@fougere/core 0.6.0-alpha.0 → 0.8.0-alpha.0

package/dist/config-loader.d.ts

@@ -1,5 +1,5 @@
 import type { AuthConfig } from './boot/auth.js';
-import type { LogLevel } from './builtins/logger.js';
+import type { LogLevel } from './builtin/logger.js';
 import type { ConventionsInput } from './scan/conventions.js';
 export interface FougereConfig {
     /** Database configuration — the DEFAULT source, the one an entity lands in unnamed. */
@@ -7,72 +7,26 @@ export interface FougereConfig {
         dialect: 'sqlite';
         path?: string;
     } | false;
-    /**
-     * The other places rows live — a name, an engine, and the entities it holds.
-     *
-     * A fact about the APP, stated beside `remotes:` because it is the same kind of
-     * statement: `remotes:` says where a CALL goes, this says where a ROW is. Neither
-     * belongs on the entity, which describes itself and not its deployment.
-     *
-     * Only the exception is declared: everything unnamed stays in `db`. Membership is
-     * per ENTITY rather than per frond — two fronds may share a database, and one frond
-     * may hold entities in two — so the entity is the truth and a frond-wide shorthand
-     * waits for a case that needs it.
-     *
-     * A `ref()` across two sources gets no foreign key: two databases share no
-     * constraint. The DDL stops pretending rather than the `ref` being refused.
-     */
+    /** The other places rows live — a name, an engine, and the entities it holds. */
     sources?: Record<string, {
         dialect?: 'sqlite';
         path?: string;
         entities: string[];
     }>;
     /**
-     * The names the scan reads instead of deriving them — the import scope, the fronds
-     * directory, the seven convention directories.
-     *
-     * Only what differs is stated. Read BEFORE the fronds are discovered, which is what
-     * lets it name the prefix they are found under: nothing in this file may import
-     * `@fronds/*`, or the name would be needed to read the file that declares it.
+     * The names the scan reads instead of deriving them — the import scope, the fronds directory,
+     * the seven convention directories.
      */
     conventions?: ConventionsInput;
-    /**
-     * How much every logger says. The one key a running app CONSULTS rather than
-     * consumes, so re-reading this file changes it without rebuilding anything.
-     *
-     * `FOUGERE_LOG_LEVEL` still wins — it is how the CLI speaks, and the precedence is
-     * the usual one (CLI over config file).
-     */
+    /** How much every logger says. */
     logLevel?: LogLevel;
     /** Remote fronds — frondName → base URL. */
     remotes?: Record<string, string>;
-    /**
-     * Which realization answers which port — port class name → implementation class name.
-     *
-     * A fact about the APP, stated beside `remotes:` for the same reason `sources:` is:
-     * `remotes:` says where a CALL goes, `sources:` says where a ROW is, this says who
-     * performs an ACTION. None of the three belongs inside the frond, which describes
-     * itself and not its deployment — a `billing` frond naming Stripe would be the one
-     * thing the framework refuses.
-     *
-     * Only the exception is declared. One class extending a port answers it by
-     * convention and this key stays absent; two make the boot refuse until one is named.
-     */
+    /** Which realization answers which port — port class name → implementation class name. */
     ports?: Record<string, string>;
     /** Auth declaration — picks a provider package and forwards options to it. */
     auth?: AuthConfig;
-    /**
-     * Which protocol adapters this app serves.
-     *
-     * A fact about the APP, declared once beside `db`, `remotes` and `auth` — not a
-     * property of whichever host runs it. Before this existed the same decision was
-     * spelled five different ways: Nuxt mounted REST unconditionally, the Web hosts
-     * served it if you happened to create a route file, and Express if you happened to
-     * call a middleware. One decision, five dialects, no canonical place.
-     *
-     * Absent means not served. The call envelope is not listed here: it is the wire the
-     * client primitives use, not a projection an app chooses to publish.
-     */
+    /** Which protocol adapters this app serves. */
     adapters?: AdapterConfig;
 }
 /** Protocol adapters, by the name of the package that provides them. */
@@ -84,22 +38,10 @@ export interface AdapterConfig {
     /** A surface of your own; the framework only records that you declared it. */
     [adapter: string]: boolean | undefined;
 }
-/**
- * Load the root fougere.config.{ts,js,mjs} from the given directory.
- *
- * `fresh` re-reads a file that may have changed since the last load — what a host
- * calls when it decides to reconsider its config, and the only way `applyConfig` has
- * anything new to apply.
- */
+/** Load the root fougere.config.{ts,js,mjs} from the given directory. */
 export declare function loadConfig(root: string, options?: {
     fresh?: boolean;
 }): Promise<FougereConfig>;
-/**
- * Load config along the workspace→app frontier. The workspace-root config is
- * the base (canonical topology: `remotes`, shared `db`); the app-root config
- * overrides. Same `root` boundary the fronds already cascade along. When both
- * roots resolve to the same dir (single app, no workspace), this is the plain
- * root config — idempotent, no behavior change.
- */
+/** Load config along the workspace→app frontier. */
 export declare function loadCascadedConfig(workspaceRoot: string, appRoot: string): Promise<FougereConfig>;
 //# sourceMappingURL=config-loader.d.ts.map

package/dist/config-loader.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"config-loader.d.ts","sourceRoot":"","sources":["../src/config-loader.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,gBAAgB,CAAC;AACjD,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,sBAAsB,CAAC;AACrD,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,uBAAuB,CAAC;AAK9D,MAAM,WAAW,aAAa;IAC5B,uFAAuF;IACvF,EAAE,CAAC,EAAE,QAAQ,GAAG;QAAE,OAAO,EAAE,QAAQ,CAAC;QAAC,IAAI,CAAC,EAAE,MAAM,CAAA;KAAE,GAAG,KAAK,CAAC;IAC7D;;;;;;;;;;;;;;OAcG;IACH,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE;QAAE,OAAO,CAAC,EAAE,QAAQ,CAAC;QAAC,IAAI,CAAC,EAAE,MAAM,CAAC;QAAC,QAAQ,EAAE,MAAM,EAAE,CAAA;KAAE,CAAC,CAAC;IACpF;;;;;;;OAOG;IACH,WAAW,CAAC,EAAE,gBAAgB,CAAC;IAC/B;;;;;;OAMG;IACH,QAAQ,CAAC,EAAE,QAAQ,CAAC;IACpB,4CAA4C;IAC5C,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACjC;;;;;;;;;;;OAWG;IACH,KAAK,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAC/B,8EAA8E;IAC9E,IAAI,CAAC,EAAE,UAAU,CAAC;IAClB;;;;;;;;;;;OAWG;IACH,QAAQ,CAAC,EAAE,aAAa,CAAC;CAC1B;AAED,wEAAwE;AACxE,MAAM,WAAW,aAAa;IAC5B,oEAAoE;IACpE,IAAI,CAAC,EAAE,OAAO,CAAC;IACf,8EAA8E;IAC9E,OAAO,CAAC,EAAE,OAAO,CAAC;IAClB,8EAA8E;IAC9E,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO,GAAG,SAAS,CAAC;CACxC;AAsBD;;;;;;GAMG;AACH,wBAAsB,UAAU,CAAC,IAAI,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE;IAAE,KAAK,CAAC,EAAE,OAAO,CAAA;CAAE,GAAG,OAAO,CAAC,aAAa,CAAC,CAEpG;AAkBD;;;;;;GAMG;AACH,wBAAsB,kBAAkB,CAAC,aAAa,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,aAAa,CAAC,CAIvG"}
+{"version":3,"file":"config-loader.d.ts","sourceRoot":"","sources":["../src/config-loader.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,gBAAgB,CAAC;AACjD,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,qBAAqB,CAAC;AACpD,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,uBAAuB,CAAC;AAK9D,MAAM,WAAW,aAAa;IAC5B,uFAAuF;IACvF,EAAE,CAAC,EAAE,QAAQ,GAAG;QAAE,OAAO,EAAE,QAAQ,CAAC;QAAC,IAAI,CAAC,EAAE,MAAM,CAAA;KAAE,GAAG,KAAK,CAAC;IAC7D,iFAAiF;IACjF,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE;QAAE,OAAO,CAAC,EAAE,QAAQ,CAAC;QAAC,IAAI,CAAC,EAAE,MAAM,CAAC;QAAC,QAAQ,EAAE,MAAM,EAAE,CAAA;KAAE,CAAC,CAAC;IACpF;;;OAGG;IACH,WAAW,CAAC,EAAE,gBAAgB,CAAC;IAC/B,kCAAkC;IAClC,QAAQ,CAAC,EAAE,QAAQ,CAAC;IACpB,4CAA4C;IAC5C,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACjC,0FAA0F;IAC1F,KAAK,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAC/B,8EAA8E;IAC9E,IAAI,CAAC,EAAE,UAAU,CAAC;IAClB,+CAA+C;IAC/C,QAAQ,CAAC,EAAE,aAAa,CAAC;CAC1B;AAED,wEAAwE;AACxE,MAAM,WAAW,aAAa;IAC5B,oEAAoE;IACpE,IAAI,CAAC,EAAE,OAAO,CAAC;IACf,8EAA8E;IAC9E,OAAO,CAAC,EAAE,OAAO,CAAC;IAClB,8EAA8E;IAC9E,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO,GAAG,SAAS,CAAC;CACxC;AAsBD,yEAAyE;AACzE,wBAAsB,UAAU,CAAC,IAAI,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE;IAAE,KAAK,CAAC,EAAE,OAAO,CAAA;CAAE,GAAG,OAAO,CAAC,aAAa,CAAC,CAEpG;AAiBD,oDAAoD;AACpD,wBAAsB,kBAAkB,CAAC,aAAa,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,aAAa,CAAC,CAIvG"}

package/dist/config-loader.js

@@ -18,22 +18,15 @@ async function loadConfigFrom(dir, fresh) {
     }
     return {};
 }
-/**
- * Load the root fougere.config.{ts,js,mjs} from the given directory.
- *
- * `fresh` re-reads a file that may have changed since the last load — what a host
- * calls when it decides to reconsider its config, and the only way `applyConfig` has
- * anything new to apply.
- */
+/** Load the root fougere.config.{ts,js,mjs} from the given directory. */
 export async function loadConfig(root, options) {
     return loadConfigFrom(root, options?.fresh);
 }
 // ── Merging ──────────────────────────────────────
 /**
- * Override a config with another, the invariant of every cascade level:
- * scalar keys replace, but `remotes` (the topology) MERGES — an override adds
- * or redirects a frond without erasing the others. Used for workspace→app and
- * for global→CLI alike.
+ * Override a config with another, the invariant of every cascade level: scalar keys replace, but
+ * `remotes` (the topology) MERGES — an override adds or redirects a frond without erasing the
+ * others.
  */
 function mergeGlobal(base, override) {
     const merged = { ...base, ...override };
@@ -42,13 +35,7 @@ function mergeGlobal(base, override) {
     }
     return merged;
 }
-/**
- * Load config along the workspace→app frontier. The workspace-root config is
- * the base (canonical topology: `remotes`, shared `db`); the app-root config
- * overrides. Same `root` boundary the fronds already cascade along. When both
- * roots resolve to the same dir (single app, no workspace), this is the plain
- * root config — idempotent, no behavior change.
- */
+/** Load config along the workspace→app frontier. */
 export async function loadCascadedConfig(workspaceRoot, appRoot) {
     const base = await loadConfig(workspaceRoot);
     if (resolve(workspaceRoot) === resolve(appRoot))

package/dist/config-loader.js.map

@@ -1 +1 @@
-{"version":3,"file":"config-loader.js","sourceRoot":"","sources":["../src/config-loader.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AACpC,OAAO,EAAE,UAAU,EAAE,MAAM,SAAS,CAAC;AAIrC,OAAO,EAAE,eAAe,EAAE,MAAM,aAAa,CAAC;AAkF9C,oDAAoD;AAEpD,MAAM,YAAY,GAAG,CAAC,mBAAmB,EAAE,mBAAmB,EAAE,oBAAoB,CAAC,CAAC;AAEtF,KAAK,UAAU,cAAc,CAAC,GAAW,EAAE,KAAe;IACxD,MAAM,MAAM,GAAG,eAAe,EAAE,CAAC;IACjC,KAAK,MAAM,IAAI,IAAI,YAAY,EAAE,CAAC;QAChC,MAAM,IAAI,GAAG,OAAO,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC;QAChC,IAAI,UAAU,CAAC,IAAI,CAAC,EAAE,CAAC;YACrB,gFAAgF;YAChF,gFAAgF;YAChF,kFAAkF;YAClF,2EAA2E;YAC3E,MAAM,GAAG,GAAG,MAAM,MAAM,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC;YAC9D,OAAO,CAAE,GAAmC,CAAC,OAAO,IAAI,GAAG,CAAkB,CAAC;QAChF,CAAC;IACH,CAAC;IACD,OAAO,EAAE,CAAC;AACZ,CAAC;AAED;;;;;;GAMG;AACH,MAAM,CAAC,KAAK,UAAU,UAAU,CAAC,IAAY,EAAE,OAA6B;IAC1E,OAAO,cAAc,CAAC,IAAI,EAAE,OAAO,EAAE,KAAK,CAAC,CAAC;AAC9C,CAAC;AAED,oDAAoD;AAEpD;;;;;GAKG;AACH,SAAS,WAAW,CAAC,IAAmB,EAAE,QAAgC;IACxE,MAAM,MAAM,GAAkB,EAAE,GAAG,IAAI,EAAE,GAAG,QAAQ,EAAE,CAAC;IACvD,IAAI,IAAI,CAAC,OAAO,IAAI,QAAQ,CAAC,OAAO,EAAE,CAAC;QACrC,MAAM,CAAC,OAAO,GAAG,EAAE,GAAG,IAAI,CAAC,OAAO,EAAE,GAAG,QAAQ,CAAC,OAAO,EAAE,CAAC;IAC5D,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC;AAED;;;;;;GAMG;AACH,MAAM,CAAC,KAAK,UAAU,kBAAkB,CAAC,aAAqB,EAAE,OAAe;IAC7E,MAAM,IAAI,GAAG,MAAM,UAAU,CAAC,aAAa,CAAC,CAAC;IAC7C,IAAI,OAAO,CAAC,aAAa,CAAC,KAAK,OAAO,CAAC,OAAO,CAAC;QAAE,OAAO,IAAI,CAAC;IAC7D,OAAO,WAAW,CAAC,IAAI,EAAE,MAAM,UAAU,CAAC,OAAO,CAAC,CAAC,CAAC;AACtD,CAAC"}
+{"version":3,"file":"config-loader.js","sourceRoot":"","sources":["../src/config-loader.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AACpC,OAAO,EAAE,UAAU,EAAE,MAAM,SAAS,CAAC;AAIrC,OAAO,EAAE,eAAe,EAAE,MAAM,aAAa,CAAC;AAoC9C,oDAAoD;AAEpD,MAAM,YAAY,GAAG,CAAC,mBAAmB,EAAE,mBAAmB,EAAE,oBAAoB,CAAC,CAAC;AAEtF,KAAK,UAAU,cAAc,CAAC,GAAW,EAAE,KAAe;IACxD,MAAM,MAAM,GAAG,eAAe,EAAE,CAAC;IACjC,KAAK,MAAM,IAAI,IAAI,YAAY,EAAE,CAAC;QAChC,MAAM,IAAI,GAAG,OAAO,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC;QAChC,IAAI,UAAU,CAAC,IAAI,CAAC,EAAE,CAAC;YACrB,gFAAgF;YAChF,gFAAgF;YAChF,kFAAkF;YAClF,2EAA2E;YAC3E,MAAM,GAAG,GAAG,MAAM,MAAM,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC;YAC9D,OAAO,CAAE,GAAmC,CAAC,OAAO,IAAI,GAAG,CAAkB,CAAC;QAChF,CAAC;IACH,CAAC;IACD,OAAO,EAAE,CAAC;AACZ,CAAC;AAED,yEAAyE;AACzE,MAAM,CAAC,KAAK,UAAU,UAAU,CAAC,IAAY,EAAE,OAA6B;IAC1E,OAAO,cAAc,CAAC,IAAI,EAAE,OAAO,EAAE,KAAK,CAAC,CAAC;AAC9C,CAAC;AAED,oDAAoD;AAEpD;;;;GAIG;AACH,SAAS,WAAW,CAAC,IAAmB,EAAE,QAAgC;IACxE,MAAM,MAAM,GAAkB,EAAE,GAAG,IAAI,EAAE,GAAG,QAAQ,EAAE,CAAC;IACvD,IAAI,IAAI,CAAC,OAAO,IAAI,QAAQ,CAAC,OAAO,EAAE,CAAC;QACrC,MAAM,CAAC,OAAO,GAAG,EAAE,GAAG,IAAI,CAAC,OAAO,EAAE,GAAG,QAAQ,CAAC,OAAO,EAAE,CAAC;IAC5D,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,oDAAoD;AACpD,MAAM,CAAC,KAAK,UAAU,kBAAkB,CAAC,aAAqB,EAAE,OAAe;IAC7E,MAAM,IAAI,GAAG,MAAM,UAAU,CAAC,aAAa,CAAC,CAAC;IAC7C,IAAI,OAAO,CAAC,aAAa,CAAC,KAAK,OAAO,CAAC,OAAO,CAAC;QAAE,OAAO,IAAI,CAAC;IAC7D,OAAO,WAAW,CAAC,IAAI,EAAE,MAAM,UAAU,CAAC,OAAO,CAAC,CAAC,CAAC;AACtD,CAAC"}

package/dist/contract.d.ts

@@ -1,41 +1,27 @@
-import { type InvocationContext } from './contract/Invocation.js';
+import { type InvocationContext } from './wire/Invocation.js';
 import type { FrondCall } from './wire/call.js';
 export { FougereError, ErrorCode, validationErrorsOf } from './wire/errors.js';
+export { comparisonOf, comparisonsIn, unknownIn, COMPARISONS } from './criterion.js';
+export type { Comparison, ComparisonName } from './criterion.js';
 export { toPublicError } from './wire/http-error.js';
 export type { FougereErrorOptions } from './wire/errors.js';
-export { canonicalInvocation, EMPTY_INVOCATION } from './contract/Invocation.js';
-export type { InvocationContext } from './contract/Invocation.js';
-export { Invocation } from './contract/Invocation.js';
-export type { InvocationInput } from './contract/Invocation.js';
-export { Call } from './contract/Call.js';
-export { RouteAddress } from './contract/RouteAddress.js';
-export type { RouteAddressInput } from './contract/RouteAddress.js';
+export { canonicalInvocation, EMPTY_INVOCATION } from './wire/Invocation.js';
+export type { InvocationContext } from './wire/Invocation.js';
+export { Invocation } from './wire/Invocation.js';
+export type { PartialInvocation } from './wire/Invocation.js';
+export { Call } from './wire/call.js';
+export { RouteAddress } from './wire/RouteAddress.js';
+export type { RouteAddressInput } from './wire/RouteAddress.js';
 export type { FrondCall, Transport, SignedCall } from './wire/call.js';
 export { MAX_BODY_BYTES } from './wire/call.js';
 export { RPC_ENTITY } from './wire/call.js';
-export type { CallPage, CallRecord } from './contract/CallLog.js';
+export type { CallPage, CallRecord } from './wire/CallLog.js';
 export { driftOf, agrees, explain } from './wire/drift.js';
 export type { CardDrift } from './wire/drift.js';
-/**
- * What `rpc.discover` answers. It belongs here and not to the runtime: the
- * reserved op travels on the same wire as every other call, so a consumer that
- * only sends — a browser bundle, a frond written elsewhere — needs its shape and
- * nothing else. Type-only, so `call.js` never enters the runtime graph.
- *
- * Stated once, on purpose: two private copies of this interface have already gone
- * stale (the CLI's, then the Rust demo's) the day an op stopped being a bare name.
- */
+/** What `rpc.discover` answers. */
 export type { IdentityCard, CardOp, TopologyReport, FrondPlacement, Edge } from './wire/call.js';
 export { assertIdentityCard } from './wire/call.js';
-/**
- * The key a class name is filed under — 'Post' → 'post'. Re-exported rather than
- * respelled: a card writes it and a foreign key derives from it, so the convention
- * belongs to the schema, and a second copy here is a second opinion. It travels
- * through this subpath because a consumer of the wire (a browser bundle) may hold no
- * schema dependency of its own — that audience only. Inside the package it is read from
- * `@fougere/schema` directly: routing four modules through here bought nothing and put
- * this file inside a cycle.
- */
+/** The key a class name is filed under — 'Post' → 'post'. */
 export { lowerFirst } from '@fougere/schema';
 /** A call, fully fabricated: the designation and its completed invocation. */
 export interface CallValue {
@@ -43,10 +29,8 @@ export interface CallValue {
     invocation: InvocationContext;
 }
 /**
- * Fabricate the call value — one designation, two spellings:
- * `callValueOf(Post, 'list', { query })` (class + verb) or
- * `callValueOf({ entity, op }, input)` (raw, for dynamic bridges).
- * Missing invocation fields complete to the empty invocation.
+ * Fabricate the call value — one designation, two spellings: `callValueOf(Post, 'list', { query
+ * })` (class + verb) or `callValueOf({ entity, op }, input)` (raw, for dynamic bridges).
  */
 export declare function callValueOf(target: {
     name: string;

package/dist/contract.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"contract.d.ts","sourceRoot":"","sources":["../src/contract.ts"],"names":[],"mappings":"AAWA,OAAO,EAAuB,KAAK,iBAAiB,EAAE,MAAM,0BAA0B,CAAC;AACvF,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,gBAAgB,CAAC;AAEhD,OAAO,EAAE,YAAY,EAAE,SAAS,EAAE,kBAAkB,EAAE,MAAM,kBAAkB,CAAC;AAG/E,OAAO,EAAE,aAAa,EAAE,MAAM,sBAAsB,CAAC;AACrD,YAAY,EAAE,mBAAmB,EAAE,MAAM,kBAAkB,CAAC;AAC5D,OAAO,EAAE,mBAAmB,EAAE,gBAAgB,EAAE,MAAM,0BAA0B,CAAC;AACjF,YAAY,EAAE,iBAAiB,EAAE,MAAM,0BAA0B,CAAC;AAClE,OAAO,EAAE,UAAU,EAAE,MAAM,0BAA0B,CAAC;AACtD,YAAY,EAAE,eAAe,EAAE,MAAM,0BAA0B,CAAC;AAChE,OAAO,EAAE,IAAI,EAAE,MAAM,oBAAoB,CAAC;AAC1C,OAAO,EAAE,YAAY,EAAE,MAAM,4BAA4B,CAAC;AAC1D,YAAY,EAAE,iBAAiB,EAAE,MAAM,4BAA4B,CAAC;AACpE,YAAY,EAAE,SAAS,EAAE,SAAS,EAAE,UAAU,EAAE,MAAM,gBAAgB,CAAC;AACvE,OAAO,EAAE,cAAc,EAAE,MAAM,gBAAgB,CAAC;AAGhD,OAAO,EAAE,UAAU,EAAE,MAAM,gBAAgB,CAAC;AAC5C,YAAY,EAAE,QAAQ,EAAE,UAAU,EAAE,MAAM,uBAAuB,CAAC;AAGlE,OAAO,EAAE,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,iBAAiB,CAAC;AAC3D,YAAY,EAAE,SAAS,EAAE,MAAM,iBAAiB,CAAC;AAEjD;;;;;;;;GAQG;AACH,YAAY,EAAE,YAAY,EAAE,MAAM,EAAE,cAAc,EAAE,cAAc,EAAE,IAAI,EAAE,MAAM,gBAAgB,CAAC;AACjG,OAAO,EAAE,kBAAkB,EAAE,MAAM,gBAAgB,CAAC;AAEpD;;;;;;;;GAQG;AACH,OAAO,EAAE,UAAU,EAAE,MAAM,iBAAiB,CAAC;AAE7C,8EAA8E;AAC9E,MAAM,WAAW,SAAS;IACxB,IAAI,EAAE,SAAS,CAAC;IAChB,UAAU,EAAE,iBAAiB,CAAC;CAC/B;AAED;;;;;GAKG;AACH,wBAAgB,WAAW,CACzB,MAAM,EAAE;IAAE,IAAI,EAAE,MAAM,CAAA;CAAE,GAAG,SAAS,EACpC,SAAS,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,iBAAiB,CAAC,EAC/C,KAAK,CAAC,EAAE,OAAO,CAAC,iBAAiB,CAAC,GACjC,SAAS,CAMX"}
+{"version":3,"file":"contract.d.ts","sourceRoot":"","sources":["../src/contract.ts"],"names":[],"mappings":"AAKA,OAAO,EAAuB,KAAK,iBAAiB,EAAE,MAAM,sBAAsB,CAAC;AACnF,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,gBAAgB,CAAC;AAEhD,OAAO,EAAE,YAAY,EAAE,SAAS,EAAE,kBAAkB,EAAE,MAAM,kBAAkB,CAAC;AAG/E,OAAO,EAAE,YAAY,EAAE,aAAa,EAAE,SAAS,EAAE,WAAW,EAAE,MAAM,gBAAgB,CAAC;AACrF,YAAY,EAAE,UAAU,EAAE,cAAc,EAAE,MAAM,gBAAgB,CAAC;AAGjE,OAAO,EAAE,aAAa,EAAE,MAAM,sBAAsB,CAAC;AACrD,YAAY,EAAE,mBAAmB,EAAE,MAAM,kBAAkB,CAAC;AAC5D,OAAO,EAAE,mBAAmB,EAAE,gBAAgB,EAAE,MAAM,sBAAsB,CAAC;AAC7E,YAAY,EAAE,iBAAiB,EAAE,MAAM,sBAAsB,CAAC;AAC9D,OAAO,EAAE,UAAU,EAAE,MAAM,sBAAsB,CAAC;AAClD,YAAY,EAAE,iBAAiB,EAAE,MAAM,sBAAsB,CAAC;AAC9D,OAAO,EAAE,IAAI,EAAE,MAAM,gBAAgB,CAAC;AACtC,OAAO,EAAE,YAAY,EAAE,MAAM,wBAAwB,CAAC;AACtD,YAAY,EAAE,iBAAiB,EAAE,MAAM,wBAAwB,CAAC;AAChE,YAAY,EAAE,SAAS,EAAE,SAAS,EAAE,UAAU,EAAE,MAAM,gBAAgB,CAAC;AACvE,OAAO,EAAE,cAAc,EAAE,MAAM,gBAAgB,CAAC;AAGhD,OAAO,EAAE,UAAU,EAAE,MAAM,gBAAgB,CAAC;AAC5C,YAAY,EAAE,QAAQ,EAAE,UAAU,EAAE,MAAM,mBAAmB,CAAC;AAG9D,OAAO,EAAE,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,iBAAiB,CAAC;AAC3D,YAAY,EAAE,SAAS,EAAE,MAAM,iBAAiB,CAAC;AAEjD,mCAAmC;AACnC,YAAY,EAAE,YAAY,EAAE,MAAM,EAAE,cAAc,EAAE,cAAc,EAAE,IAAI,EAAE,MAAM,gBAAgB,CAAC;AACjG,OAAO,EAAE,kBAAkB,EAAE,MAAM,gBAAgB,CAAC;AAEpD,6DAA6D;AAC7D,OAAO,EAAE,UAAU,EAAE,MAAM,iBAAiB,CAAC;AAE7C,8EAA8E;AAC9E,MAAM,WAAW,SAAS;IACxB,IAAI,EAAE,SAAS,CAAC;IAChB,UAAU,EAAE,iBAAiB,CAAC;CAC/B;AAED;;;GAGG;AACH,wBAAgB,WAAW,CACzB,MAAM,EAAE;IAAE,IAAI,EAAE,MAAM,CAAA;CAAE,GAAG,SAAS,EACpC,SAAS,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,iBAAiB,CAAC,EAC/C,KAAK,CAAC,EAAE,OAAO,CAAC,iBAAiB,CAAC,GACjC,SAAS,CAMX"}

package/dist/contract.js

@@ -1,23 +1,20 @@
 /**
- * Contract surface — what a sender needs to speak to a receiver, and
- * nothing that assumes a runtime: the error vocabulary, the invocation
- * shape, the call value, the naming convention.
- *
- * Browser-safe by design: no node builtin may enter this module's import
- * graph. Published as the `@fougere/core/contract` subpath so client
- * bundles never touch the full index (scanner, config loader). `@fougere/schema`
- * is allowed in — measured, it imports no node builtin either.
+ * Contract surface — what a sender needs to speak to a receiver, and nothing that assumes a
+ * runtime: the error vocabulary, the invocation shape, the call value, the naming convention.
  */
 import { lowerFirst } from '@fougere/schema';
-import { canonicalInvocation } from './contract/Invocation.js';
+import { canonicalInvocation } from './wire/Invocation.js';
 export { FougereError, ErrorCode, validationErrorsOf } from './wire/errors.js';
+// What a read may ask about one field. Here rather than on the main entry because an
+// adapter reads it to compile a query, and an adapter carries no boot.
+export { comparisonOf, comparisonsIn, unknownIn, COMPARISONS } from './criterion.js';
 // A receiver turns a refusal into what may cross a process boundary, and it is not
 // core's boot — reaching it through the main entry dragged the scanner into a bundle.
 export { toPublicError } from './wire/http-error.js';
-export { canonicalInvocation, EMPTY_INVOCATION } from './contract/Invocation.js';
-export { Invocation } from './contract/Invocation.js';
-export { Call } from './contract/Call.js';
-export { RouteAddress } from './contract/RouteAddress.js';
+export { canonicalInvocation, EMPTY_INVOCATION } from './wire/Invocation.js';
+export { Invocation } from './wire/Invocation.js';
+export { Call } from './wire/call.js';
+export { RouteAddress } from './wire/RouteAddress.js';
 export { MAX_BODY_BYTES } from './wire/call.js';
 // The reserved entity, VALUE and not type: a consumer that wants to leave it alone — a
 // call log ignoring its own reader — has to be able to name it.
@@ -26,21 +23,11 @@ export { RPC_ENTITY } from './wire/call.js';
 // purpose: a panel showing the drift holds only the two cards, never the app.
 export { driftOf, agrees, explain } from './wire/drift.js';
 export { assertIdentityCard } from './wire/call.js';
-/**
- * The key a class name is filed under — 'Post' → 'post'. Re-exported rather than
- * respelled: a card writes it and a foreign key derives from it, so the convention
- * belongs to the schema, and a second copy here is a second opinion. It travels
- * through this subpath because a consumer of the wire (a browser bundle) may hold no
- * schema dependency of its own — that audience only. Inside the package it is read from
- * `@fougere/schema` directly: routing four modules through here bought nothing and put
- * this file inside a cycle.
- */
+/** The key a class name is filed under — 'Post' → 'post'. */
 export { lowerFirst } from '@fougere/schema';
 /**
- * Fabricate the call value — one designation, two spellings:
- * `callValueOf(Post, 'list', { query })` (class + verb) or
- * `callValueOf({ entity, op }, input)` (raw, for dynamic bridges).
- * Missing invocation fields complete to the empty invocation.
+ * Fabricate the call value — one designation, two spellings: `callValueOf(Post, 'list', { query
+ * })` (class + verb) or `callValueOf({ entity, op }, input)` (raw, for dynamic bridges).
  */
 export function callValueOf(target, opOrInput, input) {
     const [call, given] = typeof opOrInput === 'string'

package/dist/contract.js.map

@@ -1 +1 @@
-{"version":3,"file":"contract.js","sourceRoot":"","sources":["../src/contract.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AACH,OAAO,EAAE,UAAU,EAAE,MAAM,iBAAiB,CAAC;AAC7C,OAAO,EAAE,mBAAmB,EAA0B,MAAM,0BAA0B,CAAC;AAGvF,OAAO,EAAE,YAAY,EAAE,SAAS,EAAE,kBAAkB,EAAE,MAAM,kBAAkB,CAAC;AAC/E,mFAAmF;AACnF,sFAAsF;AACtF,OAAO,EAAE,aAAa,EAAE,MAAM,sBAAsB,CAAC;AAErD,OAAO,EAAE,mBAAmB,EAAE,gBAAgB,EAAE,MAAM,0BAA0B,CAAC;AAEjF,OAAO,EAAE,UAAU,EAAE,MAAM,0BAA0B,CAAC;AAEtD,OAAO,EAAE,IAAI,EAAE,MAAM,oBAAoB,CAAC;AAC1C,OAAO,EAAE,YAAY,EAAE,MAAM,4BAA4B,CAAC;AAG1D,OAAO,EAAE,cAAc,EAAE,MAAM,gBAAgB,CAAC;AAChD,uFAAuF;AACvF,gEAAgE;AAChE,OAAO,EAAE,UAAU,EAAE,MAAM,gBAAgB,CAAC;AAE5C,wFAAwF;AACxF,8EAA8E;AAC9E,OAAO,EAAE,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,iBAAiB,CAAC;AAa3D,OAAO,EAAE,kBAAkB,EAAE,MAAM,gBAAgB,CAAC;AAEpD;;;;;;;;GAQG;AACH,OAAO,EAAE,UAAU,EAAE,MAAM,iBAAiB,CAAC;AAQ7C;;;;;GAKG;AACH,MAAM,UAAU,WAAW,CACzB,MAAoC,EACpC,SAA+C,EAC/C,KAAkC;IAElC,MAAM,CAAC,IAAI,EAAE,KAAK,CAAC,GACjB,OAAO,SAAS,KAAK,QAAQ;QAC3B,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,UAAU,CAAE,MAA2B,CAAC,IAAI,CAAC,EAAE,EAAE,EAAE,SAAS,EAAE,EAAE,KAAK,CAAC;QACnF,CAAC,CAAC,CAAC,MAAmB,EAAE,SAAS,CAAC,CAAC;IACvC,OAAO,EAAE,IAAI,EAAE,UAAU,EAAE,mBAAmB,CAAC,KAAK,CAAC,EAAE,CAAC;AAC1D,CAAC"}
+{"version":3,"file":"contract.js","sourceRoot":"","sources":["../src/contract.ts"],"names":[],"mappings":"AAAA;;;GAGG;AACH,OAAO,EAAE,UAAU,EAAE,MAAM,iBAAiB,CAAC;AAC7C,OAAO,EAAE,mBAAmB,EAA0B,MAAM,sBAAsB,CAAC;AAGnF,OAAO,EAAE,YAAY,EAAE,SAAS,EAAE,kBAAkB,EAAE,MAAM,kBAAkB,CAAC;AAC/E,qFAAqF;AACrF,uEAAuE;AACvE,OAAO,EAAE,YAAY,EAAE,aAAa,EAAE,SAAS,EAAE,WAAW,EAAE,MAAM,gBAAgB,CAAC;AAErF,mFAAmF;AACnF,sFAAsF;AACtF,OAAO,EAAE,aAAa,EAAE,MAAM,sBAAsB,CAAC;AAErD,OAAO,EAAE,mBAAmB,EAAE,gBAAgB,EAAE,MAAM,sBAAsB,CAAC;AAE7E,OAAO,EAAE,UAAU,EAAE,MAAM,sBAAsB,CAAC;AAElD,OAAO,EAAE,IAAI,EAAE,MAAM,gBAAgB,CAAC;AACtC,OAAO,EAAE,YAAY,EAAE,MAAM,wBAAwB,CAAC;AAGtD,OAAO,EAAE,cAAc,EAAE,MAAM,gBAAgB,CAAC;AAChD,uFAAuF;AACvF,gEAAgE;AAChE,OAAO,EAAE,UAAU,EAAE,MAAM,gBAAgB,CAAC;AAE5C,wFAAwF;AACxF,8EAA8E;AAC9E,OAAO,EAAE,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,iBAAiB,CAAC;AAK3D,OAAO,EAAE,kBAAkB,EAAE,MAAM,gBAAgB,CAAC;AAEpD,6DAA6D;AAC7D,OAAO,EAAE,UAAU,EAAE,MAAM,iBAAiB,CAAC;AAQ7C;;;GAGG;AACH,MAAM,UAAU,WAAW,CACzB,MAAoC,EACpC,SAA+C,EAC/C,KAAkC;IAElC,MAAM,CAAC,IAAI,EAAE,KAAK,CAAC,GACjB,OAAO,SAAS,KAAK,QAAQ;QAC3B,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,UAAU,CAAE,MAA2B,CAAC,IAAI,CAAC,EAAE,EAAE,EAAE,SAAS,EAAE,EAAE,KAAK,CAAC;QACnF,CAAC,CAAC,CAAC,MAAmB,EAAE,SAAS,CAAC,CAAC;IACvC,OAAO,EAAE,IAAI,EAAE,UAAU,EAAE,mBAAmB,CAAC,KAAK,CAAC,EAAE,CAAC;AAC1D,CAAC"}

package/dist/criterion.d.ts

@@ -0,0 +1,37 @@
+/** What a read may ask about one field, and how a storage tells the two forms apart. */
+import { type Field } from '@fougere/schema';
+/**
+ * The comparisons a criterion may name.
+ *
+ * `eq` and `in` are not here: a bare value already means equality and an array already
+ * means membership, and giving them a second spelling would make one criterion sayable
+ * two ways. What is added is what those two could not say at all.
+ */
+export interface Comparison {
+    gte?: unknown;
+    lte?: unknown;
+    gt?: unknown;
+    lt?: unknown;
+    ne?: unknown;
+    /** Both bounds, inclusive — `between: [1500, 4000]`. */
+    between?: [unknown, unknown];
+    contains?: string;
+    notIn?: readonly unknown[];
+    isNull?: boolean;
+}
+export declare const COMPARISONS: readonly ["gte", "lte", "gt", "lt", "ne", "between", "contains", "notIn", "isNull"];
+export type ComparisonName = (typeof COMPARISONS)[number];
+/**
+ * Is this criterion a comparison, or a value that happens to be an object?
+ *
+ * Read off the FIELD, never off the value. `json()` admits any shape, so `{ gte: … }` is
+ * a legal thing to store — telling the two apart by looking at the criterion would make a
+ * stored object unfilterable the day its keys happened to spell an operator. The shape
+ * knows, and it is the only thing that does.
+ */
+export declare function comparisonOf(field: Field | undefined, asked: unknown): Comparison | undefined;
+/** The comparisons a criterion names, in the order the caller wrote them. */
+export declare function comparisonsIn(comparison: Comparison): [ComparisonName, unknown][];
+/** What a comparison names that this vocabulary does not — a typo, said as one. */
+export declare function unknownIn(comparison: Comparison): string[];
+//# sourceMappingURL=criterion.d.ts.map

package/dist/criterion.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"criterion.d.ts","sourceRoot":"","sources":["../src/criterion.ts"],"names":[],"mappings":"AAAA,wFAAwF;AACxF,OAAO,EAAE,KAAK,KAAK,EAAU,MAAM,iBAAiB,CAAC;AAErD;;;;;;GAMG;AACH,MAAM,WAAW,UAAU;IACzB,GAAG,CAAC,EAAE,OAAO,CAAC;IACd,GAAG,CAAC,EAAE,OAAO,CAAC;IACd,EAAE,CAAC,EAAE,OAAO,CAAC;IACb,EAAE,CAAC,EAAE,OAAO,CAAC;IACb,EAAE,CAAC,EAAE,OAAO,CAAC;IACb,wDAAwD;IACxD,OAAO,CAAC,EAAE,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;IAC7B,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,KAAK,CAAC,EAAE,SAAS,OAAO,EAAE,CAAC;IAC3B,MAAM,CAAC,EAAE,OAAO,CAAC;CAClB;AAED,eAAO,MAAM,WAAW,qFAAsF,CAAC;AAE/G,MAAM,MAAM,cAAc,GAAG,CAAC,OAAO,WAAW,CAAC,CAAC,MAAM,CAAC,CAAC;AAE1D;;;;;;;GAOG;AACH,wBAAgB,YAAY,CAAC,KAAK,EAAE,KAAK,GAAG,SAAS,EAAE,KAAK,EAAE,OAAO,GAAG,UAAU,GAAG,SAAS,CAM7F;AAED,6EAA6E;AAC7E,wBAAgB,aAAa,CAAC,UAAU,EAAE,UAAU,GAAG,CAAC,cAAc,EAAE,OAAO,CAAC,EAAE,CAIjF;AAED,mFAAmF;AACnF,wBAAgB,SAAS,CAAC,UAAU,EAAE,UAAU,GAAG,MAAM,EAAE,CAE1D"}

package/dist/criterion.js

@@ -0,0 +1,28 @@
+/** What a read may ask about one field, and how a storage tells the two forms apart. */
+import { Shapes } from '@fougere/schema';
+export const COMPARISONS = ['gte', 'lte', 'gt', 'lt', 'ne', 'between', 'contains', 'notIn', 'isNull'];
+/**
+ * Is this criterion a comparison, or a value that happens to be an object?
+ *
+ * Read off the FIELD, never off the value. `json()` admits any shape, so `{ gte: … }` is
+ * a legal thing to store — telling the two apart by looking at the criterion would make a
+ * stored object unfilterable the day its keys happened to spell an operator. The shape
+ * knows, and it is the only thing that does.
+ */
+export function comparisonOf(field, asked) {
+    if (asked === null || typeof asked !== 'object' || Array.isArray(asked))
+        return undefined;
+    // `Shapes.of` answers with `null` already taken out — `optional(json())` is an object.
+    if (!field || Shapes.of(field.shape).base?.type === 'object')
+        return undefined;
+    return asked;
+}
+/** The comparisons a criterion names, in the order the caller wrote them. */
+export function comparisonsIn(comparison) {
+    return Object.entries(comparison).filter((entry) => COMPARISONS.includes(entry[0]));
+}
+/** What a comparison names that this vocabulary does not — a typo, said as one. */
+export function unknownIn(comparison) {
+    return Object.keys(comparison).filter((name) => !COMPARISONS.includes(name));
+}
+//# sourceMappingURL=criterion.js.map

package/dist/criterion.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"criterion.js","sourceRoot":"","sources":["../src/criterion.ts"],"names":[],"mappings":"AAAA,wFAAwF;AACxF,OAAO,EAAc,MAAM,EAAE,MAAM,iBAAiB,CAAC;AAsBrD,MAAM,CAAC,MAAM,WAAW,GAAG,CAAC,KAAK,EAAE,KAAK,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,SAAS,EAAE,UAAU,EAAE,OAAO,EAAE,QAAQ,CAAU,CAAC;AAI/G;;;;;;;GAOG;AACH,MAAM,UAAU,YAAY,CAAC,KAAwB,EAAE,KAAc;IACnE,IAAI,KAAK,KAAK,IAAI,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC;QAAE,OAAO,SAAS,CAAC;IAC1F,uFAAuF;IACvF,IAAI,CAAC,KAAK,IAAI,MAAM,CAAC,EAAE,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,IAAI,EAAE,IAAI,KAAK,QAAQ;QAAE,OAAO,SAAS,CAAC;IAE/E,OAAO,KAAmB,CAAC;AAC7B,CAAC;AAED,6EAA6E;AAC7E,MAAM,UAAU,aAAa,CAAC,UAAsB;IAClD,OAAO,MAAM,CAAC,OAAO,CAAC,UAAU,CAAC,CAAC,MAAM,CACtC,CAAC,KAAK,EAAsC,EAAE,CAAE,WAAiC,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CACrG,CAAC;AACJ,CAAC;AAED,mFAAmF;AACnF,MAAM,UAAU,SAAS,CAAC,UAAsB;IAC9C,OAAO,MAAM,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAE,WAAiC,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC;AACtG,CAAC"}

package/dist/crypto/encoding.d.ts

@@ -1,11 +1,4 @@
-/**
- * What both realizations spell identically — bytes in, bytes out, no platform.
- *
- * `Buffer` did all of this and does not exist on a Worker; `atob`/`btoa` exist on both.
- * Nothing here is a policy decision, which is why it sits beside the port rather than
- * inside either half: two copies of a base64url would be two chances to disagree on the
- * padding, and the disagreement would show up as a bad signature.
- */
+/** What both realizations spell identically — bytes in, bytes out, no platform. */
 export declare const bytesOf: (text: string) => Uint8Array;
 export declare const textOf: (bytes: Uint8Array) => string;
 /** Base64url, unpadded — what JWS puts between the dots. */
@@ -14,12 +7,6 @@ export declare function unb64url(input: string): Uint8Array;
 /** Plain base64, padded — what an environment variable carries a PEM as. */
 export declare function b64(input: Uint8Array | string): string;
 export declare const unb64: (input: string) => Uint8Array;
-/**
- * The DER a PEM wraps. WebCrypto imports DER and knows nothing about the armour.
- *
- * The label is not checked: a caller asking for a private key and handed a public one
- * fails at `importKey` with a message about the key, which is the truer error than one
- * about a header line.
- */
+/** The DER a PEM wraps. */
 export declare function derOf(pem: string): Uint8Array;
 //# sourceMappingURL=encoding.d.ts.map

package/dist/crypto/encoding.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"encoding.d.ts","sourceRoot":"","sources":["../../src/crypto/encoding.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAKH,eAAO,MAAM,OAAO,GAAI,MAAM,MAAM,KAAG,UAAkC,CAAC;AAC1E,eAAO,MAAM,MAAM,GAAI,OAAO,UAAU,KAAG,MAA+B,CAAC;AAE3E,4DAA4D;AAC5D,wBAAgB,MAAM,CAAC,KAAK,EAAE,UAAU,GAAG,MAAM,GAAG,MAAM,CAOzD;AAED,wBAAgB,QAAQ,CAAC,KAAK,EAAE,MAAM,GAAG,UAAU,CAKlD;AAED,4EAA4E;AAC5E,wBAAgB,GAAG,CAAC,KAAK,EAAE,UAAU,GAAG,MAAM,GAAG,MAAM,CAKtD;AAED,eAAO,MAAM,KAAK,GAAI,OAAO,MAAM,KAAG,UAKrC,CAAC;AAEF;;;;;;GAMG;AACH,wBAAgB,KAAK,CAAC,GAAG,EAAE,MAAM,GAAG,UAAU,CAI7C"}
+{"version":3,"file":"encoding.d.ts","sourceRoot":"","sources":["../../src/crypto/encoding.ts"],"names":[],"mappings":"AAAA,mFAAmF;AAKnF,eAAO,MAAM,OAAO,GAAI,MAAM,MAAM,KAAG,UAAkC,CAAC;AAC1E,eAAO,MAAM,MAAM,GAAI,OAAO,UAAU,KAAG,MAA+B,CAAC;AAE3E,4DAA4D;AAC5D,wBAAgB,MAAM,CAAC,KAAK,EAAE,UAAU,GAAG,MAAM,GAAG,MAAM,CAOzD;AAED,wBAAgB,QAAQ,CAAC,KAAK,EAAE,MAAM,GAAG,UAAU,CAKlD;AAED,4EAA4E;AAC5E,wBAAgB,GAAG,CAAC,KAAK,EAAE,UAAU,GAAG,MAAM,GAAG,MAAM,CAKtD;AAED,eAAO,MAAM,KAAK,GAAI,OAAO,MAAM,KAAG,UAKrC,CAAC;AAEF,2BAA2B;AAC3B,wBAAgB,KAAK,CAAC,GAAG,EAAE,MAAM,GAAG,UAAU,CAI7C"}

package/dist/crypto/encoding.js

@@ -1,11 +1,4 @@
-/**
- * What both realizations spell identically — bytes in, bytes out, no platform.
- *
- * `Buffer` did all of this and does not exist on a Worker; `atob`/`btoa` exist on both.
- * Nothing here is a policy decision, which is why it sits beside the port rather than
- * inside either half: two copies of a base64url would be two chances to disagree on the
- * padding, and the disagreement would show up as a bad signature.
- */
+/** What both realizations spell identically — bytes in, bytes out, no platform. */
 const encoder = new TextEncoder();
 const decoder = new TextDecoder();
 export const bytesOf = (text) => encoder.encode(text);
@@ -42,13 +35,7 @@ export const unb64 = (input) => {
         bytes[i] = binary.charCodeAt(i);
     return bytes;
 };
-/**
- * The DER a PEM wraps. WebCrypto imports DER and knows nothing about the armour.
- *
- * The label is not checked: a caller asking for a private key and handed a public one
- * fails at `importKey` with a message about the key, which is the truer error than one
- * about a header line.
- */
+/** The DER a PEM wraps. */
 export function derOf(pem) {
     const body = pem.replace(/-----(BEGIN|END)[^-]+-----/g, '').replace(/\s+/g, '');
     if (body.length === 0)

package/dist/crypto/encoding.js.map

@@ -1 +1 @@
-{"version":3,"file":"encoding.js","sourceRoot":"","sources":["../../src/crypto/encoding.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAEH,MAAM,OAAO,GAAG,IAAI,WAAW,EAAE,CAAC;AAClC,MAAM,OAAO,GAAG,IAAI,WAAW,EAAE,CAAC;AAElC,MAAM,CAAC,MAAM,OAAO,GAAG,CAAC,IAAY,EAAc,EAAE,CAAC,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;AAC1E,MAAM,CAAC,MAAM,MAAM,GAAG,CAAC,KAAiB,EAAU,EAAE,CAAC,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;AAE3E,4DAA4D;AAC5D,MAAM,UAAU,MAAM,CAAC,KAA0B;IAC/C,MAAM,KAAK,GAAG,OAAO,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC;IACjE,IAAI,MAAM,GAAG,EAAE,CAAC;IAChB,kFAAkF;IAClF,+EAA+E;IAC/E,KAAK,MAAM,IAAI,IAAI,KAAK;QAAE,MAAM,IAAI,MAAM,CAAC,YAAY,CAAC,IAAI,CAAC,CAAC;IAC9D,OAAO,IAAI,CAAC,MAAM,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;AACjF,CAAC;AAED,MAAM,UAAU,QAAQ,CAAC,KAAa;IACpC,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC,OAAO,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC,CAAC;IACjE,MAAM,KAAK,GAAG,IAAI,UAAU,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;IAC5C,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,MAAM,CAAC,MAAM,EAAE,CAAC,IAAI,CAAC;QAAE,KAAK,CAAC,CAAC,CAAC,GAAG,MAAM,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC;IAC3E,OAAO,KAAK,CAAC;AACf,CAAC;AAED,4EAA4E;AAC5E,MAAM,UAAU,GAAG,CAAC,KAA0B;IAC5C,MAAM,KAAK,GAAG,OAAO,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC;IACjE,IAAI,MAAM,GAAG,EAAE,CAAC;IAChB,KAAK,MAAM,IAAI,IAAI,KAAK;QAAE,MAAM,IAAI,MAAM,CAAC,YAAY,CAAC,IAAI,CAAC,CAAC;IAC9D,OAAO,IAAI,CAAC,MAAM,CAAC,CAAC;AACtB,CAAC;AAED,MAAM,CAAC,MAAM,KAAK,GAAG,CAAC,KAAa,EAAc,EAAE;IACjD,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC;IAC3B,MAAM,KAAK,GAAG,IAAI,UAAU,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;IAC5C,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,MAAM,CAAC,MAAM,EAAE,CAAC,IAAI,CAAC;QAAE,KAAK,CAAC,CAAC,CAAC,GAAG,MAAM,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC;IAC3E,OAAO,KAAK,CAAC;AACf,CAAC,CAAC;AAEF;;;;;;GAMG;AACH,MAAM,UAAU,KAAK,CAAC,GAAW;IAC/B,MAAM,IAAI,GAAG,GAAG,CAAC,OAAO,CAAC,6BAA6B,EAAE,EAAE,CAAC,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;IAChF,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,8CAA8C,CAAC,CAAC;IACvF,OAAO,KAAK,CAAC,IAAI,CAAC,CAAC;AACrB,CAAC"}
+{"version":3,"file":"encoding.js","sourceRoot":"","sources":["../../src/crypto/encoding.ts"],"names":[],"mappings":"AAAA,mFAAmF;AAEnF,MAAM,OAAO,GAAG,IAAI,WAAW,EAAE,CAAC;AAClC,MAAM,OAAO,GAAG,IAAI,WAAW,EAAE,CAAC;AAElC,MAAM,CAAC,MAAM,OAAO,GAAG,CAAC,IAAY,EAAc,EAAE,CAAC,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;AAC1E,MAAM,CAAC,MAAM,MAAM,GAAG,CAAC,KAAiB,EAAU,EAAE,CAAC,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;AAE3E,4DAA4D;AAC5D,MAAM,UAAU,MAAM,CAAC,KAA0B;IAC/C,MAAM,KAAK,GAAG,OAAO,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC;IACjE,IAAI,MAAM,GAAG,EAAE,CAAC;IAChB,kFAAkF;IAClF,+EAA+E;IAC/E,KAAK,MAAM,IAAI,IAAI,KAAK;QAAE,MAAM,IAAI,MAAM,CAAC,YAAY,CAAC,IAAI,CAAC,CAAC;IAC9D,OAAO,IAAI,CAAC,MAAM,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;AACjF,CAAC;AAED,MAAM,UAAU,QAAQ,CAAC,KAAa;IACpC,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC,OAAO,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC,CAAC;IACjE,MAAM,KAAK,GAAG,IAAI,UAAU,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;IAC5C,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,MAAM,CAAC,MAAM,EAAE,CAAC,IAAI,CAAC;QAAE,KAAK,CAAC,CAAC,CAAC,GAAG,MAAM,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC;IAC3E,OAAO,KAAK,CAAC;AACf,CAAC;AAED,4EAA4E;AAC5E,MAAM,UAAU,GAAG,CAAC,KAA0B;IAC5C,MAAM,KAAK,GAAG,OAAO,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC;IACjE,IAAI,MAAM,GAAG,EAAE,CAAC;IAChB,KAAK,MAAM,IAAI,IAAI,KAAK;QAAE,MAAM,IAAI,MAAM,CAAC,YAAY,CAAC,IAAI,CAAC,CAAC;IAC9D,OAAO,IAAI,CAAC,MAAM,CAAC,CAAC;AACtB,CAAC;AAED,MAAM,CAAC,MAAM,KAAK,GAAG,CAAC,KAAa,EAAc,EAAE;IACjD,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC;IAC3B,MAAM,KAAK,GAAG,IAAI,UAAU,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;IAC5C,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,MAAM,CAAC,MAAM,EAAE,CAAC,IAAI,CAAC;QAAE,KAAK,CAAC,CAAC,CAAC,GAAG,MAAM,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC;IAC3E,OAAO,KAAK,CAAC;AACf,CAAC,CAAC;AAEF,2BAA2B;AAC3B,MAAM,UAAU,KAAK,CAAC,GAAW;IAC/B,MAAM,IAAI,GAAG,GAAG,CAAC,OAAO,CAAC,6BAA6B,EAAE,EAAE,CAAC,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;IAChF,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,8CAA8C,CAAC,CAAC;IACvF,OAAO,KAAK,CAAC,IAAI,CAAC,CAAC;AACrB,CAAC"}

package/dist/crypto/node.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"node.d.ts","sourceRoot":"","sources":["../../src/crypto/node.ts"],"names":[],"mappings":"AAQA,OAAO,KAAK,EAAE,UAAU,EAAE,SAAS,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,WAAW,CAAC;AAEzE,eAAO,MAAM,MAAM,EAAE,UAiBpB,CAAC;AAEF,YAAY,EAAE,UAAU,EAAE,SAAS,EAAE,MAAM,EAAE,QAAQ,EAAE,CAAC"}
+{"version":3,"file":"node.d.ts","sourceRoot":"","sources":["../../src/crypto/node.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,UAAU,EAAE,SAAS,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,WAAW,CAAC;AAEzE,eAAO,MAAM,MAAM,EAAE,UAiBpB,CAAC;AAEF,YAAY,EAAE,UAAU,EAAE,SAAS,EAAE,MAAM,EAAE,QAAQ,EAAE,CAAC"}

package/dist/crypto/node.js

@@ -1,10 +1,4 @@
-/**
- * Ed25519 through `node:crypto` — the default realization, and the fast one.
- *
- * `sign`/`verify` are synchronous here and stay synchronous: the promise is put around
- * the answer, never around the work. That is the whole reason this file exists rather
- * than everyone sharing the WebCrypto half.
- */
+/** Ed25519 through `node:crypto` — the default realization, and the fast one. */
 import { createHash, createPrivateKey, createPublicKey, sign, verify } from 'node:crypto';
 export const crypto = {
     async sha256(data) {

package/dist/crypto/node.js.map

@@ -1 +1 @@
-{"version":3,"file":"node.js","sourceRoot":"","sources":["../../src/crypto/node.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AACH,OAAO,EAAE,UAAU,EAAE,gBAAgB,EAAE,eAAe,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,aAAa,CAAC;AAG1F,MAAM,CAAC,MAAM,MAAM,GAAe;IAChC,KAAK,CAAC,MAAM,CAAC,IAAI;QACf,OAAO,IAAI,UAAU,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC;IACpE,CAAC;IAED,KAAK,CAAC,QAAQ,CAAC,aAAa;QAC1B,oFAAoF;QACpF,MAAM,GAAG,GAAG,gBAAgB,CAAC,aAAa,CAAC,CAAC;QAC5C,OAAO,EAAE,KAAK,CAAC,IAAI,CAAC,IAAI,IAAI,OAAO,IAAI,UAAU,CAAC,IAAI,CAAC,IAAI,EAAE,IAAI,EAAE,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;IAChF,CAAC;IAED,KAAK,CAAC,UAAU,CAAC,GAAG;QAClB,MAAM,MAAM,GAAG,OAAO,GAAG,KAAK,QAAQ;YACpC,CAAC,CAAC,eAAe,CAAC,GAAG,CAAC;YACtB,CAAC,CAAC,eAAe,CAAC,EAAE,GAAG,EAAE,GAAY,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC,CAAC;QAC1D,OAAO,EAAE,KAAK,CAAC,MAAM,CAAC,IAAI,EAAE,SAAS,IAAI,OAAO,MAAM,CAAC,IAAI,EAAE,IAAI,EAAE,MAAM,EAAE,SAAS,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;IAC7F,CAAC;CACF,CAAC"}
+{"version":3,"file":"node.js","sourceRoot":"","sources":["../../src/crypto/node.ts"],"names":[],"mappings":"AAAA,iFAAiF;AACjF,OAAO,EAAE,UAAU,EAAE,gBAAgB,EAAE,eAAe,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,aAAa,CAAC;AAG1F,MAAM,CAAC,MAAM,MAAM,GAAe;IAChC,KAAK,CAAC,MAAM,CAAC,IAAI;QACf,OAAO,IAAI,UAAU,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC;IACpE,CAAC;IAED,KAAK,CAAC,QAAQ,CAAC,aAAa;QAC1B,oFAAoF;QACpF,MAAM,GAAG,GAAG,gBAAgB,CAAC,aAAa,CAAC,CAAC;QAC5C,OAAO,EAAE,KAAK,CAAC,IAAI,CAAC,IAAI,IAAI,OAAO,IAAI,UAAU,CAAC,IAAI,CAAC,IAAI,EAAE,IAAI,EAAE,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;IAChF,CAAC;IAED,KAAK,CAAC,UAAU,CAAC,GAAG;QAClB,MAAM,MAAM,GAAG,OAAO,GAAG,KAAK,QAAQ;YACpC,CAAC,CAAC,eAAe,CAAC,GAAG,CAAC;YACtB,CAAC,CAAC,eAAe,CAAC,EAAE,GAAG,EAAE,GAAY,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC,CAAC;QAC1D,OAAO,EAAE,KAAK,CAAC,MAAM,CAAC,IAAI,EAAE,SAAS,IAAI,OAAO,MAAM,CAAC,IAAI,EAAE,IAAI,EAAE,MAAM,EAAE,SAAS,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;IAC7F,CAAC;CACF,CAAC"}

package/dist/crypto/port.d.ts

@@ -1,20 +1,4 @@
-/**
- * The two Ed25519 gestures a signed call needs, and the one hash that binds it.
- *
- * Node signs 59% faster than WebCrypto on the same curve (measured 2026-08-23: 14.30 µs
- * against 22.72 µs per signature, 34.42 against 41.81 to verify), so this is a PORT with
- * two realizations and not one implementation at the lowest common denominator. `#crypto`
- * resolves to `crypto/node.ts` everywhere except under the `workerd` condition — the
- * bundler picks at build time, and neither half ever appears in the other's output.
- *
- * The shape is async because WebCrypto is. On Node that costs one microtask, which the
- * same measurement puts inside the noise of the signature itself (14.30 sync against
- * 14.28 awaited) — awaiting is free, converting is not.
- *
- * A KEY IS PARSED ONCE. `crypto.subtle.importKey` is async and per-key, so an interface
- * shaped `sign(key, data)` would import on every call; `signerOf(pem)` hands back
- * something that holds the parsed key, and a boot builds it once.
- */
+/** The two Ed25519 gestures a signed call needs, and the one hash that binds it. */
 /** A parsed private key. */
 export interface Signer {
     sign(data: Uint8Array): Promise<Uint8Array>;
@@ -32,7 +16,7 @@ export interface PublicJwk {
     [key: string]: unknown;
 }
 export interface CryptoPort {
-    /** SHA-256. What binds a body to an envelope without carrying the body. */
+    /** SHA-256. What binds an input to an envelope without carrying the input. */
     sha256(data: Uint8Array): Promise<Uint8Array>;
     /** From a PKCS#8 PEM — what `fougere keys` writes. */
     signerOf(privateKeyPem: string): Promise<Signer>;

package/dist/crypto/port.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"port.d.ts","sourceRoot":"","sources":["../../src/crypto/port.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG;AAEH,4BAA4B;AAC5B,MAAM,WAAW,MAAM;IACrB,IAAI,CAAC,IAAI,EAAE,UAAU,GAAG,OAAO,CAAC,UAAU,CAAC,CAAC;CAC7C;AAED,2BAA2B;AAC3B,MAAM,WAAW,QAAQ;IACvB,yEAAyE;IACzE,MAAM,CAAC,IAAI,EAAE,UAAU,EAAE,SAAS,EAAE,UAAU,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;CACnE;AAED,gFAAgF;AAChF,MAAM,WAAW,SAAS;IACxB,GAAG,EAAE,MAAM,CAAC;IACZ,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,CAAC,CAAC,EAAE,MAAM,CAAC;IACX,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC;CACxB;AAED,MAAM,WAAW,UAAU;IACzB,2EAA2E;IAC3E,MAAM,CAAC,IAAI,EAAE,UAAU,GAAG,OAAO,CAAC,UAAU,CAAC,CAAC;IAC9C,sDAAsD;IACtD,QAAQ,CAAC,aAAa,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC;IACjD,uEAAuE;IACvE,UAAU,CAAC,GAAG,EAAE,MAAM,GAAG,SAAS,GAAG,OAAO,CAAC,QAAQ,CAAC,CAAC;CACxD"}
+{"version":3,"file":"port.d.ts","sourceRoot":"","sources":["../../src/crypto/port.ts"],"names":[],"mappings":"AAAA,oFAAoF;AAEpF,4BAA4B;AAC5B,MAAM,WAAW,MAAM;IACrB,IAAI,CAAC,IAAI,EAAE,UAAU,GAAG,OAAO,CAAC,UAAU,CAAC,CAAC;CAC7C;AAED,2BAA2B;AAC3B,MAAM,WAAW,QAAQ;IACvB,yEAAyE;IACzE,MAAM,CAAC,IAAI,EAAE,UAAU,EAAE,SAAS,EAAE,UAAU,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;CACnE;AAED,gFAAgF;AAChF,MAAM,WAAW,SAAS;IACxB,GAAG,EAAE,MAAM,CAAC;IACZ,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,CAAC,CAAC,EAAE,MAAM,CAAC;IACX,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC;CACxB;AAED,MAAM,WAAW,UAAU;IACzB,8EAA8E;IAC9E,MAAM,CAAC,IAAI,EAAE,UAAU,GAAG,OAAO,CAAC,UAAU,CAAC,CAAC;IAC9C,sDAAsD;IACtD,QAAQ,CAAC,aAAa,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC;IACjD,uEAAuE;IACvE,UAAU,CAAC,GAAG,EAAE,MAAM,GAAG,SAAS,GAAG,OAAO,CAAC,QAAQ,CAAC,CAAC;CACxD"}

package/dist/crypto/port.js

@@ -1,19 +1,3 @@
-/**
- * The two Ed25519 gestures a signed call needs, and the one hash that binds it.
- *
- * Node signs 59% faster than WebCrypto on the same curve (measured 2026-08-23: 14.30 µs
- * against 22.72 µs per signature, 34.42 against 41.81 to verify), so this is a PORT with
- * two realizations and not one implementation at the lowest common denominator. `#crypto`
- * resolves to `crypto/node.ts` everywhere except under the `workerd` condition — the
- * bundler picks at build time, and neither half ever appears in the other's output.
- *
- * The shape is async because WebCrypto is. On Node that costs one microtask, which the
- * same measurement puts inside the noise of the signature itself (14.30 sync against
- * 14.28 awaited) — awaiting is free, converting is not.
- *
- * A KEY IS PARSED ONCE. `crypto.subtle.importKey` is async and per-key, so an interface
- * shaped `sign(key, data)` would import on every call; `signerOf(pem)` hands back
- * something that holds the parsed key, and a boot builds it once.
- */
+/** The two Ed25519 gestures a signed call needs, and the one hash that binds it. */
 export {};
 //# sourceMappingURL=port.js.map

package/dist/crypto/port.js.map

@@ -1 +1 @@
-{"version":3,"file":"port.js","sourceRoot":"","sources":["../../src/crypto/port.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG"}
+{"version":3,"file":"port.js","sourceRoot":"","sources":["../../src/crypto/port.ts"],"names":[],"mappings":"AAAA,oFAAoF"}

package/dist/crypto/webcrypto.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"webcrypto.d.ts","sourceRoot":"","sources":["../../src/crypto/webcrypto.ts"],"names":[],"mappings":"AAaA,OAAO,KAAK,EAAE,UAAU,EAAE,SAAS,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,WAAW,CAAC;AAqBzE,eAAO,MAAM,MAAM,EAAE,UAkBpB,CAAC;AAEF,YAAY,EAAE,UAAU,EAAE,SAAS,EAAE,MAAM,EAAE,QAAQ,EAAE,CAAC"}
+{"version":3,"file":"webcrypto.d.ts","sourceRoot":"","sources":["../../src/crypto/webcrypto.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,UAAU,EAAE,SAAS,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,WAAW,CAAC;AAqBzE,eAAO,MAAM,MAAM,EAAE,UAkBpB,CAAC;AAEF,YAAY,EAAE,UAAU,EAAE,SAAS,EAAE,MAAM,EAAE,QAAQ,EAAE,CAAC"}

package/dist/crypto/webcrypto.js

@@ -1,15 +1,4 @@
-/**
- * Ed25519 through WebCrypto — what a runtime with no `node:` builtin has.
- *
- * Verified in real workerd with no compatibility flag (2026-08-23): sign, verify, a JWK
- * import, an SPKI import and SHA-256 all answer. `Ed25519` is the algorithm name; the
- * older `NODE-ED25519` spelling is not used, and a runtime that only knows that one will
- * refuse at `importKey` rather than silently signing with something else.
- *
- * The four gestures are declared here rather than pulled from `lib.dom`: this package
- * compiles with `lib: ["ESNext"]` and naming DOM would make every consumer carry a
- * browser's globals to read a server type. What the file needs IS the declaration.
- */
+/** Ed25519 through WebCrypto — what a runtime with no `node:` builtin has. */
 import { derOf } from './encoding.js';
 const ED25519 = { name: 'Ed25519' };
 /** Read at call time — a Worker has the global, and reading it at module load does not. */

package/dist/crypto/webcrypto.js.map

@@ -1 +1 @@
-{"version":3,"file":"webcrypto.js","sourceRoot":"","sources":["../../src/crypto/webcrypto.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AACH,OAAO,EAAE,KAAK,EAAE,MAAM,eAAe,CAAC;AAgBtC,MAAM,OAAO,GAAG,EAAE,IAAI,EAAE,SAAS,EAAW,CAAC;AAE7C,2FAA2F;AAC3F,MAAM,MAAM,GAAG,GAAc,EAAE,CAC5B,UAA2D,CAAC,MAAM,CAAC,MAAM,CAAC;AAE7E,MAAM,CAAC,MAAM,MAAM,GAAe;IAChC,KAAK,CAAC,MAAM,CAAC,IAAI;QACf,OAAO,IAAI,UAAU,CAAC,MAAM,MAAM,EAAE,CAAC,MAAM,CAAC,SAAS,EAAE,IAAI,CAAC,CAAC,CAAC;IAChE,CAAC;IAED,KAAK,CAAC,QAAQ,CAAC,aAAa;QAC1B,gFAAgF;QAChF,2EAA2E;QAC3E,MAAM,GAAG,GAAG,MAAM,MAAM,EAAE,CAAC,SAAS,CAAC,OAAO,EAAE,KAAK,CAAC,aAAa,CAAC,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC,MAAM,CAAC,CAAC,CAAC;QAC9F,OAAO,EAAE,KAAK,CAAC,IAAI,CAAC,IAAI,IAAI,OAAO,IAAI,UAAU,CAAC,MAAM,MAAM,EAAE,CAAC,IAAI,CAAC,OAAO,EAAE,GAAG,EAAE,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;IAClG,CAAC;IAED,KAAK,CAAC,UAAU,CAAC,GAAG;QAClB,MAAM,QAAQ,GAAG,OAAO,GAAG,KAAK,QAAQ;YACtC,CAAC,CAAC,MAAM,MAAM,EAAE,CAAC,SAAS,CAAC,MAAM,EAAE,KAAK,CAAC,GAAG,CAAC,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC,QAAQ,CAAC,CAAC;YAC1E,CAAC,CAAC,MAAM,MAAM,EAAE,CAAC,SAAS,CAAC,KAAK,EAAE,GAAG,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC,QAAQ,CAAC,CAAC,CAAC;QACrE,OAAO,EAAE,MAAM,EAAE,CAAC,IAAI,EAAE,SAAS,EAAE,EAAE,CAAC,MAAM,EAAE,CAAC,MAAM,CAAC,OAAO,EAAE,QAAQ,EAAE,SAAS,EAAE,IAAI,CAAC,EAAE,CAAC;IAC9F,CAAC;CACF,CAAC"}
+{"version":3,"file":"webcrypto.js","sourceRoot":"","sources":["../../src/crypto/webcrypto.ts"],"names":[],"mappings":"AAAA,8EAA8E;AAC9E,OAAO,EAAE,KAAK,EAAE,MAAM,eAAe,CAAC;AAgBtC,MAAM,OAAO,GAAG,EAAE,IAAI,EAAE,SAAS,EAAW,CAAC;AAE7C,2FAA2F;AAC3F,MAAM,MAAM,GAAG,GAAc,EAAE,CAC5B,UAA2D,CAAC,MAAM,CAAC,MAAM,CAAC;AAE7E,MAAM,CAAC,MAAM,MAAM,GAAe;IAChC,KAAK,CAAC,MAAM,CAAC,IAAI;QACf,OAAO,IAAI,UAAU,CAAC,MAAM,MAAM,EAAE,CAAC,MAAM,CAAC,SAAS,EAAE,IAAI,CAAC,CAAC,CAAC;IAChE,CAAC;IAED,KAAK,CAAC,QAAQ,CAAC,aAAa;QAC1B,gFAAgF;QAChF,2EAA2E;QAC3E,MAAM,GAAG,GAAG,MAAM,MAAM,EAAE,CAAC,SAAS,CAAC,OAAO,EAAE,KAAK,CAAC,aAAa,CAAC,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC,MAAM,CAAC,CAAC,CAAC;QAC9F,OAAO,EAAE,KAAK,CAAC,IAAI,CAAC,IAAI,IAAI,OAAO,IAAI,UAAU,CAAC,MAAM,MAAM,EAAE,CAAC,IAAI,CAAC,OAAO,EAAE,GAAG,EAAE,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;IAClG,CAAC;IAED,KAAK,CAAC,UAAU,CAAC,GAAG;QAClB,MAAM,QAAQ,GAAG,OAAO,GAAG,KAAK,QAAQ;YACtC,CAAC,CAAC,MAAM,MAAM,EAAE,CAAC,SAAS,CAAC,MAAM,EAAE,KAAK,CAAC,GAAG,CAAC,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC,QAAQ,CAAC,CAAC;YAC1E,CAAC,CAAC,MAAM,MAAM,EAAE,CAAC,SAAS,CAAC,KAAK,EAAE,GAAG,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC,QAAQ,CAAC,CAAC,CAAC;QACrE,OAAO,EAAE,MAAM,EAAE,CAAC,IAAI,EAAE,SAAS,EAAE,EAAE,CAAC,MAAM,EAAE,CAAC,MAAM,CAAC,OAAO,EAAE,QAAQ,EAAE,SAAS,EAAE,IAAI,CAAC,EAAE,CAAC;IAC9F,CAAC;CACF,CAAC"}