@weft-js/start 0.1.0 → 0.1.2

package/src/app.mjs

@@ -8,25 +8,46 @@ import { createBuilder, createServer } from 'vite'
 import { nitro } from 'nitro/vite'
 import weft from '@weft-js/core/vite'
 import { devRunner, devSockets } from './dev-runtime.mjs'
+import { holdsSockets } from './live-target.mjs'
 import weftStart, { startDir } from './vite.mjs'
 
 /** An app with a `channel` or `sharedState`: only those pay for crossws in the server bundle (research 32 §1). */
 function usesSockets(root) {
   const src = join(root, 'src')
   if (!existsSync(src)) return false
-  return readdirSync(src, { recursive: true, withFileTypes: true }).some(f => f.isFile() && /\.[cm]?[jt]sx?$/.test(f.name) && /\b(channel|sharedState)\s*[(<]/.test(readFileSync(join(f.parentPath, f.name), 'utf8')))
+  return readdirSync(src, { recursive: true, withFileTypes: true }).some(
+    (f) =>
+      f.isFile() &&
+      /\.[cm]?[jt]sx?$/.test(f.name) &&
+      /\b(channel|sharedState)\s*[(<]/.test(readFileSync(join(f.parentPath, f.name), 'utf8')),
+  )
 }
 
-function config({ root, site, hydration, preset, port, logLevel, command, nitro: nitroOptions = {} }) {
+function config({
+  root,
+  site,
+  hydration,
+  preset,
+  port,
+  logLevel,
+  command,
+  nitro: nitroOptions = {},
+}) {
   root = resolve(root)
   const sockets = usesSockets(root)
   const runner = devRunner(sockets)
-  const user = ['vite.config.ts', 'vite.config.mts', 'vite.config.js', 'vite.config.mjs'].map(f => join(root, f)).find(existsSync)
+  const user = ['vite.config.ts', 'vite.config.mts', 'vite.config.js', 'vite.config.mjs']
+    .map((f) => join(root, f))
+    .find(existsSync)
   return {
     root,
     configFile: user ?? false,
     logLevel,
     server: { port: port ?? 5173, strictPort: port !== undefined },
+    // A function host can't hold a socket: the page goes straight to SSE, and a channel says `unavailable` (R024)
+    ...(command === 'build' && {
+      define: { __WEFT_SOCKETS__: JSON.stringify(holdsSockets(preset)) },
+    }),
     plugins: [
       weft({ hydratable: true }),
       weftStart({ root, site, hydration }),
@@ -35,7 +56,11 @@ function config({ root, site, hydration, preset, port, logLevel, command, nitro:
         preset,
         // Every app gets this: built assets ship as .br and .gz next to the file, and Nitro picks by Accept-Encoding.
         compressPublicAssets: { gzip: true, brotli: true },
-        ...(site?.headers && { routeRules: Object.fromEntries(Object.entries(site.headers).map(([path, headers]) => [path, { headers }])) }),
+        ...(site?.headers && {
+          routeRules: Object.fromEntries(
+            Object.entries(site.headers).map(([path, headers]) => [path, { headers }]),
+          ),
+        }),
         ...(sockets && { features: { websocket: true } }),
         ...(runner && { devServer: { runner } }),
         // Build mode for share cards (research 20 §4.3): the server lists them and Nitro's prerender writes the PNGs.
@@ -43,23 +68,38 @@ function config({ root, site, hydration, preset, port, logLevel, command, nitro:
         // Prerendered cards are static files at content-addressed URLs: immutable. The rule names each file (a
         // `/_weft/og/**` rule would also override the handler's no-cache for a stale `?v=` on demand). Prerender runs
         // before Nitro bundles the server, so rules added when it is done are in the build. (Dev sends no-store.)
-        ...(command === 'build' && { hooks: immutableCards(), plugins: [fileURLToPath(new URL('./range.mjs', import.meta.url))] }),
+        ...(command === 'build' && {
+          hooks: immutableCards(),
+          plugins: [fileURLToPath(new URL('./range.mjs', import.meta.url))],
+        }),
         // The media route: sharp's addon, and css-tree and csso (under svgo) read JSON from their packages at runtime.
-        ...(existsSync(join(root, '.weft/slots/media.server.ts')) && { traceDeps: ['css-tree*', 'csso*', 'sharp*'] }),
+        ...(existsSync(join(root, '.weft/slots/media.server.ts')) && {
+          traceDeps: ['css-tree*', 'csso*', 'sharp*'],
+        }),
         ...nitroOptions,
       }),
     ],
   }
 }
 
+/** Where the last build's Nitro wrote, known once it prerenders: a preset may move it (netlify serves `dist`). */
+let wrote
+
 function immutableCards() {
   let built
   return {
-    'prerender:generate'(_route, instance) { built = instance },
+    'prerender:generate'(_route, instance) {
+      built = instance
+      const { dir, publicDir } = instance.options.output
+      wrote = publicDir.startsWith(dir) ? dir : publicDir
+    },
     'prerender:done'({ prerenderedRoutes }) {
       if (!built) return
       for (const r of prerenderedRoutes) {
-        if (r.route.startsWith('/_weft/og/') && r.route.endsWith('.png')) built.options.routeRules[r.route] = { headers: { 'cache-control': 'public, max-age=31536000, immutable' } }
+        if (r.route.startsWith('/_weft/og/') && r.route.endsWith('.png'))
+          built.options.routeRules[r.route] = {
+            headers: { 'cache-control': 'public, max-age=31536000, immutable' },
+          }
       }
       built.routing.sync()
     },
@@ -73,10 +113,11 @@ export async function dev(options) {
   return server
 }
 
-/** Build client and server into `.output/` for `preset` (node by default; bun, deno_server…). */
+/** Build client and server for `preset` (node by default; bun, deno_server…), into `.output/` unless the preset moves it. */
 export async function build(options) {
   process.env.WEFT_START_DIR ??= startDir // for the share cards a build draws (og/native.mjs)
   const builder = await createBuilder(config({ ...options, command: 'build' }))
+  wrote = undefined
   await builder.buildApp()
-  return { output: join(resolve(options.root), '.output') }
+  return { output: wrote ?? join(resolve(options.root), '.output') }
 }

package/src/asset-receipt.d.mts

@@ -0,0 +1,13 @@
+import type { AssetReceipt, RouteAssetCosts } from './router'
+
+/** Select only matched levels and union their emitted files for this build. */
+export function selectRouteAssets(
+  receipt: AssetReceipt | null | undefined,
+  build: string | undefined,
+  ids: string[],
+): RouteAssetCosts | null
+/** The costs, if they were measured for this build. */
+export function matchingRouteAssets(
+  costs: RouteAssetCosts | undefined,
+  build: string | null | undefined,
+): RouteAssetCosts | null

package/src/asset-receipt.mjs

@@ -0,0 +1,61 @@
+/**
+ * Select only matched levels and union their emitted files for this build.
+ * @param {import('./router').AssetReceipt | null | undefined} receipt
+ * @param {string | undefined} build
+ * @param {string[]} ids
+ * @returns {import('./router').RouteAssetCosts | null}
+ */
+export function selectRouteAssets(receipt, build, ids) {
+  if (
+    !build ||
+    !receipt ||
+    receipt.build !== build ||
+    receipt.version !== 1 ||
+    receipt.scope !== 'vite-static-closure' ||
+    !receipt.routes ||
+    !receipt.files ||
+    !ids.length
+  )
+    return null
+  const levels = ids.map((id) => ({
+    id,
+    entry: Object.hasOwn(receipt.routes, id) ? receipt.routes[id] : null,
+  }))
+  const union = (entries) => {
+    const names = new Set()
+    for (const entry of entries) {
+      if (
+        !entry ||
+        !Array.isArray(entry.files) ||
+        typeof entry.bytes !== 'number' ||
+        !Number.isSafeInteger(entry.bytes) ||
+        entry.bytes < 0
+      )
+        return null
+      for (const file of entry.files) names.add(file)
+    }
+    let total = 0
+    for (const file of names) {
+      const bytes = Object.hasOwn(receipt.files, file) ? receipt.files[file]?.bytes : null
+      if (typeof bytes !== 'number' || !Number.isSafeInteger(bytes) || bytes < 0) return null
+      total += bytes
+      if (!Number.isSafeInteger(total)) return null
+    }
+    return total
+  }
+  return {
+    build,
+    scope: receipt.scope,
+    levels: levels.map(({ id, entry }) => ({ id, bytes: union([entry]) })),
+    routeBytes: union(levels.map(({ entry }) => entry)),
+    eagerBytes: union([receipt.eager]),
+    combinedBytes: union([...levels.map(({ entry }) => entry), receipt.eager]),
+  }
+}
+
+/** @param {import('./router').RouteAssetCosts | undefined} costs
+ * @param {string | null | undefined} build
+ * @returns {import('./router').RouteAssetCosts | null} */
+export function matchingRouteAssets(costs, build) {
+  return costs?.build && costs.build === build ? costs : null
+}

package/src/auth/better-auth.ts

@@ -1,12 +1,99 @@
 // Better Auth as weft's default auth provider (research 28 §3, 34 §5). `src/auth.server.ts` default-exports `createAuth(…)`.
 // No client code: sign-in is a mutation, so nothing of Better Auth ships to the browser.
 
-import { betterAuth, type BetterAuthOptions } from 'better-auth'
-import { CLIENT_IP, StartError } from '../data'
+import { betterAuth, type BetterAuthOptions, type BetterAuthPlugin } from 'better-auth'
+import { createAuthMiddleware } from 'better-auth/api'
+import { expireCookie } from 'better-auth/cookies'
+import { jwt, type JwtOptions } from 'better-auth/plugins/jwt'
+import { CLIENT_IP, currentScope, fnOf, StartError } from '../data'
 import type { DbHandle } from '../db/core'
 
 const SESSION = /(?:^|;\s*)(?:__Secure-)?[\w.-]*session_token=/
-const buildSecret = () => Array.from(crypto.getRandomValues(new Uint8Array(32)), x => x.toString(16).padStart(2, '0')).join('')
+const BEARER = /^Bearer\s+(\S+)$/i
+const CHUNK = /^(?:__Secure-)?[\w.-]*session_data\.\d+=/
+/** A socket or stream keeps its `ctx` past this request, and an extension's route is its own, so they never read the cache. */
+const HELD = /^\/_weft\/(rt|ws|x\/)/
+const FN = '/_weft/fn/'
+const ANONYMOUS = { user: null, session: null }
+const TABLES = ['user', 'session', 'account', 'verification', 'jwks']
+
+/** A cache too big for one cookie is no cache: that session just reads the database. An expired chunk still goes out. */
+const oversized = (line: string) =>
+  CHUNK.test(line) && !/max-age=0/i.test(line) && !/^[^=]+=;/.test(line)
+
+/** Better Auth's own routes follow the rule `session()` does: only reading who you are can answer from the cache. */
+const cacheRules: BetterAuthPlugin = {
+  id: 'weft-session-cache',
+  hooks: {
+    // `/token` above all: a revoked session mustn't mint a 15-minute token from a cookie it still holds.
+    before: [
+      {
+        matcher: (c) => c.path !== '/get-session',
+        handler: createAuthMiddleware((c) =>
+          Promise.resolve({ context: { query: { ...c.query, disableCookieCache: true } } }),
+        ),
+      },
+    ],
+    // With `revokeOtherSessions` this response already carries the new session's cookies.
+    after: [
+      {
+        matcher: (c) => c.path === '/change-password',
+        handler: createAuthMiddleware((c) =>
+          Promise.resolve(
+            void (c.context.newSession || expireCookie(c, c.context.authCookies.sessionData)),
+          ),
+        ),
+      },
+      // Chunks go on every request after this one: a big enough user would pass the server's header limit and be locked out with 431s.
+      {
+        matcher: () => true,
+        handler: createAuthMiddleware((c) => {
+          const out = (c.context as { responseHeaders?: Headers }).responseHeaders
+          const all = out?.getSetCookie() ?? []
+          if (out && all.some(oversized)) {
+            out.delete('set-cookie')
+            for (const line of all) if (!oversized(line)) out.append('set-cookie', line)
+          }
+          return Promise.resolve()
+        }),
+      },
+    ],
+  },
+}
+
+/** `createAuth({ api })`: Better Auth's `jwt` options, and which server functions take a bearer token. */
+export interface ApiAccess extends JwtOptions {
+  /** The server functions a bearer token may call, as a function so this module needn't load them first. No others read it. */
+  functions?: () => unknown[]
+}
+type Found = NonNullable<
+  Awaited<ReturnType<ReturnType<typeof betterAuth<BetterAuthOptions>>['api']['getSession']>>
+>
+type Session = { user: Found['user'] | null; session: Found['session'] | null }
+/** What a token of ours carries: Better Auth's claims, the session it came from, and the user's fields. */
+type Claims = {
+  sub: string
+  sid: string
+  iss?: string
+  aud?: string | string[]
+  exp?: number
+  iat?: number
+} & Record<string, unknown>
+/** The calls made here. The `jwt` plugin is optional, so `verifyJWT` isn't in the instance's own type. */
+interface Methods {
+  verifyJWT(input: { body: { token: string } }): Promise<{ payload: Claims | null }>
+  getSession(input: {
+    headers: Headers
+    returnHeaders: true
+    query?: { disableCookieCache: boolean }
+  }): Promise<{ headers: Headers; response: Found | null }>
+}
+type Signed = Parameters<NonNullable<NonNullable<JwtOptions['jwt']>['definePayload']>>[0]
+
+const buildSecret = () =>
+  Array.from(crypto.getRandomValues(new Uint8Array(32)), (x) =>
+    x.toString(16).padStart(2, '0'),
+  ).join('')
 
 /** `createAuth`: the database, the secret, and any Better Auth option on top. */
 export interface AuthOptions<S extends Record<string, unknown>, O extends BetterAuthOptions> {
@@ -14,16 +101,102 @@ export interface AuthOptions<S extends Record<string, unknown>, O extends Better
   /** The tables, Better Auth's included, for a data layer that needs them. */
   schema?: S
   /** 32+ characters (A001 in production). */
-  secret?: string
+  secret?: string | undefined
   /** The rest of Better Auth's options; they win over the defaults here. */
   options?: O
+  /** Short-lived JWTs for other services and API clients, with a public JWKS: Better Auth's `jwt` options. `false` turns it off. */
+  api?: ApiAccess | false
 }
 
-/** A Better Auth instance with Weft's defaults, on the store `options.database` names. */
-export function createAuth<S extends Record<string, unknown>, const O extends BetterAuthOptions = {}>({ db, secret, options }: AuthOptions<S, O>) {
+function sessionReader(
+  auth: {
+    $context: Promise<{
+      internalAdapter: {
+        listSessions(
+          user: string,
+          options: { onlyActiveSessions: boolean },
+        ): Promise<{ id: string }[]>
+      }
+    }>
+  },
+  methods: Methods,
+  claims: { issuer?: string | undefined; audience?: string | string[] | undefined },
+  functions: (() => unknown[]) | undefined,
+  api: ApiAccess | false | undefined,
+) {
+  /** Who a token says, for a function that takes one. A write also needs the session behind it to still be there. */
+  async function bearer(token: string, read: boolean): Promise<Session> {
+    // Unchecked, Better Auth would skip `iss` and `aud`: with no URL configured, no token is good.
+    if (!claims.issuer || !claims.audience) return ANONYMOUS
+    const { payload } = await methods.verifyJWT({ body: { token } })
+    if (!payload) return ANONYMOUS
+    if (!read) {
+      const live = await (
+        await auth.$context
+      ).internalAdapter.listSessions(payload.sub, { onlyActiveSessions: true })
+      if (!live.some((s) => s.id === payload.sid)) return ANONYMOUS
+    }
+    const { iss: _iss, aud: _aud, exp: _exp, iat: _iat, sub, sid: _sid, ...user } = payload
+    return { user: { ...user, id: sub } as unknown as Found['user'], session: null }
+  }
+
+  const marked = (pathname: string) => {
+    if (!functions || !pathname.startsWith(FN)) return false
+    const id = pathname.slice(FN.length)
+    return functions().some((f) => encodeURIComponent((fnOf(f) as { $id: string }).$id) === id)
+  }
+
+  return async function session(request: Request): Promise<Session> {
+    const read = request.method === 'GET' || request.method === 'HEAD'
+    const { pathname } = new URL(request.url)
+    const token = request.headers.get('authorization')?.match(BEARER)?.[1]
+    if (token && api !== false && marked(pathname)) return bearer(token, read)
+    if (!SESSION.test(request.headers.get('cookie') ?? '')) return ANONYMOUS
+    const { headers, response: s } = await methods.getSession({
+      headers: request.headers,
+      returnHeaders: true,
+      ...(!(read && !HELD.test(pathname)) && { query: { disableCookieCache: true } }),
+    })
+    // A fresh cache cookie, a slid expiry or a dead session's removal. Not `forward`: who's signed in hasn't changed.
+    // A socket's re-check runs inside whichever request poked it, and its cookies are that socket's, not this response's.
+    const scope = currentScope() as { request?: Request; headers?: Headers } | undefined
+    if (scope?.headers && scope.request === request)
+      for (const c of headers.getSetCookie()) scope.headers.append('set-cookie', c)
+    return { user: s?.user ?? null, session: s?.session ?? null }
+  }
+}
+
+function requireStore(db: { $weft: DbHandle }, options: BetterAuthOptions | undefined) {
   const handle = db.$weft
-  if (options?.database) for (const name of ['user', 'session', 'account', 'verification']) handle.exempt.add(name)
-  else throw new StartError('A005', 'Better Auth has no store', 'pass `options.database`: `drizzleAuth(db, schema)` from @weft-js/start/auth/drizzle, or your data layer\'s adapter')
+  if (options?.database) for (const name of TABLES) handle.exempt.add(name)
+  else
+    throw new StartError(
+      'A005',
+      'Better Auth has no store',
+      "pass `options.database`: `drizzleAuth(db, schema)` from @weft-js/start/auth/drizzle, or your data layer's adapter",
+    )
+}
+
+/** A Better Auth instance with Weft's defaults, on the store `options.database` names. */
+export function createAuth<
+  S extends Record<string, unknown>,
+  const O extends BetterAuthOptions = {},
+>({ db, secret, options, api }: AuthOptions<S, O>) {
+  requireStore(db, options)
+  const { functions, ...access } = api || {}
+  const origin =
+    typeof options?.baseURL === 'string' ? options.baseURL : process.env.BETTER_AUTH_URL
+  const claims = {
+    expirationTime: '15m',
+    issuer: origin,
+    audience: origin,
+    ...access.jwt,
+    // Which session a token came from, so a write can ask whether it still exists.
+    definePayload: async (s: Signed) => ({
+      ...((await access.jwt?.definePayload?.(s)) ?? s.user),
+      sid: s.session.id,
+    }),
+  }
   const auth = betterAuth({
     // A build loads this module with no environment, and in production Better Auth refuses to start without a secret: the
     // build gets one of its own, since nothing it makes is signed. A server still needs the real one (A001).
@@ -33,26 +206,51 @@ export function createAuth<S extends Record<string, unknown>, const O extends Be
     telemetry: { enabled: false },
     emailAndPassword: { enabled: true },
     ...options,
+    // Login stays an opaque token in the database. This only spares reads of it, for a window: see `session()`.
+    session: {
+      ...options?.session,
+      cookieCache: {
+        enabled: true,
+        maxAge: 300,
+        strategy: 'compact',
+        ...options?.session?.cookieCache,
+      },
+    },
+    // Signing a JWT on every session read would put a query back on each page, and login has no use for one.
+    plugins: [
+      ...(options?.plugins ?? []),
+      cacheRules,
+      ...(api === false ? [] : [jwt({ ...access, jwt: claims, disableSettingJwtHeader: true })]),
+    ],
     // The server stamps this header from the socket (server.tsx), so rate limits aren't one bucket for everyone.
     // Its schema check runs when this module loads. On Kysely that connects, in a build, and before a fresh database has
     // had weft's migrations. Q014 covers a schema that doesn't match, so it's off unless you turn it on.
-    advanced: { ...options?.advanced, database: { validateSchema: false, ...options?.advanced?.database }, ipAddress: { ipAddressHeaders: [CLIENT_IP], ...options?.advanced?.ipAddress } },
+    advanced: {
+      ...options?.advanced,
+      database: { validateSchema: false, ...options?.advanced?.database },
+      ipAddress: { ipAddressHeaders: [CLIENT_IP], ...options?.advanced?.ipAddress },
+    },
   })
+  const methods = auth.api as unknown as Methods
+
   return Object.assign(auth, {
     basePath: options?.basePath,
-    /** With no session cookie it's `null` without a query, so anonymous pages don't touch the database. */
-    async session(request: Request) {
-      if (!SESSION.test(request.headers.get('cookie') ?? '')) return { user: null, session: null }
-      const s = await (auth as unknown as ReturnType<typeof betterAuth<BetterAuthOptions>>).api.getSession({ headers: request.headers })
-      return { user: s?.user ?? null, session: s?.session ?? null }
-    },
+    /**
+     * With no session cookie it's `null` without a query, so anonymous pages don't touch the database. A page or query
+     * reads the signed cookie cache; a mutation (not GET) and anything that outlives the request read the database, so a
+     * revoked session may be shown a page for the cache's window but can't write.
+     */
+    session: sessionReader(auth, methods, claims, functions, api),
     $weft: {
       /** On the first request (never in a build, which holds no secrets). */
       check() {
         if (process.env.NODE_ENV === 'production' && (secret?.length ?? 0) < 32)
-          throw new StartError('A001', 'the auth secret is missing or under 32 characters', 'set `BETTER_AUTH_SECRET` (`openssl rand -base64 32`) in the server\'s environment')
+          throw new StartError(
+            'A001',
+            'the auth secret is missing or under 32 characters',
+            "set `BETTER_AUTH_SECRET` (`openssl rand -base64 32`) in the server's environment",
+          )
       },
     },
   })
 }
-

package/src/auth/drizzle.ts

@@ -9,7 +9,7 @@ const PROVIDER = { sqlite: 'sqlite', postgresql: 'pg', mysql: 'mysql' } as const
 
 /** Better Auth's store on a Weft database, for `createAuth`'s `options.database`. */
 export function drizzleAuth(db: { $weft: DbHandle }, schema?: Record<string, unknown>) {
-  for (const name of ['user', 'session', 'account', 'verification']) {
+  for (const name of ['user', 'session', 'account', 'verification', 'jwks']) {
     const t = schema?.[name]
     if (isTable(t)) db.$weft.exempt.add(getTableName(t))
   }

package/src/auth.ts

@@ -8,10 +8,13 @@ import { FnError, type Context } from './data'
 export interface AuthProvider<U = unknown, S = unknown> {
   /** Serves everything under `basePath`. */
   handler(request: Request): Promise<Response> | Response
-  /** Who this request is. Anonymous is `{ user: null, session: null }`, and should cost no query. */
+  /**
+   * Who this request is. Anonymous is `{ user: null, session: null }`, and should cost no query. A provider that caches
+   * sessions may answer a GET from the cache, and must ask its store for any other method: that's what a mutation runs on.
+   */
   session(request: Request): Promise<{ user: U | null; session: S | null }>
   /** Where `handler` is mounted (default `/api/auth`). */
-  basePath?: string
+  basePath?: string | undefined
   $weft?: {
     /** On the first request, never in a build: throw for a server that can't run safely. */
     check(): void
@@ -24,7 +27,10 @@ export function defineAuth<U, S>(provider: AuthProvider<U, S>): AuthProvider<U,
 }
 
 /** `{ user, session }` for `ctx` (`src/context.server.ts`), from any provider. */
-export const session = <A extends { session(request: Request): unknown }>(auth: A, request: Request): ReturnType<A['session']> => auth.session(request) as ReturnType<A['session']>
+export const session = <A extends { session(request: Request): unknown }>(
+  auth: A,
+  request: Request,
+): ReturnType<A['session']> => auth.session(request) as ReturnType<A['session']>
 
 const changed = new WeakSet<Headers>()
 
@@ -35,13 +41,22 @@ export const sessionChanged = (headers: Headers) => changed.has(headers)
  * Finish a provider's Response (Better Auth's with `asResponse: true`): its cookies go on this response, so a redirect
  * after it is a full load, and a failure rejects with the provider's message (`e.message` on the client).
  */
-export async function forward<T = unknown>(ctx: Context, call: Response | Promise<Response>): Promise<T> {
+export async function forward<T = unknown>(
+  ctx: Context,
+  call: Response | Promise<Response>,
+): Promise<T> {
   const res = await call
   for (const c of res.headers.getSetCookie()) {
     ctx.response.headers.append('set-cookie', c)
     changed.add(ctx.response.headers)
   }
-  const body = await res.json().catch(() => null) as (T & { code?: string; message?: string }) | null
-  if (!res.ok) throw new FnError({ ...(body?.code && { code: body.code }), message: body?.message ?? 'Authentication failed' }, res.status)
+  const body = (await res.json().catch(() => null)) as
+    | (T & { code?: string; message?: string })
+    | null
+  if (!res.ok)
+    throw new FnError(
+      { ...(body?.code && { code: body.code }), message: body?.message ?? 'Authentication failed' },
+      res.status,
+    )
   return body as T
 }

package/src/boot.ts

@@ -3,7 +3,15 @@
 // less data gets it on interaction only. `#weft-route` and the islands' comments are read by `start()` once it's here.
 
 /** What the inline script left on `window`: the queue, and how to play or wake it. */
-export interface Held { q: unknown[]; p: (held: unknown) => void; w?: (k: Element, lead?: 1) => void; r?: 1; n?: unknown; l?: Element; d?: unknown }
+export interface Held {
+  q: unknown[]
+  p: (held: unknown) => void
+  w?: (k: Element, lead?: 1) => void
+  r?: 1
+  n?: unknown
+  l?: Element
+  d?: unknown
+}
 
 export function boot(full: () => Promise<unknown>) {
   const q = (window as Window & { __wq?: Held }).__wq
@@ -26,13 +34,16 @@ export function boot(full: () => Promise<unknown>) {
   if (q.d) return
   const first = new WeakSet<Element>()
   const needs = new WeakSet<Element>()
-  io = new IntersectionObserver(list => {
-    for (const e of list) {
-      const was = first.has(e.target)
-      first.add(e.target)
-      if (e.isIntersecting && (was || needs.has(e.target))) return go()
-    }
-  }, { rootMargin: '600px' })
+  io = new IntersectionObserver(
+    (list) => {
+      for (const e of list) {
+        const was = first.has(e.target)
+        first.add(e.target)
+        if (e.isIntersecting && (was || needs.has(e.target))) return go()
+      }
+    },
+    { rootMargin: '600px' },
+  )
   const w = document.createTreeWalker(document.body, 128)
   while (w.nextNode()) {
     const c = w.currentNode as Comment

package/src/bus/postgres.ts

@@ -16,11 +16,23 @@ const CHANNEL = 'weft_bus'
 const WHOLE = 7_900
 const CHUNK = 7_800
 
+function delivery(listeners: Map<string, Set<(message: string) => void>>) {
+  return (text: string) => {
+    const at = text.indexOf('\n')
+    const list = listeners.get(text.slice(0, at))
+    if (list) for (const on of list) on(text.slice(at + 1))
+  }
+}
+
 /** A bus on Postgres NOTIFY, for several instances with no broker beside the database. */
 export function postgresBus({ url }: PostgresBusOptions): Bus {
   if (!url && process.env.WEFT_BUILD) url = 'postgres://localhost/build' // a build loads this module and never connects
   if (!/^postgres(ql)?:\/\//.test(url ?? ''))
-    throw new StartError('Q013', `\`postgresBus\` needs a \`postgres://\` URL, not \`${(url ?? '').replace(/\/\/.*@/, '//…@')}\``, 'set `DATABASE_URL`, or leave `bus` out for the memory bus on one instance')
+    throw new StartError(
+      'Q013',
+      `\`postgresBus\` needs a \`postgres://\` URL, not \`${(url ?? '').replace(/\/\/.*@/, '//…@')}\``,
+      'set `DATABASE_URL`, or leave `bus` out for the memory bus on one instance',
+    )
   let sql: ReturnType<typeof postgres> | undefined
   const client = () => (sql ??= postgres(url, { max: 2, idle_timeout: 20, onnotice: () => {} }))
   const listeners = new Map<string, Set<(message: string) => void>>()
@@ -29,15 +41,12 @@ export function postgresBus({ url }: PostgresBusOptions): Bus {
   let listening: Promise<unknown> | undefined
   let connected = false
 
-  const deliver = (text: string) => {
-    const at = text.indexOf('\n')
-    const list = listeners.get(text.slice(0, at))
-    if (list) for (const on of list) on(text.slice(at + 1))
-  }
+  const deliver = delivery(listeners)
   const received = (payload: string) => {
     if (payload[0] === '=') return deliver(payload.slice(1))
     const [id, i, n, body] = payload.slice(1).split(':')
-    if (id === undefined || i === undefined || n === undefined || body === undefined) return undefined
+    if (id === undefined || i === undefined || n === undefined || body === undefined)
+      return undefined
     const got = parts.get(id) ?? []
     got[+i] = body
     parts.set(id, got)
@@ -46,16 +55,19 @@ export function postgresBus({ url }: PostgresBusOptions): Bus {
     deliver(Buffer.from(got.join(''), 'base64').toString())
   }
   /** `onlisten` runs on every (re)connect: after the first, whatever was published meanwhile is gone. */
-  const listen = () => (listening ??= client().listen(CHANNEL, received, () => {
-    if (connected) {
-      parts.clear()
-      for (const gap of gaps) gap()
-    }
-    connected = true
-  }).catch(e => {
-    listening = undefined // the next subscribe tries again
-    throw e
-  }))
+  const listen = () =>
+    (listening ??= client()
+      .listen(CHANNEL, received, () => {
+        if (connected) {
+          parts.clear()
+          for (const gap of gaps) gap()
+        }
+        connected = true
+      })
+      .catch((e) => {
+        listening = undefined // the next subscribe tries again
+        throw e
+      }))
 
   return {
     name: 'postgres',
@@ -65,8 +77,9 @@ export function postgresBus({ url }: PostgresBusOptions): Bus {
       const b64 = Buffer.from(text).toString('base64')
       const id = crypto.randomUUID()
       const n = Math.ceil(b64.length / CHUNK)
-      await client().begin(async tx => {
-        for (let i = 0; i < n; i++) await tx`select pg_notify(${CHANNEL}, ${`+${id}:${i}:${n}:${b64.slice(i * CHUNK, (i + 1) * CHUNK)}`})`
+      await client().begin(async (tx) => {
+        for (let i = 0; i < n; i++)
+          await tx`select pg_notify(${CHANNEL}, ${`+${id}:${i}:${n}:${b64.slice(i * CHUNK, (i + 1) * CHUNK)}`})`
       })
     },
     async subscribe(channel, on, gap) {