Full-stack beta

Install one exact beta graph

G2 is public in the coordinated 0.4.0-beta.1 graph. Pin pliego-data, pliego-router, pliego-runtime, and every other pliego-* dependency to that exact version and treat them as one indivisible application contract.

[dependencies]
pliego-data = "=0.4.0-beta.1"
pliego-router = "=0.4.0-beta.1"
pliego-runtime = "=0.4.0-beta.1"

Seal data authority before serving

pliego-data registers typed resources and capabilities before NativeRuntime seals the route, loader, action, cache, and invalidation graph. A declaration is not authority: route grants, provider capabilities, action or loader requirements, and operator policy must intersect before a lease is issued.

DataContext

Admitted values, deadline, cancellation, cleanup, grants, and redacted receipts

LoaderPolicy

Typed input/output schemas, immutable bounded output, resources, and request-local deduplication

ActionPolicy

Strict input, auth hooks, commit state, idempotency, invalidation intent, and navigation

Runtime contract

Canonical route, resource, loader, action, cache, and invalidation projection with one SHA-256

Keep the mutation useful without JavaScript

The reference login and account mutation are ordinary HTML forms. The same action policy admits form, JSON, gzip, or multipart only when explicitly configured; it validates Origin, session-bound CSRF, authentication, application authorization, unknown fields, encoded and decoded bytes, and output before application code receives typed input.

Idempotency

Binds key, action revision, principal partition, admitted input, and deployment epoch

Commit

Distinguishes no commit, committing, committed, outcome unknown, and compensation required

Uploads

Bounds fields, parts, filenames, files, total temporary storage, decoding, and cleanup

Failures

Returns typed accessible 422 errors, 403 CSRF rejection, or 409 idempotency conflict

Separate identity from cache authority

Opaque server-side sessions rotate at login, reject schema skew and expiry, and revoke through the configured store. Session claims identify a principal; application authorization still runs next to protected resources. Cache policies independently declare public, private-request, or private-session domains, exact Vary, structured partitions, freshness, bounds, compatibility epoch, and fill behavior.

Inspect contracts and receipts

cargo run -p fullstack-pliego -- contract .pliego/runtime-contract.json
cargo run -p pliego-cli -- inspect action rename-account --contract .pliego/runtime-contract.json
cargo run -p pliego-cli -- why request runtime-receipt.json
cargo run -p pliego-cli -- why cache cache-receipt.json

Diagnostic inputs are bounded, versioned, and contract-checked. Explanations show stable policy identity, coarse outcome, commit and acknowledgement state, and digests while excluding bodies, claims, identities, raw cache keys, values, and secrets.