@fougere/core 0.5.0-alpha.1 → 0.7.0-alpha.0

package/dist/emit.d.ts

@@ -1,50 +1,12 @@
-/**
- * What an emitter injects. Resolved by type, like `EntityOrm<Post>` and `Facade<T>`.
- *
- * The returned promise settles when the fact has been **dispatched**, never when it has
- * been handled: a subscriber's failure is its own. The `EventBus` this replaces did
- * `await Promise.all(handlers)` and handed their rejections back, which made a publication
- * hostage to its own indexer.
- */
+/** What an emitter injects. */
 export type Emit<T> = (fact: T) => Promise<void>;
-/**
- * What a subscriber accepts — and what it PROMISES about itself.
- *
- * Not merely "I subscribe". Push is the strict mode and pull is a special case of it: an
- * op written for push is correct when called directly, the reverse is false. So this
- * wrapper commits the operation to three things its author must honour, because no type
- * can check them:
- *
- * 1. **replayable** — delivery is at-least-once the day a broker sits underneath;
- * 2. **no reader for its return** — nobody receives what it hands back;
- * 3. **owner of its failures** — they reach a log, never the emitter.
- *
- * It is the identity at runtime. The scan reads the written name, which is the whole
- * mechanism: `binding.ts` sees `Fact<X>` and binds the parameter as a fact instead of
- * letting it fall through to "everything else — body".
- */
+/** What a subscriber accepts — and what it PROMISES about itself. */
 export type Fact<T> = T;
-/**
- * The container key of an emission — THE one place that spells the format.
- *
- * Its dual is right below, because the boot reads the fact back out of a handler's `deps`
- * to know which emissions to register. A key and the way to undo it belong together: the
- * pair that is split is the pair that drifts.
- */
+/** The container key of an emission — THE one place that spells the format. */
 export declare function emitKeyOf(fact: string): string;
 /** The fact behind an emission key, or `undefined` when the key is not one. */
 export declare function factOfEmitKey(key: string): string | undefined;
-/**
- * What a set of handlers ANNOUNCES — `Emit<T>` read back out of their dependencies.
- *
- * Two readers, which is exactly why it is a function and not a line: the boot registers one
- * emission value per name, and the identity card publishes the same set. Spelled twice they
- * would drift the day an emission stops being a constructor dependency.
- *
- * The dual — what a handler ACCEPTS — is not here, because it is not read the same way: a
- * `Fact<T>` parameter is a fact about one operation, and `computeBindingPlan` has already
- * written it into the plan (`app.listensTo()`).
- */
+/** What a set of handlers ANNOUNCES — `Emit<T>` read back out of their dependencies. */
 export declare function factsAnnouncedBy(handlers: readonly {
     deps: readonly string[];
 }[]): string[];

package/dist/emit.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"emit.d.ts","sourceRoot":"","sources":["../src/emit.ts"],"names":[],"mappings":"AAuBA;;;;;;;GAOG;AACH,MAAM,MAAM,IAAI,CAAC,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;AAEjD;;;;;;;;;;;;;;;GAeG;AACH,MAAM,MAAM,IAAI,CAAC,CAAC,IAAI,CAAC,CAAC;AAExB;;;;;;GAMG;AACH,wBAAgB,SAAS,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAE9C;AAID,+EAA+E;AAC/E,wBAAgB,aAAa,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS,CAI7D;AAED;;;;;;;;;;GAUG;AACH,wBAAgB,gBAAgB,CAAC,QAAQ,EAAE,SAAS;IAAE,IAAI,EAAE,SAAS,MAAM,EAAE,CAAA;CAAE,EAAE,GAAG,MAAM,EAAE,CAO3F"}
+{"version":3,"file":"emit.d.ts","sourceRoot":"","sources":["../src/emit.ts"],"names":[],"mappings":"AAGA,+BAA+B;AAC/B,MAAM,MAAM,IAAI,CAAC,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;AAEjD,qEAAqE;AACrE,MAAM,MAAM,IAAI,CAAC,CAAC,IAAI,CAAC,CAAC;AAExB,+EAA+E;AAC/E,wBAAgB,SAAS,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAE9C;AAID,+EAA+E;AAC/E,wBAAgB,aAAa,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS,CAI7D;AAED,wFAAwF;AACxF,wBAAgB,gBAAgB,CAAC,QAAQ,EAAE,SAAS;IAAE,IAAI,EAAE,SAAS,MAAM,EAAE,CAAA;CAAE,EAAE,GAAG,MAAM,EAAE,CAO3F"}

package/dist/emit.js

@@ -1,32 +1,6 @@
-/**
- * Announcing a fact — the half of the topology `remotes:` never covered.
- *
- * Every other call in Fougere names **one** recipient: `remotes` names one address per
- * frond, `Facade<T>` resolves one door. `Emit<T>` names a **subject** instead, and the
- * number of readers is not the emitter's business.
- *
- * ```ts
- * constructor(private published: Emit<PostPublished>) {}
- * await this.published({ id, title });          // I say it happened. I do not know who cares.
- *
- * async reindex(fact: Fact<PostPublished>) {}   // any handler, any frond. Nothing to register.
- * ```
- *
- * **It is a resolver, not a channel.** A bus moves messages — it has a queue, an envelope
- * format, a delivery semantic. This has none of that: it answers *who*, then hands over to
- * the call path that already exists. It is `resolve` returning N things instead of one.
- * That is also why temporal decoupling stays out of reach: a resolver holds nothing. The
- * day at-least-once is wanted, a real channel goes UNDER this, in the transport — the
- * dispatch line becomes a publish and a consumer calls the same door on the far side.
- */
+/** Announcing a fact — the half of the topology `remotes:` never covered. */
 import { lowerFirst } from '@fougere/schema';
-/**
- * The container key of an emission — THE one place that spells the format.
- *
- * Its dual is right below, because the boot reads the fact back out of a handler's `deps`
- * to know which emissions to register. A key and the way to undo it belong together: the
- * pair that is split is the pair that drifts.
- */
+/** The container key of an emission — THE one place that spells the format. */
 export function emitKeyOf(fact) {
     return `${lowerFirst(fact)}Emit`;
 }
@@ -37,17 +11,7 @@ export function factOfEmitKey(key) {
         ? key.slice(0, -SUFFIX.length)
         : undefined;
 }
-/**
- * What a set of handlers ANNOUNCES — `Emit<T>` read back out of their dependencies.
- *
- * Two readers, which is exactly why it is a function and not a line: the boot registers one
- * emission value per name, and the identity card publishes the same set. Spelled twice they
- * would drift the day an emission stops being a constructor dependency.
- *
- * The dual — what a handler ACCEPTS — is not here, because it is not read the same way: a
- * `Fact<T>` parameter is a fact about one operation, and `computeBindingPlan` has already
- * written it into the plan (`app.listensTo()`).
- */
+/** What a set of handlers ANNOUNCES — `Emit<T>` read back out of their dependencies. */
 export function factsAnnouncedBy(handlers) {
     return [...new Set(handlers
             .flatMap((handler) => handler.deps)

package/dist/emit.js.map

@@ -1 +1 @@
-{"version":3,"file":"emit.js","sourceRoot":"","sources":["../src/emit.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,OAAO,EAAE,UAAU,EAAE,MAAM,iBAAiB,CAAC;AA8B7C;;;;;;GAMG;AACH,MAAM,UAAU,SAAS,CAAC,IAAY;IACpC,OAAO,GAAG,UAAU,CAAC,IAAI,CAAC,MAAM,CAAC;AACnC,CAAC;AAED,MAAM,MAAM,GAAG,MAAM,CAAC;AAEtB,+EAA+E;AAC/E,MAAM,UAAU,aAAa,CAAC,GAAW;IACvC,OAAO,GAAG,CAAC,MAAM,GAAG,MAAM,CAAC,MAAM,IAAI,GAAG,CAAC,QAAQ,CAAC,MAAM,CAAC;QACvD,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,MAAM,CAAC,MAAM,CAAC;QAC9B,CAAC,CAAC,SAAS,CAAC;AAChB,CAAC;AAED;;;;;;;;;;GAUG;AACH,MAAM,UAAU,gBAAgB,CAAC,QAAgD;IAC/E,OAAO,CAAC,GAAG,IAAI,GAAG,CAChB,QAAQ;aACL,OAAO,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC;aAClC,GAAG,CAAC,aAAa,CAAC;aAClB,MAAM,CAAC,CAAC,IAAI,EAAkB,EAAE,CAAC,IAAI,KAAK,SAAS,CAAC,CACxD,CAAC,CAAC;AACL,CAAC"}
+{"version":3,"file":"emit.js","sourceRoot":"","sources":["../src/emit.ts"],"names":[],"mappings":"AAAA,6EAA6E;AAC7E,OAAO,EAAE,UAAU,EAAE,MAAM,iBAAiB,CAAC;AAQ7C,+EAA+E;AAC/E,MAAM,UAAU,SAAS,CAAC,IAAY;IACpC,OAAO,GAAG,UAAU,CAAC,IAAI,CAAC,MAAM,CAAC;AACnC,CAAC;AAED,MAAM,MAAM,GAAG,MAAM,CAAC;AAEtB,+EAA+E;AAC/E,MAAM,UAAU,aAAa,CAAC,GAAW;IACvC,OAAO,GAAG,CAAC,MAAM,GAAG,MAAM,CAAC,MAAM,IAAI,GAAG,CAAC,QAAQ,CAAC,MAAM,CAAC;QACvD,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,MAAM,CAAC,MAAM,CAAC;QAC9B,CAAC,CAAC,SAAS,CAAC;AAChB,CAAC;AAED,wFAAwF;AACxF,MAAM,UAAU,gBAAgB,CAAC,QAAgD;IAC/E,OAAO,CAAC,GAAG,IAAI,GAAG,CAChB,QAAQ;aACL,OAAO,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC;aAClC,GAAG,CAAC,aAAa,CAAC;aAClB,MAAM,CAAC,CAAC,IAAI,EAAkB,EAAE,CAAC,IAAI,KAAK,SAAS,CAAC,CACxD,CAAC,CAAC;AACL,CAAC"}

package/dist/entry/facade.d.ts

@@ -0,0 +1,8 @@
+import type { DispatchPort } from '../dispatch/DispatchPort.js';
+type Operation = (...args: any[]) => unknown;
+/** Facade for a contract whose operation names are only known at discovery. */
+export declare function dynamicOperations(operation: (name: string) => Operation): Record<string, Operation>;
+/** Turns facade method calls into canonical dispatches. */
+export declare function facadeOperations(dispatcher: DispatchPort, entity: string, operationNames?: Iterable<string>, surface?: string): Record<string, Operation>;
+export {};
+//# sourceMappingURL=facade.d.ts.map

package/dist/entry/facade.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"facade.d.ts","sourceRoot":"","sources":["../../src/entry/facade.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,6BAA6B,CAAC;AAEhE,KAAK,SAAS,GAAG,CAAC,GAAG,IAAI,EAAE,GAAG,EAAE,KAAK,OAAO,CAAC;AAE7C,+EAA+E;AAC/E,wBAAgB,iBAAiB,CAAC,SAAS,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,SAAS,GAAG,MAAM,CAAC,MAAM,EAAE,SAAS,CAAC,CAcnG;AAED,2DAA2D;AAC3D,wBAAgB,gBAAgB,CAC9B,UAAU,EAAE,YAAY,EACxB,MAAM,EAAE,MAAM,EACd,cAAc,CAAC,EAAE,QAAQ,CAAC,MAAM,CAAC,EACjC,OAAO,CAAC,EAAE,MAAM,GACf,MAAM,CAAC,MAAM,EAAE,SAAS,CAAC,CAa3B"}

package/dist/entry/facade.js

@@ -0,0 +1,28 @@
+import { Call } from '../wire/call.js';
+import { RouteAddress } from '../wire/RouteAddress.js';
+/** Facade for a contract whose operation names are only known at discovery. */
+export function dynamicOperations(operation) {
+    const isOperationName = (name) => typeof name === 'string'
+        && name !== 'then'
+        && name !== 'toJSON'
+        && !Object.hasOwn(Object.prototype, name);
+    return new Proxy({}, {
+        get: (_target, name) => (isOperationName(name) ? operation(name) : undefined),
+        has: (_target, name) => isOperationName(name),
+        getOwnPropertyDescriptor: (_target, name) => (isOperationName(name)
+            ? { value: operation(name), writable: false, enumerable: true, configurable: true }
+            : undefined),
+    });
+}
+/** Turns facade method calls into canonical dispatches. */
+export function facadeOperations(dispatcher, entity, operationNames, surface) {
+    const operation = (name) => (invocation) => dispatcher.dispatch(new Call(new RouteAddress({
+        entity,
+        operation: name,
+        ...(surface !== undefined ? { surface } : {}),
+    }), invocation));
+    return operationNames
+        ? Object.fromEntries([...operationNames].map((name) => [name, operation(name)]))
+        : dynamicOperations(operation);
+}
+//# sourceMappingURL=facade.js.map

package/dist/entry/facade.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"facade.js","sourceRoot":"","sources":["../../src/entry/facade.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,IAAI,EAAE,MAAM,iBAAiB,CAAC;AAEvC,OAAO,EAAE,YAAY,EAAE,MAAM,yBAAyB,CAAC;AAKvD,+EAA+E;AAC/E,MAAM,UAAU,iBAAiB,CAAC,SAAsC;IACtE,MAAM,eAAe,GAAG,CAAC,IAAqB,EAAkB,EAAE,CAChE,OAAO,IAAI,KAAK,QAAQ;WACrB,IAAI,KAAK,MAAM;WACf,IAAI,KAAK,QAAQ;WACjB,CAAC,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,SAAS,EAAE,IAAI,CAAC,CAAC;IAE5C,OAAO,IAAI,KAAK,CAAC,EAAE,EAAE;QACnB,GAAG,EAAE,CAAC,OAAO,EAAE,IAAI,EAAE,EAAE,CAAC,CAAC,eAAe,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;QAC7E,GAAG,EAAE,CAAC,OAAO,EAAE,IAAI,EAAE,EAAE,CAAC,eAAe,CAAC,IAAI,CAAC;QAC7C,wBAAwB,EAAE,CAAC,OAAO,EAAE,IAAI,EAAE,EAAE,CAAC,CAAC,eAAe,CAAC,IAAI,CAAC;YACjE,CAAC,CAAC,EAAE,KAAK,EAAE,SAAS,CAAC,IAAI,CAAC,EAAE,QAAQ,EAAE,KAAK,EAAE,UAAU,EAAE,IAAI,EAAE,YAAY,EAAE,IAAI,EAAE;YACnF,CAAC,CAAC,SAAS,CAAC;KACf,CAAC,CAAC;AACL,CAAC;AAED,2DAA2D;AAC3D,MAAM,UAAU,gBAAgB,CAC9B,UAAwB,EACxB,MAAc,EACd,cAAiC,EACjC,OAAgB;IAEhB,MAAM,SAAS,GAAG,CAAC,IAAY,EAAa,EAAE,CAAC,CAAC,UAAU,EAAE,EAAE,CAAC,UAAU,CAAC,QAAQ,CAAC,IAAI,IAAI,CACzF,IAAI,YAAY,CAAC;QACf,MAAM;QACN,SAAS,EAAE,IAAI;QACf,GAAG,CAAC,OAAO,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KAC9C,CAAC,EACF,UAAU,CACX,CAAC,CAAC;IAEH,OAAO,cAAc;QACnB,CAAC,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC,GAAG,cAAc,CAAC,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,IAAI,EAAE,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAChF,CAAC,CAAC,iBAAiB,CAAC,SAAS,CAAC,CAAC;AACnC,CAAC"}

package/dist/entry/transport.d.ts

@@ -0,0 +1,5 @@
+import type { DispatchPort } from '../dispatch/DispatchPort.js';
+import type { Transport } from '../wire/call.js';
+/** Adapts the historical transport signature to the canonical dispatch port. */
+export declare function createTransportEntry(dispatcher: DispatchPort, surface?: string): Transport;
+//# sourceMappingURL=transport.d.ts.map

package/dist/entry/transport.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"transport.d.ts","sourceRoot":"","sources":["../../src/entry/transport.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,6BAA6B,CAAC;AAChE,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,iBAAiB,CAAC;AAEjD,gFAAgF;AAChF,wBAAgB,oBAAoB,CAAC,UAAU,EAAE,YAAY,EAAE,OAAO,CAAC,EAAE,MAAM,GAAG,SAAS,CAS1F"}

package/dist/entry/transport.js

@@ -0,0 +1,11 @@
+import { Call } from '../wire/call.js';
+import { RouteAddress } from '../wire/RouteAddress.js';
+/** Adapts the historical transport signature to the canonical dispatch port. */
+export function createTransportEntry(dispatcher, surface) {
+    return (legacy, invocation) => dispatcher.dispatch(new Call(new RouteAddress({
+        entity: legacy.entity,
+        operation: legacy.op,
+        ...(surface !== undefined ? { surface } : {}),
+    }), invocation));
+}
+//# sourceMappingURL=transport.js.map

package/dist/entry/transport.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"transport.js","sourceRoot":"","sources":["../../src/entry/transport.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,IAAI,EAAE,MAAM,iBAAiB,CAAC;AACvC,OAAO,EAAE,YAAY,EAAE,MAAM,yBAAyB,CAAC;AAIvD,gFAAgF;AAChF,MAAM,UAAU,oBAAoB,CAAC,UAAwB,EAAE,OAAgB;IAC7E,OAAO,CAAC,MAAM,EAAE,UAAU,EAAE,EAAE,CAAC,UAAU,CAAC,QAAQ,CAAC,IAAI,IAAI,CACzD,IAAI,YAAY,CAAC;QACf,MAAM,EAAE,MAAM,CAAC,MAAM;QACrB,SAAS,EAAE,MAAM,CAAC,EAAE;QACpB,GAAG,CAAC,OAAO,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KAC9C,CAAC,EACF,UAAU,CACX,CAAC,CAAC;AACL,CAAC"}

package/dist/frond-config.d.ts

@@ -1,44 +1,10 @@
 import type { EntityConstructor, SchemaView } from '@fougere/schema';
-import type { BindingPlan } from './boot/binding.js';
-/**
- * Per-operation override. Config takes precedence over conventions (isReadOp, facade lookup).
- *
- * Two families of keys, and they act at different depths:
- *
- * - **Resolution** (`kind`, `handler`, `method`) — intent and implementation, resolved
- *   once into core's `EffectiveOperation`; every local or remote door consumes it.
- * - **Projection** (`graphql`) — protocol vocabulary, read only by that adapter.
- * - **Contract** (`input`, `output`, `binding`) — what the op IS. Read by the façade,
- *   and this is the third producer of an {@link OperationContract}: a prefab DECLARES its
- *   ops (`Crud.__ops`), the scan DERIVES them from source, config STATES them outright.
- *   The façade cannot tell the three apart.
- *
- * Stating a contract here makes the scan optional rather than load-bearing. Two cases it
- * answers that nothing else does:
- * - a method inherited from an **installed** base class — the scan resolves nothing there
- *   (workspace-only heritage) and says nothing, so the op silently misses the façade;
- * - an operation inherited from a declaration unavailable to the project's type checker.
- *
- * Config wins over both other producers — it is the most explicit statement, made by
- * whoever assembles the app. Precedence: CLI > frond config > fougere config > scan >
- * conventions.
- */
+import type { BindingPlan } from './wire/binding.js';
+/** Per-operation override. */
 export interface OperationOverride {
-    /**
-     * Force operation kind, over the naming convention (`isReadOp`).
-     *
-     * The convention reads the NAME, which is a weak signal — an app naming its reads in
-     * domain terms (`ofBook`, `roots`, `bySlug`) matches no prefix and every one of them is
-     * published as a mutation and a POST. This is the only place that fixes it.
-     */
+    /** Force operation kind, over the naming convention (`isReadOp`). */
     kind?: 'query' | 'command';
-    /**
-     * The GraphQL root field this op answers to. Defaults to the method name.
-     *
-     * A GraphQL root is flat, so two handlers naming a method `ofBook` claim one field and
-     * the build is refused, naming both. Nothing is renamed for you: the root vocabulary is
-     * the app's, and a derived name would move the day a distant frond gained an entity.
-     */
+    /** The GraphQL root field this op answers to. */
     graphql?: string;
     /**
      * Handler class to delegate to (overrides the default `{Entity}Handler` lookup).
@@ -47,19 +13,9 @@ export interface OperationOverride {
     handler?: EntityConstructor;
     /** Method name on `handler` (defaults to the operation name). */
     method?: string;
-    /**
-     * CASL ability check (e.g. 'archive Post'). **Declared, not implemented** — no
-     * reader interprets it today, in any adapter. Kept as the named slot for the
-     * question rather than silently dropped, but do not rely on it: a config that
-     * states a policy is not enforced anywhere.
-     *
-     * Wiring it means adopting a rules engine, which is precisely what the design
-     * turns down: an identity-dependent right is judged INSIDE the operation
-     * (`publish` reads `post.authorId !== user.id`), and a door-dependent one is a
-     * surface. Neither needs a second vocabulary evaluated by a second engine.
-     */
+    /** CASL ability check (e.g. */
     policy?: string;
-    /** What judges the input. The view carries its own mode (`partial()` → patch). */
+    /** What validates the input. The view carries its own mode (`partial()` → patch). */
     input?: SchemaView;
     /**
      * Where each argument is read from — states what the scan would otherwise derive
@@ -72,18 +28,7 @@ export interface OperationOverride {
 export interface FrondConfig {
     /** Class names exposed as the frond's public contract (all surfaces). */
     expose?: string[];
-    /**
-     * The entities this frond may read ACROSS sources, by name.
-     *
-     * It is not a permission checked after the fact: the list IS the environment a
-     * cross-source query runs in — a source holding none of these is never opened, so
-     * its tables do not exist in that connection. `facadeFor` excludes an entity with no
-     * door on purpose ("it would publish the auth tables to anyone who asks"), and a SQL
-     * door at app scope would hand them over; this is what keeps it shut.
-     *
-     * Declaring it is what makes `Sources` injectable here. A frond that declares none
-     * asks for none, and nothing is attached on its behalf.
-     */
+    /** The entities this frond may read ACROSS sources, by name. */
     reads?: string[];
     /** Per-surface entity lists. Overrides default deduction for each named surface. */
     surfaces?: Record<string, string[]>;
@@ -92,15 +37,7 @@ export interface FrondConfig {
     /** Per-operation overrides. Key = operation name (method name on a handler). */
     operations?: Record<string, OperationOverride>;
 }
-/**
- * Define a frond configuration (typed identity helper).
- *
- * ```ts
- * // fronds/auth/frond.config.ts
- * import { defineFrond } from '@fougere/core'
- * export default defineFrond({ expose: ['User', 'AuthHandler'] })
- * ```
- */
+/** Define a frond configuration (typed identity helper). */
 export declare function defineFrond(config: FrondConfig): FrondConfig;
 /**
  * Load a frond's `frond.config.{ts,js,mjs}` from the given frond directory.

package/dist/frond-config.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"frond-config.d.ts","sourceRoot":"","sources":["../src/frond-config.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,iBAAiB,EAAE,UAAU,EAAE,MAAM,iBAAiB,CAAC;AACrE,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,mBAAmB,CAAC;AAIrD;;;;;;;;;;;;;;;;;;;;;;GAsBG;AACH,MAAM,WAAW,iBAAiB;IAChC;;;;;;OAMG;IACH,IAAI,CAAC,EAAE,OAAO,GAAG,SAAS,CAAC;IAC3B;;;;;;OAMG;IACH,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB;;;OAGG;IACH,OAAO,CAAC,EAAE,iBAAiB,CAAC;IAC5B,iEAAiE;IACjE,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB;;;;;;;;;;OAUG;IACH,MAAM,CAAC,EAAE,MAAM,CAAC;IAIhB,kFAAkF;IAClF,KAAK,CAAC,EAAE,UAAU,CAAC;IACnB;;;OAGG;IACH,OAAO,CAAC,EAAE,WAAW,CAAC;IAEtB,8FAA8F;IAC9F,MAAM,CAAC,EAAE,UAAU,CAAC;CACrB;AAED,MAAM,WAAW,WAAW;IAC1B,yEAAyE;IACzE,MAAM,CAAC,EAAE,MAAM,EAAE,CAAC;IAClB;;;;;;;;;;;OAWG;IACH,KAAK,CAAC,EAAE,MAAM,EAAE,CAAC;IACjB,oFAAoF;IACpF,QAAQ,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,EAAE,CAAC,CAAC;IACpC,wFAAwF;IACxF,QAAQ,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAClC,gFAAgF;IAChF,UAAU,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,iBAAiB,CAAC,CAAC;CAChD;AAID;;;;;;;;GAQG;AACH,wBAAgB,WAAW,CAAC,MAAM,EAAE,WAAW,GAAG,WAAW,CAE5D;AAMD;;;GAGG;AACH,wBAAsB,eAAe,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,WAAW,GAAG,SAAS,CAAC,CASzF"}
+{"version":3,"file":"frond-config.d.ts","sourceRoot":"","sources":["../src/frond-config.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,iBAAiB,EAAE,UAAU,EAAE,MAAM,iBAAiB,CAAC;AACrE,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,mBAAmB,CAAC;AAIrD,8BAA8B;AAC9B,MAAM,WAAW,iBAAiB;IAChC,qEAAqE;IACrE,IAAI,CAAC,EAAE,OAAO,GAAG,SAAS,CAAC;IAC3B,iDAAiD;IACjD,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB;;;OAGG;IACH,OAAO,CAAC,EAAE,iBAAiB,CAAC;IAC5B,iEAAiE;IACjE,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,+BAA+B;IAC/B,MAAM,CAAC,EAAE,MAAM,CAAC;IAIhB,qFAAqF;IACrF,KAAK,CAAC,EAAE,UAAU,CAAC;IACnB;;;OAGG;IACH,OAAO,CAAC,EAAE,WAAW,CAAC;IAEtB,8FAA8F;IAC9F,MAAM,CAAC,EAAE,UAAU,CAAC;CACrB;AAED,MAAM,WAAW,WAAW;IAC1B,yEAAyE;IACzE,MAAM,CAAC,EAAE,MAAM,EAAE,CAAC;IAClB,gEAAgE;IAChE,KAAK,CAAC,EAAE,MAAM,EAAE,CAAC;IACjB,oFAAoF;IACpF,QAAQ,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,EAAE,CAAC,CAAC;IACpC,wFAAwF;IACxF,QAAQ,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAClC,gFAAgF;IAChF,UAAU,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,iBAAiB,CAAC,CAAC;CAChD;AAID,4DAA4D;AAC5D,wBAAgB,WAAW,CAAC,MAAM,EAAE,WAAW,GAAG,WAAW,CAE5D;AAMD;;;GAGG;AACH,wBAAsB,eAAe,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,WAAW,GAAG,SAAS,CAAC,CASzF"}

package/dist/frond-config.js

@@ -1,15 +1,7 @@
 import { resolve } from 'node:path';
 import { existsSync } from 'node:fs';
 // ── Helper ───────────────────────────────────────
-/**
- * Define a frond configuration (typed identity helper).
- *
- * ```ts
- * // fronds/auth/frond.config.ts
- * import { defineFrond } from '@fougere/core'
- * export default defineFrond({ expose: ['User', 'AuthHandler'] })
- * ```
- */
+/** Define a frond configuration (typed identity helper). */
 export function defineFrond(config) {
     return config;
 }

package/dist/frond-config.js.map

@@ -1 +1 @@
-{"version":3,"file":"frond-config.js","sourceRoot":"","sources":["../src/frond-config.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AACpC,OAAO,EAAE,UAAU,EAAE,MAAM,SAAS,CAAC;AAwGrC,oDAAoD;AAEpD;;;;;;;;GAQG;AACH,MAAM,UAAU,WAAW,CAAC,MAAmB;IAC7C,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,oDAAoD;AAEpD,MAAM,kBAAkB,GAAG,CAAC,iBAAiB,EAAE,iBAAiB,EAAE,kBAAkB,CAAC,CAAC;AAEtF;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,eAAe,CAAC,SAAiB;IACrD,KAAK,MAAM,IAAI,IAAI,kBAAkB,EAAE,CAAC;QACtC,MAAM,IAAI,GAAG,OAAO,CAAC,SAAS,EAAE,IAAI,CAAC,CAAC;QACtC,IAAI,UAAU,CAAC,IAAI,CAAC,EAAE,CAAC;YACrB,MAAM,GAAG,GAAG,MAAM,MAAM,CAAC,IAAI,CAAC,CAAC;YAC/B,OAAO,GAAG,CAAC,OAAO,IAAI,GAAG,CAAC;QAC5B,CAAC;IACH,CAAC;IACD,OAAO,SAAS,CAAC;AACnB,CAAC"}
+{"version":3,"file":"frond-config.js","sourceRoot":"","sources":["../src/frond-config.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AACpC,OAAO,EAAE,UAAU,EAAE,MAAM,SAAS,CAAC;AAiDrC,oDAAoD;AAEpD,4DAA4D;AAC5D,MAAM,UAAU,WAAW,CAAC,MAAmB;IAC7C,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,oDAAoD;AAEpD,MAAM,kBAAkB,GAAG,CAAC,iBAAiB,EAAE,iBAAiB,EAAE,kBAAkB,CAAC,CAAC;AAEtF;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,eAAe,CAAC,SAAiB;IACrD,KAAK,MAAM,IAAI,IAAI,kBAAkB,EAAE,CAAC;QACtC,MAAM,IAAI,GAAG,OAAO,CAAC,SAAS,EAAE,IAAI,CAAC,CAAC;QACtC,IAAI,UAAU,CAAC,IAAI,CAAC,EAAE,CAAC;YACrB,MAAM,GAAG,GAAG,MAAM,MAAM,CAAC,IAAI,CAAC,CAAC;YAC/B,OAAO,GAAG,CAAC,OAAO,IAAI,GAAG,CAAC;QAC5B,CAAC;IACH,CAAC;IACD,OAAO,SAAS,CAAC;AACnB,CAAC"}

package/dist/graph.d.ts

@@ -2,7 +2,7 @@
  * Entity dependency graph — analyzes ref() links between entities
  * to suggest domain boundaries for splitting fronds.
  */
-import type { FrondDescriptor } from './scan/frond.js';
+import type { FrondDescriptor } from './descriptor/frond.js';
 export interface EntityNode {
     name: string;
     frond: string;

package/dist/graph.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"graph.d.ts","sourceRoot":"","sources":["../src/graph.ts"],"names":[],"mappings":"AACA;;;GAGG;AACH,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,iBAAiB,CAAC;AAEvD,MAAM,WAAW,UAAU;IACzB,IAAI,EAAE,MAAM,CAAC;IACb,KAAK,EAAE,MAAM,CAAC;IACd,IAAI,EAAE,MAAM,EAAE,CAAC;IACf,YAAY,EAAE,MAAM,EAAE,CAAC;CACxB;AAED,MAAM,WAAW,aAAa;IAC5B,IAAI,EAAE,MAAM,CAAC;IACb,QAAQ,EAAE,MAAM,EAAE,CAAC;IACnB,SAAS,EAAE;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,EAAE,EAAE,MAAM,CAAC;QAAC,aAAa,EAAE,MAAM,CAAA;KAAE,EAAE,CAAC;CAClE;AAED,kEAAkE;AAClE,wBAAgB,UAAU,CAAC,MAAM,EAAE,eAAe,EAAE,GAAG,GAAG,CAAC,MAAM,EAAE,UAAU,CAAC,CA6B7E;AAED;;;GAGG;AACH,wBAAgB,eAAe,CAAC,KAAK,EAAE,GAAG,CAAC,MAAM,EAAE,UAAU,CAAC,GAAG,aAAa,EAAE,CAwC/E;AAED;;;GAGG;AACH,wBAAgB,YAAY,CAC1B,KAAK,EAAE,GAAG,CAAC,MAAM,EAAE,UAAU,CAAC,EAC9B,cAAc,SAAI,GACjB,aAAa,EAAE,CAmDjB"}
+{"version":3,"file":"graph.d.ts","sourceRoot":"","sources":["../src/graph.ts"],"names":[],"mappings":"AACA;;;GAGG;AACH,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,uBAAuB,CAAC;AAE7D,MAAM,WAAW,UAAU;IACzB,IAAI,EAAE,MAAM,CAAC;IACb,KAAK,EAAE,MAAM,CAAC;IACd,IAAI,EAAE,MAAM,EAAE,CAAC;IACf,YAAY,EAAE,MAAM,EAAE,CAAC;CACxB;AAED,MAAM,WAAW,aAAa;IAC5B,IAAI,EAAE,MAAM,CAAC;IACb,QAAQ,EAAE,MAAM,EAAE,CAAC;IACnB,SAAS,EAAE;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,EAAE,EAAE,MAAM,CAAC;QAAC,aAAa,EAAE,MAAM,CAAA;KAAE,EAAE,CAAC;CAClE;AAED,kEAAkE;AAClE,wBAAgB,UAAU,CAAC,MAAM,EAAE,eAAe,EAAE,GAAG,GAAG,CAAC,MAAM,EAAE,UAAU,CAAC,CA6B7E;AAED;;;GAGG;AACH,wBAAgB,eAAe,CAAC,KAAK,EAAE,GAAG,CAAC,MAAM,EAAE,UAAU,CAAC,GAAG,aAAa,EAAE,CAwC/E;AAED;;;GAGG;AACH,wBAAgB,YAAY,CAC1B,KAAK,EAAE,GAAG,CAAC,MAAM,EAAE,UAAU,CAAC,EAC9B,cAAc,SAAI,GACjB,aAAa,EAAE,CAmDjB"}

package/dist/identity-keys.d.ts

@@ -4,11 +4,8 @@ export declare function generateKeyPair(): {
     publicKey: string;
 };
 /**
- * Bind a name to a public key, signed by the root — the whole of what a receiver
- * needs to recognize a frond it has never seen.
- *
- * `ttlDays` bounds the damage of a leaked frond key without a revocation list:
- * re-issuing is a deployment, which is the same gesture that leaked it.
+ * Bind a name to a public key, signed by the root — the whole of what a receiver needs to
+ * recognize a frond it has never seen.
  */
 export declare function issueGrant(rootPrivateKey: string, name: string, frondPublicKey: string, ttlDays?: number): string;
 //# sourceMappingURL=identity-keys.d.ts.map

package/dist/identity-keys.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"identity-keys.d.ts","sourceRoot":"","sources":["../src/identity-keys.ts"],"names":[],"mappings":"AAcA,uFAAuF;AACvF,wBAAgB,eAAe,IAAI;IAAE,UAAU,EAAE,MAAM,CAAC;IAAC,SAAS,EAAE,MAAM,CAAA;CAAE,CAM3E;AAED;;;;;;GAMG;AACH,wBAAgB,UAAU,CACxB,cAAc,EAAE,MAAM,EACtB,IAAI,EAAE,MAAM,EACZ,cAAc,EAAE,MAAM,EACtB,OAAO,SAAK,GACX,MAAM,CAOR"}
+{"version":3,"file":"identity-keys.d.ts","sourceRoot":"","sources":["../src/identity-keys.ts"],"names":[],"mappings":"AAIA,uFAAuF;AACvF,wBAAgB,eAAe,IAAI;IAAE,UAAU,EAAE,MAAM,CAAC;IAAC,SAAS,EAAE,MAAM,CAAA;CAAE,CAM3E;AAED;;;GAGG;AACH,wBAAgB,UAAU,CACxB,cAAc,EAAE,MAAM,EACtB,IAAI,EAAE,MAAM,EACZ,cAAc,EAAE,MAAM,EACtB,OAAO,SAAK,GACX,MAAM,CAOR"}

package/dist/identity-keys.js

@@ -1,14 +1,4 @@
-/**
- * Making keys and issuing grants — the half of identity that runs at a DEPLOYMENT.
- *
- * It sits on the Node entry because it is the CLI speaking: `fougere keys` generates a
- * pair, `fougere grant` binds a name to one, and both happen once, on a machine with a
- * filesystem. Neither is reachable from a request path, so nothing here is on any hot
- * path and `generateKeyPairSync` — the one gesture WebCrypto could not replace without
- * changing what a key IS — never has to leave `node:crypto`.
- *
- * The verifying half is elsewhere (`identity.ts`) because it runs per call, everywhere.
- */
+/** Making keys and issuing grants — the half of identity that runs at a DEPLOYMENT. */
 import { createPrivateKey, createPublicKey, generateKeyPairSync, sign } from 'node:crypto';
 import { b64url } from './crypto/encoding.js';
 /** A fresh Ed25519 pair, PEM both ways. The root's and a frond's are the same kind. */
@@ -20,11 +10,8 @@ export function generateKeyPair() {
     };
 }
 /**
- * Bind a name to a public key, signed by the root — the whole of what a receiver
- * needs to recognize a frond it has never seen.
- *
- * `ttlDays` bounds the damage of a leaked frond key without a revocation list:
- * re-issuing is a deployment, which is the same gesture that leaked it.
+ * Bind a name to a public key, signed by the root — the whole of what a receiver needs to
+ * recognize a frond it has never seen.
  */
 export function issueGrant(rootPrivateKey, name, frondPublicKey, ttlDays = 90) {
     const jwk = createPublicKey(frondPublicKey).export({ format: 'jwk' });

package/dist/identity-keys.js.map

@@ -1 +1 @@
-{"version":3,"file":"identity-keys.js","sourceRoot":"","sources":["../src/identity-keys.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AACH,OAAO,EAAE,gBAAgB,EAAE,eAAe,EAAE,mBAAmB,EAAE,IAAI,EAAE,MAAM,aAAa,CAAC;AAC3F,OAAO,EAAE,MAAM,EAAE,MAAM,sBAAsB,CAAC;AAE9C,uFAAuF;AACvF,MAAM,UAAU,eAAe;IAC7B,MAAM,EAAE,UAAU,EAAE,SAAS,EAAE,GAAG,mBAAmB,CAAC,SAAS,CAAC,CAAC;IACjE,OAAO;QACL,UAAU,EAAE,UAAU,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC,CAAC,QAAQ,EAAE;QAC1E,SAAS,EAAE,SAAS,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC,CAAC,QAAQ,EAAE;KACxE,CAAC;AACJ,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,UAAU,CACxB,cAAsB,EACtB,IAAY,EACZ,cAAsB,EACtB,OAAO,GAAG,EAAE;IAEZ,MAAM,GAAG,GAAG,eAAe,CAAC,cAAc,CAAC,CAAC,MAAM,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC,CAAC;IACtE,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;IACvB,MAAM,MAAM,GAAG,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,GAAG,EAAE,OAAO,EAAE,GAAG,EAAE,eAAe,EAAE,CAAC,CAAC,CAAC;IAC9E,MAAM,OAAO,GAAG,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,GAAG,EAAE,IAAI,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,GAAG,OAAO,GAAG,UAAU,EAAE,CAAC,CAAC,CAAC;IACtG,MAAM,YAAY,GAAG,GAAG,MAAM,IAAI,OAAO,EAAE,CAAC;IAC5C,OAAO,GAAG,YAAY,IAAI,MAAM,CAAC,IAAI,UAAU,CAAC,IAAI,CAAC,IAAI,EAAE,MAAM,CAAC,IAAI,CAAC,YAAY,CAAC,EAAE,gBAAgB,CAAC,cAAc,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;AAC9H,CAAC"}
+{"version":3,"file":"identity-keys.js","sourceRoot":"","sources":["../src/identity-keys.ts"],"names":[],"mappings":"AAAA,uFAAuF;AACvF,OAAO,EAAE,gBAAgB,EAAE,eAAe,EAAE,mBAAmB,EAAE,IAAI,EAAE,MAAM,aAAa,CAAC;AAC3F,OAAO,EAAE,MAAM,EAAE,MAAM,sBAAsB,CAAC;AAE9C,uFAAuF;AACvF,MAAM,UAAU,eAAe;IAC7B,MAAM,EAAE,UAAU,EAAE,SAAS,EAAE,GAAG,mBAAmB,CAAC,SAAS,CAAC,CAAC;IACjE,OAAO;QACL,UAAU,EAAE,UAAU,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC,CAAC,QAAQ,EAAE;QAC1E,SAAS,EAAE,SAAS,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC,CAAC,QAAQ,EAAE;KACxE,CAAC;AACJ,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,UAAU,CACxB,cAAsB,EACtB,IAAY,EACZ,cAAsB,EACtB,OAAO,GAAG,EAAE;IAEZ,MAAM,GAAG,GAAG,eAAe,CAAC,cAAc,CAAC,CAAC,MAAM,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC,CAAC;IACtE,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;IACvB,MAAM,MAAM,GAAG,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,GAAG,EAAE,OAAO,EAAE,GAAG,EAAE,eAAe,EAAE,CAAC,CAAC,CAAC;IAC9E,MAAM,OAAO,GAAG,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,GAAG,EAAE,IAAI,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,GAAG,OAAO,GAAG,UAAU,EAAE,CAAC,CAAC,CAAC;IACtG,MAAM,YAAY,GAAG,GAAG,MAAM,IAAI,OAAO,EAAE,CAAC;IAC5C,OAAO,GAAG,YAAY,IAAI,MAAM,CAAC,IAAI,UAAU,CAAC,IAAI,CAAC,IAAI,EAAE,MAAM,CAAC,IAAI,CAAC,YAAY,CAAC,EAAE,gBAAgB,CAAC,cAAc,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;AAC9H,CAAC"}

package/dist/identity.d.ts

@@ -14,45 +14,19 @@ export interface VerifiedCall {
     /** The state it asserted, now proven to come from `caller`. */
     state: Record<string, unknown>;
 }
-/**
- * Sign one call, whole: who is asking, what is asked, and on whose behalf.
- *
- * The private key is parsed on every call here, which is the convenience form. A process
- * that signs in a request path builds its signer once — `identityFromEnv` does exactly
- * that, and `sign` on the value it returns holds the parsed key.
- */
+/** Sign one call, whole. */
 export declare function signEnvelope(identity: FrondIdentity, call: SignedCall): Promise<string>;
-/**
- * Establish the caller, or throw. Order matters: the grant is checked against the ROOT
- * first, and only the key it carries verifies the envelope — reading the envelope's own
- * claim of who it is before that would be believing the thing under examination.
- */
+/** Establish the caller, or throw. */
 export declare function verifyEnvelope(token: string, rootPublicKey: string, presented: SignedCall): Promise<VerifiedCall>;
 /** The two halves a boot needs, and the environment they come from. */
 export interface CallIdentity {
-    /**
-     * Signs an outgoing call, whole. Absent when this process holds no key — it only answers.
-     *
-     * A promise because WebCrypto has no synchronous form. On Node the work stays
-     * synchronous inside and only the answer is wrapped: measured at 14.28 µs awaited
-     * against 14.30 µs called directly, while WebCrypto on the same curve costs 22.72.
-     */
+    /** Signs an outgoing call, whole. */
     sign?: (call: SignedCall) => Promise<string>;
     /** Establishes an incoming caller, against the call that actually arrived. */
     verify?: (identity: string, presented: SignedCall) => Promise<VerifiedCall>;
     /** Refuse an unsigned call. True exactly when a root is trusted. */
     requireIdentity: boolean;
 }
-/**
- * What the deployment injected, read once at boot.
- *
- * Three variables, no config key: a private key never belongs in a committed file, and
- * `fougere keys` prints exactly these. A process may hold either half or both — a frond
- * that only answers has no key, one that only calls trusts no root, one in the middle
- * does both.
- *
- * Trusting a root IS asking to refuse: there is no separate flag, because a deployment
- * that names an authority and then accepts unsigned calls has said two things at once.
- */
+/** What the deployment injected, read once at boot. */
 export declare function identityFromEnv(env?: Record<string, string | undefined>): Promise<CallIdentity>;
 //# sourceMappingURL=identity.d.ts.map

package/dist/identity.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"identity.d.ts","sourceRoot":"","sources":["../src/identity.ts"],"names":[],"mappings":"AAmCA,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,gBAAgB,CAAC;AAEjD,YAAY,EAAE,UAAU,EAAE,MAAM,gBAAgB,CAAC;AAOjD,2FAA2F;AAC3F,MAAM,WAAW,aAAa;IAC5B,6CAA6C;IAC7C,UAAU,EAAE,MAAM,CAAC;IACnB,wEAAwE;IACxE,KAAK,EAAE,MAAM,CAAC;CACf;AAuBD,2EAA2E;AAC3E,MAAM,WAAW,YAAY;IAC3B,mDAAmD;IACnD,MAAM,EAAE,MAAM,CAAC;IACf,+DAA+D;IAC/D,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CAChC;AAkCD;;;;;;GAMG;AACH,wBAAsB,YAAY,CAAC,QAAQ,EAAE,aAAa,EAAE,IAAI,EAAE,UAAU,GAAG,OAAO,CAAC,MAAM,CAAC,CAE7F;AAaD;;;;GAIG;AACH,wBAAsB,cAAc,CAAC,KAAK,EAAE,MAAM,EAAE,aAAa,EAAE,MAAM,EAAE,SAAS,EAAE,UAAU,GAAG,OAAO,CAAC,YAAY,CAAC,CAEvH;AA+BD,uEAAuE;AACvE,MAAM,WAAW,YAAY;IAC3B;;;;;;OAMG;IACH,IAAI,CAAC,EAAE,CAAC,IAAI,EAAE,UAAU,KAAK,OAAO,CAAC,MAAM,CAAC,CAAC;IAC7C,8EAA8E;IAC9E,MAAM,CAAC,EAAE,CAAC,QAAQ,EAAE,MAAM,EAAE,SAAS,EAAE,UAAU,KAAK,OAAO,CAAC,YAAY,CAAC,CAAC;IAC5E,oEAAoE;IACpE,eAAe,EAAE,OAAO,CAAC;CAC1B;AAcD;;;;;;;;;;GAUG;AACH,wBAAsB,eAAe,CAAC,GAAG,GAAE,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,SAAS,CAAkB,GAAG,OAAO,CAAC,YAAY,CAAC,CAgBrH"}
+{"version":3,"file":"identity.d.ts","sourceRoot":"","sources":["../src/identity.ts"],"names":[],"mappings":"AAIA,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,gBAAgB,CAAC;AAEjD,YAAY,EAAE,UAAU,EAAE,MAAM,gBAAgB,CAAC;AAOjD,2FAA2F;AAC3F,MAAM,WAAW,aAAa;IAC5B,6CAA6C;IAC7C,UAAU,EAAE,MAAM,CAAC;IACnB,wEAAwE;IACxE,KAAK,EAAE,MAAM,CAAC;CACf;AAuBD,2EAA2E;AAC3E,MAAM,WAAW,YAAY;IAC3B,mDAAmD;IACnD,MAAM,EAAE,MAAM,CAAC;IACf,+DAA+D;IAC/D,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CAChC;AA8BD,4BAA4B;AAC5B,wBAAsB,YAAY,CAAC,QAAQ,EAAE,aAAa,EAAE,IAAI,EAAE,UAAU,GAAG,OAAO,CAAC,MAAM,CAAC,CAE7F;AAaD,sCAAsC;AACtC,wBAAsB,cAAc,CAAC,KAAK,EAAE,MAAM,EAAE,aAAa,EAAE,MAAM,EAAE,SAAS,EAAE,UAAU,GAAG,OAAO,CAAC,YAAY,CAAC,CAEvH;AA+BD,uEAAuE;AACvE,MAAM,WAAW,YAAY;IAC3B,qCAAqC;IACrC,IAAI,CAAC,EAAE,CAAC,IAAI,EAAE,UAAU,KAAK,OAAO,CAAC,MAAM,CAAC,CAAC;IAC7C,8EAA8E;IAC9E,MAAM,CAAC,EAAE,CAAC,QAAQ,EAAE,MAAM,EAAE,SAAS,EAAE,UAAU,KAAK,OAAO,CAAC,YAAY,CAAC,CAAC;IAC5E,oEAAoE;IACpE,eAAe,EAAE,OAAO,CAAC;CAC1B;AAOD,uDAAuD;AACvD,wBAAsB,eAAe,CAAC,GAAG,GAAE,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,SAAS,CAAkB,GAAG,OAAO,CAAC,YAAY,CAAC,CAgBrH"}

package/dist/identity.js

@@ -1,48 +1,17 @@
-/**
- * Who is calling — the proof, not the claim.
- *
- * `InvocationContext.state` is what a caller SAYS about itself, and a split receiver
- * used to believe it: identity read straight off the wire, so a reader could post
- * `{ state: { user: { role: 'admin' } } }` and be one. This module is what turns that
- * sack into something a receiver establishes instead of accepts.
- *
- * Two signatures, one public key to distribute:
- *
- *   GRANT      the root says "this key is `blog`"   — issued once, at deployment
- *   ENVELOPE   `blog` says "here is my whole call"   — signed per call
- *
- * The envelope binds the CALL and not only its state: address, params, query, a digest
- * of the body. Signing the state alone proved WHO without proving WHAT, so anyone on the
- * wire could replay a captured envelope against another operation for as long as it
- * stayed valid — `post.list` re-sent as `post.delete`, same signature, still good.
- *
- * A receiver holds the root's public key and nothing else: it validates any frond it
- * has never seen, which is what a per-caller list could not do. The private root key
- * signs grants and never leaves the machine that issued them.
- *
- * Ed25519 and a JWS-shaped grant rather than X.509: node can PARSE a certificate but
- * not ISSUE one, so a real chain would mean openssl or a library. The grant says the
- * same thing — a name bound to a public key, signed by the root — with no dependency.
- *
- * The Ed25519 itself comes through `#crypto`, which has two realizations: `node:crypto`
- * everywhere, WebCrypto under `workerd`. Everything here is therefore async — WebCrypto
- * has no synchronous form — and a key is parsed ONCE, into a `Signer` or a `Verifier`,
- * never per call. Making the keys and issuing grants happen at a deployment and live in
- * `identity-keys.ts`, on the Node entry.
- */
+/** Who is calling — the proof, not the claim. */
 import { crypto } from '#crypto';
 import { b64url, unb64url, bytesOf, textOf, unb64 } from './crypto/encoding.js';
 /** How long a call envelope stays valid. A signed call is not a session. */
 const ENVELOPE_TTL_MS = 60_000;
 /** Clock skew tolerated on both sides of a validity window. */
 const SKEW_MS = 30_000;
-/** The body's fingerprint. Absence and explicit null are different signed calls. */
-async function digestOf(body) {
+/** The input's fingerprint. Absence and explicit null are different signed calls. */
+async function digestOf(input) {
     // The tag is outside the caller value, so no user object can collide with it. JSON's
     // own omission rule still applies inside `value`, matching what crosses the wire.
-    const canonical = body === undefined
+    const canonical = input === undefined
         ? { kind: 'undefined' }
-        : { kind: 'value', value: body };
+        : { kind: 'value', value: input };
     return b64url(await crypto.sha256(bytesOf(JSON.stringify(canonical))));
 }
 /** What the envelope pins, as one comparable value. */
@@ -52,7 +21,7 @@ async function boundTo(call) {
         op: call.op,
         params: call.params ?? {},
         query: call.query ?? {},
-        body: await digestOf(call.body),
+        input: await digestOf(call.input),
     };
 }
 /** A JWS compact serialization, signed with Ed25519. */
@@ -60,11 +29,7 @@ async function signJws(header, payload, signer) {
     const signingInput = `${b64url(JSON.stringify(header))}.${b64url(JSON.stringify(payload))}`;
     return `${signingInput}.${b64url(await signer.sign(bytesOf(signingInput)))}`;
 }
-/**
- * The payload, once the signature holds. Throws rather than returning a falsy value:
- * every caller here is deciding whether to admit a call, and an unverified payload
- * must never be reachable by forgetting a check.
- */
+/** The payload, once the signature holds. */
 async function verifyJws(token, verifier, what) {
     const parts = token.split('.');
     if (parts.length !== 3)
@@ -88,13 +53,7 @@ function headerOf(token) {
         throw new Error('Malformed envelope');
     return JSON.parse(textOf(unb64url(encodedHeader)));
 }
-/**
- * Sign one call, whole: who is asking, what is asked, and on whose behalf.
- *
- * The private key is parsed on every call here, which is the convenience form. A process
- * that signs in a request path builds its signer once — `identityFromEnv` does exactly
- * that, and `sign` on the value it returns holds the parsed key.
- */
+/** Sign one call, whole. */
 export async function signEnvelope(identity, call) {
     return sealWith(await crypto.signerOf(identity.privateKey), identity.grant, call);
 }
@@ -104,11 +63,7 @@ async function sealWith(signer, grant, call) {
     const { sub } = JSON.parse(textOf(unb64url(grant.split('.')[1])));
     return signJws({ alg: 'EdDSA', typ: 'fougere-call', grant }, { iss: sub, state: call.state ?? {}, bound: await boundTo(call), iat: now, exp: now + ENVELOPE_TTL_MS }, signer);
 }
-/**
- * Establish the caller, or throw. Order matters: the grant is checked against the ROOT
- * first, and only the key it carries verifies the envelope — reading the envelope's own
- * claim of who it is before that would be believing the thing under examination.
- */
+/** Establish the caller, or throw. */
 export async function verifyEnvelope(token, rootPublicKey, presented) {
     return openWith(await crypto.verifierOf(rootPublicKey), token, presented);
 }
@@ -137,28 +92,11 @@ async function openWith(root, token, presented) {
         state: payload.state ?? {},
     };
 }
-/**
- * A PEM, however the deployment chose to carry it.
- *
- * A PEM is multi-line and an environment variable that spans lines survives poorly —
- * docker-compose, systemd and CI secret stores each mangle it differently — so
- * `fougere keys` prints base64. Both forms are read here rather than one being decreed:
- * a human pasting a real PEM is not making a mistake.
- */
+/** A PEM, however the deployment chose to carry it. */
 function pemOf(value) {
     return value.trimStart().startsWith('-----') ? value : textOf(unb64(value));
 }
-/**
- * What the deployment injected, read once at boot.
- *
- * Three variables, no config key: a private key never belongs in a committed file, and
- * `fougere keys` prints exactly these. A process may hold either half or both — a frond
- * that only answers has no key, one that only calls trusts no root, one in the middle
- * does both.
- *
- * Trusting a root IS asking to refuse: there is no separate flag, because a deployment
- * that names an authority and then accepts unsigned calls has said two things at once.
- */
+/** What the deployment injected, read once at boot. */
 export async function identityFromEnv(env = envOfProcess()) {
     const root = env.FOUGERE_ROOT_KEY ? pemOf(env.FOUGERE_ROOT_KEY) : undefined;
     const privateKey = env.FOUGERE_KEY ? pemOf(env.FOUGERE_KEY) : undefined;