@fougere/core 0.2.0-alpha.2 → 0.4.0-alpha.0

package/src/identity.ts

@@ -0,0 +1,235 @@
+/**
+ * Who is calling — the proof, not the claim.
+ *
+ * `InvocationContext.state` is what a caller SAYS about itself, and a split receiver
+ * used to believe it: identity read straight off the wire, so a reader could post
+ * `{ state: { user: { role: 'admin' } } }` and be one. This module is what turns that
+ * sack into something a receiver establishes instead of accepts.
+ *
+ * Two signatures, one public key to distribute:
+ *
+ *   GRANT      the root says "this key is `blog`"   — issued once, at deployment
+ *   ENVELOPE   `blog` says "here is my whole call"   — signed per call
+ *
+ * The envelope binds the CALL and not only its state: address, params, query, a digest
+ * of the body. Signing the state alone proved WHO without proving WHAT, so anyone on the
+ * wire could replay a captured envelope against another operation for as long as it
+ * stayed valid — `post.list` re-sent as `post.delete`, same signature, still good.
+ *
+ * A receiver holds the root's public key and nothing else: it validates any frond it
+ * has never seen, which is what a per-caller list could not do. The private root key
+ * signs grants and never leaves the machine that issued them.
+ *
+ * Ed25519 and a JWS-shaped grant rather than X.509: node can PARSE a certificate but
+ * not ISSUE one, so a real chain would mean openssl or a library. The grant says the
+ * same thing — a name bound to a public key, signed by the root — with no dependency.
+ *
+ * The Ed25519 itself comes through `#crypto`, which has two realizations: `node:crypto`
+ * everywhere, WebCrypto under `workerd`. Everything here is therefore async — WebCrypto
+ * has no synchronous form — and a key is parsed ONCE, into a `Signer` or a `Verifier`,
+ * never per call. Making the keys and issuing grants happen at a deployment and live in
+ * `identity-keys.ts`, on the Node entry.
+ */
+import { crypto } from '#crypto';
+import type { PublicJwk, Signer, Verifier } from './crypto/port.js';
+import { b64url, unb64url, bytesOf, textOf, unb64 } from './crypto/encoding.js';
+import type { SignedCall } from './wire/call.js';
+
+export type { SignedCall } from './wire/call.js';
+
+/** How long a call envelope stays valid. A signed call is not a session. */
+const ENVELOPE_TTL_MS = 60_000;
+/** Clock skew tolerated on both sides of a validity window. */
+const SKEW_MS = 30_000;
+
+/** What a deployment hands a frond that CALLS: its own key, and the root's word for it. */
+export interface FrondIdentity {
+  /** The frond's private key, PEM (PKCS#8). */
+  privateKey: string;
+  /** The root's statement binding this frond's name to its public key. */
+  grant: string;
+}
+
+/** The body's fingerprint. Absence and explicit null are different signed calls. */
+async function digestOf(body: unknown): Promise<string> {
+  // The tag is outside the caller value, so no user object can collide with it. JSON's
+  // own omission rule still applies inside `value`, matching what crosses the wire.
+  const canonical = body === undefined
+    ? { kind: 'undefined' }
+    : { kind: 'value', value: body };
+  return b64url(await crypto.sha256(bytesOf(JSON.stringify(canonical))));
+}
+
+/** What the envelope pins, as one comparable value. */
+async function boundTo(call: SignedCall) {
+  return {
+    entity: call.entity,
+    op: call.op,
+    params: call.params ?? {},
+    query: call.query ?? {},
+    body: await digestOf(call.body),
+  };
+}
+
+/** What `verifyEnvelope` establishes — never what the caller asked for. */
+export interface VerifiedCall {
+  /** The frond that signed, as the root named it. */
+  caller: string;
+  /** The state it asserted, now proven to come from `caller`. */
+  state: Record<string, unknown>;
+}
+
+/** A JWS compact serialization, signed with Ed25519. */
+async function signJws(header: object, payload: object, signer: Signer): Promise<string> {
+  const signingInput = `${b64url(JSON.stringify(header))}.${b64url(JSON.stringify(payload))}`;
+  return `${signingInput}.${b64url(await signer.sign(bytesOf(signingInput)))}`;
+}
+
+/**
+ * The payload, once the signature holds. Throws rather than returning a falsy value:
+ * every caller here is deciding whether to admit a call, and an unverified payload
+ * must never be reachable by forgetting a check.
+ */
+async function verifyJws(token: string, verifier: Verifier, what: string): Promise<Record<string, unknown>> {
+  const parts = token.split('.');
+  if (parts.length !== 3) throw new Error(`Malformed ${what}`);
+  const [encodedHeader, encodedPayload, encodedSignature] = parts;
+  if (!await verifier.verify(bytesOf(`${encodedHeader}.${encodedPayload}`), unb64url(encodedSignature))) {
+    throw new Error(`Bad ${what} signature`);
+  }
+  const payload = JSON.parse(textOf(unb64url(encodedPayload))) as Record<string, unknown>;
+  const now = Date.now();
+  if (typeof payload.exp === 'number' && now > payload.exp + SKEW_MS) throw new Error(`Expired ${what}`);
+  if (typeof payload.nbf === 'number' && now < payload.nbf - SKEW_MS) throw new Error(`${what} not yet valid`);
+  return payload;
+}
+
+/** Read a JWS header without verifying anything — only to find which key to verify WITH. */
+function headerOf(token: string): Record<string, unknown> {
+  const encodedHeader = token.split('.')[0];
+  if (!encodedHeader) throw new Error('Malformed envelope');
+  return JSON.parse(textOf(unb64url(encodedHeader))) as Record<string, unknown>;
+}
+
+/**
+ * Sign one call, whole: who is asking, what is asked, and on whose behalf.
+ *
+ * The private key is parsed on every call here, which is the convenience form. A process
+ * that signs in a request path builds its signer once — `identityFromEnv` does exactly
+ * that, and `sign` on the value it returns holds the parsed key.
+ */
+export async function signEnvelope(identity: FrondIdentity, call: SignedCall): Promise<string> {
+  return sealWith(await crypto.signerOf(identity.privateKey), identity.grant, call);
+}
+
+/** The same envelope, against a key someone already parsed. */
+async function sealWith(signer: Signer, grant: string, call: SignedCall): Promise<string> {
+  const now = Date.now();
+  const { sub } = JSON.parse(textOf(unb64url(grant.split('.')[1]))) as { sub: string };
+  return signJws(
+    { alg: 'EdDSA', typ: 'fougere-call', grant },
+    { iss: sub, state: call.state ?? {}, bound: await boundTo(call), iat: now, exp: now + ENVELOPE_TTL_MS },
+    signer,
+  );
+}
+
+/**
+ * Establish the caller, or throw. Order matters: the grant is checked against the ROOT
+ * first, and only the key it carries verifies the envelope — reading the envelope's own
+ * claim of who it is before that would be believing the thing under examination.
+ */
+export async function verifyEnvelope(token: string, rootPublicKey: string, presented: SignedCall): Promise<VerifiedCall> {
+  return openWith(await crypto.verifierOf(rootPublicKey), token, presented);
+}
+
+/** The same check, against a root key someone already parsed. */
+async function openWith(root: Verifier, token: string, presented: SignedCall): Promise<VerifiedCall> {
+  const { grant } = headerOf(token);
+  if (typeof grant !== 'string') throw new Error('Envelope carries no grant');
+
+  const granted = await verifyJws(grant, root, 'grant');
+  if (typeof granted.sub !== 'string' || typeof granted.jwk !== 'object' || granted.jwk === null) {
+    throw new Error('Grant names no frond');
+  }
+
+  const payload = await verifyJws(token, await crypto.verifierOf(granted.jwk as PublicJwk), 'envelope');
+
+  // The grant is the authority on the name; the envelope only repeats it. They disagree
+  // when a frond signs under someone else's name with its own key.
+  if (payload.iss !== granted.sub) throw new Error(`Envelope signed by '${granted.sub}' claims to be '${String(payload.iss)}'`);
+
+  // The signature says this envelope was made by `blog`; this says it was made for THIS
+  // call. Without it a captured envelope is a blank cheque until it expires.
+  const bound = JSON.stringify(payload.bound);
+  if (bound !== JSON.stringify(await boundTo(presented))) {
+    throw new Error(`Envelope was signed for a different call than ${presented.entity}.${presented.op}`);
+  }
+
+  return {
+    caller: granted.sub,
+    state: (payload.state as Record<string, unknown>) ?? {},
+  };
+}
+
+/** The two halves a boot needs, and the environment they come from. */
+export interface CallIdentity {
+  /**
+   * Signs an outgoing call, whole. Absent when this process holds no key — it only answers.
+   *
+   * A promise because WebCrypto has no synchronous form. On Node the work stays
+   * synchronous inside and only the answer is wrapped: measured at 14.28 µs awaited
+   * against 14.30 µs called directly, while WebCrypto on the same curve costs 22.72.
+   */
+  sign?: (call: SignedCall) => Promise<string>;
+  /** Establishes an incoming caller, against the call that actually arrived. */
+  verify?: (identity: string, presented: SignedCall) => Promise<VerifiedCall>;
+  /** Refuse an unsigned call. True exactly when a root is trusted. */
+  requireIdentity: boolean;
+}
+
+/**
+ * A PEM, however the deployment chose to carry it.
+ *
+ * A PEM is multi-line and an environment variable that spans lines survives poorly —
+ * docker-compose, systemd and CI secret stores each mangle it differently — so
+ * `fougere keys` prints base64. Both forms are read here rather than one being decreed:
+ * a human pasting a real PEM is not making a mistake.
+ */
+function pemOf(value: string): string {
+  return value.trimStart().startsWith('-----') ? value : textOf(unb64(value));
+}
+
+/**
+ * What the deployment injected, read once at boot.
+ *
+ * Three variables, no config key: a private key never belongs in a committed file, and
+ * `fougere keys` prints exactly these. A process may hold either half or both — a frond
+ * that only answers has no key, one that only calls trusts no root, one in the middle
+ * does both.
+ *
+ * Trusting a root IS asking to refuse: there is no separate flag, because a deployment
+ * that names an authority and then accepts unsigned calls has said two things at once.
+ */
+export async function identityFromEnv(env: Record<string, string | undefined> = envOfProcess()): Promise<CallIdentity> {
+  const root = env.FOUGERE_ROOT_KEY ? pemOf(env.FOUGERE_ROOT_KEY) : undefined;
+  const privateKey = env.FOUGERE_KEY ? pemOf(env.FOUGERE_KEY) : undefined;
+  const grant = env.FOUGERE_GRANT;
+
+  // Async because the keys are parsed HERE, once, and both closures below capture the
+  // result: importing a key is per-key work, and a per-call import would put it inside
+  // every request. This is the one gesture a boot pays for.
+  const signer = privateKey ? await crypto.signerOf(privateKey) : undefined;
+  const rootKey = root ? await crypto.verifierOf(root) : undefined;
+
+  return {
+    ...(signer && grant ? { sign: (call: SignedCall) => sealWith(signer, grant, call) } : {}),
+    ...(rootKey ? { verify: (identity: string, presented: SignedCall) => openWith(rootKey, identity, presented) } : {}),
+    requireIdentity: Boolean(root),
+  };
+}
+
+/** A Worker has no `process`. Reading the global is what makes an absent one an empty env. */
+function envOfProcess(): Record<string, string | undefined> {
+  const proc = (globalThis as { process?: { env?: Record<string, string | undefined> } }).process;
+  return proc?.env ?? {};
+}

package/src/imports.ts

@@ -0,0 +1,123 @@
+/**
+ * A frond reaching into another one by FILE PATH.
+ *
+ * `verify()` next door answers the same question — does this app survive a split? — from
+ * the MODEL: what a constructor asks for, what a parameter is typed. This one can only be
+ * answered from the source text, so it reads files and lives apart rather than making
+ * `verify` lose the sentence that says it reads none.
+ *
+ * ```ts
+ * import User from '../../user/entities/User.js';   // these two folders are neighbours
+ * import User from '@fronds/user/entities/User';    // I depend on the frond named user
+ * ```
+ *
+ * Both resolve today, and that is exactly the trap: a frond declared in `remotes:` is
+ * still scanned, its code is still on this disk, so the relative form keeps working right
+ * up to the day the folder is not there — an extraction into its own repository, an image
+ * that copies one frond. Then it fails at build time, with a message about a file path
+ * that says nothing about the model.
+ *
+ * So a relative path across a boundary is not a bug. It is a **colocation constraint that
+ * nothing declares**: real, load-bearing, and invisible to the scan, to the identity card
+ * and to `remotes:`. The named form states the same dependency in terms the model can
+ * read — and it is the form `fougere sync` writes, so it survives the move.
+ */
+import type ts from '@typescript/typescript6';
+import { readdir, readFile } from 'node:fs/promises';
+import { join, resolve, dirname, relative, isAbsolute } from 'node:path';
+import type { FrondDescriptor } from './scan/frond.js';
+
+let _ts: typeof ts | undefined;
+async function loadTs(): Promise<typeof ts> {
+  if (!_ts) _ts = (await import('@typescript/typescript6')).default;
+  return _ts;
+}
+
+export interface CrossFrondImport {
+  /** Stable rule name — the same vocabulary `verify()` uses. */
+  rule: 'cross-frond-import';
+  /** The frond doing the reaching. */
+  frond: string;
+  filePath: string;
+  /** The specifier as written. */
+  specifier: string;
+  /** The frond the path lands in — absent when it lands outside every frond. */
+  target?: string;
+  message: string;
+}
+
+/** Is `child` inside `parent`? Path-based, so it says nothing about either existing. */
+function inside(parent: string, child: string): boolean {
+  const rel = relative(parent, child);
+  return rel !== '' && !rel.startsWith('..') && !isAbsolute(rel);
+}
+
+async function sourcesUnder(dir: string): Promise<string[]> {
+  const out: string[] = [];
+  let entries;
+  try {
+    entries = await readdir(dir, { withFileTypes: true });
+  } catch {
+    // Unreadable is the scan's complaint, not this rule's — and an absent directory is
+    // ordinary (a frond with no handlers).
+    return out;
+  }
+  for (const entry of entries) {
+    if (entry.name === 'node_modules' || entry.name.startsWith('.')) continue;
+    const full = join(dir, entry.name);
+    if (entry.isDirectory()) out.push(...await sourcesUnder(full));
+    else if (entry.name.endsWith('.ts') && !entry.name.endsWith('.d.ts')) out.push(full);
+  }
+  return out;
+}
+
+/**
+ * Every relative import that resolves outside its own frond.
+ *
+ * `preProcessFile` rather than a regex or a full parse: it is TypeScript's own scanner for
+ * exactly this question, so `// import x from '../../other'` in a comment is not a finding
+ * and a specifier split across lines still is.
+ */
+export async function crossFrondImports(
+  fronds: readonly Pick<FrondDescriptor, 'name' | 'source'>[],
+): Promise<CrossFrondImport[]> {
+  const typescript = await loadTs();
+  // `source.package` is the scoped name the scan already resolved — the remedy this rule
+  // prints must be the name that actually resolves, not one rebuilt from a prefix here.
+  const roots = fronds.map((frond) => ({
+    name: frond.name, path: resolve(frond.source.path), package: frond.source.package,
+  }));
+  const found: CrossFrondImport[] = [];
+
+  for (const root of roots) {
+    for (const filePath of await sourcesUnder(root.path)) {
+      const text = await readFile(filePath, 'utf8').catch(() => undefined);
+      if (text === undefined) continue;
+
+      for (const { fileName: specifier } of typescript.preProcessFile(text, true, true).importedFiles) {
+        if (!specifier.startsWith('.')) continue;
+        const landed = resolve(dirname(filePath), specifier);
+        if (inside(root.path, landed)) continue;
+
+        const target = roots.find((other) => other.name !== root.name && inside(other.path, landed));
+        found.push({
+          rule: 'cross-frond-import',
+          frond: root.name,
+          filePath,
+          specifier,
+          ...(target ? { target: target.name } : {}),
+          message: target
+            ? `'${specifier}' resolves into frond '${target.name}'. A relative path states that `
+              + `these two fronds share a directory tree — a constraint nothing declares, and one `
+              + `that nothing here can see. Write '${target.package}/…' instead: it says the `
+              + `same dependency in terms the model reads, and it is the form \`fougere sync\` writes, `
+              + `so it survives '${target.name}' moving out.`
+            : `'${specifier}' resolves outside frond '${root.name}', into no frond at all. `
+              + `Whatever it reaches is not part of any frond's contract, so nothing carries it `
+              + `when this one is deployed on its own.`,
+        });
+      }
+    }
+  }
+  return found;
+}

package/src/index.ts

@@ -0,0 +1,106 @@
+/**
+ * What a consumer writes, and nothing else.
+ *
+ * `exports` publishes this barrel and `./contract`, so an import that is not here
+ * cannot be reached from outside the package at all — which is what makes this file
+ * the contract rather than a convenience. The machinery the boot uses to keep its own
+ * promises stays inside: container keys, the binding plan, the mixin's runtime
+ * accessors, the config merge. Measured on 2026-08-16, none of them had a single
+ * importer anywhere in the workspace.
+ */
+export { createApp } from './boot/bootstrap.js';
+export { orderSeeds, runSeeds, seeding } from './boot/seed.js';
+export { AppLifecycle, AppLifecycle as Lifecycle, migrating } from './boot/AppLifecycle.js';
+export type { Extension } from './boot/AppLifecycle.js';
+export { defineFougere } from './define.js';
+export type { AdapterConfig, FougereConfig } from './config-loader.js';
+export type { FrondConfig, OperationOverride } from './frond-config.js';
+export { buildGraph, clusterEntities, suggestSplit, type EntityNode, type DomainCluster } from './graph.js';
+export { Crud } from './prefab/crud.js';
+export type { CrudOps, CrudOpName, CrudViews, CrudConstructor } from './prefab/crud.js';
+export { Mirror } from './prefab/mirror.js';
+export type { MirrorOf, MirrorConstructor, Refreshed } from './prefab/mirror.js';
+export { Presenter } from './prefab/presenter.js';
+export type { PresenterViews } from './prefab/presenter.js';
+export { Collector } from './prefab/collector.js';
+export { Repository, type RepositoryOf, type RepositoryConstructor, type AggregateOf, type AggregateConstructor } from './prefab/repository.js';
+export { Invocation, canonicalInvocation, EMPTY_INVOCATION } from './contract/Invocation.js';
+export type { InvocationContext, InvocationInput } from './contract/Invocation.js';
+export { Call } from './contract/Call.js';
+export { RouteAddress } from './contract/RouteAddress.js';
+export type { RouteAddressInput } from './contract/RouteAddress.js';
+export { DispatchLifecycle } from './dispatch/DispatchLifecycle.js';
+export { Dispatcher } from './dispatch/Dispatcher.js';
+export type { DispatchEvent, DispatchObserver } from './dispatch/DispatchEvent.js';
+export type { DispatchPort } from './dispatch/DispatchPort.js';
+export {
+  inferOperationKind,
+  resolveContracts,
+  resolveIsReadOp,
+  resolveOperationKind,
+} from './wire/operation.js';
+export type {
+  OperationContract,
+  OperationKind,
+  OperationKindInference,
+  OperationsMap,
+  ParsedParam,
+  ParsedType,
+} from './wire/operation.js';
+export {
+  EFFECTIVE_OPERATION_SEMANTICS,
+  EffectiveOperationModel,
+  resolveEffectiveOperations,
+} from './effective-operation.js';
+export type {
+  EffectiveCollector,
+  EffectiveOperation,
+  EffectiveOperationOptions,
+  EffectiveOperationsMap,
+  EffectiveParameter,
+} from './effective-operation.js';
+export type { ModuleLoader } from './loader.js';
+export { FougereError, ErrorCode, validationErrorsOf, type FougereErrorOptions } from './wire/errors.js';
+export type { OperationContext, AppNext, AppMiddleware } from './wire/middleware.js';
+export { createLocalRunner, createAppRunner, assertIdentityCard } from './wire/call.js';
+export type {
+  FrondCall, Transport, IdentityCard, CardOp, Facade, RpcAnswer,
+  TopologyReport, FrondPlacement, Edge,
+} from './wire/call.js';
+export { type Emit, type Fact } from './emit.js';
+export { callValueOf } from './contract.js';
+export type { CallValue } from './contract.js';
+export { toHttpError, toPublicError } from './wire/http-error.js';
+export { loggerMiddleware } from './wire/loggerMiddleware.js';
+export { Logger, setLogLevel, logLevel, envLevel, onLog } from './builtins/logger.js';
+export type { LogLevel, LogRecord, LogSink } from './builtins/logger.js';
+// What a re-read config changes in a running process — and what it cannot.
+export { applyConfig, type ConfigApplication } from './boot/apply.js';
+export { Config } from './builtins/config.js';
+export type { EntityOrm, OrmFactory, ListOptions, ListResult, Together } from './orm.js';
+export { togetherKeyOf, membersOfTogetherKey } from './orm.js';
+export type { App, CreateAppOptions } from './boot/types.js';
+export type {
+  ScanResult,
+  ScanDiagnostic,
+  FrondDescriptor,
+  FrondSource,
+  ProviderEntry,
+  EntityEntry,
+  HandlerEntry,
+  SeedEntry,
+  SeedFactory,
+  PresenterEntry,
+  PresenterFieldMeta,
+  CollectorEntry,
+} from './scan/frond.js';
+export type { AuthConfig, AuthContext, AuthRuntime } from './boot/auth.js';
+export { Fronds } from './scan/Fronds.js';
+export { verify, assertSplittable, type Violation } from './verify.js';
+// Same question as verify(), answered from the source text instead of the model.
+export type { CrossFrondImport } from './imports.js';
+// Who is calling, established rather than accepted — the proof beside `state`'s claim.
+// `generateKeyPair` and `issueGrant` are NOT here: they make keys at a deployment and
+// need `node:crypto` for a gesture WebCrypto has no equal of. They sit on `/node`.
+export { signEnvelope, verifyEnvelope, identityFromEnv } from './identity.js';
+export type { FrondIdentity, VerifiedCall, CallIdentity, SignedCall } from './identity.js';

package/src/loader.ts

@@ -0,0 +1,41 @@
+/**
+ * How a source file becomes a module — one registry, two readers.
+ *
+ * The scanner loads fronds and `config-loader` loads a config, and both must use the
+ * loader the host installed: a TS file needs jiti under Nuxt and plain `import` under
+ * tsx. It lived in `scan/scanner.ts`, so reading a config dragged the scanner, its AST
+ * parser and the TypeScript compiler behind it.
+ */
+import { pathToFileURL } from 'node:url';
+
+/**
+ * Module loader — can be swapped (e.g. jiti for TS files in Nuxt context).
+ *
+ * `fresh` asks for a file that may have changed since it was last read. Every loader
+ * caches, so without it a second read of an EDITED file hands back the first one —
+ * which is what re-reading a config is for. A loader that cannot honour it may ignore
+ * the flag; it then answers with what it already had.
+ */
+export type ModuleLoader = (
+  filePath: string,
+  options?: { fresh?: boolean },
+) => Promise<Record<string, unknown>>;
+
+const defaultLoader: ModuleLoader = async (filePath, options) => {
+  // On the URL, never on the path: `pathToFileURL` percent-encodes a `?` into the
+  // filename, and the import then looks for a file whose name ends in `%3Fv=…`.
+  const url = pathToFileURL(filePath).href;
+  return await import(options?.fresh ? `${url}?v=${Date.now()}` : url);
+};
+
+let activeLoader: ModuleLoader = defaultLoader;
+
+/** Override the module loader used by the scanner (e.g. for jiti/tsx support). */
+export function setModuleLoader(loader: ModuleLoader): void {
+  activeLoader = loader;
+}
+
+/** Used by config-loader to load fougere.config.ts via the same TS-aware loader. */
+export function getModuleLoader(): ModuleLoader {
+  return activeLoader;
+}

package/src/node.ts

@@ -0,0 +1,28 @@
+/**
+ * What Fougere does with a filesystem — the half of core that a Worker cannot run.
+ *
+ * The line is not "build vs runtime": `boot()` and `loadConfig` run in production, on a
+ * server, every time. It is whether the thing reaches for a disk. Everything here does,
+ * transitively, and nothing on the main entry does — which is what lets a bundler for a
+ * runtime without `node:fs` trace the main entry and find no builtin at all.
+ *
+ * The third entry, `@fougere/core/contract`, answers a different question: what crosses a
+ * process boundary. A foreign frond reads it without reading our boot.
+ */
+export { boot } from './boot/boot.js';
+
+export { scanProject, frondAliases } from './scan/scanner.js';
+export {
+  type Conventions, type ConventionsInput, DEFAULT_CONVENTIONS,
+  resolveConventions, frondPackage, frondDirsOf, providerDirsOf, watchPathsOf,
+} from './scan/conventions.js';
+export { emitScan, type EmitOptions } from './scan/emit.js';
+export { setModuleLoader, getModuleLoader } from './loader.js';
+export { loadConfig, loadCascadedConfig } from './config-loader.js';
+export { defineFrond } from './frond-config.js';
+export { crossFrondImports } from './imports.js';
+
+// Making a key and binding a name to it happen once, at a deployment, on a machine with
+// a filesystem — the CLI speaking. Verifying happens per call, everywhere, and stays on
+// the main entry behind `#crypto`.
+export { generateKeyPair, issueGrant } from './identity-keys.js';