# webapp

DO-backed fluent web client factory: site-agnostic. Deploy once; instances
are attenuated handles whose **ids are bearer capabilities** — anyone
holding the id string can drive the instance; nobody without it can.
TODO: this proxy-page flow (see diigo-dump README) vs running webapp as
the primary worker (`wrangler dev -c ../webapp/wrangler.jsonc -c ../diigo-dump/wrangler.jsonc`)
so its own port serves the mint form directly; reconsider when the UI
grows past a form or two.

## HTTP surface

- `GET /` — the mint form. Prefill via query string: `?url=…&headers=<urlencoded JSON>&msPerCall=…`; secret header keys (cookie, authorization, proxy-authorization) render **blank** — paste them at mint time; never echoed back.
- `POST /` — mint. Form-encoded (that page) or JSON `{url, headers, msPerCall}` (service-style). Responds `{id}` (and `x-webapp-id`). The id is *not* logged: possession is authority.
- `POST /at/<id>` — drive an instance by capability: JSON `{path?, query?, method?, body?}` → the fluent chain → `{status, text}` (or `{error}`; messages carry no header/param values).

## RPC surface (same-account workers; binding `entrypoint: "WebAppFactory"`)

- `newWebApp({url, headers?, msPerCall?})` → `{id, app}` — the fluent stub;
  promise pipelining makes a whole `pathjoin().query().get()` chain a
  single round trip
- `at(id)` — the fluent stub for a previously-minted instance

## Run

    npx wrangler dev   # → its own ready line (usually :8787 with the
                       # two-config diigo-dump run; standalone, :8788)

Status: typechecks; mint + drive not yet exercised end-to-end (needs the
combined dev run; see ../capsite-checklist.md — it is the single
source for run/connect/deploy instructions).