@fougere/core 0.12.2-alpha.0 → 0.12.4-alpha.0

package/src/EffectiveOperationModel.ts

@@ -21,6 +21,9 @@ import type { EffectiveOperationOptions } from './EffectiveOperationOptions.js';
 
 type Binding = BindingPlan[number];
 
+/** A contract whose parameters are all bound. */
+type BoundContract = OperationContract & { binding: BindingPlan };
+
 /**
  * Where an op's work goes: the fronds its handler reaches, and how many are a process away.
  *
@@ -47,26 +50,30 @@ function reachOf(
  * boot never has to find a handler again by an order-dependent name lookup.
  */
 export class EffectiveOperationModel {
-  readonly operations: EffectiveOperation[];
-  readonly diagnostics: Diagnostic[];
-  readonly resolutionDiagnostics: Diagnostic[];
-
   constructor(
-    operations: EffectiveOperation[],
-    diagnostics: Diagnostic[],
-    resolutionDiagnostics: Diagnostic[],
+    readonly operations: EffectiveOperation[],
+    readonly diagnostics: Diagnostic[],
+    readonly resolutionDiagnostics: Diagnostic[],
     private readonly byHandler: Map<HandlerEntry, EffectiveOperationsMap>,
-  ) {
-    this.operations = operations;
-    this.diagnostics = diagnostics;
-    this.resolutionDiagnostics = resolutionDiagnostics;
-  }
+  ) {}
 
   forHandler(handler: HandlerEntry): EffectiveOperationsMap {
     return this.byHandler.get(handler) ?? new Map();
   }
 }
 
+/** What one handler's operations are resolved against. */
+interface Resolving {
+  fronds: readonly FrondDescriptor[];
+  frond: FrondDescriptor;
+  handler: HandlerEntry;
+  schemas: Map<string, SchemaView>;
+  served: Map<string, string>;
+  collectorsByType: Map<string, CollectorEntry[]>;
+  options: EffectiveOperationOptions;
+  diagnostics: Diagnostic[];
+}
+
 /** Resolve the complete operation model without starting the application. */
 export function resolveEffectiveOperations(
   fronds: readonly FrondDescriptor[],
@@ -74,214 +81,40 @@ export function resolveEffectiveOperations(
 ): EffectiveOperationModel {
   const operations: EffectiveOperation[] = [];
   const byHandler = new Map<HandlerEntry, EffectiveOperationsMap>();
-  const resolutionDiagnostics: Diagnostic[] = [];
   const scanDiagnostics = [...(options.diagnostics ?? [])];
   const schemas = new Map(
     fronds.flatMap((frond) => frond.entities.map((entity) => [entity.name, entity.entityClass] as const)),
   );
-  /** Every address a frond answers, so a dependency naming one is read as the crossing it is. */
   const served = servedBy(fronds);
 
-  // Input ambiguity is produced where schemas are available (the scanner), but it is a
-  // resolution failure. Lift it into the same refusal table as kind/binding/topology.
-  resolutionDiagnostics.push(...scanDiagnostics.filter((diagnostic) =>
-    diagnostic.code === 'input-contract-ambiguous'));
+  // Input ambiguity is found by the scanner, where schemas are, but it is a resolution failure.
+  const diagnostics = scanDiagnostics.filter((diagnostic) => diagnostic.code === 'input-contract-ambiguous');
 
   for (const frond of fronds) {
     const collectorsByType = groupedCollectors(frond.collectors);
-    for (const [typeName, collectors] of collectorsByType) {
-      if (collectors.length < 2) continue;
-      resolutionDiagnostics.push({
-        severity: 'blocking',
-        code: 'collector-ambiguous',
-        filePath: collectors[0]!.filePath,
-        frond: frond.name,
-        subject: typeName,
-        message: `Frond '${frond.name}' declares ${collectors.length} collectors for '${typeName}' — `
-          + `${collectors.map((collector) => collector.ctor.name).sort().join(', ')}. `
-          + 'Exactly one collector must own a parameter type.',
-      });
-    }
+    refuseAmbiguousCollectors(frond, collectorsByType, diagnostics);
 
     const collectorNames = new Set(frond.collectors.map((collector) => collector.typeName));
     for (const handler of frond.handlers) {
       const effective = new Map<string, EffectiveOperation>();
       byHandler.set(handler, effective);
       const contracts = resolveContracts(handler, frond.operationsOverrides, collectorNames);
-      // A statement wins over the scan on purpose; saying so out loud is what keeps the
-      // win from hiding a rename. Compared here, where both readings are in hand.
-      resolutionDiagnostics.push(...statementDrift(frond, handler));
-      resolutionDiagnostics.push(...unansweredOperations(frond, handler, contracts.keys()));
-
-      for (const [name, rawContract] of contracts) {
-        const subject = `${handler.ctor.name}.${name}`;
-        const contract = normalizeBinding(rawContract, handler, frond, name, resolutionDiagnostics);
-        if (!contract) continue;
-
-        // An operation answers DATA — what JSON keeps. A DECLARED output is converted by its
-        // fields, so `created()` leaves as an ISO string and nothing is asked of it here; an
-        // undeclared one has nothing to convert it, so it must already be data. Measured
-        // 2026-09-18: `{ at: new Date(0) }` reaches a local caller as a `Date` and a remote one
-        // as a string, and an object carrying methods loses them on both sides, differently.
-        if (!contract.output && contract.signature?.notData) {
-          resolutionDiagnostics.push({
-            severity: 'blocking',
-            code: 'operation-output-not-data',
-            filePath: handler.filePath,
-            frond: frond.name,
-            subject,
-            message: `${subject}() answers ${contract.signature.notData}, which carries methods.\n`
-              + '  An operation answers data — what JSON keeps.\n'
-              + '  Declare the output as an entity, whose fields convert it, or answer what it produces.',
-          });
-          continue;
-        }
-
-        const override = frond.operationsOverrides?.[name];
-        const inference = inferOperationKind(name);
-        const inferredKinds = new Set<OperationKind>();
-        if (inference.kind) inferredKinds.add(inference.kind);
-        if (inference.queryMatches.length > 0) inferredKinds.add('query');
-        if (inference.commandMatches.length > 0) inferredKinds.add('command');
-        const kind = override?.kind
-          ?? (inferredKinds.size === 1 ? [...inferredKinds][0] : undefined);
-        if (!kind) {
-          const ambiguous = inferredKinds.size > 1;
-          resolutionDiagnostics.push({
-            severity: 'blocking',
-            code: ambiguous ? 'operation-kind-ambiguous' : 'operation-kind-unknown',
-            filePath: handler.filePath,
-            frond: frond.name,
-            subject,
-            message: ambiguous
-              ? `Cannot resolve the kind of ${subject}: its name carries query evidence `
-                + `(${inference.queryMatches.join(', ')}) and command evidence `
-                + `(${inference.commandMatches.join(', ')}). `
-                + `Declare operations.${name}.kind.`
-              : `Cannot resolve the kind of ${subject}: '${name}' leads with no known verb. `
-                + `Rename it to lead with one, or declare operations.${name}.kind in `
-                + `frond.config.ts.\n  query:   ${knownVerbs().query.join(', ')}`
-                + `\n  command: ${knownVerbs().command.join(', ')}`,
-          });
-          continue;
-        }
-
-        const implementation = implementationOf(frond, handler, name, resolutionDiagnostics);
-        if (!implementation) continue;
-
-        const params = contract.signature?.params ?? [];
-        const parameters = contract.binding.map((binding, position) => {
-          const param = params[position];
-          const undefinable = binding.optional
-            || param?.optional === true
-            || param?.type.undefined === true;
-
-          return {
-            position,
-            name: param?.name ?? binding.name,
-            type: param?.type.raw ?? null,
-            optional: undefinable,
-            nullable: param?.type.nullable === true,
-            undefinable,
-            binding,
-          } satisfies EffectiveParameter;
-        });
-
-        if (!validateProvenance(
-          fronds,
-          frond,
-          handler,
-          name,
-          contract,
-          parameters,
-          collectorsByType,
-          resolutionDiagnostics,
-        )) continue;
-
-        // A fact is validated by the entity it names. This used to be patched into the
-        // facade after resolution, leaving check/explain with a different input.
-        const announced = contract.binding.find((binding) =>
-          binding.source.kind === 'fact' || binding.source.kind === 'pipe');
-        const fact = announced?.source.kind === 'fact' || announced?.source.kind === 'pipe'
-          ? schemas.get(announced.source.factName)
-          : undefined;
-        const input = contract.input ?? fact;
-
-        // An op that FINISHES a fact answers the fact, so its answer is the fact's shape:
-        // derived here, where its input already is. Left to the ordinary projection it
-        // came back stripped — measured, the subscriber got a value with no `id`.
-        const output = announced?.source.kind === 'pipe' && fact
-          ? { schema: fact, closed: false }
-          : effectiveOutput(frond, handler, name, contract);
-        const className = handler.ctor.name.endsWith('Handler')
-          ? handler.ctor.name.slice(0, -'Handler'.length)
-          : handler.ctor.name;
-        const surface = handler.surface ? `/${handler.surface}` : '/default';
-        const remote = options.remotes?.[frond.name];
-        const op: EffectiveOperation = {
-          ...contract,
-          ...(input ? { input } : {}),
-          ...(output.schema ? { output: output.schema } : {}),
-          id: `${frond.name}${surface}/${className}.${name}`,
-          operation: `${className}.${name}`,
-          name,
-          kind,
-          kindSource: override?.kind
-            ? 'explicit'
-            : 'convention',
-          handler: {
-            className: handler.ctor.name,
-            address: handler.address,
-            filePath: handler.filePath,
-          },
-          implementation,
-          binding: contract.binding,
-          parameters,
-          collectors: parameters.flatMap((parameter) => {
-            if (parameter.binding.source.kind !== 'collector') return [];
-            const collector = collectorsByType.get(parameter.binding.source.typeName)?.[0];
-
-            return collector ? [{
-              parameter: parameter.name,
-              typeName: collector.typeName,
-              className: collector.ctor.name,
-              frond: frond.name,
-              filePath: collector.filePath,
-            }] : [];
-          }),
-          contexts: parameters
-            .filter((parameter) => parameter.binding.source.kind === 'context')
-            .map((parameter) => parameter.name),
-          placement: {
-            frond: frond.name,
-            runtime: remote ? 'remote' : 'local',
-            ...(remote ? { remote } : {}),
-          },
-          reach: reachOf(handler.deps, frond.name, served, options.remotes ?? {}),
-          exposure: {
-            surfaces: servedSurfaces(frond, handler).map((surface) => surface ?? 'default'),
-            adapters: exposedAdapters(handler, options.adapters),
-          },
-          outputClosed: output.closed,
-          semantics: EFFECTIVE_OPERATION_SEMANTICS,
-        };
+      // A statement wins over the scan on purpose; saying so is what keeps the win from hiding a rename.
+      diagnostics.push(...statementDrift(frond, handler));
+      diagnostics.push(...unansweredOperations(frond, handler, contracts.keys()));
+
+      const resolving: Resolving = { fronds, frond, handler, schemas, served, collectorsByType, options, diagnostics };
+      for (const [name, contract] of contracts) {
+        const op = resolveOperation(resolving, name, contract);
+        if (!op) continue;
         effective.set(name, op);
         operations.push(op);
       }
     }
   }
 
-  // Topology and DI are part of the same effective program. A dependency targeting an
-  // actually remote frond is a refusal, not the warning appropriate to a future split.
-  for (const misplaced of verify({ fronds })) {
-    const remoteBoundary = options.remotes?.[misplaced.frond] !== undefined
-      || options.remotes?.[misplaced.dependsOn.frond] !== undefined;
-    resolutionDiagnostics.push(remoteBoundary && misplaced.code === 'cross-frond-dependency'
-      ? { ...misplaced, severity: 'blocking' }
-      : misplaced);
-  }
-
-  const resolution = uniqueDiagnostics(resolutionDiagnostics);
+  diagnostics.push(...placementRefusals(fronds, options));
+  const resolution = uniqueDiagnostics(diagnostics);
 
   return new EffectiveOperationModel(
     operations,
@@ -291,6 +124,193 @@ export function resolveEffectiveOperations(
   );
 }
 
+function refuseAmbiguousCollectors(
+  frond: FrondDescriptor,
+  collectorsByType: Map<string, CollectorEntry[]>,
+  diagnostics: Diagnostic[],
+): void {
+  for (const [typeName, collectors] of collectorsByType) {
+    if (collectors.length < 2) continue;
+    diagnostics.push({
+      severity: 'blocking',
+      code: 'collector-ambiguous',
+      filePath: collectors[0]!.filePath,
+      frond: frond.name,
+      subject: typeName,
+      message: `Frond '${frond.name}' declares ${collectors.length} collectors for '${typeName}' — `
+        + `${collectors.map((collector) => collector.ctor.name).sort().join(', ')}. `
+        + 'Exactly one collector must own a parameter type.',
+    });
+  }
+}
+
+/** One operation, or nothing when a refusal was written for it. */
+function resolveOperation(resolving: Resolving, name: string, rawContract: OperationContract): EffectiveOperation | undefined {
+  const { fronds, frond, handler, schemas, served, collectorsByType, options, diagnostics } = resolving;
+  const contract = normalizeBinding(rawContract, handler, frond, name, diagnostics);
+  if (!contract || !answersData(resolving, name, contract)) return undefined;
+
+  const kind = kindOf(resolving, name);
+  if (!kind) return undefined;
+
+  const implementation = implementationOf(frond, handler, name, diagnostics);
+  if (!implementation) return undefined;
+
+  const parameters = parametersOf(contract);
+  if (!validateProvenance(fronds, frond, handler, name, contract, parameters, collectorsByType, diagnostics)) {
+    return undefined;
+  }
+
+  // A fact is validated by the entity it names, and an op that FINISHES one answers its shape —
+  // left to the ordinary projection, the subscriber got a value with no `id`.
+  const announced = contract.binding.find((binding) => binding.source.kind === 'fact' || binding.source.kind === 'pipe');
+  const fact = announced?.source.kind === 'fact' || announced?.source.kind === 'pipe'
+    ? schemas.get(announced.source.factName)
+    : undefined;
+  const input = contract.input ?? fact;
+  const output = announced?.source.kind === 'pipe' && fact
+    ? { schema: fact, closed: false }
+    : effectiveOutput(frond, handler, name, contract);
+
+  const className = handler.ctor.name.replace(/Handler$/, '');
+  const surface = handler.surface ? `/${handler.surface}` : '/default';
+  const remote = options.remotes?.[frond.name];
+
+  return {
+    ...contract,
+    ...(input ? { input } : {}),
+    ...(output.schema ? { output: output.schema } : {}),
+    id: `${frond.name}${surface}/${className}.${name}`,
+    operation: `${className}.${name}`,
+    name,
+    kind,
+    kindSource: frond.operationsOverrides?.[name]?.kind ? 'explicit' : 'convention',
+    handler: { className: handler.ctor.name, address: handler.address, filePath: handler.filePath },
+    implementation,
+    binding: contract.binding,
+    parameters,
+    collectors: collectorsOf(parameters, collectorsByType, frond),
+    contexts: parameters
+      .filter((parameter) => parameter.binding.source.kind === 'context')
+      .map((parameter) => parameter.name),
+    placement: { frond: frond.name, runtime: remote ? 'remote' : 'local', ...(remote ? { remote } : {}) },
+    reach: reachOf(handler.deps, frond.name, served, options.remotes ?? {}),
+    exposure: {
+      surfaces: servedSurfaces(frond, handler).map((surface) => surface ?? 'default'),
+      adapters: exposedAdapters(handler, options.adapters),
+    },
+    outputClosed: output.closed,
+    semantics: EFFECTIVE_OPERATION_SEMANTICS,
+  };
+}
+
+/**
+ * An operation answers DATA — what JSON keeps. A declared output is converted by its fields; an
+ * undeclared one has nothing to convert it. Measured 2026-09-18: `{ at: new Date(0) }` reaches a
+ * local caller as a `Date` and a remote one as a string.
+ */
+function answersData({ frond, handler, diagnostics }: Resolving, name: string, contract: OperationContract): boolean {
+  if (contract.output || !contract.signature?.notData) return true;
+
+  const subject = `${handler.ctor.name}.${name}`;
+  diagnostics.push({
+    severity: 'blocking',
+    code: 'operation-output-not-data',
+    filePath: handler.filePath,
+    frond: frond.name,
+    subject,
+    message: `${subject}() answers ${contract.signature.notData}, which carries methods.\n`
+      + '  An operation answers data — what JSON keeps.\n'
+      + '  Declare the output as an entity, whose fields convert it, or answer what it produces.',
+  });
+
+  return false;
+}
+
+/** Stated in `frond.config.ts`, or read off the verb the name leads with — never guessed between two. */
+function kindOf({ frond, handler, diagnostics }: Resolving, name: string): OperationKind | undefined {
+  const stated = frond.operationsOverrides?.[name]?.kind;
+  if (stated) return stated;
+
+  const inference = inferOperationKind(name);
+  const inferred = new Set<OperationKind>();
+  if (inference.kind) inferred.add(inference.kind);
+  if (inference.queryMatches.length > 0) inferred.add('query');
+  if (inference.commandMatches.length > 0) inferred.add('command');
+  if (inferred.size === 1) return [...inferred][0];
+
+  const subject = `${handler.ctor.name}.${name}`;
+  const ambiguous = inferred.size > 1;
+  diagnostics.push({
+    severity: 'blocking',
+    code: ambiguous ? 'operation-kind-ambiguous' : 'operation-kind-unknown',
+    filePath: handler.filePath,
+    frond: frond.name,
+    subject,
+    message: ambiguous
+      ? `Cannot resolve the kind of ${subject}: its name carries query evidence `
+        + `(${inference.queryMatches.join(', ')}) and command evidence `
+        + `(${inference.commandMatches.join(', ')}). `
+        + `Declare operations.${name}.kind.`
+      : `Cannot resolve the kind of ${subject}: '${name}' leads with no known verb. `
+        + `Rename it to lead with one, or declare operations.${name}.kind in `
+        + `frond.config.ts.\n  query:   ${knownVerbs().query.join(', ')}`
+        + `\n  command: ${knownVerbs().command.join(', ')}`,
+  });
+
+  return undefined;
+}
+
+function parametersOf(contract: BoundContract): EffectiveParameter[] {
+  const params = contract.signature?.params ?? [];
+
+  return contract.binding.map((binding, position) => {
+    const param = params[position];
+    const undefinable = binding.optional || param?.optional === true || param?.type.undefined === true;
+
+    return {
+      position,
+      name: param?.name ?? binding.name,
+      type: param?.type.raw ?? null,
+      optional: undefinable,
+      nullable: param?.type.nullable === true,
+      undefinable,
+      binding,
+    };
+  });
+}
+
+function collectorsOf(
+  parameters: readonly EffectiveParameter[],
+  collectorsByType: Map<string, CollectorEntry[]>,
+  frond: FrondDescriptor,
+): EffectiveOperation['collectors'] {
+  return parameters.flatMap((parameter) => {
+    if (parameter.binding.source.kind !== 'collector') return [];
+    const collector = collectorsByType.get(parameter.binding.source.typeName)?.[0];
+
+    return collector ? [{
+      parameter: parameter.name,
+      typeName: collector.typeName,
+      className: collector.ctor.name,
+      frond: frond.name,
+      filePath: collector.filePath,
+    }] : [];
+  });
+}
+
+/** A dependency on a frond that actually runs elsewhere is a refusal, not the warning a future split deserves. */
+function placementRefusals(fronds: readonly FrondDescriptor[], options: EffectiveOperationOptions): Diagnostic[] {
+  return verify({ fronds }).map((misplaced) => {
+    const remoteBoundary = options.remotes?.[misplaced.frond] !== undefined
+      || options.remotes?.[misplaced.dependsOn.frond] !== undefined;
+
+    return remoteBoundary && misplaced.code === 'cross-frond-dependency'
+      ? { ...misplaced, severity: 'blocking' as const }
+      : misplaced;
+  });
+}
+
 function groupedCollectors(collectors: readonly CollectorEntry[]): Map<string, CollectorEntry[]> {
   const grouped = new Map<string, CollectorEntry[]>();
   for (const collector of collectors) {
@@ -308,7 +328,7 @@ function normalizeBinding(
   frond: FrondDescriptor,
   name: string,
   diagnostics: Diagnostic[],
-): (OperationContract & { binding: BindingPlan }) | undefined {
+): BoundContract | undefined {
   const params = contract.signature?.params ?? [];
   if (!contract.binding) {
     if (params.length === 0) return { ...contract, binding: [] };
@@ -567,7 +587,7 @@ function uniqueDiagnostics(diagnostics: readonly Diagnostic[]): Diagnostic[] {
 }
 
 /** The contract of every operation a handler serves — the three producers, merged once. */
-export function resolveContracts(
+function resolveContracts(
   handler: Pick<HandlerEntry, 'ctor' | 'operations'>,
   overrides: FrondDescriptor['operationsOverrides'],
   collectorTypeNames: Set<string>,

package/src/FougereConfig.ts

@@ -1,6 +1,6 @@
 import { resolve } from 'node:path';
 import { existsSync } from 'node:fs';
-import type { AuthConfig } from './boot/AuthConfig.js';
+import type { Extension } from './boot/Extension.js';
 import type { LogLevel } from './builtin/LogLevel.js';
 import type { ConventionsInput } from './ConventionsInput.js';
 import type { NameOf } from './NameOf.js';
@@ -29,30 +29,28 @@ export interface FougereConfig {
   fronds?: FrondsStated;
   /** What answers a port — a name, or the chain from the outside in. */
   ports?: PortChoice;
-  /** Auth declaration — picks a provider package and forwards options to it. */
-  auth?: AuthConfig;
+  /** The auth provider — an extension, which brings the frond its rows live in. */
+  auth?: Extension;
   /** Which protocol adapters this app serves. */
   adapters?: AdapterConfig;
 }
 
 const CONFIG_FILES = ['fougere.config.ts', 'fougere.config.js', 'fougere.config.mjs'];
 
+/** The config file a directory holds, if it holds one. */
+export function configFileIn(dir: string): string | undefined {
+  return CONFIG_FILES.map((file) => resolve(dir, file)).find((path) => existsSync(path));
+}
+
 async function loadConfigFrom(dir: string, fresh?: boolean): Promise<FougereConfig> {
-  const loader = getModuleLoader();
-  for (const file of CONFIG_FILES) {
-    const path = resolve(dir, file);
-    if (existsSync(path)) {
-      // A module is cached by its specifier, so a second load of an EDITED file hands
-      // back what was read the first time — measured, and it made re-reading a config
-      // return the config already in force. The loader owns its own cache, so it is the
-      // one told; the old module stays in memory, re-reading being for a change.
-      const mod = await loader(path, fresh ? { fresh } : undefined);
+  const path = configFileIn(dir);
+  if (!path) return {};
 
-      return ((mod as { default?: FougereConfig }).default ?? mod) as FougereConfig;
-    }
-  }
+  // A module is cached by its specifier, so a second load of an EDITED file hands back what
+  // was read the first time. The loader owns its own cache, so it is the one told.
+  const mod = await getModuleLoader()(path, fresh ? { fresh } : undefined);
 
-  return {};
+  return ((mod as { default?: FougereConfig }).default ?? mod) as FougereConfig;
 }
 
 /** Load the root fougere.config.{ts,js,mjs} from the given directory. */

package/src/FrondDeclaration.ts

@@ -1,4 +1,5 @@
 import { lowerFirst, type SchemaView } from '@fougere/schema';
+import { addressOf } from './wire/Facade.js';
 import type { CollectorEntry } from './descriptor/CollectorEntry.js';
 import type { EntityEntry } from './descriptor/EntityEntry.js';
 import type { FrondDescriptor } from './descriptor/FrondDescriptor.js';
@@ -54,13 +55,6 @@ function statedOperations(h: Ctor | DeclaredHandler): Map<string, OperationContr
   return merged;
 }
 
-/** `PostHandler` answers at `post` — the same rule the scan applies to a file it found. */
-function addressOf(className: string): string {
-  const base = className.endsWith('Handler') ? className.slice(0, -7) : className;
-
-  return lowerFirst(base);
-}
-
 /** What a declaration states about one frond. Everything else is derived from the classes. */
 export interface FrondDeclaration {
   entities?: SchemaView[];

package/src/Source.ts

@@ -8,7 +8,7 @@ import type { SourceConfig } from './SourceConfig.js';
 export function declares(schema: SchemaView, constraint: Constraint): boolean {
   const fields = Object.values(schema.getFields());
   if (constraint === 'relation') return fields.some((field) => Role.of(field).isReference());
-  if ((schema.getUnique() ?? []).length > 0) return true;
+  if (schema.getUnique().length > 0) return true;
 
   return fields.some((field) => Role.of(field).isUnique());
 }

package/src/SourceView.ts

@@ -1,7 +1,5 @@
 /** The app as ONE source sees it. */
 export interface SourceView {
   fronds: readonly { readonly name: string; readonly entities: readonly { readonly name: string }[] }[];
-  /** The auth provider's own entities, when they ride with this source. */
-  auth?: unknown;
   elsewhere: readonly string[];
 }

package/src/boot/App.ts

@@ -3,10 +3,10 @@ import type { Fronds } from '../descriptor/Fronds.js';
 import type { SchemaView } from '@fougere/schema';
 import type { AppMiddleware } from '../wire/AppMiddleware.js';
 import type { RpcAnswer } from '../wire/RpcAnswer.js';
-import type { AuthRuntime } from './AuthRuntime.js';
 import type { EffectiveOperationsMap } from '../EffectiveOperationsMap.js';
 import type { DispatchObserver } from '../dispatch/DispatchObserver.js';
 import type { DispatchPort } from '../dispatch/DispatchPort.js';
+import type { Storage } from '../storage/Storage.js';
 
 /** The App object returned by createApp(). */
 export interface App extends DispatchPort {
@@ -42,7 +42,7 @@ export interface App extends DispatchPort {
    * The storage an entity is backed by, resolved through its owning frond's scope — the dual of
    * {@link facadeFor}.
    */
-  storageFor(entity: string): unknown | undefined;
+  storageFor<T = Record<string, unknown>>(entity: string): Storage<T> | undefined;
   /** The presenter of an entity, resolved through its owning frond's scope. */
   presenterFor(entity: string): unknown | undefined;
   /** Dispose the root container. */
@@ -66,6 +66,4 @@ export interface App extends DispatchPort {
   use(middleware: AppMiddleware): void;
   /** Register an app middleware scoped to a specific entity. */
   use(entity: string, middleware: AppMiddleware): void;
-  /** Auth runtime, present when fougere.config.ts declares `auth`. */
-  auth?: AuthRuntime;
 }

package/src/boot/AppLifecycle.ts

@@ -25,18 +25,29 @@ export class AppLifecycle {
   }
 
   async down(app: App): Promise<void> {
-    const refused: unknown[] = [];
-    for (const extension of [...this.members].reverse()) {
-      try {
-        await extension.down?.(app);
-      } catch (error) {
-        refused.push(error);
-      }
-    }
-    if (refused.length > 0) {
-      throw new AggregateError(refused, `${refused.length} extension(s) refused to release`);
+    await closeAll(
+      [...this.members].reverse().map((extension) => () => extension.down?.(app)),
+      'extension(s) refused to release',
+    );
+  }
+}
+
+/**
+ * Every level told to close even when one refuses, the refusals leaving together in one
+ * `AggregateError` — one already carried by a level is flattened into the list.
+ */
+export async function closeAll(levels: readonly (() => unknown)[], refusals: string): Promise<void> {
+  const refused: unknown[] = [];
+  for (const level of levels) {
+    try {
+      await level();
+    } catch (error) {
+      if (error instanceof AggregateError) refused.push(...error.errors);
+      else refused.push(error);
     }
   }
+
+  if (refused.length > 0) throw new AggregateError(refused, `${refused.length} ${refusals}`);
 }
 
 /** The replaceable migration slot of the application lifecycle. */