SSR's page reads

A server-rendered page reads what it shows before it renders, as whoever asked for it. The request is the page's own navigation: it carries no CSRF header, and, followed from a link elsewhere or typed into the address bar, no Origin and no Sec-Fetch-Site: same-origin either, so the resolver above refuses its cookie. requests: 'navigation' reads the cookie of a GET or HEAD without asking for either, as any server-rendered site reads its reader's session for the page they asked for. It refuses it on any other method, on a protocol upgrade (a WebSocket's, which any site may open and read), and on a request the browser marks as no navigation (Sec-Fetch-Mode other than navigate, a script's fetch):

import { pageReader } from 'foldkit-remote-server/fetch'

const resolving = { auth: AppAuth, http, principal }
const reader = pageReader({
  server,
  resolvePrincipal: AuthServer.resolver({ ...resolving, requests: 'navigation' }),
  layer: () => AppAuthLive,
})

It is for that reader alone. pageReader answers reads and refuses every write and live stream, so the checks this drops guard nothing there; given to serveFetch, it would let a page elsewhere post as the reader, so never give it there. examples/auth's src/host.ts serves both from one fetch handler.