise<void> {
+  const path = join(process.cwd(), '.gitignore');
+  const current = await readFile(path, 'utf8').catch(() => '');
+  if (current.split('\n').some((line) => line.trim() === entry)) return;
+  await appendFile(path, `${current.endsWith('\n') || current === '' ? '' : '\n'}${entry}\n`);
+}

package/app/commands/MigrateCommand.ts

@@ -0,0 +1,54 @@
+import { createAppRunner } from '@fougere/core';
+import type { App } from '@fougere/core';
+import type { ui as createUi } from '../../src/ui.js';
+import type { MigrationPlan } from '../../fronds/analysis/handlers/MigrateHandler.js';
+import pc from 'picocolors';
+
+type Ui = ReturnType<typeof createUi>;
+
+/**
+ * Catching a database up with the frozen chain.
+ *
+ * Prints by default and moves nothing: what this runs drops and renames columns, so the
+ * plan is read before it is agreed to. `--apply` is that agreement.
+ */
+export default class MigrateCommand {
+  constructor(private app: App, private ui: Ui) {}
+
+  async run(raw: Record<string, unknown>) {
+    const result = (await createAppRunner(this.app)(
+      { entity: 'migrate', op: 'execute' },
+      { params: {}, query: {}, body: raw, state: {} },
+    )) as MigrationPlan;
+
+    if (result.chain.length === 0) {
+      this.ui.warn('No frozen step to apply. `fougere freeze <version>` records one.');
+      return;
+    }
+
+    if (result.refusals.length > 0) {
+      this.ui.error(`This chain cannot be realised as it stands (${result.chain.join(' → ')}):`);
+      for (const one of result.refusals) this.ui.step(`${pc.bold(`${one.entity}.${one.field}`)} — ${one.reason}`);
+      return;
+    }
+
+    if (result.changes.length === 0) {
+      this.ui.success(`Up to date — ${result.chain.join(' → ')} already realised.`);
+      return;
+    }
+
+    for (const change of result.changes) {
+      this.ui.step(
+        change.kind === 'renameColumn'
+          ? `${change.table}: ${pc.bold(change.from)} → ${pc.bold(change.to)}`
+          : `${change.table}: drop ${pc.bold(change.column)}`,
+      );
+    }
+
+    if (result.ran.length === 0) {
+      this.ui.info(`${result.changes.length} statement(s) — run again with ${pc.bold('--apply')} to make it so.`);
+      return;
+    }
+    this.ui.success(`${result.ran.length} statement(s) run.`);
+  }
+}

package/app/commands/NewCommand.ts

@@ -1,7 +1,7 @@
 import { existsSync } from 'node:fs';
 import { join } from 'node:path';
 import ProjectWriter from '../../fronds/scaffold/services/ProjectWriter.js';
-import type { ui as createUi } from '@fougere/cli-ui';
+import type { ui as createUi } from '../../src/ui.js';
 import type { App } from '@fougere/core';
 
 type Ui = ReturnType<typeof createUi>;
@@ -47,7 +47,7 @@ export default class NewCommand {
       if (raw.local) pw.linkLocal(dir);
       this.ui.info(`${template} at the root`);
       this.ui.note([`cd ${name}`, INSTALL, `pnpm dev`].join('\n'), `${name} — one frond, at the root`);
-      this.ui.outro('Prêt.');
+      this.ui.outro('Ready.');
       return;
     }
 
@@ -56,7 +56,7 @@ export default class NewCommand {
     if (raw.bare) {
       if (raw.local) pw.linkLocal(dir);
       this.ui.note([`cd ${name}`, `fougere new   # compose it (guided)`].join('\n'), `${name} — empty workspace`);
-      this.ui.outro('Prêt.');
+      this.ui.outro('Ready.');
       return;
     }
 
@@ -65,16 +65,16 @@ export default class NewCommand {
     const stated = (raw.frond as string) || (raw.app as string);
     const fronds = stated
       ? this.state(dir, pw, 'fronds', raw.frond as string)
-      : await this.compose(dir, pw, 'fronds', 'Fronds — tes domaines', pw.listTemplates('fronds'));
+      : await this.compose(dir, pw, 'fronds', 'Fronds — your domains', pw.listTemplates('fronds'));
     const apps = stated
       ? this.state(dir, pw, 'apps', raw.app as string)
-      : await this.compose(dir, pw, 'apps', 'Apps — ce qui les consomme', pw.listTemplates('apps'));
+      : await this.compose(dir, pw, 'apps', 'Apps — what consumes them', pw.listTemplates('apps'));
 
     // Every app depends on every frond — stated here, where both names are known.
     pw.linkFronds(dir);
     if (raw.local) pw.linkLocal(dir);
     this.ui.note([`cd ${name}`, INSTALL, `pnpm dev`].join('\n'), `${name} — ${fronds} frond(s), ${apps} app(s)`);
-    this.ui.outro('Prêt.');
+    this.ui.outro('Ready.');
   }
 
   /**

package/app/commands/ServeCommand.ts

@@ -1,11 +1,29 @@
-import { createLocalRunner } from '@fougere/core';
-import { bootAppFromConfig } from '@fougere/runtime';
+import { createLocalRunner, identityFromEnv } from '@fougere/core';
+import { setModuleLoader, loadConfig, resolveConventions, watchPathsOf } from '@fougere/core/node';
+import { bootAppFromConfig } from '@fougere/defaults';
 import { serve } from '@fougere/transport-http';
-import type { App } from '@fougere/core';
-import type { ui as createUi } from '@fougere/cli-ui';
+import { watch } from 'node:fs';
+import type { App, Transport } from '@fougere/core';
+import type { ui as createUi } from '../../src/ui.js';
 
 type Ui = ReturnType<typeof createUi>;
 
+/** What a reload gives the calls already running before it releases the app they hold. */
+const DRAIN_MS = 5_000;
+
+/** One save fires several events; the boot must not start once per event. */
+const SETTLE_MS = 60;
+
+/**
+ * A loader that re-reads. Every loader caches by specifier, so a second boot in this
+ * process would be handed the modules the first one read — a reload that changes nothing.
+ */
+async function rereadingLoader(): Promise<void> {
+  const { createJiti } = await import('jiti');
+  const jiti = createJiti(import.meta.url, { interopDefault: true, moduleCache: false });
+  setModuleLoader((filePath) => jiti.import(filePath) as Promise<Record<string, unknown>>);
+}
+
 /**
  * The host end of the gradient: one frond, alone in this process, reachable
  * over HTTP. `topology: false` — a served frond IS the host, it never routes
@@ -19,16 +37,74 @@ export default class ServeCommand {
     const frond = raw.frond as string | undefined;
     if (!frond) { this.ui.error('Usage: fougere serve <frond>'); return; }
 
-    const app = await bootAppFromConfig(process.cwd(), { fronds: [frond], topology: false });
-    if (!app.fronds.some((f) => f.name === frond)) {
+    const root = process.cwd();
+    const watching = raw.watch === true;
+
+    // Cache-free from the FIRST boot, so every boot in this process reads the same way.
+    if (watching) await rereadingLoader();
+
+    let hosted = await bootAppFromConfig(root, { fronds: [frond], topology: false });
+    if (!hosted.fronds.some((f) => f.name === frond)) {
       this.ui.error(`Frond '${frond}' introuvable dans ce projet.`);
       return;
     }
 
+    // A handle, not a binding: `serve` holds this closure for the process's life while
+    // `current` moves under it, so nothing on the wire learns the app was replaced.
+    let current: Transport = createLocalRunner(hosted);
+
     const port = raw.port != null ? Number(raw.port) : 4100;
-    const { port: bound } = await serve(createLocalRunner(app), { port });
+    // A served frond admits what it can establish. With no root injected it takes the
+    // state it is handed, which is why the loopback default is the other half.
+    const { verify, requireIdentity } = await identityFromEnv();
+    const { port: bound } = await serve((call, inv) => current(call, inv), { port, verify, requireIdentity });
     this.ui.step(`frond ${frond} servie — POST http://127.0.0.1:${bound}/_fougere/call`);
-    this.ui.info('Ctrl-C pour arrêter.');
-    // The listening server keeps the event loop alive; the command returns and stays up.
+    this.ui.info(requireIdentity ? 'signed calls only (FOUGERE_ROOT is set)' : 'unsigned calls accepted — no FOUGERE_ROOT');
+
+    if (!watching) {
+      this.ui.info('Ctrl-C pour arrêter.');
+      // The listening server keeps the event loop alive; the command returns and stays up.
+      return;
+    }
+
+    const reload = async (): Promise<void> => {
+      const started = Date.now();
+      let next: App;
+      try {
+        next = await bootAppFromConfig(root, { fronds: [frond], topology: false });
+      } catch (error) {
+        // The previous app keeps serving: a dev loop that dies on a typo is worse than
+        // one that holds the last state which booted.
+        this.ui.error(`reload refused — ${(error as Error).message}`);
+        return;
+      }
+      const previous = hosted;
+      hosted = next;
+      current = createLocalRunner(next);
+      this.ui.step(`reloaded in ${Date.now() - started} ms`);
+      // Drain then release, on the OLD app and in that order: a call that started before
+      // the swap finishes on the app it started on.
+      await previous.drain(DRAIN_MS).catch((e) => this.ui.info(`drain: ${(e as Error).message}`));
+      await previous.dispose();
+    };
+
+    const config = await loadConfig(root);
+    const conventions = resolveConventions(config.conventions);
+    let settling: NodeJS.Timeout | undefined;
+    let watched = 0;
+
+    for (const path of hosted.fronds.flatMap((f) => watchPathsOf(f, root, conventions))) {
+      try {
+        watch(path, { recursive: true }, () => {
+          clearTimeout(settling);
+          settling = setTimeout(() => { void reload(); }, SETTLE_MS);
+        });
+        watched++;
+      } catch {
+        // An absent convention directory IS the convention — the same silence the scan keeps.
+      }
+    }
+
+    this.ui.info(`watching ${watched} path(s) — Ctrl-C pour arrêter.`);
   }
 }

package/app/commands/grant-material.ts

@@ -0,0 +1,5 @@
+/** Where the root lives. `.fougere/` already holds generated local state. */
+export const ROOT_KEY = '.fougere/root.key';
+
+/** A PEM spans lines and an env var carrying one survives compose, systemd and CI poorly. */
+export const packed = (pem: string) => Buffer.from(pem, 'utf8').toString('base64');