@fougere/core 0.12.4-alpha.0 → 0.12.6-alpha.0

package/dist/wire/StateShape.js

@@ -0,0 +1,59 @@
+import { InputValidator, dotted, optional } from '@fougere/schema';
+import { ErrorCode } from './ErrorCode.js';
+import { FougereError } from './FougereError.js';
+/**
+ * What a call's `state` may hold in this process: the members its extensions declare, each one
+ * absent until a host fills it. Judged at the facade, so a member arriving over the wire is
+ * rebuilt by its field exactly as it would have been handed over in-process.
+ *
+ * Documented: [collectors](https://fougere.dev/docs/business/collectors).
+ */
+export class StateShape {
+    fields;
+    static empty = new StateShape({});
+    validator;
+    constructor(fields) {
+        this.fields = fields;
+        this.validator = InputValidator.of(fields);
+    }
+    /** Two extensions declaring one member refuse: the field that judges it would depend on wiring order. */
+    static of(declarations) {
+        const fields = {};
+        const owners = new Map();
+        for (const { name, state } of declarations) {
+            for (const [member, field] of Object.entries(state ?? {})) {
+                const owner = owners.get(member);
+                if (owner) {
+                    throw new Error(`[state] '${member}' is declared by two extensions, '${owner}' and '${name}'.\n`
+                        + '  A member has one owner — keep one of them out of `extensions:`.');
+                }
+                owners.set(member, name);
+                fields[member] = optional(field);
+            }
+        }
+        return new StateShape(fields);
+    }
+    /**
+     * The members written since `entered` rebuilt by their fields, or a refusal naming the member
+     * and what this process declares. What `entered` already held was judged where it entered.
+     */
+    judge(state, entity, operation, entered = {}) {
+        const written = Object.fromEntries(Object.entries(state).filter(([member, value]) => entered[member] !== value));
+        if (Object.keys(written).length === 0)
+            return state;
+        const result = this.validator.validate(written);
+        if (result.success)
+            return { ...state, ...result.data };
+        const declared = Object.keys(this.fields);
+        const errors = result.errors.map((error) => ({ ...error, path: ['state', ...error.path] }));
+        throw new FougereError({
+            code: ErrorCode.VALIDATION_FAILED,
+            message: errors.map((error) => `${dotted(error.path)}: ${error.message}`).join(', ')
+                + (declared.length ? ` — this process declares ${declared.join(', ')}` : ' — this process declares no state member'),
+            details: errors,
+            entity,
+            operation,
+        });
+    }
+}
+//# sourceMappingURL=StateShape.js.map

package/dist/wire/StateShape.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"StateShape.js","sourceRoot":"","sources":["../../src/wire/StateShape.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,cAAc,EAAE,MAAM,EAAE,QAAQ,EAA2B,MAAM,iBAAiB,CAAC;AAC5F,OAAO,EAAE,SAAS,EAAE,MAAM,gBAAgB,CAAC;AAC3C,OAAO,EAAE,YAAY,EAAE,MAAM,mBAAmB,CAAC;AAQjD;;;;;;GAMG;AACH,MAAM,OAAO,UAAU;IAKgB;IAJrC,MAAM,CAAU,KAAK,GAAG,IAAI,UAAU,CAAC,EAAE,CAAC,CAAC;IAE1B,SAAS,CAAiB;IAE3C,YAAqC,MAAc;QAAd,WAAM,GAAN,MAAM,CAAQ;QACjD,IAAI,CAAC,SAAS,GAAG,cAAc,CAAC,EAAE,CAAC,MAAM,CAAC,CAAC;IAC7C,CAAC;IAED,yGAAyG;IACzG,MAAM,CAAC,EAAE,CAAC,YAAyC;QACjD,MAAM,MAAM,GAAW,EAAE,CAAC;QAC1B,MAAM,MAAM,GAAG,IAAI,GAAG,EAAkB,CAAC;QACzC,KAAK,MAAM,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,YAAY,EAAE,CAAC;YAC3C,KAAK,MAAM,CAAC,MAAM,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,KAAK,IAAI,EAAE,CAAC,EAAE,CAAC;gBAC1D,MAAM,KAAK,GAAG,MAAM,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;gBACjC,IAAI,KAAK,EAAE,CAAC;oBACV,MAAM,IAAI,KAAK,CACb,YAAY,MAAM,qCAAqC,KAAK,UAAU,IAAI,MAAM;0BAC9E,mEAAmE,CACtE,CAAC;gBACJ,CAAC;gBACD,MAAM,CAAC,GAAG,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC;gBACzB,MAAM,CAAC,MAAM,CAAC,GAAG,QAAQ,CAAC,KAAK,CAAC,CAAC;YACnC,CAAC;QACH,CAAC;QAED,OAAO,IAAI,UAAU,CAAC,MAAM,CAAC,CAAC;IAChC,CAAC;IAED;;;OAGG;IACH,KAAK,CACH,KAA8B,EAC9B,MAAc,EACd,SAAiB,EACjB,UAAmC,EAAE;QAErC,MAAM,OAAO,GAAG,MAAM,CAAC,WAAW,CAAC,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,EAAE,KAAK,CAAC,EAAE,EAAE,CAAC,OAAO,CAAC,MAAM,CAAC,KAAK,KAAK,CAAC,CAAC,CAAC;QACjH,IAAI,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,MAAM,KAAK,CAAC;YAAE,OAAO,KAAK,CAAC;QAEpD,MAAM,MAAM,GAAG,IAAI,CAAC,SAAS,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC;QAChD,IAAI,MAAM,CAAC,OAAO;YAAE,OAAO,EAAE,GAAG,KAAK,EAAE,GAAG,MAAM,CAAC,IAAI,EAAE,CAAC;QAExD,MAAM,QAAQ,GAAG,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;QAC1C,MAAM,MAAM,GAAG,MAAM,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,EAAE,GAAG,KAAK,EAAE,IAAI,EAAE,CAAC,OAAO,EAAE,GAAG,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC;QAE5F,MAAM,IAAI,YAAY,CAAC;YACrB,IAAI,EAAE,SAAS,CAAC,iBAAiB;YACjC,OAAO,EAAE,MAAM,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,GAAG,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,KAAK,KAAK,CAAC,OAAO,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC;kBAChF,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,4BAA4B,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC,0CAA0C,CAAC;YACtH,OAAO,EAAE,MAAM;YACf,MAAM;YACN,SAAS;SACV,CAAC,CAAC;IACL,CAAC"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@fougere/core",
-  "version": "0.12.4-alpha.0",
+  "version": "0.12.6-alpha.0",
   "description": "The core — scan, call contract, façades, remote stand-ins.",
   "keywords": [
     "fougere",
@@ -60,13 +60,13 @@
   ],
   "dependencies": {
     "dequal": "^2.0.3",
-    "@fougere/container": "0.12.4-alpha.0",
-    "@fougere/schema": "0.12.4-alpha.0"
+    "@fougere/container": "0.12.6-alpha.0",
+    "@fougere/schema": "0.12.6-alpha.0"
   },
   "devDependencies": {
     "@types/node": "^22.0.0",
     "@typescript/typescript6": "^6.0.2",
-    "@fougere/compiler": "0.12.4-alpha.0"
+    "@fougere/compiler": "0.12.6-alpha.0"
   },
   "publishConfig": {
     "access": "public"

package/src/FougereConfig.ts

@@ -1,6 +1,5 @@
 import { resolve } from 'node:path';
 import { existsSync } from 'node:fs';
-import type { Extension } from './boot/Extension.js';
 import type { LogLevel } from './builtin/LogLevel.js';
 import type { ConventionsInput } from './ConventionsInput.js';
 import type { NameOf } from './NameOf.js';
@@ -22,6 +21,8 @@ export interface FougereConfig {
   conventions?: ConventionsInput;
   /** How much every logger says. */
   logLevel?: LogLevel;
+  /** How many bytes a caller may send in one call — 2 MiB when unsaid. Consulted at every door. */
+  maxBodyBytes?: number;
   /**
    * What this app is made of, and who inherits code from whom. The key is a frond name or a
    * module specifier; nesting says only that a child resolves what its parent declared.
@@ -29,8 +30,6 @@ export interface FougereConfig {
   fronds?: FrondsStated;
   /** What answers a port — a name, or the chain from the outside in. */
   ports?: PortChoice;
-  /** The auth provider — an extension, which brings the frond its rows live in. */
-  auth?: Extension;
   /** Which protocol adapters this app serves. */
   adapters?: AdapterConfig;
 }

package/src/FrondDeclaration.ts

@@ -8,6 +8,7 @@ import type { MiddlewareEntry } from './descriptor/MiddlewareEntry.js';
 import type { PresenterEntry } from './descriptor/PresenterEntry.js';
 import type { ProviderEntry } from './descriptor/ProviderEntry.js';
 import type { SeedEntry } from './descriptor/SeedEntry.js';
+import type { ExtensionEntry } from './descriptor/ExtensionEntry.js';
 import { DEFAULT_CONVENTIONS } from './Conventions.js';
 import { getPresenterFields } from './prefab/presenter.js';
 import type { OperationContract } from './wire/OperationContract.js';
@@ -73,6 +74,8 @@ export interface FrondDeclaration {
   scope?: string;
   /** What `frond.config.ts` states — the third producer of an operation contract. */
   operationsOverrides?: FrondDescriptor['operationsOverrides'];
+  /** What rises with the process serving this frond — the same thing its `extensions/` states. */
+  extensions?: (ExtensionEntry['extension'] & { name: string })[];
 }
 
 /** State a frond without reading a disk. */
@@ -176,5 +179,8 @@ export function frond(name: string, declared: FrondDeclaration = {}): FrondDescr
     middlewares,
     ...(declared.pipes ? { pipes: declared.pipes } : {}),
     ...(declared.surfaces ? { surfaces: declared.surfaces } : {}),
+    ...(declared.extensions
+      ? { extensions: declared.extensions.map((extension) => ({ name: extension.name, extension, filePath: '' })) }
+      : {}),
   };
 }

package/src/FrondsStated.ts

@@ -1,4 +1,5 @@
 import type { NameOf } from './NameOf.js';
+import type { FrondDescriptor } from './descriptor/FrondDescriptor.js';
 
 /**
  * What the config says about the fronds this app is made of — where each one comes from, and
@@ -20,9 +21,10 @@ export type FrondsStated = {
 
 /**
  * Everything an entry says, or the one string that is the whole of it — an address for a frond
- * that answers elsewhere, the argument for a module key.
+ * that answers elsewhere, the argument for a module key — or the frond itself, built by the
+ * config's own import: `auth: betterAuth({ … })`.
  */
-export type FrondStated = string | FrondAttributes;
+export type FrondStated = string | FrondAttributes | FrondDescriptor;
 
 export interface FrondAttributes {
   /**

package/src/StatedFrond.ts

@@ -1,4 +1,5 @@
 import { statesModule, type FrondAttributes, type FrondStated, type FrondsStated } from './FrondsStated.js';
+import { isFrondDescriptor, type FrondDescriptor } from './descriptor/FrondDescriptor.js';
 
 /** One entry of the config, read whole. */
 export interface StatedFrond {
@@ -10,10 +11,13 @@ export interface StatedFrond {
   path: string;
   /** An address for a frond that is elsewhere, an argument for a module. */
   value?: string;
+  /** The frond the config built in place, which the host installs like one it scanned. */
+  held?: FrondDescriptor;
 }
 
 /** What an entry says, whichever of its two forms it was written in. */
 function attributesOf(stated: FrondStated, key: string): FrondAttributes {
+  if (isFrondDescriptor(stated)) return {};
   if (typeof stated !== 'string') return stated;
 
   return statesModule(key) ? { options: stated } : { remote: stated };
@@ -41,6 +45,7 @@ export function statedFronds(stated: FrondsStated | undefined): StatedFrond[] {
       path: above !== undefined ? `${above}.${key}` : key,
       ...(above !== undefined ? { extends: above } : {}),
       ...(carries !== undefined ? { value: carries } : {}),
+      ...(isFrondDescriptor(value) ? { held: value } : {}),
     };
   };
 

package/src/StatedModules.ts

@@ -3,13 +3,17 @@
  * of your own. Reading one means importing it, which is why this lives on the node entry and
  * never on the one a Worker runs.
  *
- * What a module hands back decides where it goes: a shape stating `up` or `down` is an
+ * What a module hands back decides where it goes: a shape stating `up`, `down` or `state` is an
  * extension and rises with the app, anything else is a frond and is installed like the rest.
  * The author of a config does not have to know which one their package exports — the same
  * reading `extensions/` already does off a module's form.
+ *
+ * A frond the config BUILT in place — `auth: betterAuth({ … })` — is handed over the same way,
+ * with nothing to import: the config file already did.
  */
 import type { Extension } from './boot/Extension.js';
 import type { FrondDescriptor } from './descriptor/FrondDescriptor.js';
+import { isExtension } from './descriptor/ExtensionEntry.js';
 import { statesModule, type FrondsStated } from './FrondsStated.js';
 import { statedFronds } from './StatedFrond.js';
 import { getModuleLoader } from './loader.js';
@@ -21,13 +25,7 @@ function exportedBy(specifier: string): string {
   return last.replace(/\.[cm]?[jt]s$/, '');
 }
 
-function rises(built: unknown): built is Extension {
-  const shape = built as { up?: unknown; down?: unknown } | null;
-
-  return typeof shape?.up === 'function' || typeof shape?.down === 'function';
-}
-
-/** What a config's module keys hand over, sorted by what each one turned out to be. */
+/** What a config hands over as code — its module keys and the fronds it built — sorted by what each one is. */
 export async function statedModules(
   stated: FrondsStated | undefined,
 ): Promise<{ fronds: FrondDescriptor[]; extensions: Extension[] }> {
@@ -36,6 +34,16 @@ export async function statedModules(
   const loader = getModuleLoader();
 
   for (const entry of statedFronds(stated)) {
+    if (entry.held) {
+      if (entry.held.name !== entry.key) {
+        throw new Error(
+          `Fougere config: the entry '${entry.path}' holds the frond '${entry.held.name}'. `
+          + `Name the entry '${entry.held.name}' — the key is how \`only:\` and an address find it.`,
+        );
+      }
+      fronds.push(entry.held);
+      continue;
+    }
     if (!statesModule(entry.key)) continue;
 
     const module = await loader(entry.key) as Record<string, unknown>;
@@ -50,7 +58,7 @@ export async function statedModules(
     }
 
     const built = (factory as (argument?: unknown) => unknown)(entry.value);
-    if (rises(built)) extensions.push(built);
+    if (isExtension(built)) extensions.push(built as Extension);
     else fronds.push(built as FrondDescriptor);
   }
 

package/src/boot/AppLifecycle.ts

@@ -1,5 +1,6 @@
 import type { App } from './App.js';
 import type { Extension } from './Extension.js';
+import { StateShape } from '../wire/StateShape.js';
 
 /** Runs application extensions up in order and down in reverse order. */
 export class AppLifecycle {
@@ -20,6 +21,11 @@ export class AppLifecycle {
     return this.members.map((extension) => extension.name);
   }
 
+  /** Read off the members that stay, so an extension replaced by name declares nothing. */
+  state(): StateShape {
+    return StateShape.of(this.members);
+  }
+
   async up(app: App): Promise<void> {
     for (const extension of this.members) await extension.up?.(app);
   }

package/src/boot/Extension.ts

@@ -1,4 +1,5 @@
 import type { App } from './App.js';
+import type { Field } from '@fougere/schema';
 import type { FrondDescriptor } from '../descriptor/FrondDescriptor.js';
 
 /**
@@ -15,6 +16,11 @@ export interface Extension {
    * signature is the only way to ask for one.
    */
   fronds?: readonly FrondDescriptor[];
+  /**
+   * The members it puts on a call's `state` — `{ user: json(User) }`. A member nobody declares
+   * is refused at the facade, and one declared twice refuses the boot.
+   */
+  state?: Readonly<Record<string, Field>>;
   up?(app: App): void | Promise<void>;
   down?(app: App): void | Promise<void>;
 }

package/src/boot/apply.ts

@@ -1,5 +1,6 @@
 import type { FougereConfig } from '../FougereConfig.js';
 import { envLevel, logLevel, setLogLevel } from '../builtin/Logger.js';
+import { maxBodyBytes, setMaxBodyBytes } from '../wire/BodyLimit.js';
 import { dequal } from 'dequal';
 
 export interface ConfigApplication {
@@ -9,6 +10,9 @@ export interface ConfigApplication {
   pending: string[];
 }
 
+/** The keys read at use rather than consumed at boot, so a re-read moves them. */
+const CONSULTED = new Set(['logLevel', 'maxBodyBytes']);
+
 /**
  * What a (re-)read config changes in a process that is already running.
  *
@@ -34,8 +38,14 @@ export function applyConfig(next: FougereConfig, inForce?: FougereConfig): Confi
     applied.push(`logLevel: ${before} → ${wanted}`);
   }
 
+  const limit = next.maxBodyBytes ?? maxBodyBytes();
+  if (limit !== maxBodyBytes()) {
+    applied.push(`maxBodyBytes: ${maxBodyBytes()} → ${limit}`);
+    setMaxBodyBytes(limit);
+  }
+
   for (const key of new Set([...Object.keys(next), ...Object.keys(inForce ?? {})])) {
-    if (key === 'logLevel' || !inForce) continue;
+    if (CONSULTED.has(key) || !inForce) continue;
     if (!dequal((next as Record<string, unknown>)[key], (inForce as Record<string, unknown>)[key])) {
       pending.push(key);
     }

package/src/boot/bootstrap.ts

@@ -568,16 +568,26 @@ function markLineCarriers(emissions: Emissions): void {
  * declares `product`.
  */
 function answerRemotes(
-  { container, routeRegistry, dispatcher, getMiddlewares }: Pick<Assembly, 'container' | 'routeRegistry' | 'dispatcher' | 'getMiddlewares'>,
+  { container, routeRegistry, dispatcher, getMiddlewares, options, state }: Pick<Assembly, 'container' | 'routeRegistry' | 'dispatcher' | 'getMiddlewares' | 'options' | 'state'>,
   remoteRouter: RemoteRouter,
+  fronds: Fronds,
 ): void {
-  container.setFallback((name) => (isFacadeKey(name) ? facadeOperations(dispatcher, addressOf(name)) : undefined));
+  // Only for what another process may serve: an entity a frond hosts HERE and gives no handler
+  // is served by nobody, and a stand-in for it had GraphQL project an entity with no operation.
+  const servedElsewhere = (address: string): boolean => {
+    const owner = fronds.owner(address);
+
+    return owner === undefined || owner.name in (options.remotes ?? {});
+  };
+  container.setFallback((name) => (isFacadeKey(name) && servedElsewhere(addressOf(name))
+    ? facadeOperations(dispatcher, addressOf(name))
+    : undefined));
 
   const remoteFacades = new Map<string, Record<string, Function>>();
   routeRegistry.addResolver(remoteRoutes((entity) => {
     const known = remoteFacades.get(entity);
     if (known) return known;
-    const facade = createRemoteFacade(entity, remoteRouter, getMiddlewares);
+    const facade = createRemoteFacade(entity, remoteRouter, getMiddlewares, state);
     remoteFacades.set(entity, facade);
 
     return facade;
@@ -650,6 +660,7 @@ export async function createApp(options: CreateAppOptions): Promise<App> {
     log.debug('builtins registered (Logger, Config)');
 
     const { fronds, operationModel } = await readFronds(options, log);
+    appLifecycle.add(...frondExtensions(fronds));
     const remoteRouter = remoteRouterOf(options);
     const { inflight, routeRegistry, dispatchLifecycle, dispatcher, localDispatcher, getMiddlewares, use } =
       dispatching(options, log, fronds, () => journalOf());
@@ -672,6 +683,7 @@ export async function createApp(options: CreateAppOptions): Promise<App> {
       container, routeRegistry, emissions, dispatcher, localDispatcher, effectiveByKey,
       boundPorts, refused, relations, hosting, operationModel, entityByName, frondOf, contractsOf,
       getMiddlewares, use, middlewaresOf: new Map(), seamsOf: new Map(), log, options,
+      state: appLifecycle.state(),
     };
     for (const frond of fronds) await installFrond(frond, assembly);
 
@@ -685,7 +697,7 @@ export async function createApp(options: CreateAppOptions): Promise<App> {
     refuseWhatDoesNotHold(refused);
     markLineCarriers(emissions);
 
-    if (remoteRouter) answerRemotes(assembly, remoteRouter);
+    if (remoteRouter) answerRemotes(assembly, remoteRouter, fronds);
 
     const { resolve, schemaFor, facadeFor, operationsFor, presenterFor } = readings({
       container, fronds, remoteRouter, localDispatcher, routeRegistry, effectiveByKey, log,
@@ -725,7 +737,6 @@ export async function createApp(options: CreateAppOptions): Promise<App> {
     serveCoreRpc(app, hosting, storageFor);
 
     built = app;
-    appLifecycle.add(...frondExtensions(fronds));
     await appLifecycle.up(app);
     stopAnnouncing = announceLines(emissions, container, carry);
 

package/src/boot/install.ts

@@ -1,5 +1,6 @@
 /** Putting one frond into the app being built: its scope, what it serves, what it takes. */
 import type { Container } from '@fougere/container';
+import type { StateShape } from '../wire/StateShape.js';
 import type { ProviderEntry } from '../descriptor/ProviderEntry.js';
 import type { PresenterEntry } from '../descriptor/PresenterEntry.js';
 import { lowerFirst, type Fields, type SchemaView } from '@fougere/schema';
@@ -85,6 +86,8 @@ export interface Assembly {
   seamsOf: Map<string, Map<string, ProviderEntry[]>>;
   log: Logger;
   options: CreateAppOptions;
+  /** What a call's `state` may hold, read off every extension this process mounts. */
+  state: StateShape;
 }
 
 /**
@@ -424,6 +427,7 @@ function buildFacadeInto(
     presenter: presenterMap.get(handler.address),
     presenterScope: scope,
     middlewares: () => getMiddlewares(handler.address),
+    state: assembly.state,
   });
 
   // Emissions use the same contracts and execution path as direct calls, and the terms sit

package/src/boot/nesting.ts

@@ -6,6 +6,7 @@
  * Documented: [fronds](https://fougere.dev/docs/infra/fronds).
  */
 import type { Diagnostic } from '../diagnostic.js';
+import { isFrondDescriptor } from '../descriptor/FrondDescriptor.js';
 import type { FrondDescriptor } from '../descriptor/FrondDescriptor.js';
 import { Fronds } from '../descriptor/Fronds.js';
 import { statesModule, type FrondsStated } from '../FrondsStated.js';
@@ -102,7 +103,7 @@ export function nestingOf(
     if (frond === undefined) continue;
 
     const placed = stated[parent];
-    const address = typeof placed === 'string' ? placed : placed?.remote;
+    const address = typeof placed === 'string' ? placed : isFrondDescriptor(placed) ? undefined : placed?.remote;
     if (address !== undefined || (remotes && parent in remotes)) {
       refused.push({
         severity: 'blocking',

package/src/boot/remote.ts

@@ -4,6 +4,7 @@
  * Documented: [the gradient](https://fougere.dev/docs/infra/gradient).
  */
 import type { FrondCall } from '../wire/FrondCall.js';
+import type { StateShape } from '../wire/StateShape.js';
 import type { Transport } from '../wire/Transport.js';
 import { RPC_ENTITY } from '../wire/RpcAnswer.js';
 import { assertIdentityCard } from '../wire/card/IdentityCard.js';
@@ -103,15 +104,19 @@ export function createRemoteFacade(
   entity: string,
   router: RemoteRouter,
   middlewaresFor: (address: string) => AppMiddleware[],
+  shape: StateShape,
 ): Facade {
-  const opFn = (op: string) => async (invocation: InvocationContext = Invocation.empty) => {
+  const opFn = (op: string) => async (received: InvocationContext = Invocation.empty) => {
     const { frond, transport, schema } = await router.route(entity);
     const call: FrondCall = { frond, entity, op };
+    const state = received.crossed ? { ...received.state } : shape.judge(received.state, entity, op);
+    const invocation = { ...received, state };
+    const entered = { ...state };
     const ctx: OperationContext = {
-      entity, frond, operation: op, args: [], state: invocation.state, invocation,
+      entity, frond, operation: op, args: [], state, invocation, crosses: true,
     };
     const answer = await runMiddlewares(middlewaresFor(entity), ctx, () =>
-      transport(call, ctx.invocation ?? invocation));
+      transport(call, { ...(ctx.invocation ?? invocation), state: shape.judge(ctx.state, entity, op, entered) }));
 
     // The schema the card carried, put to work: a row crosses as data and comes back through
     // the same codecs a local facade applies, so a placement does not decide what a caller

package/src/boot/seed.ts

@@ -1,5 +1,5 @@
+import { pageOf } from '../wire/Page.js';
 import { Role } from '@fougere/schema';
-import { facadeKeyOf } from '../wire/Facade.js';
 import type { FrondDescriptor } from '../descriptor/FrondDescriptor.js';
 import type { SeedEntry } from '../descriptor/SeedEntry.js';
 import type { SeedFactory } from '../descriptor/SeedFactory.js';
@@ -64,14 +64,9 @@ function whatEachWaitsFor(
   }));
 }
 
-/** Where a seed writes, and what it may skip — resolved per entity. */
-interface SeedFacade {
-  list(): Promise<unknown[]>;
-  write(item: Record<string, unknown>): Promise<unknown>;
-}
-
 /**
- * Plant a set of seeds, in the order given.
+ * Plant a set of seeds, in the order given — by the storage, as a handler writes: a seed is the
+ * frond's own code, not a client.
  *
  * Documented: [seeds](https://fougere.dev/docs/business/seeds).
  */
@@ -81,26 +76,26 @@ export async function runSeeds(
   report: (message: string) => void = () => {},
 ): Promise<void> {
   for (const seed of seeds) {
-    const resolve = <T>(name: string) => app.resolve<T>(name + 'Handler');
-    const data = typeof seed.data === 'function' ? await (seed.data as SeedFactory)(resolve) : seed.data;
-
-    const facade = facadeFor(app, seed.entityName);
-    if (!facade) {
-      report(`  ${seed.entityName}: no handler façade nor storage — skipping seed`);
+    const storage = app.storageFor(seed.entityName);
+    if (!storage) {
+      report(`  ${seed.entityName}: no storage in this process — skipping seed`);
       continue;
     }
 
-    const existing = await facade.list();
+    const existing = pageOf(await storage.list()).items;
     if (existing.length > 0) {
       report(`  ${seed.entityName}: skipped (${existing.length} exist)`);
       continue;
     }
 
+    const resolve = <T>(name: string) => app.resolve<T>(name + 'Handler');
+    const data = typeof seed.data === 'function' ? await (seed.data as SeedFactory)(resolve) : seed.data;
+
     // The driver's error alone names neither the entity nor the row — and a foreign
     // key is exactly what a seed gets wrong.
     for (const item of data) {
       try {
-        await facade.write(item);
+        await storage.create(item);
       } catch (cause) {
         throw new Error(
           `Seed '${seed.entityName}' failed on ${JSON.stringify(item)}: ${(cause as Error)?.message ?? cause}`,
@@ -112,26 +107,6 @@ export async function runSeeds(
   }
 }
 
-/** A seed is not a client. */
-function facadeFor(app: App, entityName: string): SeedFacade | undefined {
-  let handler: Record<string, Function> | undefined;
-  try { handler = app.resolve<Record<string, Function>>(facadeKeyOf(entityName)); } catch {}
-
-  const list = handler?.list;
-  const create = handler?.create;
-  if (typeof list === 'function' && typeof create === 'function') {
-    return {
-      list: () => list.call(handler) as Promise<unknown[]>,
-      write: (item) => create.call(handler, { params: {}, query: {}, input: item, state: {} }),
-    };
-  }
-
-  const storage = app.storageFor(entityName);
-  if (!storage) return undefined;
-
-  return { list: () => storage.list(), write: (item) => storage.create(item) };
-}
-
 /**
  * The framework's own ascent for rows, named — so a host can REPLACE it rather than take over the
  * whole post-boot to get its own.

package/src/contract.ts

@@ -24,7 +24,7 @@ export { RouteAddress } from './wire/RouteAddress.js';
 export type { FrondCall } from './wire/FrondCall.js';
 export type { SignedCall } from './wire/SignedCall.js';
 export type { Transport } from './wire/Transport.js';
-export { MAX_BODY_BYTES } from './wire/SignedCall.js';
+export { ENVELOPE_BYTES, maxBodyBytes, maxFrameBytes, setMaxBodyBytes } from './wire/BodyLimit.js';
 // The reserved entity, VALUE and not type: a consumer that wants to leave it alone — a
 // call log ignoring its own reader — has to be able to name it.
 export { RPC_ENTITY } from './wire/RpcAnswer.js';

package/src/descriptor/ExtensionEntry.ts

@@ -1,3 +1,5 @@
+import type { Field } from '@fougere/schema';
+
 /**
  * An extension this frond declares — what rises and falls with the process, written beside the
  * code it instruments.
@@ -10,6 +12,19 @@ export interface ExtensionEntry {
   /** Its own `name`, or the file's — the ascent REPLACES a name already declared. */
   name: string;
   /** The value handed to the ascent, the same shape `CreateAppOptions.extensions` takes. */
-  extension: { name?: string; up?: (app: never) => void | Promise<void>; down?: (app: never) => void | Promise<void> };
+  extension: {
+    name?: string;
+    state?: Readonly<Record<string, Field>>;
+    up?: (app: never) => void | Promise<void>;
+    down?: (app: never) => void | Promise<void>;
+  };
   filePath: string;
 }
+
+/** Recognized by its FORM: a value stating `up`, `down`, or the `state` members it declares. */
+export function isExtension(value: unknown): value is ExtensionEntry['extension'] {
+  const shape = value as { up?: unknown; down?: unknown; state?: unknown } | null;
+
+  return typeof shape?.up === 'function' || typeof shape?.down === 'function'
+    || (typeof shape?.state === 'object' && shape.state !== null);
+}

package/src/descriptor/FrondDescriptor.ts

@@ -63,3 +63,10 @@ export interface FrondDescriptor {
     rest?: { method?: string; path?: string; status?: number };
   }>;
 }
+
+/** Recognized by its FORM, like everything a config holds: a name and the lists every frond carries. */
+export function isFrondDescriptor(value: unknown): value is FrondDescriptor {
+  const shape = value as Partial<Record<keyof FrondDescriptor, unknown>> | null;
+
+  return typeof shape?.name === 'string' && Array.isArray(shape.entities) && Array.isArray(shape.handlers);
+}

package/src/dispatch/ArgumentResolver.ts

@@ -1,6 +1,7 @@
 import type { InvocationContext } from '../wire/InvocationContext.js';
 import type { BindingPlan } from '../wire/binding.js';
 import type { CollectorLookup } from './CollectorLookup.js';
+import { collectedAs } from '../prefab/collector.js';
 
 /** Resolves an operation's declared binding plan against one invocation. */
 export class ArgumentResolver {
@@ -13,7 +14,7 @@ export class ArgumentResolver {
       switch (binding.source.kind) {
         case 'collector': {
           const collector = this.collectors?.(binding.source.typeName);
-          args.push(collector ? await collector.collect(ctx) : undefined);
+          args.push(collector ? collectedAs(collector, await collector.collect(ctx)) : undefined);
           break;
         }
         case 'context': {

package/src/dispatch/Facade.ts

@@ -3,6 +3,7 @@ import { type AppMiddleware } from '../wire/AppMiddleware.js';
 import type { EffectiveOperationsMap } from '../EffectiveOperationsMap.js';
 import type { HandlerEntry } from '../descriptor/HandlerEntry.js';
 import type { PresenterEntry } from '../descriptor/PresenterEntry.js';
+import type { StateShape } from '../wire/StateShape.js';
 
 /** What boot resolved around one handler, beyond the handler and the scope it resolves in. */
 export interface Facade {
@@ -22,4 +23,6 @@ export interface Facade {
   presenterScope: Container;
   /** The middlewares that apply to this address, read at call time and never at boot. */
   middlewares: () => AppMiddleware[];
+  /** What a call's `state` may hold in this process. */
+  state: StateShape;
 }