@fougere/transport-http 0.2.0-alpha.2 → 0.4.0-alpha.0

package/README.md

@@ -14,4 +14,4 @@ pnpm add @fougere/transport-http
 
 Part of [Fougere](https://github.com/chok/fougere) — one schema, a gradient from
 monolith to distributed, the same user code.
-Reference documentation: [the site](https://chok.github.io/fougere/) (en/fr).
+Reference documentation: [the site](https://fougere.dev/) (en/fr).

package/dist/client.d.ts

@@ -5,18 +5,45 @@
  * typed error (SERVICE_UNAVAILABLE, GATEWAY_TIMEOUT, BAD_GATEWAY), an
  * application failure comes back as the FougereError the façade threw.
  */
-import { type Transport, type FrondCall, type InvocationContext } from '@fougere/core/contract';
-import type { RpcRequest, RpcResponse } from './jsonrpc.js';
+import { type Transport, type FrondCall, type InvocationContext, type SignedCall } from '@fougere/core/contract';
+import type { RpcRequest } from './jsonrpc.js';
 export type { RpcRequest, RpcResponse } from './jsonrpc.js';
 /** Frame a call as a JSON-RPC request. */
 export declare function frameCall(call: FrondCall, invocation: InvocationContext, id: number): RpcRequest;
-/** Unframe a JSON-RPC response — the result, or the revived FougereError thrown. */
-export declare function unframeResponse(response: RpcResponse, call: FrondCall): unknown;
+/**
+ * Unframe a JSON-RPC response — the result, or the revived FougereError thrown.
+ *
+ * The answer is JUDGED first: it crossed a process boundary, and `as RpcResponse` at the
+ * call site is a claim about it, not a check. A 200 carrying neither `result` nor `error`
+ * — a proxy's own JSON, a receiver that is not one — used to return `undefined` as if the
+ * op had succeeded, and a `null` body raised `Cannot use 'in' operator`, which is not the
+ * failure vocabulary this file promises.
+ */
+export declare function unframeResponse(response: unknown, call: FrondCall): unknown;
 export interface HttpTransportOptions {
     /** Abort a call after this long. A timed-out call may have executed — it is never retried. */
     timeoutMs?: number;
     /** Extra attempts on connection failures only — the request provably never left. */
     retries?: number;
+    /**
+     * Signs the state this transport sends, turning a claim into something the receiver
+     * can check. Supplied rather than built here: signing is `node:crypto`, and this
+     * module is published as the browser-safe `/client` subpath — a browser holds no key
+     * and never signs. `@fougere/app` wires it from `signEnvelope`.
+     *
+     * Absent, the state travels as a bare claim and only a receiver that asks for nothing
+     * will take it.
+     */
+    sign?: (call: SignedCall) => Promise<string>;
+    /**
+     * Who performs the request. Defaults to the global `fetch`.
+     *
+     * A Cloudflare service binding answers this shape (`env.CATALOG.fetch`), and on that
+     * platform it is not an optimization: a Worker calling a sibling's public URL is
+     * refused by the edge (error 1042), so a binding is the only route between two Workers
+     * of one account. Nothing else about the call changes — same envelope, same retries.
+     */
+    fetch?: (input: string, init: RequestInit) => Promise<Response>;
 }
 export declare function createHttpTransport(baseUrl: string, options?: HttpTransportOptions): Transport;
 //# sourceMappingURL=client.d.ts.map

package/dist/client.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"client.d.ts","sourceRoot":"","sources":["../src/client.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AACH,OAAO,EAA2B,KAAK,SAAS,EAAE,KAAK,SAAS,EAAE,KAAK,iBAAiB,EAAE,MAAM,wBAAwB,CAAC;AACzH,OAAO,KAAK,EAAE,UAAU,EAAE,WAAW,EAAE,MAAM,cAAc,CAAC;AAC5D,YAAY,EAAE,UAAU,EAAE,WAAW,EAAE,MAAM,cAAc,CAAC;AAE5D,0CAA0C;AAC1C,wBAAgB,SAAS,CAAC,IAAI,EAAE,SAAS,EAAE,UAAU,EAAE,iBAAiB,EAAE,EAAE,EAAE,MAAM,GAAG,UAAU,CAEhG;AAED,oFAAoF;AACpF,wBAAgB,eAAe,CAAC,QAAQ,EAAE,WAAW,EAAE,IAAI,EAAE,SAAS,GAAG,OAAO,CAW/E;AAED,MAAM,WAAW,oBAAoB;IACnC,8FAA8F;IAC9F,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,oFAAoF;IACpF,OAAO,CAAC,EAAE,MAAM,CAAC;CAClB;AAKD,wBAAgB,mBAAmB,CAAC,OAAO,EAAE,MAAM,EAAE,OAAO,GAAE,oBAAyB,GAAG,SAAS,CA6DlG"}
+{"version":3,"file":"client.d.ts","sourceRoot":"","sources":["../src/client.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AACH,OAAO,EAA2B,KAAK,SAAS,EAAE,KAAK,SAAS,EAAE,KAAK,iBAAiB,EAAE,KAAK,UAAU,EAAE,MAAM,wBAAwB,CAAC;AAC1I,OAAO,KAAK,EAAE,UAAU,EAA8B,MAAM,cAAc,CAAC;AAC3E,YAAY,EAAE,UAAU,EAAE,WAAW,EAAE,MAAM,cAAc,CAAC;AAE5D,0CAA0C;AAC1C,wBAAgB,SAAS,CAAC,IAAI,EAAE,SAAS,EAAE,UAAU,EAAE,iBAAiB,EAAE,EAAE,EAAE,MAAM,GAAG,UAAU,CAEhG;AAED;;;;;;;;GAQG;AACH,wBAAgB,eAAe,CAAC,QAAQ,EAAE,OAAO,EAAE,IAAI,EAAE,SAAS,GAAG,OAAO,CA4B3E;AAED,MAAM,WAAW,oBAAoB;IACnC,8FAA8F;IAC9F,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,oFAAoF;IACpF,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB;;;;;;;;OAQG;IACH,IAAI,CAAC,EAAE,CAAC,IAAI,EAAE,UAAU,KAAK,OAAO,CAAC,MAAM,CAAC,CAAC;IAC7C;;;;;;;OAOG;IACH,KAAK,CAAC,EAAE,CAAC,KAAK,EAAE,MAAM,EAAE,IAAI,EAAE,WAAW,KAAK,OAAO,CAAC,QAAQ,CAAC,CAAC;CACjE;AAKD,wBAAgB,mBAAmB,CAAC,OAAO,EAAE,MAAM,EAAE,OAAO,GAAE,oBAAyB,GAAG,SAAS,CA6ElG"}

package/dist/client.js

@@ -10,14 +10,39 @@ import { FougereError, ErrorCode } from '@fougere/core/contract';
 export function frameCall(call, invocation, id) {
     return { jsonrpc: '2.0', id, method: `${call.entity}.${call.op}`, params: invocation };
 }
-/** Unframe a JSON-RPC response — the result, or the revived FougereError thrown. */
+/**
+ * Unframe a JSON-RPC response — the result, or the revived FougereError thrown.
+ *
+ * The answer is JUDGED first: it crossed a process boundary, and `as RpcResponse` at the
+ * call site is a claim about it, not a check. A 200 carrying neither `result` nor `error`
+ * — a proxy's own JSON, a receiver that is not one — used to return `undefined` as if the
+ * op had succeeded, and a `null` body raised `Cannot use 'in' operator`, which is not the
+ * failure vocabulary this file promises.
+ */
 export function unframeResponse(response, call) {
+    if (!response || typeof response !== 'object' || !('result' in response || 'error' in response)) {
+        throw new FougereError({
+            code: ErrorCode.BAD_GATEWAY,
+            message: 'Answered neither a result nor an error — not a Fougere receiver?',
+            entity: call.entity,
+            operation: call.op,
+        });
+    }
     if ('error' in response) {
-        if (response.error.data !== undefined)
-            throw FougereError.fromJSON(response.error.data);
+        const error = response.error;
+        if (!error || typeof error !== 'object') {
+            throw new FougereError({
+                code: ErrorCode.BAD_GATEWAY,
+                message: 'Answered an error that is not a JSON-RPC error object',
+                entity: call.entity,
+                operation: call.op,
+            });
+        }
+        if (error.data !== undefined)
+            throw FougereError.fromJSON(error.data);
         throw new FougereError({
             code: ErrorCode.INTERNAL_ERROR,
-            message: `${response.error.message} (rpc ${response.error.code})`,
+            message: `${error.message} (rpc ${error.code})`,
             entity: call.entity,
             operation: call.op,
         });
@@ -28,15 +53,31 @@ export function unframeResponse(response, call) {
 const CONNECTION_FAILURES = new Set(['ECONNREFUSED', 'ENOTFOUND', 'EAI_AGAIN']);
 export function createHttpTransport(baseUrl, options = {}) {
     const url = `${baseUrl.replace(/\/$/, '')}/_fougere/call`;
+    // Who performs the request, when it is not the global one. A Cloudflare service binding
+    // is exactly this shape — and on that platform it is the ONLY way two Workers of one
+    // account reach each other: measured, a Worker fetching a sibling's public URL is
+    // refused by the edge with error 1042 before the request leaves. The framing above and
+    // below is identical either way, which is the whole reason this is one option and not
+    // a second transport.
+    const send = options.fetch ?? fetch;
     const timeoutMs = options.timeoutMs ?? 10_000;
     const retries = options.retries ?? 1;
     let nextId = 1;
     return async (call, invocation) => {
-        const request = frameCall(call, invocation, nextId++);
+        // The envelope REPLACES the state on the wire — sending both would leave the
+        // receiver choosing between a proof and a claim about the same thing.
+        // `caller` is dropped on every hop: it names who signed THIS call, so carrying the
+        // one this process was handed would make `shop → catalog → billing` read `shop`.
+        // It travels outside the envelope anyway, so a stale one would be unsigned too.
+        const { caller: _established, ...forwarded } = invocation;
+        const sent = options.sign
+            ? { ...forwarded, state: {}, identity: await options.sign({ ...call, ...invocation }) }
+            : forwarded;
+        const request = frameCall(call, sent, nextId++);
         for (let attempt = 0;; attempt++) {
             let res;
             try {
-                res = await fetch(url, {
+                res = await send(url, {
                     method: 'POST',
                     headers: { 'content-type': 'application/json' },
                     body: JSON.stringify(request),

package/dist/client.js.map

@@ -1 +1 @@
-{"version":3,"file":"client.js","sourceRoot":"","sources":["../src/client.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AACH,OAAO,EAAE,YAAY,EAAE,SAAS,EAA0D,MAAM,wBAAwB,CAAC;AAIzH,0CAA0C;AAC1C,MAAM,UAAU,SAAS,CAAC,IAAe,EAAE,UAA6B,EAAE,EAAU;IAClF,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,EAAE,EAAE,MAAM,EAAE,GAAG,IAAI,CAAC,MAAM,IAAI,IAAI,CAAC,EAAE,EAAE,EAAE,MAAM,EAAE,UAAU,EAAE,CAAC;AACzF,CAAC;AAED,oFAAoF;AACpF,MAAM,UAAU,eAAe,CAAC,QAAqB,EAAE,IAAe;IACpE,IAAI,OAAO,IAAI,QAAQ,EAAE,CAAC;QACxB,IAAI,QAAQ,CAAC,KAAK,CAAC,IAAI,KAAK,SAAS;YAAE,MAAM,YAAY,CAAC,QAAQ,CAAC,QAAQ,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;QACxF,MAAM,IAAI,YAAY,CAAC;YACrB,IAAI,EAAE,SAAS,CAAC,cAAc;YAC9B,OAAO,EAAE,GAAG,QAAQ,CAAC,KAAK,CAAC,OAAO,SAAS,QAAQ,CAAC,KAAK,CAAC,IAAI,GAAG;YACjE,MAAM,EAAE,IAAI,CAAC,MAAM;YACnB,SAAS,EAAE,IAAI,CAAC,EAAE;SACnB,CAAC,CAAC;IACL,CAAC;IACD,OAAO,QAAQ,CAAC,MAAM,CAAC;AACzB,CAAC;AASD,+EAA+E;AAC/E,MAAM,mBAAmB,GAAG,IAAI,GAAG,CAAC,CAAC,cAAc,EAAE,WAAW,EAAE,WAAW,CAAC,CAAC,CAAC;AAEhF,MAAM,UAAU,mBAAmB,CAAC,OAAe,EAAE,OAAO,GAAyB,EAAE;IACrF,MAAM,GAAG,GAAG,GAAG,OAAO,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,gBAAgB,CAAC;IAC1D,MAAM,SAAS,GAAG,OAAO,CAAC,SAAS,IAAI,MAAM,CAAC;IAC9C,MAAM,OAAO,GAAG,OAAO,CAAC,OAAO,IAAI,CAAC,CAAC;IACrC,IAAI,MAAM,GAAG,CAAC,CAAC;IAEf,OAAO,KAAK,EAAE,IAAI,EAAE,UAAU,EAAE,EAAE;QAChC,MAAM,OAAO,GAAG,SAAS,CAAC,IAAI,EAAE,UAAU,EAAE,MAAM,EAAE,CAAC,CAAC;QAEtD,KAAK,IAAI,OAAO,GAAG,CAAC,GAAI,OAAO,EAAE,EAAE,CAAC;YAClC,IAAI,GAAa,CAAC;YAClB,IAAI,CAAC;gBACH,GAAG,GAAG,MAAM,KAAK,CAAC,GAAG,EAAE;oBACrB,MAAM,EAAE,MAAM;oBACd,OAAO,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE;oBAC/C,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC;oBAC7B,MAAM,EAAE,WAAW,CAAC,OAAO,CAAC,SAAS,CAAC;iBACvC,CAAC,CAAC;YACL,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACb,IAAI,SAAS,CAAC,GAAG,CAAC,EAAE,CAAC;oBACnB,MAAM,IAAI,YAAY,CAAC;wBACrB,IAAI,EAAE,SAAS,CAAC,eAAe;wBAC/B,OAAO,EAAE,GAAG,IAAI,CAAC,MAAM,IAAI,IAAI,CAAC,EAAE,oBAAoB,SAAS,OAAO,OAAO,GAAG;wBAChF,MAAM,EAAE,IAAI,CAAC,MAAM;wBACnB,SAAS,EAAE,IAAI,CAAC,EAAE;qBACnB,CAAC,CAAC;gBACL,CAAC;gBACD,IAAI,OAAO,GAAG,OAAO,IAAI,mBAAmB,CAAC,GAAG,CAAC;oBAAE,SAAS;gBAC5D,MAAM,IAAI,YAAY,CAAC;oBACrB,IAAI,EAAE,SAAS,CAAC,mBAAmB;oBACnC,OAAO,EAAE,GAAG,OAAO,iBAAkB,GAAa,EAAE,OAAO,IAAI,GAAG,EAAE;oBACpE,MAAM,EAAE,IAAI,CAAC,MAAM;oBACnB,SAAS,EAAE,IAAI,CAAC,EAAE;oBAClB,KAAK,EAAE,GAAG;iBACX,CAAC,CAAC;YACL,CAAC;YAED,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC;gBACZ,MAAM,IAAI,YAAY,CAAC;oBACrB,IAAI,EAAE,SAAS,CAAC,WAAW;oBAC3B,OAAO,EAAE,GAAG,OAAO,kBAAkB,GAAG,CAAC,MAAM,4BAA4B;oBAC3E,MAAM,EAAE,IAAI,CAAC,MAAM;oBACnB,SAAS,EAAE,IAAI,CAAC,EAAE;iBACnB,CAAC,CAAC;YACL,CAAC;YAED,IAAI,QAAqB,CAAC;YAC1B,IAAI,CAAC;gBACH,QAAQ,GAAG,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,CAAgB,CAAC;YAC/C,CAAC;YAAC,MAAM,CAAC;gBACP,MAAM,IAAI,YAAY,CAAC;oBACrB,IAAI,EAAE,SAAS,CAAC,WAAW;oBAC3B,OAAO,EAAE,GAAG,OAAO,oBAAoB;oBACvC,MAAM,EAAE,IAAI,CAAC,MAAM;oBACnB,SAAS,EAAE,IAAI,CAAC,EAAE;iBACnB,CAAC,CAAC;YACL,CAAC;YAED,OAAO,eAAe,CAAC,QAAQ,EAAE,IAAI,CAAC,CAAC;QACzC,CAAC;IACH,CAAC,CAAC;AACJ,CAAC;AAED,SAAS,SAAS,CAAC,GAAY;IAC7B,OAAO,GAAG,YAAY,YAAY,IAAI,CAAC,GAAG,CAAC,IAAI,KAAK,cAAc,IAAI,GAAG,CAAC,IAAI,KAAK,YAAY,CAAC,CAAC;AACnG,CAAC;AAED,SAAS,mBAAmB,CAAC,GAAY;IACvC,MAAM,IAAI,GAAI,GAAqC,EAAE,KAAK,EAAE,IAAI,CAAC;IACjE,OAAO,OAAO,IAAI,KAAK,QAAQ,IAAI,mBAAmB,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;AACnE,CAAC"}
+{"version":3,"file":"client.js","sourceRoot":"","sources":["../src/client.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AACH,OAAO,EAAE,YAAY,EAAE,SAAS,EAA2E,MAAM,wBAAwB,CAAC;AAI1I,0CAA0C;AAC1C,MAAM,UAAU,SAAS,CAAC,IAAe,EAAE,UAA6B,EAAE,EAAU;IAClF,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,EAAE,EAAE,MAAM,EAAE,GAAG,IAAI,CAAC,MAAM,IAAI,IAAI,CAAC,EAAE,EAAE,EAAE,MAAM,EAAE,UAAU,EAAE,CAAC;AACzF,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,UAAU,eAAe,CAAC,QAAiB,EAAE,IAAe;IAChE,IAAI,CAAC,QAAQ,IAAI,OAAO,QAAQ,KAAK,QAAQ,IAAI,CAAC,CAAC,QAAQ,IAAI,QAAQ,IAAI,OAAO,IAAI,QAAQ,CAAC,EAAE,CAAC;QAChG,MAAM,IAAI,YAAY,CAAC;YACrB,IAAI,EAAE,SAAS,CAAC,WAAW;YAC3B,OAAO,EAAE,kEAAkE;YAC3E,MAAM,EAAE,IAAI,CAAC,MAAM;YACnB,SAAS,EAAE,IAAI,CAAC,EAAE;SACnB,CAAC,CAAC;IACL,CAAC;IACD,IAAI,OAAO,IAAI,QAAQ,EAAE,CAAC;QACxB,MAAM,KAAK,GAAG,QAAQ,CAAC,KAAsC,CAAC;QAC9D,IAAI,CAAC,KAAK,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;YACxC,MAAM,IAAI,YAAY,CAAC;gBACrB,IAAI,EAAE,SAAS,CAAC,WAAW;gBAC3B,OAAO,EAAE,uDAAuD;gBAChE,MAAM,EAAE,IAAI,CAAC,MAAM;gBACnB,SAAS,EAAE,IAAI,CAAC,EAAE;aACnB,CAAC,CAAC;QACL,CAAC;QACD,IAAI,KAAK,CAAC,IAAI,KAAK,SAAS;YAAE,MAAM,YAAY,CAAC,QAAQ,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;QACtE,MAAM,IAAI,YAAY,CAAC;YACrB,IAAI,EAAE,SAAS,CAAC,cAAc;YAC9B,OAAO,EAAE,GAAG,KAAK,CAAC,OAAO,SAAS,KAAK,CAAC,IAAI,GAAG;YAC/C,MAAM,EAAE,IAAI,CAAC,MAAM;YACnB,SAAS,EAAE,IAAI,CAAC,EAAE;SACnB,CAAC,CAAC;IACL,CAAC;IACD,OAAO,QAAQ,CAAC,MAAM,CAAC;AACzB,CAAC;AA4BD,+EAA+E;AAC/E,MAAM,mBAAmB,GAAG,IAAI,GAAG,CAAC,CAAC,cAAc,EAAE,WAAW,EAAE,WAAW,CAAC,CAAC,CAAC;AAEhF,MAAM,UAAU,mBAAmB,CAAC,OAAe,EAAE,OAAO,GAAyB,EAAE;IACrF,MAAM,GAAG,GAAG,GAAG,OAAO,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,gBAAgB,CAAC;IAC1D,wFAAwF;IACxF,qFAAqF;IACrF,kFAAkF;IAClF,uFAAuF;IACvF,sFAAsF;IACtF,sBAAsB;IACtB,MAAM,IAAI,GAAG,OAAO,CAAC,KAAK,IAAI,KAAK,CAAC;IACpC,MAAM,SAAS,GAAG,OAAO,CAAC,SAAS,IAAI,MAAM,CAAC;IAC9C,MAAM,OAAO,GAAG,OAAO,CAAC,OAAO,IAAI,CAAC,CAAC;IACrC,IAAI,MAAM,GAAG,CAAC,CAAC;IAEf,OAAO,KAAK,EAAE,IAAI,EAAE,UAAU,EAAE,EAAE;QAChC,6EAA6E;QAC7E,sEAAsE;QACtE,mFAAmF;QACnF,iFAAiF;QACjF,gFAAgF;QAChF,MAAM,EAAE,MAAM,EAAE,YAAY,EAAE,GAAG,SAAS,EAAE,GAAG,UAAU,CAAC;QAC1D,MAAM,IAAI,GAAG,OAAO,CAAC,IAAI;YACvB,CAAC,CAAC,EAAE,GAAG,SAAS,EAAE,KAAK,EAAE,EAAE,EAAE,QAAQ,EAAE,MAAM,OAAO,CAAC,IAAI,CAAC,EAAE,GAAG,IAAI,EAAE,GAAG,UAAU,EAAE,CAAC,EAAE;YACvF,CAAC,CAAC,SAAS,CAAC;QACd,MAAM,OAAO,GAAG,SAAS,CAAC,IAAI,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC,CAAC;QAEhD,KAAK,IAAI,OAAO,GAAG,CAAC,GAAI,OAAO,EAAE,EAAE,CAAC;YAClC,IAAI,GAAa,CAAC;YAClB,IAAI,CAAC;gBACH,GAAG,GAAG,MAAM,IAAI,CAAC,GAAG,EAAE;oBACpB,MAAM,EAAE,MAAM;oBACd,OAAO,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE;oBAC/C,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC;oBAC7B,MAAM,EAAE,WAAW,CAAC,OAAO,CAAC,SAAS,CAAC;iBACvC,CAAC,CAAC;YACL,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACb,IAAI,SAAS,CAAC,GAAG,CAAC,EAAE,CAAC;oBACnB,MAAM,IAAI,YAAY,CAAC;wBACrB,IAAI,EAAE,SAAS,CAAC,eAAe;wBAC/B,OAAO,EAAE,GAAG,IAAI,CAAC,MAAM,IAAI,IAAI,CAAC,EAAE,oBAAoB,SAAS,OAAO,OAAO,GAAG;wBAChF,MAAM,EAAE,IAAI,CAAC,MAAM;wBACnB,SAAS,EAAE,IAAI,CAAC,EAAE;qBACnB,CAAC,CAAC;gBACL,CAAC;gBACD,IAAI,OAAO,GAAG,OAAO,IAAI,mBAAmB,CAAC,GAAG,CAAC;oBAAE,SAAS;gBAC5D,MAAM,IAAI,YAAY,CAAC;oBACrB,IAAI,EAAE,SAAS,CAAC,mBAAmB;oBACnC,OAAO,EAAE,GAAG,OAAO,iBAAkB,GAAa,EAAE,OAAO,IAAI,GAAG,EAAE;oBACpE,MAAM,EAAE,IAAI,CAAC,MAAM;oBACnB,SAAS,EAAE,IAAI,CAAC,EAAE;oBAClB,KAAK,EAAE,GAAG;iBACX,CAAC,CAAC;YACL,CAAC;YAED,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC;gBACZ,MAAM,IAAI,YAAY,CAAC;oBACrB,IAAI,EAAE,SAAS,CAAC,WAAW;oBAC3B,OAAO,EAAE,GAAG,OAAO,kBAAkB,GAAG,CAAC,MAAM,4BAA4B;oBAC3E,MAAM,EAAE,IAAI,CAAC,MAAM;oBACnB,SAAS,EAAE,IAAI,CAAC,EAAE;iBACnB,CAAC,CAAC;YACL,CAAC;YAED,IAAI,QAAqB,CAAC;YAC1B,IAAI,CAAC;gBACH,QAAQ,GAAG,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,CAAgB,CAAC;YAC/C,CAAC;YAAC,MAAM,CAAC;gBACP,MAAM,IAAI,YAAY,CAAC;oBACrB,IAAI,EAAE,SAAS,CAAC,WAAW;oBAC3B,OAAO,EAAE,GAAG,OAAO,oBAAoB;oBACvC,MAAM,EAAE,IAAI,CAAC,MAAM;oBACnB,SAAS,EAAE,IAAI,CAAC,EAAE;iBACnB,CAAC,CAAC;YACL,CAAC;YAED,OAAO,eAAe,CAAC,QAAQ,EAAE,IAAI,CAAC,CAAC;QACzC,CAAC;IACH,CAAC,CAAC;AACJ,CAAC;AAED,SAAS,SAAS,CAAC,GAAY;IAC7B,OAAO,GAAG,YAAY,YAAY,IAAI,CAAC,GAAG,CAAC,IAAI,KAAK,cAAc,IAAI,GAAG,CAAC,IAAI,KAAK,YAAY,CAAC,CAAC;AACnG,CAAC;AAED,SAAS,mBAAmB,CAAC,GAAY;IACvC,MAAM,IAAI,GAAI,GAAqC,EAAE,KAAK,EAAE,IAAI,CAAC;IACjE,OAAO,OAAO,IAAI,KAAK,QAAQ,IAAI,mBAAmB,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;AACnE,CAAC"}

package/dist/index.d.ts

@@ -1,5 +1,7 @@
 export { createHttpTransport, frameCall, unframeResponse, type HttpTransportOptions } from './client.js';
-export { handleRpc } from './server.js';
+export { handleRpc, type ReceiveOptions } from './server.js';
+export { receive, type ReceiveHttpOptions } from './receive.js';
+export { CALL_PATH, MAX_BODY_BYTES } from './policy.js';
 export { serve, type ServeOptions, type RunningReceiver } from './serve.js';
 export { APP_ERROR, PARSE_ERROR, INVALID_REQUEST } from './jsonrpc.js';
 export type { RpcRequest, RpcResponse, RpcErrorShape } from './jsonrpc.js';

package/dist/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,mBAAmB,EAAE,SAAS,EAAE,eAAe,EAAE,KAAK,oBAAoB,EAAE,MAAM,aAAa,CAAC;AACzG,OAAO,EAAE,SAAS,EAAE,MAAM,aAAa,CAAC;AACxC,OAAO,EAAE,KAAK,EAAE,KAAK,YAAY,EAAE,KAAK,eAAe,EAAE,MAAM,YAAY,CAAC;AAC5E,OAAO,EAAE,SAAS,EAAE,WAAW,EAAE,eAAe,EAAE,MAAM,cAAc,CAAC;AACvE,YAAY,EAAE,UAAU,EAAE,WAAW,EAAE,aAAa,EAAE,MAAM,cAAc,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,mBAAmB,EAAE,SAAS,EAAE,eAAe,EAAE,KAAK,oBAAoB,EAAE,MAAM,aAAa,CAAC;AACzG,OAAO,EAAE,SAAS,EAAE,KAAK,cAAc,EAAE,MAAM,aAAa,CAAC;AAC7D,OAAO,EAAE,OAAO,EAAE,KAAK,kBAAkB,EAAE,MAAM,cAAc,CAAC;AAChE,OAAO,EAAE,SAAS,EAAE,cAAc,EAAE,MAAM,aAAa,CAAC;AACxD,OAAO,EAAE,KAAK,EAAE,KAAK,YAAY,EAAE,KAAK,eAAe,EAAE,MAAM,YAAY,CAAC;AAC5E,OAAO,EAAE,SAAS,EAAE,WAAW,EAAE,eAAe,EAAE,MAAM,cAAc,CAAC;AACvE,YAAY,EAAE,UAAU,EAAE,WAAW,EAAE,aAAa,EAAE,MAAM,cAAc,CAAC"}

package/dist/index.js

@@ -1,5 +1,7 @@
 export { createHttpTransport, frameCall, unframeResponse } from './client.js';
 export { handleRpc } from './server.js';
+export { receive } from './receive.js';
+export { CALL_PATH, MAX_BODY_BYTES } from './policy.js';
 export { serve } from './serve.js';
 export { APP_ERROR, PARSE_ERROR, INVALID_REQUEST } from './jsonrpc.js';
 //# sourceMappingURL=index.js.map

package/dist/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,mBAAmB,EAAE,SAAS,EAAE,eAAe,EAA6B,MAAM,aAAa,CAAC;AACzG,OAAO,EAAE,SAAS,EAAE,MAAM,aAAa,CAAC;AACxC,OAAO,EAAE,KAAK,EAA2C,MAAM,YAAY,CAAC;AAC5E,OAAO,EAAE,SAAS,EAAE,WAAW,EAAE,eAAe,EAAE,MAAM,cAAc,CAAC"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,mBAAmB,EAAE,SAAS,EAAE,eAAe,EAA6B,MAAM,aAAa,CAAC;AACzG,OAAO,EAAE,SAAS,EAAuB,MAAM,aAAa,CAAC;AAC7D,OAAO,EAAE,OAAO,EAA2B,MAAM,cAAc,CAAC;AAChE,OAAO,EAAE,SAAS,EAAE,cAAc,EAAE,MAAM,aAAa,CAAC;AACxD,OAAO,EAAE,KAAK,EAA2C,MAAM,YAAY,CAAC;AAC5E,OAAO,EAAE,SAAS,EAAE,WAAW,EAAE,eAAe,EAAE,MAAM,cAAc,CAAC"}

package/dist/policy.d.ts

@@ -0,0 +1,24 @@
+/**
+ * What every receiver of the envelope decides the same way, and what it does not.
+ *
+ * The cap and the answers are POLICY — `1024 * 1024` was spelled in four packages and
+ * omitted by the receiver written by hand. Reading the body is PLUMBING, and it belongs to
+ * the transport: a `node:http` stream and a `Request` body are read differently, and putting
+ * Node through the Web reader HALVED the door that took it (measured, 2026-08-22: the JSON-RPC
+ * door fell from 0.677 to 0.341 of its hand-written baseline, while the REST door, which never
+ * traverses `serve()`, sat at 0.653 in that same run).
+ *
+ * So this file holds the decisions. Each receiver keeps its own reader.
+ */
+import { type RpcResponse } from './jsonrpc.js';
+/** What a receiver accepts before it stops reading. */
+export declare const MAX_BODY_BYTES: number;
+/** The path the envelope answers on. A host mounting it elsewhere passes its own. */
+export declare const CALL_PATH = "/_fougere/call";
+/** The answer to a payload that was not JSON. */
+export declare const parseError: () => RpcResponse;
+/** The answer to a body over the cap. */
+export declare const tooLarge: () => {
+    error: string;
+};
+//# sourceMappingURL=policy.d.ts.map

package/dist/policy.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"policy.d.ts","sourceRoot":"","sources":["../src/policy.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AACH,OAAO,EAAe,KAAK,WAAW,EAAE,MAAM,cAAc,CAAC;AAE7D,uDAAuD;AACvD,eAAO,MAAM,cAAc,QAAc,CAAC;AAE1C,qFAAqF;AACrF,eAAO,MAAM,SAAS,mBAAmB,CAAC;AAE1C,iDAAiD;AACjD,eAAO,MAAM,UAAU,QAAO,WAI5B,CAAC;AAEH,yCAAyC;AACzC,eAAO,MAAM,QAAQ;IAAY,KAAK;CAAwB,CAAC"}

package/dist/policy.js

@@ -0,0 +1,26 @@
+/**
+ * What every receiver of the envelope decides the same way, and what it does not.
+ *
+ * The cap and the answers are POLICY — `1024 * 1024` was spelled in four packages and
+ * omitted by the receiver written by hand. Reading the body is PLUMBING, and it belongs to
+ * the transport: a `node:http` stream and a `Request` body are read differently, and putting
+ * Node through the Web reader HALVED the door that took it (measured, 2026-08-22: the JSON-RPC
+ * door fell from 0.677 to 0.341 of its hand-written baseline, while the REST door, which never
+ * traverses `serve()`, sat at 0.653 in that same run).
+ *
+ * So this file holds the decisions. Each receiver keeps its own reader.
+ */
+import { PARSE_ERROR } from './jsonrpc.js';
+/** What a receiver accepts before it stops reading. */
+export const MAX_BODY_BYTES = 1024 * 1024;
+/** The path the envelope answers on. A host mounting it elsewhere passes its own. */
+export const CALL_PATH = '/_fougere/call';
+/** The answer to a payload that was not JSON. */
+export const parseError = () => ({
+    jsonrpc: '2.0',
+    id: null,
+    error: { code: PARSE_ERROR, message: 'Parse error' },
+});
+/** The answer to a body over the cap. */
+export const tooLarge = () => ({ error: 'Payload too large' });
+//# sourceMappingURL=policy.js.map

package/dist/policy.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"policy.js","sourceRoot":"","sources":["../src/policy.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AACH,OAAO,EAAE,WAAW,EAAoB,MAAM,cAAc,CAAC;AAE7D,uDAAuD;AACvD,MAAM,CAAC,MAAM,cAAc,GAAG,IAAI,GAAG,IAAI,CAAC;AAE1C,qFAAqF;AACrF,MAAM,CAAC,MAAM,SAAS,GAAG,gBAAgB,CAAC;AAE1C,iDAAiD;AACjD,MAAM,CAAC,MAAM,UAAU,GAAG,GAAgB,EAAE,CAAC,CAAC;IAC5C,OAAO,EAAE,KAAK;IACd,EAAE,EAAE,IAAI;IACR,KAAK,EAAE,EAAE,IAAI,EAAE,WAAW,EAAE,OAAO,EAAE,aAAa,EAAE;CACrD,CAAC,CAAC;AAEH,yCAAyC;AACzC,MAAM,CAAC,MAAM,QAAQ,GAAG,GAAG,EAAE,CAAC,CAAC,EAAE,KAAK,EAAE,mBAAmB,EAAE,CAAC,CAAC"}

package/dist/receive.d.ts

@@ -0,0 +1,33 @@
+/**
+ * The envelope door for a host that speaks `Request`/`Response` — hono, a Worker, Next,
+ * SvelteKit. It reads a `Request` body; `serve` reads a `node:http` stream, and the two
+ * stay separate on purpose: putting Node through this reader HALVED the Node door
+ * (0.677 → 0.341 of its baseline, measured 2026-08-22).
+ *
+ * What they share is `policy.ts` — the cap and the answers. Nothing here is edge-specific
+ * beyond that: `handleRpc` is the wire and knows no HTTP at all.
+ */
+import { type ReceiveOptions } from './server.js';
+import type { Transport } from '@fougere/core/contract';
+export interface ReceiveHttpOptions extends ReceiveOptions {
+    /** Maximum JSON-RPC body size. Default: 1 MiB. */
+    maxBodyBytes?: number;
+    /** The path this door answers. Default: `/_fougere/call`. */
+    path?: string;
+    /**
+     * Take unsigned calls, deliberately.
+     *
+     * `serve()` reads the decision off the ADDRESS — loopback by default, and widening it
+     * is written down. This door binds nothing: its host mounts it wherever it likes, and a
+     * `Request` arrives with no bound address to consult. So the decision has to be stated,
+     * and the default is the safe one: with no `verify` and no word here, this REFUSES to
+     * be built. A door that starts and then believes whatever `state` it is handed is the
+     * hole `identity.ts` exists to close, and it was open here.
+     *
+     * The one case that legitimately needs it beyond local development is the same as
+     * `serve`'s: something in front already established the peer.
+     */
+    allowUnsigned?: boolean;
+}
+export declare function receive(runner: Transport, options?: ReceiveHttpOptions): (request: Request) => Promise<Response>;
+//# sourceMappingURL=receive.d.ts.map

package/dist/receive.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"receive.d.ts","sourceRoot":"","sources":["../src/receive.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AACH,OAAO,EAAa,KAAK,cAAc,EAAE,MAAM,aAAa,CAAC;AAE7D,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,wBAAwB,CAAC;AAExD,MAAM,WAAW,kBAAmB,SAAQ,cAAc;IACxD,kDAAkD;IAClD,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,6DAA6D;IAC7D,IAAI,CAAC,EAAE,MAAM,CAAC;IACd;;;;;;;;;;;;OAYG;IACH,aAAa,CAAC,EAAE,OAAO,CAAC;CACzB;AA4CD,wBAAgB,OAAO,CACrB,MAAM,EAAE,SAAS,EACjB,OAAO,GAAE,kBAAuB,GAC/B,CAAC,OAAO,EAAE,OAAO,KAAK,OAAO,CAAC,QAAQ,CAAC,CA+BzC"}

package/dist/receive.js

@@ -0,0 +1,78 @@
+/**
+ * The envelope door for a host that speaks `Request`/`Response` — hono, a Worker, Next,
+ * SvelteKit. It reads a `Request` body; `serve` reads a `node:http` stream, and the two
+ * stay separate on purpose: putting Node through this reader HALVED the Node door
+ * (0.677 → 0.341 of its baseline, measured 2026-08-22).
+ *
+ * What they share is `policy.ts` — the cap and the answers. Nothing here is edge-specific
+ * beyond that: `handleRpc` is the wire and knows no HTTP at all.
+ */
+import { handleRpc } from './server.js';
+import { MAX_BODY_BYTES, CALL_PATH, parseError, tooLarge } from './policy.js';
+const json = (body, status = 200) => new Response(JSON.stringify(body), { status, headers: { 'content-type': 'application/json' } });
+/** Distinguishes "the body was too large" from any body a caller could actually send. */
+const TOO_LARGE = Symbol('too large');
+/**
+ * The declared length is a cheap refusal; the count is the real one. A `content-length` may
+ * be absent, and it may lie — the copy that trusted it alone had no cap at all in that case.
+ */
+async function bodyWithin(request, max) {
+    const declared = Number(request.headers.get('content-length'));
+    if (Number.isFinite(declared) && declared > max)
+        return TOO_LARGE;
+    const reader = request.body?.getReader();
+    if (!reader)
+        return '';
+    const chunks = [];
+    let size = 0;
+    for (;;) {
+        const { done, value } = await reader.read();
+        if (done)
+            break;
+        size += value.byteLength;
+        if (size > max) {
+            await reader.cancel();
+            return TOO_LARGE;
+        }
+        chunks.push(value);
+    }
+    return new TextDecoder().decode(concat(chunks, size));
+}
+function concat(chunks, size) {
+    const all = new Uint8Array(size);
+    let at = 0;
+    for (const chunk of chunks) {
+        all.set(chunk, at);
+        at += chunk.byteLength;
+    }
+    return all;
+}
+export function receive(runner, options = {}) {
+    // At CONSTRUCTION and not per call, for the reason `serve` refuses at bind: a receiver
+    // that starts and then rejects everything is found in production.
+    if (!options.verify && !options.allowUnsigned) {
+        throw new Error('A Fougere receiver takes the `state` it is handed, so this door needs to know who is calling.\n'
+            + '  Wire `verify` (see `verifyEnvelope`, and `fougere keys` / `fougere grant`),\n'
+            + '  or say `allowUnsigned: true` — which is right for local development and for a\n'
+            + '  mesh whose sidecar already established the peer.');
+    }
+    const max = options.maxBodyBytes ?? MAX_BODY_BYTES;
+    const path = options.path ?? CALL_PATH;
+    return async (request) => {
+        if (request.method !== 'POST' || new URL(request.url).pathname !== path) {
+            return new Response(null, { status: 404 });
+        }
+        const raw = await bodyWithin(request, max);
+        if (raw === TOO_LARGE)
+            return json(tooLarge(), 413);
+        let parsed;
+        try {
+            parsed = JSON.parse(raw);
+        }
+        catch {
+            return json(parseError());
+        }
+        return json(await handleRpc(runner, parsed, options));
+    };
+}
+//# sourceMappingURL=receive.js.map

package/dist/receive.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"receive.js","sourceRoot":"","sources":["../src/receive.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AACH,OAAO,EAAE,SAAS,EAAuB,MAAM,aAAa,CAAC;AAC7D,OAAO,EAAE,cAAc,EAAE,SAAS,EAAE,UAAU,EAAE,QAAQ,EAAE,MAAM,aAAa,CAAC;AAwB9E,MAAM,IAAI,GAAG,CAAC,IAAa,EAAE,MAAM,GAAG,GAAG,EAAE,EAAE,CAC3C,IAAI,QAAQ,CAAC,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,EAAE,EAAE,MAAM,EAAE,OAAO,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE,EAAE,CAAC,CAAC;AAElG,yFAAyF;AACzF,MAAM,SAAS,GAAG,MAAM,CAAC,WAAW,CAAC,CAAC;AAEtC;;;GAGG;AACH,KAAK,UAAU,UAAU,CAAC,OAAgB,EAAE,GAAW;IACrD,MAAM,QAAQ,GAAG,MAAM,CAAC,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,gBAAgB,CAAC,CAAC,CAAC;IAC/D,IAAI,MAAM,CAAC,QAAQ,CAAC,QAAQ,CAAC,IAAI,QAAQ,GAAG,GAAG;QAAE,OAAO,SAAS,CAAC;IAElE,MAAM,MAAM,GAAG,OAAO,CAAC,IAAI,EAAE,SAAS,EAAE,CAAC;IACzC,IAAI,CAAC,MAAM;QAAE,OAAO,EAAE,CAAC;IAEvB,MAAM,MAAM,GAAiB,EAAE,CAAC;IAChC,IAAI,IAAI,GAAG,CAAC,CAAC;IACb,SAAS,CAAC;QACR,MAAM,EAAE,IAAI,EAAE,KAAK,EAAE,GAAG,MAAM,MAAM,CAAC,IAAI,EAAE,CAAC;QAC5C,IAAI,IAAI;YAAE,MAAM;QAChB,IAAI,IAAI,KAAK,CAAC,UAAU,CAAC;QACzB,IAAI,IAAI,GAAG,GAAG,EAAE,CAAC;YACf,MAAM,MAAM,CAAC,MAAM,EAAE,CAAC;YACtB,OAAO,SAAS,CAAC;QACnB,CAAC;QACD,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IACrB,CAAC;IACD,OAAO,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,MAAM,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC,CAAC;AACxD,CAAC;AAED,SAAS,MAAM,CAAC,MAA6B,EAAE,IAAY;IACzD,MAAM,GAAG,GAAG,IAAI,UAAU,CAAC,IAAI,CAAC,CAAC;IACjC,IAAI,EAAE,GAAG,CAAC,CAAC;IACX,KAAK,MAAM,KAAK,IAAI,MAAM,EAAE,CAAC;QAC3B,GAAG,CAAC,GAAG,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;QACnB,EAAE,IAAI,KAAK,CAAC,UAAU,CAAC;IACzB,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED,MAAM,UAAU,OAAO,CACrB,MAAiB,EACjB,OAAO,GAAuB,EAAE;IAEhC,uFAAuF;IACvF,kEAAkE;IAClE,IAAI,CAAC,OAAO,CAAC,MAAM,IAAI,CAAC,OAAO,CAAC,aAAa,EAAE,CAAC;QAC9C,MAAM,IAAI,KAAK,CACb,iGAAiG;cAC/F,iFAAiF;cACjF,mFAAmF;cACnF,oDAAoD,CACvD,CAAC;IACJ,CAAC;IAED,MAAM,GAAG,GAAG,OAAO,CAAC,YAAY,IAAI,cAAc,CAAC;IACnD,MAAM,IAAI,GAAG,OAAO,CAAC,IAAI,IAAI,SAAS,CAAC;IAEvC,OAAO,KAAK,EAAE,OAAO,EAAE,EAAE;QACvB,IAAI,OAAO,CAAC,MAAM,KAAK,MAAM,IAAI,IAAI,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,QAAQ,KAAK,IAAI,EAAE,CAAC;YACxE,OAAO,IAAI,QAAQ,CAAC,IAAI,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC,CAAC;QAC7C,CAAC;QAED,MAAM,GAAG,GAAG,MAAM,UAAU,CAAC,OAAO,EAAE,GAAG,CAAC,CAAC;QAC3C,IAAI,GAAG,KAAK,SAAS;YAAE,OAAO,IAAI,CAAC,QAAQ,EAAE,EAAE,GAAG,CAAC,CAAC;QAEpD,IAAI,MAAe,CAAC;QACpB,IAAI,CAAC;YACH,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;QAC3B,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,IAAI,CAAC,UAAU,EAAE,CAAC,CAAC;QAC5B,CAAC;QACD,OAAO,IAAI,CAAC,MAAM,SAAS,CAAC,MAAM,EAAE,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC;IACxD,CAAC,CAAC;AACJ,CAAC"}

package/dist/serve.d.ts

@@ -1,5 +1,6 @@
 import type { Transport } from '@fougere/core';
-export interface ServeOptions {
+import { type ReceiveOptions } from './server.js';
+export interface ServeOptions extends ReceiveOptions {
     /** Port to listen on. 0 (default) picks a free one. */
     port?: number;
     /**
@@ -13,6 +14,17 @@ export interface ServeOptions {
     hosts?: string[];
     /** Which address to bind. Must be one of `hosts`. Defaults to its first. */
     host?: string;
+    /**
+     * Serve unsigned calls beyond loopback, deliberately.
+     *
+     * The one case that legitimately needs it: something in front already established the
+     * peer — a service mesh whose sidecar terminated mTLS, an ingress doing client certs.
+     * Asking for a second signature there would redo what was just done a centimetre away.
+     *
+     * It is spelled separately from `requireIdentity` on purpose: that one arrives `false`
+     * by default from `identityFromEnv`, so it cannot also mean "I thought about this".
+     */
+    allowUnsigned?: boolean;
     /** Maximum JSON-RPC body size. Default: 1 MiB. */
     maxBodyBytes?: number;
     /** Time allowed to receive a request. Default: 15 seconds. */

package/dist/serve.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"serve.d.ts","sourceRoot":"","sources":["../src/serve.ts"],"names":[],"mappings":"AAOA,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,eAAe,CAAC;AAI/C,MAAM,WAAW,YAAY;IAC3B,uDAAuD;IACvD,IAAI,CAAC,EAAE,MAAM,CAAC;IACd;;;;;;;OAOG;IACH,KAAK,CAAC,EAAE,MAAM,EAAE,CAAC;IACjB,4EAA4E;IAC5E,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,kDAAkD;IAClD,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,8DAA8D;IAC9D,gBAAgB,CAAC,EAAE,MAAM,CAAC;CAC3B;AAED,MAAM,WAAW,eAAe;IAC9B,IAAI,EAAE,MAAM,CAAC;IACb,KAAK,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC;CACxB;AAED,qDAAqD;AACrD,eAAO,MAAM,cAAc,UAAoC,CAAC;AAEhE,wBAAgB,KAAK,CAAC,MAAM,EAAE,SAAS,EAAE,OAAO,GAAE,YAAiB,GAAG,OAAO,CAAC,eAAe,CAAC,CAyD7F"}
+{"version":3,"file":"serve.d.ts","sourceRoot":"","sources":["../src/serve.ts"],"names":[],"mappings":"AAOA,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,eAAe,CAAC;AAE/C,OAAO,EAAa,KAAK,cAAc,EAAE,MAAM,aAAa,CAAC;AAG7D,MAAM,WAAW,YAAa,SAAQ,cAAc;IAClD,uDAAuD;IACvD,IAAI,CAAC,EAAE,MAAM,CAAC;IACd;;;;;;;OAOG;IACH,KAAK,CAAC,EAAE,MAAM,EAAE,CAAC;IACjB,4EAA4E;IAC5E,IAAI,CAAC,EAAE,MAAM,CAAC;IACd;;;;;;;;;OASG;IACH,aAAa,CAAC,EAAE,OAAO,CAAC;IACxB,kDAAkD;IAClD,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,8DAA8D;IAC9D,gBAAgB,CAAC,EAAE,MAAM,CAAC;CAC3B;AAED,MAAM,WAAW,eAAe;IAC9B,IAAI,EAAE,MAAM,CAAC;IACb,KAAK,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC;CACxB;AAED,qDAAqD;AACrD,eAAO,MAAM,cAAc,UAAoC,CAAC;AAEhE,wBAAgB,KAAK,CAAC,MAAM,EAAE,SAAS,EAAE,OAAO,GAAE,YAAiB,GAAG,OAAO,CAAC,eAAe,CAAC,CA6E7F"}

package/dist/serve.js

@@ -5,8 +5,8 @@
  * half inside an existing server (@fougere/http, Nitro) is layer-2 work.
  */
 import { createServer } from 'node:http';
-import { PARSE_ERROR } from './jsonrpc.js';
 import { handleRpc } from './server.js';
+import { MAX_BODY_BYTES, CALL_PATH, parseError, tooLarge } from './policy.js';
 /** What a frond binds when nobody says otherwise. */
 export const LOOPBACK_HOSTS = ['127.0.0.1', 'localhost', '::1'];
 export function serve(runner, options = {}) {
@@ -15,17 +15,32 @@ export function serve(runner, options = {}) {
         return Promise.reject(new Error('A Fougere receiver needs at least one host to bind, `hosts` is empty'));
     }
     const host = options.host ?? allowed[0];
-    // A receiver trusts the `state` it is handed — the caller's identity arrives on
-    // the wire and nothing here re-establishes it. `hosts` is where that fact meets a
-    // deployment: the default keeps it on the machine, and widening it is written down
-    // rather than inferred. A shared link secret would not help — whoever holds it can
-    // claim any user — so the answer stays identity at the Frond.
+    // Where a receiver binds, and what it admits, are two questions now. `verify` answers
+    // the second — without it this receiver still takes the `state` it is handed, and
+    // `hosts` is all that stands. The default keeps it on the machine; widening it is
+    // written down rather than inferred, and a widened receiver wants `requireIdentity`.
     if (!allowed.includes(host)) {
         return Promise.reject(new Error(`A Fougere receiver binds one of [${allowed.join(', ')}], got '${host}' — add it to \`hosts\` to allow it`));
     }
-    const maxBodyBytes = options.maxBodyBytes ?? 1024 * 1024;
+    /**
+     * Loopback or signed — there is no third way to serve.
+     *
+     * The address already carries the decision: binding beyond loopback is a deliberate
+     * act (`hosts` says so), and a receiver reachable from outside that establishes nothing
+     * takes the `state` it is handed. Refusing at BOOT and not per call is the point — a
+     * receiver that starts and then rejects everything is discovered in production, one
+     * that will not start is discovered at deployment.
+     */
+    if (!LOOPBACK_HOSTS.includes(host) && !options.verify && !options.allowUnsigned) {
+        return Promise.reject(new Error(`A Fougere receiver on '${host}' is reachable from outside this machine and would believe whatever `
+            + 'state it is handed.\n'
+            + '  - `fougere keys` once, then inject FOUGERE_ROOT_KEY here (and `fougere grant <frond>` for each caller), or\n'
+            + '  - keep it on loopback, or\n'
+            + '  - pass `allowUnsigned: true` if a mesh or an ingress already authenticated the caller.'));
+    }
+    const maxBodyBytes = options.maxBodyBytes ?? MAX_BODY_BYTES;
     const server = createServer(async (req, res) => {
-        if (req.method !== 'POST' || req.url !== '/_fougere/call') {
+        if (req.method !== 'POST' || req.url !== CALL_PATH) {
             res.writeHead(404).end();
             return;
         }
@@ -35,7 +50,7 @@ export function serve(runner, options = {}) {
             const chunk = Buffer.from(value);
             size += chunk.length;
             if (size > maxBodyBytes) {
-                res.writeHead(413, { 'content-type': 'application/json' }).end(JSON.stringify({ error: 'Payload too large' }));
+                res.writeHead(413, { 'content-type': 'application/json' }).end(JSON.stringify(tooLarge()));
                 return;
             }
             chunks.push(chunk);
@@ -43,10 +58,10 @@ export function serve(runner, options = {}) {
         let response;
         try {
             const raw = JSON.parse(Buffer.concat(chunks).toString('utf8'));
-            response = await handleRpc(runner, raw);
+            response = await handleRpc(runner, raw, options);
         }
         catch {
-            response = { jsonrpc: '2.0', id: null, error: { code: PARSE_ERROR, message: 'Parse error' } };
+            response = parseError();
         }
         res.writeHead(200, { 'content-type': 'application/json' }).end(JSON.stringify(response));
     });

package/dist/serve.js.map

@@ -1 +1 @@
-{"version":3,"file":"serve.js","sourceRoot":"","sources":["../src/serve.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AACH,OAAO,EAAE,YAAY,EAAE,MAAM,WAAW,CAAC;AAEzC,OAAO,EAAE,WAAW,EAAoB,MAAM,cAAc,CAAC;AAC7D,OAAO,EAAE,SAAS,EAAE,MAAM,aAAa,CAAC;AA2BxC,qDAAqD;AACrD,MAAM,CAAC,MAAM,cAAc,GAAG,CAAC,WAAW,EAAE,WAAW,EAAE,KAAK,CAAC,CAAC;AAEhE,MAAM,UAAU,KAAK,CAAC,MAAiB,EAAE,OAAO,GAAiB,EAAE;IACjE,MAAM,OAAO,GAAG,OAAO,CAAC,KAAK,IAAI,cAAc,CAAC;IAChD,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACzB,OAAO,OAAO,CAAC,MAAM,CAAC,IAAI,KAAK,CAAC,sEAAsE,CAAC,CAAC,CAAC;IAC3G,CAAC;IACD,MAAM,IAAI,GAAG,OAAO,CAAC,IAAI,IAAI,OAAO,CAAC,CAAC,CAAC,CAAC;IACxC,gFAAgF;IAChF,kFAAkF;IAClF,mFAAmF;IACnF,mFAAmF;IACnF,8DAA8D;IAC9D,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC;QAC5B,OAAO,OAAO,CAAC,MAAM,CACnB,IAAI,KAAK,CAAC,oCAAoC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,WAAW,IAAI,qCAAqC,CAAC,CACtH,CAAC;IACJ,CAAC;IACD,MAAM,YAAY,GAAG,OAAO,CAAC,YAAY,IAAI,IAAI,GAAG,IAAI,CAAC;IACzD,MAAM,MAAM,GAAG,YAAY,CAAC,KAAK,EAAE,GAAG,EAAE,GAAG,EAAE,EAAE;QAC7C,IAAI,GAAG,CAAC,MAAM,KAAK,MAAM,IAAI,GAAG,CAAC,GAAG,KAAK,gBAAgB,EAAE,CAAC;YAC1D,GAAG,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,CAAC;YACzB,OAAO;QACT,CAAC;QAED,MAAM,MAAM,GAAa,EAAE,CAAC;QAC5B,IAAI,IAAI,GAAG,CAAC,CAAC;QACb,IAAI,KAAK,EAAE,MAAM,KAAK,IAAI,GAAG,EAAE,CAAC;YAC9B,MAAM,KAAK,GAAG,MAAM,CAAC,IAAI,CAAC,KAAmB,CAAC,CAAC;YAC/C,IAAI,IAAI,KAAK,CAAC,MAAM,CAAC;YACrB,IAAI,IAAI,GAAG,YAAY,EAAE,CAAC;gBACxB,GAAG,CAAC,SAAS,CAAC,GAAG,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,KAAK,EAAE,mBAAmB,EAAE,CAAC,CAAC,CAAC;gBAC/G,OAAO;YACT,CAAC;YACD,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QACrB,CAAC;QAED,IAAI,QAAqB,CAAC;QAC1B,IAAI,CAAC;YACH,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC;YAC/D,QAAQ,GAAG,MAAM,SAAS,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC;QAC1C,CAAC;QAAC,MAAM,CAAC;YACP,QAAQ,GAAG,EAAE,OAAO,EAAE,KAAK,EAAE,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,WAAW,EAAE,OAAO,EAAE,aAAa,EAAE,EAAE,CAAC;QAChG,CAAC;QACD,GAAG,CAAC,SAAS,CAAC,GAAG,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,QAAQ,CAAC,CAAC,CAAC;IAC3F,CAAC,CAAC,CAAC;IAEH,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;QACrC,MAAM,CAAC,IAAI,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;QAC7B,MAAM,CAAC,cAAc,GAAG,OAAO,CAAC,gBAAgB,IAAI,MAAM,CAAC;QAC3D,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,IAAI,IAAI,CAAC,EAAE,IAAI,EAAE,GAAG,EAAE;YAC1C,MAAM,OAAO,GAAG,MAAM,CAAC,OAAO,EAAE,CAAC;YACjC,MAAM,IAAI,GAAG,OAAO,OAAO,KAAK,QAAQ,IAAI,OAAO,KAAK,IAAI,CAAC,CAAC,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC;YAChF,OAAO,CAAC;gBACN,IAAI;gBACJ,KAAK,EAAE,GAAG,EAAE,CAAC,IAAI,OAAO,CAAO,CAAC,IAAI,EAAE,IAAI,EAAE,EAAE,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC;aAClG,CAAC,CAAC;QACL,CAAC,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;AACL,CAAC"}
+{"version":3,"file":"serve.js","sourceRoot":"","sources":["../src/serve.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AACH,OAAO,EAAE,YAAY,EAAE,MAAM,WAAW,CAAC;AAGzC,OAAO,EAAE,SAAS,EAAuB,MAAM,aAAa,CAAC;AAC7D,OAAO,EAAE,cAAc,EAAE,SAAS,EAAE,UAAU,EAAE,QAAQ,EAAE,MAAM,aAAa,CAAC;AAsC9E,qDAAqD;AACrD,MAAM,CAAC,MAAM,cAAc,GAAG,CAAC,WAAW,EAAE,WAAW,EAAE,KAAK,CAAC,CAAC;AAEhE,MAAM,UAAU,KAAK,CAAC,MAAiB,EAAE,OAAO,GAAiB,EAAE;IACjE,MAAM,OAAO,GAAG,OAAO,CAAC,KAAK,IAAI,cAAc,CAAC;IAChD,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACzB,OAAO,OAAO,CAAC,MAAM,CAAC,IAAI,KAAK,CAAC,sEAAsE,CAAC,CAAC,CAAC;IAC3G,CAAC;IACD,MAAM,IAAI,GAAG,OAAO,CAAC,IAAI,IAAI,OAAO,CAAC,CAAC,CAAC,CAAC;IACxC,sFAAsF;IACtF,kFAAkF;IAClF,kFAAkF;IAClF,qFAAqF;IACrF,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC;QAC5B,OAAO,OAAO,CAAC,MAAM,CACnB,IAAI,KAAK,CAAC,oCAAoC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,WAAW,IAAI,qCAAqC,CAAC,CACtH,CAAC;IACJ,CAAC;IACD;;;;;;;;OAQG;IACH,IAAI,CAAC,cAAc,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,MAAM,IAAI,CAAC,OAAO,CAAC,aAAa,EAAE,CAAC;QAChF,OAAO,OAAO,CAAC,MAAM,CACnB,IAAI,KAAK,CACP,0BAA0B,IAAI,sEAAsE;cAClG,uBAAuB;cACvB,gHAAgH;cAChH,+BAA+B;cAC/B,0FAA0F,CAC7F,CACF,CAAC;IACJ,CAAC;IAED,MAAM,YAAY,GAAG,OAAO,CAAC,YAAY,IAAI,cAAc,CAAC;IAC5D,MAAM,MAAM,GAAG,YAAY,CAAC,KAAK,EAAE,GAAG,EAAE,GAAG,EAAE,EAAE;QAC7C,IAAI,GAAG,CAAC,MAAM,KAAK,MAAM,IAAI,GAAG,CAAC,GAAG,KAAK,SAAS,EAAE,CAAC;YACnD,GAAG,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,CAAC;YACzB,OAAO;QACT,CAAC;QAED,MAAM,MAAM,GAAa,EAAE,CAAC;QAC5B,IAAI,IAAI,GAAG,CAAC,CAAC;QACb,IAAI,KAAK,EAAE,MAAM,KAAK,IAAI,GAAG,EAAE,CAAC;YAC9B,MAAM,KAAK,GAAG,MAAM,CAAC,IAAI,CAAC,KAAmB,CAAC,CAAC;YAC/C,IAAI,IAAI,KAAK,CAAC,MAAM,CAAC;YACrB,IAAI,IAAI,GAAG,YAAY,EAAE,CAAC;gBACxB,GAAG,CAAC,SAAS,CAAC,GAAG,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAC;gBAC3F,OAAO;YACT,CAAC;YACD,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QACrB,CAAC;QAED,IAAI,QAAqB,CAAC;QAC1B,IAAI,CAAC;YACH,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC;YAC/D,QAAQ,GAAG,MAAM,SAAS,CAAC,MAAM,EAAE,GAAG,EAAE,OAAO,CAAC,CAAC;QACnD,CAAC;QAAC,MAAM,CAAC;YACP,QAAQ,GAAG,UAAU,EAAE,CAAC;QAC1B,CAAC;QACD,GAAG,CAAC,SAAS,CAAC,GAAG,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,QAAQ,CAAC,CAAC,CAAC;IAC3F,CAAC,CAAC,CAAC;IAEH,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;QACrC,MAAM,CAAC,IAAI,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;QAC7B,MAAM,CAAC,cAAc,GAAG,OAAO,CAAC,gBAAgB,IAAI,MAAM,CAAC;QAC3D,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,IAAI,IAAI,CAAC,EAAE,IAAI,EAAE,GAAG,EAAE;YAC1C,MAAM,OAAO,GAAG,MAAM,CAAC,OAAO,EAAE,CAAC;YACjC,MAAM,IAAI,GAAG,OAAO,OAAO,KAAK,QAAQ,IAAI,OAAO,KAAK,IAAI,CAAC,CAAC,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC;YAChF,OAAO,CAAC;gBACN,IAAI;gBACJ,KAAK,EAAE,GAAG,EAAE,CAAC,IAAI,OAAO,CAAO,CAAC,IAAI,EAAE,IAAI,EAAE,EAAE,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC;aAClG,CAAC,CAAC;QACL,CAAC,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;AACL,CAAC"}

package/dist/server.d.ts

@@ -4,7 +4,25 @@
  * Judges nothing: validation and middlewares live with the handler, inside
  * the runner. The error a façade throws is framed whole, never flattened.
  */
-import { type Transport } from '@fougere/core';
+import { type SignedCall, type Transport } from '@fougere/core/contract';
 import { type RpcResponse } from './jsonrpc.js';
-export declare function handleRpc(runner: Transport, raw: unknown): Promise<RpcResponse>;
+/** What a receiver does with the caller's envelope. */
+export interface ReceiveOptions {
+    /**
+     * Establishes who signed, or throws. Supplied rather than built here for the reason
+     * the sender's `sign` is: verifying is `node:crypto` and this package carries none.
+     * `@fougere/app` wires it from `verifyEnvelope` and the root public key.
+     */
+    verify?: (identity: string, presented: SignedCall) => Promise<{
+        caller: string;
+        state: Record<string, unknown>;
+    }>;
+    /**
+     * Refuse a call carrying no verifiable identity — the whole of "secure by default"
+     * at the wire. Without it a receiver takes the state it is handed and its only
+     * protection is the address it bound.
+     */
+    requireIdentity?: boolean;
+}
+export declare function handleRpc(runner: Transport, raw: unknown, options?: ReceiveOptions): Promise<RpcResponse>;
 //# sourceMappingURL=server.d.ts.map

package/dist/server.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"server.d.ts","sourceRoot":"","sources":["../src/server.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AACH,OAAO,EAAkE,KAAK,SAAS,EAAE,MAAM,eAAe,CAAC;AAC/G,OAAO,EAA+C,KAAK,WAAW,EAAE,MAAM,cAAc,CAAC;AAE7F,wBAAsB,SAAS,CAAC,MAAM,EAAE,SAAS,EAAE,GAAG,EAAE,OAAO,GAAG,OAAO,CAAC,WAAW,CAAC,CA2CrF"}
+{"version":3,"file":"server.d.ts","sourceRoot":"","sources":["../src/server.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AACH,OAAO,EAAkE,KAAK,UAAU,EAAE,KAAK,SAAS,EAAE,MAAM,wBAAwB,CAAC;AACzI,OAAO,EAA+C,KAAK,WAAW,EAAE,MAAM,cAAc,CAAC;AAE7F,uDAAuD;AACvD,MAAM,WAAW,cAAc;IAC7B;;;;OAIG;IACH,MAAM,CAAC,EAAE,CAAC,QAAQ,EAAE,MAAM,EAAE,SAAS,EAAE,UAAU,KAAK,OAAO,CAAC;QAAE,MAAM,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;KAAE,CAAC,CAAC;IAClH;;;;OAIG;IACH,eAAe,CAAC,EAAE,OAAO,CAAC;CAC3B;AAED,wBAAsB,SAAS,CAAC,MAAM,EAAE,SAAS,EAAE,GAAG,EAAE,OAAO,EAAE,OAAO,GAAE,cAAmB,GAAG,OAAO,CAAC,WAAW,CAAC,CA0EnH"}

package/dist/server.js

@@ -4,9 +4,9 @@
  * Judges nothing: validation and middlewares live with the handler, inside
  * the runner. The error a façade throws is framed whole, never flattened.
  */
-import { FougereError, ErrorCode, toPublicError } from '@fougere/core';
+import { FougereError, ErrorCode, toPublicError } from '@fougere/core/contract';
 import { APP_ERROR, INVALID_REQUEST } from './jsonrpc.js';
-export async function handleRpc(runner, raw) {
+export async function handleRpc(runner, raw, options = {}) {
     const req = raw;
     const id = typeof req?.id === 'number' || typeof req?.id === 'string' ? req.id : null;
     if (!req || req.jsonrpc !== '2.0' || typeof req.method !== 'string' || id === null) {
@@ -24,11 +24,42 @@ export async function handleRpc(runner, raw) {
     const op = req.method.slice(dot + 1);
     // Fresh objects — middlewares deposit into state, nothing may be shared.
     const sent = (req.params ?? {});
+    /**
+     * State is ESTABLISHED here, or it is only claimed.
+     *
+     * `sent.state` is what the caller typed; a verified envelope is what it can prove, and
+     * when a verifier is wired the envelope REPLACES the claim rather than enriching it —
+     * carrying both would leave every reader downstream choosing between them.
+     */
+    let state = sent.state ?? {};
+    let caller;
+    if (options.verify && sent.identity) {
+        try {
+            // What ARRIVED, never what we would rather it had been — the comparison is the point.
+            ({ caller, state } = await options.verify(sent.identity, {
+                entity,
+                op,
+                params: sent.params ?? {},
+                query: sent.query ?? {},
+                body: sent.body,
+            }));
+        }
+        catch (err) {
+            return refused(id, err?.message ?? 'unverifiable identity', entity, op);
+        }
+    }
+    else if (options.requireIdentity) {
+        return refused(id, 'this receiver takes signed calls only', entity, op);
+    }
+    // Built field by field, never spread from `sent`: everything here is either judged
+    // above or carried deliberately, and `caller` is ours to write alone.
     const invocation = {
         params: sent.params ?? {},
         query: sent.query ?? {},
         body: sent.body,
-        state: sent.state ?? {},
+        state,
+        trace: sent.trace,
+        ...(caller ? { caller } : {}),
     };
     try {
         return { jsonrpc: '2.0', id, result: await runner({ entity, op }, invocation) };
@@ -47,4 +78,9 @@ export async function handleRpc(runner, raw) {
         return { jsonrpc: '2.0', id, error: { code: APP_ERROR, message: data.message, data } };
     }
 }
+/** An admission refusal, framed like any other failure so a caller reads one vocabulary. */
+function refused(id, why, entity, op) {
+    const data = toPublicError(new FougereError({ code: ErrorCode.UNAUTHORIZED, message: `Refused: ${why}`, entity, operation: op }));
+    return { jsonrpc: '2.0', id, error: { code: APP_ERROR, message: data.message, data } };
+}
 //# sourceMappingURL=server.js.map

package/dist/server.js.map

@@ -1 +1 @@
-{"version":3,"file":"server.js","sourceRoot":"","sources":["../src/server.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AACH,OAAO,EAAE,YAAY,EAAE,SAAS,EAAE,aAAa,EAA0C,MAAM,eAAe,CAAC;AAC/G,OAAO,EAAE,SAAS,EAAE,eAAe,EAAqC,MAAM,cAAc,CAAC;AAE7F,MAAM,CAAC,KAAK,UAAU,SAAS,CAAC,MAAiB,EAAE,GAAY;IAC7D,MAAM,GAAG,GAAG,GAAiC,CAAC;IAC9C,MAAM,EAAE,GAAG,OAAO,GAAG,EAAE,EAAE,KAAK,QAAQ,IAAI,OAAO,GAAG,EAAE,EAAE,KAAK,QAAQ,CAAC,CAAC,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC;IAEtF,IAAI,CAAC,GAAG,IAAI,GAAG,CAAC,OAAO,KAAK,KAAK,IAAI,OAAO,GAAG,CAAC,MAAM,KAAK,QAAQ,IAAI,EAAE,KAAK,IAAI,EAAE,CAAC;QACnF,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,EAAE,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,eAAe,EAAE,OAAO,EAAE,8BAA8B,EAAE,EAAE,CAAC;IAC3G,CAAC;IAED,MAAM,GAAG,GAAG,GAAG,CAAC,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;IACpC,IAAI,GAAG,IAAI,CAAC,IAAI,GAAG,KAAK,GAAG,CAAC,MAAM,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAC9C,OAAO;YACL,OAAO,EAAE,KAAK;YACd,EAAE;YACF,KAAK,EAAE,EAAE,IAAI,EAAE,eAAe,EAAE,OAAO,EAAE,mBAAmB,GAAG,CAAC,MAAM,0BAA0B,EAAE;SACnG,CAAC;IACJ,CAAC;IACD,MAAM,MAAM,GAAG,GAAG,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC;IACxC,MAAM,EAAE,GAAG,GAAG,CAAC,MAAM,CAAC,KAAK,CAAC,GAAG,GAAG,CAAC,CAAC,CAAC;IAErC,yEAAyE;IACzE,MAAM,IAAI,GAAG,CAAC,GAAG,CAAC,MAAM,IAAI,EAAE,CAA+B,CAAC;IAC9D,MAAM,UAAU,GAAsB;QACpC,MAAM,EAAE,IAAI,CAAC,MAAM,IAAI,EAAE;QACzB,KAAK,EAAE,IAAI,CAAC,KAAK,IAAI,EAAE;QACvB,IAAI,EAAE,IAAI,CAAC,IAAI;QACf,KAAK,EAAE,IAAI,CAAC,KAAK,IAAI,EAAE;KACxB,CAAC;IAEF,IAAI,CAAC;QACH,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,EAAE,EAAE,MAAM,EAAE,MAAM,MAAM,CAAC,EAAE,MAAM,EAAE,EAAE,EAAE,EAAE,UAAU,CAAC,EAAE,CAAC;IAClF,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,MAAM,OAAO,GAAG,GAAG,YAAY,YAAY;YACzC,CAAC,CAAC,GAAG;YACL,CAAC,CAAC,IAAI,YAAY,CAAC;gBACf,IAAI,EAAE,SAAS,CAAC,cAAc;gBAC9B,OAAO,EAAG,GAAa,EAAE,OAAO,IAAI,gBAAgB;gBACpD,MAAM;gBACN,SAAS,EAAE,EAAE;gBACb,KAAK,EAAE,GAAG;aACX,CAAC,CAAC;QACP,MAAM,IAAI,GAAG,aAAa,CAAC,OAAO,CAAC,CAAC;QACpC,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,EAAE,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE,OAAO,EAAE,IAAI,CAAC,OAAO,EAAE,IAAI,EAAE,EAAE,CAAC;IACzF,CAAC;AACH,CAAC"}
+{"version":3,"file":"server.js","sourceRoot":"","sources":["../src/server.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AACH,OAAO,EAAE,YAAY,EAAE,SAAS,EAAE,aAAa,EAA2D,MAAM,wBAAwB,CAAC;AACzI,OAAO,EAAE,SAAS,EAAE,eAAe,EAAqC,MAAM,cAAc,CAAC;AAkB7F,MAAM,CAAC,KAAK,UAAU,SAAS,CAAC,MAAiB,EAAE,GAAY,EAAE,OAAO,GAAmB,EAAE;IAC3F,MAAM,GAAG,GAAG,GAAiC,CAAC;IAC9C,MAAM,EAAE,GAAG,OAAO,GAAG,EAAE,EAAE,KAAK,QAAQ,IAAI,OAAO,GAAG,EAAE,EAAE,KAAK,QAAQ,CAAC,CAAC,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC;IAEtF,IAAI,CAAC,GAAG,IAAI,GAAG,CAAC,OAAO,KAAK,KAAK,IAAI,OAAO,GAAG,CAAC,MAAM,KAAK,QAAQ,IAAI,EAAE,KAAK,IAAI,EAAE,CAAC;QACnF,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,EAAE,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,eAAe,EAAE,OAAO,EAAE,8BAA8B,EAAE,EAAE,CAAC;IAC3G,CAAC;IAED,MAAM,GAAG,GAAG,GAAG,CAAC,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;IACpC,IAAI,GAAG,IAAI,CAAC,IAAI,GAAG,KAAK,GAAG,CAAC,MAAM,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAC9C,OAAO;YACL,OAAO,EAAE,KAAK;YACd,EAAE;YACF,KAAK,EAAE,EAAE,IAAI,EAAE,eAAe,EAAE,OAAO,EAAE,mBAAmB,GAAG,CAAC,MAAM,0BAA0B,EAAE;SACnG,CAAC;IACJ,CAAC;IACD,MAAM,MAAM,GAAG,GAAG,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC;IACxC,MAAM,EAAE,GAAG,GAAG,CAAC,MAAM,CAAC,KAAK,CAAC,GAAG,GAAG,CAAC,CAAC,CAAC;IAErC,yEAAyE;IACzE,MAAM,IAAI,GAAG,CAAC,GAAG,CAAC,MAAM,IAAI,EAAE,CAA+B,CAAC;IAE9D;;;;;;OAMG;IACH,IAAI,KAAK,GAA4B,IAAI,CAAC,KAAK,IAAI,EAAE,CAAC;IACtD,IAAI,MAA0B,CAAC;IAC/B,IAAI,OAAO,CAAC,MAAM,IAAI,IAAI,CAAC,QAAQ,EAAE,CAAC;QACpC,IAAI,CAAC;YACH,sFAAsF;YACtF,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,GAAG,MAAM,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC,QAAQ,EAAE;gBACvD,MAAM;gBACN,EAAE;gBACF,MAAM,EAAE,IAAI,CAAC,MAAM,IAAI,EAAE;gBACzB,KAAK,EAAE,IAAI,CAAC,KAAK,IAAI,EAAE;gBACvB,IAAI,EAAE,IAAI,CAAC,IAAI;aAChB,CAAC,CAAC,CAAC;QACN,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,OAAO,OAAO,CAAC,EAAE,EAAG,GAAa,EAAE,OAAO,IAAI,uBAAuB,EAAE,MAAM,EAAE,EAAE,CAAC,CAAC;QACrF,CAAC;IACH,CAAC;SAAM,IAAI,OAAO,CAAC,eAAe,EAAE,CAAC;QACnC,OAAO,OAAO,CAAC,EAAE,EAAE,uCAAuC,EAAE,MAAM,EAAE,EAAE,CAAC,CAAC;IAC1E,CAAC;IAED,mFAAmF;IACnF,sEAAsE;IACtE,MAAM,UAAU,GAAsB;QACpC,MAAM,EAAE,IAAI,CAAC,MAAM,IAAI,EAAE;QACzB,KAAK,EAAE,IAAI,CAAC,KAAK,IAAI,EAAE;QACvB,IAAI,EAAE,IAAI,CAAC,IAAI;QACf,KAAK;QACL,KAAK,EAAE,IAAI,CAAC,KAAK;QACjB,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KAC9B,CAAC;IAEF,IAAI,CAAC;QACH,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,EAAE,EAAE,MAAM,EAAE,MAAM,MAAM,CAAC,EAAE,MAAM,EAAE,EAAE,EAAE,EAAE,UAAU,CAAC,EAAE,CAAC;IAClF,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,MAAM,OAAO,GAAG,GAAG,YAAY,YAAY;YACzC,CAAC,CAAC,GAAG;YACL,CAAC,CAAC,IAAI,YAAY,CAAC;gBACf,IAAI,EAAE,SAAS,CAAC,cAAc;gBAC9B,OAAO,EAAG,GAAa,EAAE,OAAO,IAAI,gBAAgB;gBACpD,MAAM;gBACN,SAAS,EAAE,EAAE;gBACb,KAAK,EAAE,GAAG;aACX,CAAC,CAAC;QACP,MAAM,IAAI,GAAG,aAAa,CAAC,OAAO,CAAC,CAAC;QACpC,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,EAAE,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE,OAAO,EAAE,IAAI,CAAC,OAAO,EAAE,IAAI,EAAE,EAAE,CAAC;IACzF,CAAC;AACH,CAAC;AAED,4FAA4F;AAC5F,SAAS,OAAO,CAAC,EAAmB,EAAE,GAAW,EAAE,MAAc,EAAE,EAAU;IAC3E,MAAM,IAAI,GAAG,aAAa,CACxB,IAAI,YAAY,CAAC,EAAE,IAAI,EAAE,SAAS,CAAC,YAAY,EAAE,OAAO,EAAE,YAAY,GAAG,EAAE,EAAE,MAAM,EAAE,SAAS,EAAE,EAAE,EAAE,CAAC,CACtG,CAAC;IACF,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,EAAE,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE,OAAO,EAAE,IAAI,CAAC,OAAO,EAAE,IAAI,EAAE,EAAE,CAAC;AACzF,CAAC"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@fougere/transport-http",
-  "version": "0.2.0-alpha.2",
+  "version": "0.4.0-alpha.0",
   "description": "The call contract on the wire, in JSON-RPC 2.0 (server + client).",
   "keywords": [
     "fougere",
@@ -24,21 +24,26 @@
       "types": "./dist/index.d.ts",
       "import": "./dist/index.js"
     },
+    "./receive": {
+      "types": "./dist/receive.d.ts",
+      "import": "./dist/receive.js"
+    },
     "./client": {
       "types": "./dist/client.d.ts",
       "import": "./dist/client.js"
     }
   },
   "files": [
-    "dist"
+    "dist",
+    "src"
   ],
   "dependencies": {
-    "@fougere/core": "0.2.0-alpha.2"
+    "@fougere/core": "0.4.0-alpha.0"
   },
   "devDependencies": {
     "jiti": "^2.6.1",
-    "@fougere/schema": "0.2.0-alpha.2",
-    "@fougere/container": "0.2.0-alpha.2"
+    "@fougere/schema": "0.4.0-alpha.0",
+    "@fougere/container": "0.4.0-alpha.0"
   },
   "publishConfig": {
     "access": "public"

package/src/client.ts

@@ -0,0 +1,171 @@
+/**
+ * Sending half — frame the call, POST it, unframe the result.
+ *
+ * Failure vocabulary is FougereError only: a transport failure becomes a
+ * typed error (SERVICE_UNAVAILABLE, GATEWAY_TIMEOUT, BAD_GATEWAY), an
+ * application failure comes back as the FougereError the façade threw.
+ */
+import { FougereError, ErrorCode, type Transport, type FrondCall, type InvocationContext, type SignedCall } from '@fougere/core/contract';
+import type { RpcRequest, RpcResponse, RpcErrorShape } from './jsonrpc.js';
+export type { RpcRequest, RpcResponse } from './jsonrpc.js';
+
+/** Frame a call as a JSON-RPC request. */
+export function frameCall(call: FrondCall, invocation: InvocationContext, id: number): RpcRequest {
+  return { jsonrpc: '2.0', id, method: `${call.entity}.${call.op}`, params: invocation };
+}
+
+/**
+ * Unframe a JSON-RPC response — the result, or the revived FougereError thrown.
+ *
+ * The answer is JUDGED first: it crossed a process boundary, and `as RpcResponse` at the
+ * call site is a claim about it, not a check. A 200 carrying neither `result` nor `error`
+ * — a proxy's own JSON, a receiver that is not one — used to return `undefined` as if the
+ * op had succeeded, and a `null` body raised `Cannot use 'in' operator`, which is not the
+ * failure vocabulary this file promises.
+ */
+export function unframeResponse(response: unknown, call: FrondCall): unknown {
+  if (!response || typeof response !== 'object' || !('result' in response || 'error' in response)) {
+    throw new FougereError({
+      code: ErrorCode.BAD_GATEWAY,
+      message: 'Answered neither a result nor an error — not a Fougere receiver?',
+      entity: call.entity,
+      operation: call.op,
+    });
+  }
+  if ('error' in response) {
+    const error = response.error as Partial<RpcErrorShape> | null;
+    if (!error || typeof error !== 'object') {
+      throw new FougereError({
+        code: ErrorCode.BAD_GATEWAY,
+        message: 'Answered an error that is not a JSON-RPC error object',
+        entity: call.entity,
+        operation: call.op,
+      });
+    }
+    if (error.data !== undefined) throw FougereError.fromJSON(error.data);
+    throw new FougereError({
+      code: ErrorCode.INTERNAL_ERROR,
+      message: `${error.message} (rpc ${error.code})`,
+      entity: call.entity,
+      operation: call.op,
+    });
+  }
+  return response.result;
+}
+
+export interface HttpTransportOptions {
+  /** Abort a call after this long. A timed-out call may have executed — it is never retried. */
+  timeoutMs?: number;
+  /** Extra attempts on connection failures only — the request provably never left. */
+  retries?: number;
+  /**
+   * Signs the state this transport sends, turning a claim into something the receiver
+   * can check. Supplied rather than built here: signing is `node:crypto`, and this
+   * module is published as the browser-safe `/client` subpath — a browser holds no key
+   * and never signs. `@fougere/app` wires it from `signEnvelope`.
+   *
+   * Absent, the state travels as a bare claim and only a receiver that asks for nothing
+   * will take it.
+   */
+  sign?: (call: SignedCall) => Promise<string>;
+  /**
+   * Who performs the request. Defaults to the global `fetch`.
+   *
+   * A Cloudflare service binding answers this shape (`env.CATALOG.fetch`), and on that
+   * platform it is not an optimization: a Worker calling a sibling's public URL is
+   * refused by the edge (error 1042), so a binding is the only route between two Workers
+   * of one account. Nothing else about the call changes — same envelope, same retries.
+   */
+  fetch?: (input: string, init: RequestInit) => Promise<Response>;
+}
+
+/** Failures where the request never reached the other side — safe to retry. */
+const CONNECTION_FAILURES = new Set(['ECONNREFUSED', 'ENOTFOUND', 'EAI_AGAIN']);
+
+export function createHttpTransport(baseUrl: string, options: HttpTransportOptions = {}): Transport {
+  const url = `${baseUrl.replace(/\/$/, '')}/_fougere/call`;
+  // Who performs the request, when it is not the global one. A Cloudflare service binding
+  // is exactly this shape — and on that platform it is the ONLY way two Workers of one
+  // account reach each other: measured, a Worker fetching a sibling's public URL is
+  // refused by the edge with error 1042 before the request leaves. The framing above and
+  // below is identical either way, which is the whole reason this is one option and not
+  // a second transport.
+  const send = options.fetch ?? fetch;
+  const timeoutMs = options.timeoutMs ?? 10_000;
+  const retries = options.retries ?? 1;
+  let nextId = 1;
+
+  return async (call, invocation) => {
+    // The envelope REPLACES the state on the wire — sending both would leave the
+    // receiver choosing between a proof and a claim about the same thing.
+    // `caller` is dropped on every hop: it names who signed THIS call, so carrying the
+    // one this process was handed would make `shop → catalog → billing` read `shop`.
+    // It travels outside the envelope anyway, so a stale one would be unsigned too.
+    const { caller: _established, ...forwarded } = invocation;
+    const sent = options.sign
+      ? { ...forwarded, state: {}, identity: await options.sign({ ...call, ...invocation }) }
+      : forwarded;
+    const request = frameCall(call, sent, nextId++);
+
+    for (let attempt = 0; ; attempt++) {
+      let res: Response;
+      try {
+        res = await send(url, {
+          method: 'POST',
+          headers: { 'content-type': 'application/json' },
+          body: JSON.stringify(request),
+          signal: AbortSignal.timeout(timeoutMs),
+        });
+      } catch (err) {
+        if (isTimeout(err)) {
+          throw new FougereError({
+            code: ErrorCode.GATEWAY_TIMEOUT,
+            message: `${call.entity}.${call.op} timed out after ${timeoutMs}ms (${baseUrl})`,
+            entity: call.entity,
+            operation: call.op,
+          });
+        }
+        if (attempt < retries && isConnectionFailure(err)) continue;
+        throw new FougereError({
+          code: ErrorCode.SERVICE_UNAVAILABLE,
+          message: `${baseUrl} unreachable: ${(err as Error)?.message ?? err}`,
+          entity: call.entity,
+          operation: call.op,
+          cause: err,
+        });
+      }
+
+      if (!res.ok) {
+        throw new FougereError({
+          code: ErrorCode.BAD_GATEWAY,
+          message: `${baseUrl} answered HTTP ${res.status} — not a Fougere receiver?`,
+          entity: call.entity,
+          operation: call.op,
+        });
+      }
+
+      let response: RpcResponse;
+      try {
+        response = (await res.json()) as RpcResponse;
+      } catch {
+        throw new FougereError({
+          code: ErrorCode.BAD_GATEWAY,
+          message: `${baseUrl} answered non-JSON`,
+          entity: call.entity,
+          operation: call.op,
+        });
+      }
+
+      return unframeResponse(response, call);
+    }
+  };
+}
+
+function isTimeout(err: unknown): boolean {
+  return err instanceof DOMException && (err.name === 'TimeoutError' || err.name === 'AbortError');
+}
+
+function isConnectionFailure(err: unknown): boolean {
+  const code = (err as { cause?: { code?: string } })?.cause?.code;
+  return typeof code === 'string' && CONNECTION_FAILURES.has(code);
+}

package/src/index.ts

@@ -0,0 +1,7 @@
+export { createHttpTransport, frameCall, unframeResponse, type HttpTransportOptions } from './client.js';
+export { handleRpc, type ReceiveOptions } from './server.js';
+export { receive, type ReceiveHttpOptions } from './receive.js';
+export { CALL_PATH, MAX_BODY_BYTES } from './policy.js';
+export { serve, type ServeOptions, type RunningReceiver } from './serve.js';
+export { APP_ERROR, PARSE_ERROR, INVALID_REQUEST } from './jsonrpc.js';
+export type { RpcRequest, RpcResponse, RpcErrorShape } from './jsonrpc.js';

package/src/jsonrpc.ts

@@ -0,0 +1,32 @@
+/**
+ * JSON-RPC 2.0 framing — the standard written form of a call.
+ *
+ * The spec is the reuse: these few lines follow it, no lib adds anything.
+ * `method` is `entity.op`; `params` is the InvocationContext untouched.
+ * A FougereError travels whole in `error.data` (spec keeps `error.code`
+ * for integers — the semantic code lives in the data).
+ */
+
+export interface RpcRequest {
+  jsonrpc: '2.0';
+  id: number | string;
+  method: string;
+  params?: unknown;
+}
+
+export interface RpcErrorShape {
+  code: number;
+  message: string;
+  data?: unknown;
+}
+
+export type RpcResponse =
+  | { jsonrpc: '2.0'; id: number | string | null; result: unknown }
+  | { jsonrpc: '2.0'; id: number | string | null; error: RpcErrorShape };
+
+/** Application failure — a FougereError, carried in error.data. */
+export const APP_ERROR = -32000;
+/** Body wasn't JSON (spec-reserved). */
+export const PARSE_ERROR = -32700;
+/** Not a valid JSON-RPC 2.0 call (spec-reserved). */
+export const INVALID_REQUEST = -32600;

package/src/policy.ts

@@ -0,0 +1,29 @@
+/**
+ * What every receiver of the envelope decides the same way, and what it does not.
+ *
+ * The cap and the answers are POLICY — `1024 * 1024` was spelled in four packages and
+ * omitted by the receiver written by hand. Reading the body is PLUMBING, and it belongs to
+ * the transport: a `node:http` stream and a `Request` body are read differently, and putting
+ * Node through the Web reader HALVED the door that took it (measured, 2026-08-22: the JSON-RPC
+ * door fell from 0.677 to 0.341 of its hand-written baseline, while the REST door, which never
+ * traverses `serve()`, sat at 0.653 in that same run).
+ *
+ * So this file holds the decisions. Each receiver keeps its own reader.
+ */
+import { PARSE_ERROR, type RpcResponse } from './jsonrpc.js';
+
+/** What a receiver accepts before it stops reading. */
+export const MAX_BODY_BYTES = 1024 * 1024;
+
+/** The path the envelope answers on. A host mounting it elsewhere passes its own. */
+export const CALL_PATH = '/_fougere/call';
+
+/** The answer to a payload that was not JSON. */
+export const parseError = (): RpcResponse => ({
+  jsonrpc: '2.0',
+  id: null,
+  error: { code: PARSE_ERROR, message: 'Parse error' },
+});
+
+/** The answer to a body over the cap. */
+export const tooLarge = () => ({ error: 'Payload too large' });

package/src/receive.ts

@@ -0,0 +1,111 @@
+/**
+ * The envelope door for a host that speaks `Request`/`Response` — hono, a Worker, Next,
+ * SvelteKit. It reads a `Request` body; `serve` reads a `node:http` stream, and the two
+ * stay separate on purpose: putting Node through this reader HALVED the Node door
+ * (0.677 → 0.341 of its baseline, measured 2026-08-22).
+ *
+ * What they share is `policy.ts` — the cap and the answers. Nothing here is edge-specific
+ * beyond that: `handleRpc` is the wire and knows no HTTP at all.
+ */
+import { handleRpc, type ReceiveOptions } from './server.js';
+import { MAX_BODY_BYTES, CALL_PATH, parseError, tooLarge } from './policy.js';
+import type { Transport } from '@fougere/core/contract';
+
+export interface ReceiveHttpOptions extends ReceiveOptions {
+  /** Maximum JSON-RPC body size. Default: 1 MiB. */
+  maxBodyBytes?: number;
+  /** The path this door answers. Default: `/_fougere/call`. */
+  path?: string;
+  /**
+   * Take unsigned calls, deliberately.
+   *
+   * `serve()` reads the decision off the ADDRESS — loopback by default, and widening it
+   * is written down. This door binds nothing: its host mounts it wherever it likes, and a
+   * `Request` arrives with no bound address to consult. So the decision has to be stated,
+   * and the default is the safe one: with no `verify` and no word here, this REFUSES to
+   * be built. A door that starts and then believes whatever `state` it is handed is the
+   * hole `identity.ts` exists to close, and it was open here.
+   *
+   * The one case that legitimately needs it beyond local development is the same as
+   * `serve`'s: something in front already established the peer.
+   */
+  allowUnsigned?: boolean;
+}
+
+const json = (body: unknown, status = 200) =>
+  new Response(JSON.stringify(body), { status, headers: { 'content-type': 'application/json' } });
+
+/** Distinguishes "the body was too large" from any body a caller could actually send. */
+const TOO_LARGE = Symbol('too large');
+
+/**
+ * The declared length is a cheap refusal; the count is the real one. A `content-length` may
+ * be absent, and it may lie — the copy that trusted it alone had no cap at all in that case.
+ */
+async function bodyWithin(request: Request, max: number): Promise<string | typeof TOO_LARGE> {
+  const declared = Number(request.headers.get('content-length'));
+  if (Number.isFinite(declared) && declared > max) return TOO_LARGE;
+
+  const reader = request.body?.getReader();
+  if (!reader) return '';
+
+  const chunks: Uint8Array[] = [];
+  let size = 0;
+  for (;;) {
+    const { done, value } = await reader.read();
+    if (done) break;
+    size += value.byteLength;
+    if (size > max) {
+      await reader.cancel();
+      return TOO_LARGE;
+    }
+    chunks.push(value);
+  }
+  return new TextDecoder().decode(concat(chunks, size));
+}
+
+function concat(chunks: readonly Uint8Array[], size: number): Uint8Array {
+  const all = new Uint8Array(size);
+  let at = 0;
+  for (const chunk of chunks) {
+    all.set(chunk, at);
+    at += chunk.byteLength;
+  }
+  return all;
+}
+
+export function receive(
+  runner: Transport,
+  options: ReceiveHttpOptions = {},
+): (request: Request) => Promise<Response> {
+  // At CONSTRUCTION and not per call, for the reason `serve` refuses at bind: a receiver
+  // that starts and then rejects everything is found in production.
+  if (!options.verify && !options.allowUnsigned) {
+    throw new Error(
+      'A Fougere receiver takes the `state` it is handed, so this door needs to know who is calling.\n'
+      + '  Wire `verify` (see `verifyEnvelope`, and `fougere keys` / `fougere grant`),\n'
+      + '  or say `allowUnsigned: true` — which is right for local development and for a\n'
+      + '  mesh whose sidecar already established the peer.',
+    );
+  }
+
+  const max = options.maxBodyBytes ?? MAX_BODY_BYTES;
+  const path = options.path ?? CALL_PATH;
+
+  return async (request) => {
+    if (request.method !== 'POST' || new URL(request.url).pathname !== path) {
+      return new Response(null, { status: 404 });
+    }
+
+    const raw = await bodyWithin(request, max);
+    if (raw === TOO_LARGE) return json(tooLarge(), 413);
+
+    let parsed: unknown;
+    try {
+      parsed = JSON.parse(raw);
+    } catch {
+      return json(parseError());
+    }
+    return json(await handleRpc(runner, parsed, options));
+  };
+}

package/src/serve.ts

@@ -0,0 +1,129 @@
+/**
+ * Standalone receiver — enough to host a Frond in its own process.
+ *
+ * Plain node:http, one route: POST /_fougere/call. Mounting the receiving
+ * half inside an existing server (@fougere/http, Nitro) is layer-2 work.
+ */
+import { createServer } from 'node:http';
+import type { Transport } from '@fougere/core';
+import type { RpcResponse } from './jsonrpc.js';
+import { handleRpc, type ReceiveOptions } from './server.js';
+import { MAX_BODY_BYTES, CALL_PATH, parseError, tooLarge } from './policy.js';
+
+export interface ServeOptions extends ReceiveOptions {
+  /** Port to listen on. 0 (default) picks a free one. */
+  port?: number;
+  /**
+   * The addresses this receiver may bind. Default: loopback only.
+   *
+   * A receiver reads the caller's identity off the wire and re-establishes
+   * nothing, so reaching beyond the machine is a decision its operator takes
+   * — stating it here IS taking it. The default is what a frond on a laptop
+   * wants; a container wants `hosts: ['0.0.0.0']` and says so.
+   */
+  hosts?: string[];
+  /** Which address to bind. Must be one of `hosts`. Defaults to its first. */
+  host?: string;
+  /**
+   * Serve unsigned calls beyond loopback, deliberately.
+   *
+   * The one case that legitimately needs it: something in front already established the
+   * peer — a service mesh whose sidecar terminated mTLS, an ingress doing client certs.
+   * Asking for a second signature there would redo what was just done a centimetre away.
+   *
+   * It is spelled separately from `requireIdentity` on purpose: that one arrives `false`
+   * by default from `identityFromEnv`, so it cannot also mean "I thought about this".
+   */
+  allowUnsigned?: boolean;
+  /** Maximum JSON-RPC body size. Default: 1 MiB. */
+  maxBodyBytes?: number;
+  /** Time allowed to receive a request. Default: 15 seconds. */
+  requestTimeoutMs?: number;
+}
+
+export interface RunningReceiver {
+  port: number;
+  close(): Promise<void>;
+}
+
+/** What a frond binds when nobody says otherwise. */
+export const LOOPBACK_HOSTS = ['127.0.0.1', 'localhost', '::1'];
+
+export function serve(runner: Transport, options: ServeOptions = {}): Promise<RunningReceiver> {
+  const allowed = options.hosts ?? LOOPBACK_HOSTS;
+  if (allowed.length === 0) {
+    return Promise.reject(new Error('A Fougere receiver needs at least one host to bind, `hosts` is empty'));
+  }
+  const host = options.host ?? allowed[0];
+  // Where a receiver binds, and what it admits, are two questions now. `verify` answers
+  // the second — without it this receiver still takes the `state` it is handed, and
+  // `hosts` is all that stands. The default keeps it on the machine; widening it is
+  // written down rather than inferred, and a widened receiver wants `requireIdentity`.
+  if (!allowed.includes(host)) {
+    return Promise.reject(
+      new Error(`A Fougere receiver binds one of [${allowed.join(', ')}], got '${host}' — add it to \`hosts\` to allow it`),
+    );
+  }
+  /**
+   * Loopback or signed — there is no third way to serve.
+   *
+   * The address already carries the decision: binding beyond loopback is a deliberate
+   * act (`hosts` says so), and a receiver reachable from outside that establishes nothing
+   * takes the `state` it is handed. Refusing at BOOT and not per call is the point — a
+   * receiver that starts and then rejects everything is discovered in production, one
+   * that will not start is discovered at deployment.
+   */
+  if (!LOOPBACK_HOSTS.includes(host) && !options.verify && !options.allowUnsigned) {
+    return Promise.reject(
+      new Error(
+        `A Fougere receiver on '${host}' is reachable from outside this machine and would believe whatever `
+        + 'state it is handed.\n'
+        + '  - `fougere keys` once, then inject FOUGERE_ROOT_KEY here (and `fougere grant <frond>` for each caller), or\n'
+        + '  - keep it on loopback, or\n'
+        + '  - pass `allowUnsigned: true` if a mesh or an ingress already authenticated the caller.',
+      ),
+    );
+  }
+
+  const maxBodyBytes = options.maxBodyBytes ?? MAX_BODY_BYTES;
+  const server = createServer(async (req, res) => {
+    if (req.method !== 'POST' || req.url !== CALL_PATH) {
+      res.writeHead(404).end();
+      return;
+    }
+
+    const chunks: Buffer[] = [];
+    let size = 0;
+    for await (const value of req) {
+      const chunk = Buffer.from(value as Uint8Array);
+      size += chunk.length;
+      if (size > maxBodyBytes) {
+        res.writeHead(413, { 'content-type': 'application/json' }).end(JSON.stringify(tooLarge()));
+        return;
+      }
+      chunks.push(chunk);
+    }
+
+    let response: RpcResponse;
+    try {
+      const raw = JSON.parse(Buffer.concat(chunks).toString('utf8'));
+      response = await handleRpc(runner, raw, options);
+    } catch {
+      response = parseError();
+    }
+    res.writeHead(200, { 'content-type': 'application/json' }).end(JSON.stringify(response));
+  });
+
+  return new Promise((resolve, reject) => {
+    server.once('error', reject);
+    server.requestTimeout = options.requestTimeoutMs ?? 15_000;
+    server.listen(options.port ?? 0, host, () => {
+      const address = server.address();
+      const port = typeof address === 'object' && address !== null ? address.port : 0;
+      resolve({
+        port,
+        close: () => new Promise<void>((done, fail) => server.close((err) => (err ? fail(err) : done()))),
+      });
+    });
+  });
+}

package/src/server.ts

@@ -0,0 +1,108 @@
+/**
+ * Receiving half — unframe the call, run it, frame what comes out.
+ *
+ * Judges nothing: validation and middlewares live with the handler, inside
+ * the runner. The error a façade throws is framed whole, never flattened.
+ */
+import { FougereError, ErrorCode, toPublicError, type InvocationContext, type SignedCall, type Transport } from '@fougere/core/contract';
+import { APP_ERROR, INVALID_REQUEST, type RpcRequest, type RpcResponse } from './jsonrpc.js';
+
+/** What a receiver does with the caller's envelope. */
+export interface ReceiveOptions {
+  /**
+   * Establishes who signed, or throws. Supplied rather than built here for the reason
+   * the sender's `sign` is: verifying is `node:crypto` and this package carries none.
+   * `@fougere/app` wires it from `verifyEnvelope` and the root public key.
+   */
+  verify?: (identity: string, presented: SignedCall) => Promise<{ caller: string; state: Record<string, unknown> }>;
+  /**
+   * Refuse a call carrying no verifiable identity — the whole of "secure by default"
+   * at the wire. Without it a receiver takes the state it is handed and its only
+   * protection is the address it bound.
+   */
+  requireIdentity?: boolean;
+}
+
+export async function handleRpc(runner: Transport, raw: unknown, options: ReceiveOptions = {}): Promise<RpcResponse> {
+  const req = raw as Partial<RpcRequest> | null;
+  const id = typeof req?.id === 'number' || typeof req?.id === 'string' ? req.id : null;
+
+  if (!req || req.jsonrpc !== '2.0' || typeof req.method !== 'string' || id === null) {
+    return { jsonrpc: '2.0', id, error: { code: INVALID_REQUEST, message: 'Invalid JSON-RPC 2.0 request' } };
+  }
+
+  const dot = req.method.indexOf('.');
+  if (dot <= 0 || dot === req.method.length - 1) {
+    return {
+      jsonrpc: '2.0',
+      id,
+      error: { code: INVALID_REQUEST, message: `Invalid method '${req.method}' — expected 'entity.op'` },
+    };
+  }
+  const entity = req.method.slice(0, dot);
+  const op = req.method.slice(dot + 1);
+
+  // Fresh objects — middlewares deposit into state, nothing may be shared.
+  const sent = (req.params ?? {}) as Partial<InvocationContext>;
+
+  /**
+   * State is ESTABLISHED here, or it is only claimed.
+   *
+   * `sent.state` is what the caller typed; a verified envelope is what it can prove, and
+   * when a verifier is wired the envelope REPLACES the claim rather than enriching it —
+   * carrying both would leave every reader downstream choosing between them.
+   */
+  let state: Record<string, unknown> = sent.state ?? {};
+  let caller: string | undefined;
+  if (options.verify && sent.identity) {
+    try {
+      // What ARRIVED, never what we would rather it had been — the comparison is the point.
+      ({ caller, state } = await options.verify(sent.identity, {
+        entity,
+        op,
+        params: sent.params ?? {},
+        query: sent.query ?? {},
+        body: sent.body,
+      }));
+    } catch (err) {
+      return refused(id, (err as Error)?.message ?? 'unverifiable identity', entity, op);
+    }
+  } else if (options.requireIdentity) {
+    return refused(id, 'this receiver takes signed calls only', entity, op);
+  }
+
+  // Built field by field, never spread from `sent`: everything here is either judged
+  // above or carried deliberately, and `caller` is ours to write alone.
+  const invocation: InvocationContext = {
+    params: sent.params ?? {},
+    query: sent.query ?? {},
+    body: sent.body,
+    state,
+    trace: sent.trace,
+    ...(caller ? { caller } : {}),
+  };
+
+  try {
+    return { jsonrpc: '2.0', id, result: await runner({ entity, op }, invocation) };
+  } catch (err) {
+    const failure = err instanceof FougereError
+      ? err
+      : new FougereError({
+          code: ErrorCode.INTERNAL_ERROR,
+          message: (err as Error)?.message ?? 'Internal error',
+          entity,
+          operation: op,
+          cause: err,
+        });
+    const data = toPublicError(failure);
+    return { jsonrpc: '2.0', id, error: { code: APP_ERROR, message: data.message, data } };
+  }
+}
+
+/** An admission refusal, framed like any other failure so a caller reads one vocabulary. */
+function refused(id: string | number, why: string, entity: string, op: string): RpcResponse {
+  const data = toPublicError(
+    new FougereError({ code: ErrorCode.UNAUTHORIZED, message: `Refused: ${why}`, entity, operation: op }),
+  );
+  return { jsonrpc: '2.0', id, error: { code: APP_ERROR, message: data.message, data } };
+}