@fougere/core 0.18.0-alpha.0 → 0.19.1-alpha.0

package/src/boot/Emissions.ts

@@ -172,8 +172,16 @@ export class Emissions {
     return (this.subscribers.get(fact) ?? []).map(({ facade }) => facade);
   }
 
+  /**
+   * What a listener is handed a fact through: the calls a door makes, never the facade code
+   * holds. A fact arrives as the invocation's input and the listener's binding plan places it,
+   * wherever it sits in the signature.
+   */
+  private calls: (facade: string) => Record<string, Function> | undefined = () => undefined;
+
   /** Register one emission value per fact — announced here, or merely listened to. */
-  register(): void {
+  register(calls: (facade: string) => Record<string, Function> | undefined): void {
+    this.calls = calls;
     this.orderPipes();
     for (const fact of new Set([...this.announced, ...this.subscribers.keys()])) {
       this.container.registerValue(emitKeyOf(fact), (raw: unknown) => this.announce(fact, raw));
@@ -295,8 +303,7 @@ export class Emissions {
   private async finished(fact: string, payload: unknown): Promise<unknown> {
     let carried = payload;
     for (const link of this.pipes.get(fact) ?? []) {
-      const facade = this.container.resolve<Record<string, Function>>(link.facade);
-      const answered = await facade[link.op]({ ...Invocation.empty, input: carried });
+      const answered = await this.reach(link.facade, fact)[link.op]({ ...Invocation.empty, input: carried });
 
       // A link that answers nothing SUPPRESSES the fact — every subscriber was then handed
       // `null` and crashed reading it, one message each. It is refused rather than named,
@@ -377,18 +384,18 @@ export class Emissions {
       facade,
       op,
       done: ambient.enterChain(fact, async () => {
-        let handler: Record<string, Function>;
-        try {
-          handler = this.container.resolve<Record<string, Function>>(facade);
-        } catch (cause) {
-          throw new Error(`${fact} → ${facade} could not be reached`, { cause });
-        }
-
-        return handler[op]({ ...Invocation.empty, input: payload });
+        return this.reach(facade, fact)[op]({ ...Invocation.empty, input: payload });
       }),
     }));
   }
 
+  private reach(facade: string, fact: string): Record<string, Function> {
+    const calls = this.calls(facade);
+    if (!calls) throw new Error(`${fact} → ${facade} could not be reached`);
+
+    return calls;
+  }
+
   /** A subscriber refusing the SHAPE, said in one line instead of dumped as an error. */
   private describeRefusal(fact: string, cause: unknown): string | undefined {
     const refusals = validationErrorsOf(cause);

package/src/boot/bootstrap.ts

@@ -57,7 +57,8 @@ import { LocalRoutePolicy } from '../dispatch/LocalRoutePolicy.js';
 import { OperationRoute } from '../dispatch/OperationRoute.js';
 import { remoteRoutes } from '../dispatch/remoteRoutes.js';
 import { RouteRegistry } from '../dispatch/RouteRegistry.js';
-import { facadeOperations } from '../entry/facade.js';
+import { callOperations, facadeOperations } from '../entry/facade.js';
+import { decoded } from '../dispatch/decoded.js';
 
 const LOG_LINE = lowerFirst(LogLine.name);
 
@@ -403,6 +404,7 @@ interface Serving {
   container: Container;
   fronds: Fronds;
   remoteRouter: RemoteRouter | undefined;
+  dispatcher: Dispatcher;
   localDispatcher: Dispatcher;
   routeRegistry: RouteRegistry;
   effectiveByKey: Map<string, EffectiveOperationsMap>;
@@ -415,7 +417,7 @@ interface Serving {
  * `facadeFor` is THE rule, stated once: every projection reads it and nothing else.
  */
 function readings(
-  { container, fronds, remoteRouter, localDispatcher, routeRegistry, effectiveByKey, log }: Serving,
+  { container, fronds, remoteRouter, dispatcher, localDispatcher, routeRegistry, effectiveByKey, log }: Serving,
 ): Pick<App, 'resolve' | 'schemaFor' | 'facadeFor' | 'operationsFor' | 'presenterFor'> {
   const resolve = <T>(name: string): T => {
     try {
@@ -454,6 +456,19 @@ function readings(
     }
   };
 
+  /**
+   * What a door is handed for an address it may serve: the calls, not the facade code holds.
+   * The names are the routes this process registered; an address served elsewhere has none
+   * before it is reached, so its calls are named when they are made.
+   */
+  const callsAt = (address: string, surface: string | undefined, through: Dispatcher): Record<string, Function> => {
+    const names = routeRegistry.operationNames(address, surface);
+    if (names.length === 0) return callOperations(through, address, undefined, surface);
+    const effective = effectiveByKey.get(facadeKeyOf(address, surface));
+
+    return callOperations(through, address, names, surface, (operation, answer) => decoded(effective?.get(operation)?.output, answer));
+  };
+
   /** Said once per pair, so a facade that registers in a loop says it once. */
   const saidAbsent = new Set<string>();
 
@@ -474,9 +489,9 @@ function readings(
 
   /** THE membership rule, stated once — every projection reads this and nothing else. */
   const facadeFor = (address: string, surface?: string): Record<string, Function> | undefined => {
-    if (!surface) return facadeAt(facadeKeyOf(address), true);
+    if (!surface) return facadeAt(facadeKeyOf(address), true) && callsAt(address, undefined, dispatcher);
 
-    const own = facadeAt(facadeKeyOf(address, surface), false);
+    const own = facadeAt(facadeKeyOf(address, surface), false) && callsAt(address, surface, localDispatcher);
     if (!fronds.owner(address)) {
       sayNoSurfaceAcross(address, surface);
 
@@ -490,7 +505,7 @@ function readings(
     const fallback = facadeAt(facadeKeyOf(address), false);
 
     return fallback
-      ? facadeOperations(
+      ? callOperations(
           localDispatcher,
           address,
           routeRegistry.operationNames(address, surface),
@@ -696,17 +711,17 @@ export async function createApp(options: CreateAppOptions): Promise<App> {
     refuseWhatDoesNotHold(refused);
     warnAboutUnboundPorts(options, boundPorts, log);
 
+    const { resolve, schemaFor, facadeFor, operationsFor, presenterFor } = readings({
+      container, fronds, remoteRouter, dispatcher, localDispatcher, routeRegistry, effectiveByKey, log,
+    });
+
     // A pipe order and an `Emit<T, A>` are read here, once every facade exists.
-    emissions.register();
+    emissions.register((facade) => facadeFor(addressOf(facade)));
     refuseWhatDoesNotHold(refused);
     markLineCarriers(emissions);
 
     const answeredElsewhere = remoteRouter ? answerRemotes(assembly, remoteRouter, fronds) : () => false;
 
-    const { resolve, schemaFor, facadeFor, operationsFor, presenterFor } = readings({
-      container, fronds, remoteRouter, localDispatcher, routeRegistry, effectiveByKey, log,
-    });
-
     const app: App = {
       container,
       fronds,

package/src/boot/card.ts

@@ -2,12 +2,11 @@
 import { Card } from '@fougere/schema';
 import type { App } from './App.js';
 import { factsAnnouncedBy } from '../wire/Emit.js';
-import type { InvocationContext } from '../wire/InvocationContext.js';
 import { type CardOp } from '../wire/card/CardOp.js';
 import { type IdentityCard } from '../wire/card/IdentityCard.js';
 import { facadeKeyOf } from '../wire/Facade.js';
 
-type AnyFacade = Record<string, (invocation?: InvocationContext) => Promise<unknown>>;
+type AnyFacade = Record<string, (...args: unknown[]) => Promise<unknown>>;
 
 /** Serialize what the app hosts, for one audience. */
 export function identityCardOf(app: App, surface?: string): IdentityCard {

package/src/boot/install.ts

@@ -434,6 +434,7 @@ function buildFacadeInto(
     frond: frond.name,
     handlers: frond.handlers,
     operations: operationModel.forHandler(handler),
+    entities: (name) => assembly.entityByName.get(lowerFirst(name)),
     collectors: collectorTypeNames,
     presenter: presenterMap.get(handler.address),
     presenterScope: scope,

package/src/boot/ownership.ts

@@ -4,7 +4,7 @@ import { type ProviderEntry } from '../descriptor/ProviderEntry.js';
 import { inheritsCrud } from '../prefab/CrudConstructor.js';
 import { targetOf } from '../prefab/prefab.js';
 import { ownedBy, repositoryKeyOf } from '../prefab/RepositoryConstructor.js';
-import { entityOfStorageKey } from '../storage/Storage.js';
+import { entityOfStorageKey, membersOfTogetherKey } from '../storage/Storage.js';
 import type { Diagnostic } from '../diagnostic.js';
 
 /** One name, one file: two providers under one key and the second silently replaces the first. */
@@ -129,23 +129,16 @@ function refuseStorageReached(
   const allowed = decl.kind === 'provider' ? builtOn(decl.ctor) : [];
 
   for (const dep of decl.deps) {
-    const entity = entityOfStorageKey(dep, known);
-    if (!entity) continue;
-
-    const owner = owners.get(entity);
-    if (owner && owner !== decl.ctor.name) {
-      refused.push({
-        severity: 'blocking',
-        code: 'aggregate-storage-reached',
-        filePath: decl.filePath,
-        frond,
-        subject: `${decl.ctor.name}(${dep})`,
-        message: `${decl.ctor.name} asks for ${dep}, and ${owner} owns ${entity}. Nothing else `
-          + `reaches an owned entity's storage — name the operation on ${owner} and ask for it: `
-          + `constructor(private ${entity}: ${owner}) {}`,
-      });
+    const framed = membersOfTogetherKey(dep);
+    if (framed) {
+      const members = framed.entities.map(lowerFirst).filter(known);
+      for (const entity of members) reachesOwned(decl, dep, entity, frond, owners, refused);
       continue;
     }
+
+    const entity = entityOfStorageKey(dep, known);
+    if (!entity) continue;
+    if (reachesOwned(decl, dep, entity, frond, owners, refused)) continue;
     if (allowed.includes(entity)) continue;
 
     refused.push({
@@ -162,6 +155,32 @@ function refuseStorageReached(
   }
 }
 
+/** Whether `dep` reaches an entity an aggregate other than `decl` owns — a frame as much as a storage. */
+function reachesOwned(
+  decl: { ctor: { name: string }; filePath: string },
+  dep: string,
+  entity: string,
+  frond: string,
+  owners: Map<string, string>,
+  refused: Diagnostic[],
+): boolean {
+  const owner = owners.get(entity);
+  if (!owner || owner === decl.ctor.name) return false;
+
+  refused.push({
+    severity: 'blocking',
+    code: 'aggregate-storage-reached',
+    filePath: decl.filePath,
+    frond,
+    subject: `${decl.ctor.name}(${dep})`,
+    message: `${decl.ctor.name} asks for ${dep}, and ${owner} owns ${entity}. Nothing else `
+      + `reaches an owned entity's storage — name the operation on ${owner} and ask for it: `
+      + `constructor(private ${entity}: ${owner}) {}`,
+  });
+
+  return true;
+}
+
 export function storageInUserCode(
   frond: FrondDescriptor,
   owners: Map<string, string>,

package/src/diagnostic.ts

@@ -1,3 +1,5 @@
+import { BootRefusal } from './BootRefusal.js';
+
 /**
  * One thing that does not hold, in the terms of whoever has to fix it — raised by the scan,
  * by a boot rule, or by `fougere check`, which is why it belongs to no phase.
@@ -30,12 +32,12 @@ export interface Diagnostic {
  * Every blocking diagnostic in ONE refusal, so a boot names all of them rather than the
  * first — the shape `fougere check` renders, read back by whoever has to fix it.
  */
-export function refusalOf(diagnostics: readonly Diagnostic[], what: string): Error | undefined {
+export function refusalOf(diagnostics: readonly Diagnostic[], what: string): BootRefusal | undefined {
   const blocking = diagnostics.filter((one) => one.severity === 'blocking');
   if (blocking.length === 0) return undefined;
 
   const lines = blocking.map((one) =>
     `  [${one.code}]${one.subject ? ` ${one.subject}` : ''}\n    ${one.message}\n    ${one.filePath}`);
 
-  return new Error(`Fougere boot refused: ${blocking.length} ${what}:\n${lines.join('\n')}`);
+  return new BootRefusal(`Fougere boot refused: ${blocking.length} ${what}:\n${lines.join('\n')}`);
 }

package/src/dispatch/ArgumentResolver.ts

@@ -1,15 +1,21 @@
+import { FieldValueValidator, type SchemaView } from '@fougere/schema';
 import type { InvocationContext } from '../wire/InvocationContext.js';
 import type { BindingPlan } from '../wire/binding.js';
 import { ErrorCode } from '../wire/ErrorCode.js';
 import { FougereError } from '../wire/FougereError.js';
 import type { CollectorLookup } from './CollectorLookup.js';
+import type { EntityLookup } from './EntityLookup.js';
 import { collectedAs } from '../prefab/collector.js';
+import { validateInput } from './validateInput.js';
 
 type ParamSource = Extract<BindingPlan[number]['source'], { kind: 'param' }>;
 
 /** Resolves an operation's declared binding plan against one invocation. */
 export class ArgumentResolver {
-  constructor(private readonly collectors?: CollectorLookup) {}
+  constructor(
+    private readonly collectors?: CollectorLookup,
+    private readonly entities?: EntityLookup,
+  ) {}
 
   async resolve(plan: BindingPlan, ctx: InvocationContext): Promise<unknown[]> {
     const args: unknown[] = [];
@@ -26,7 +32,7 @@ export class ArgumentResolver {
           break;
         }
         case 'param': {
-          args.push(ArgumentResolver.param(binding.source, binding.optional, ctx));
+          args.push(this.judged(binding.source, ArgumentResolver.param(binding.source, binding.optional, ctx)));
           break;
         }
         case 'fact':
@@ -56,6 +62,39 @@ export class ArgumentResolver {
     return args;
   }
 
+  /**
+   * The arguments code wrote, judged where a door would have judged them: the input against
+   * the op's view, a value a collector would have produced through that collector's entity —
+   * which also puts back a `Date` that crossed a wire as text. Nothing is collected: what the
+   * caller left out stays out.
+   */
+  given(plan: BindingPlan, input: SchemaView | undefined, ctx: InvocationContext): unknown[] {
+    const args = ctx.args ?? [];
+
+    return plan.map((binding, index) => {
+      const value = args[index];
+      switch (binding.source.kind) {
+        case 'context':
+          return ctx;
+        case 'input':
+        case 'fact':
+        case 'pipe':
+          return validateInput(input, { ...ctx, input: value }).input;
+        case 'collector': {
+          const collector = this.collectors?.(binding.source.typeName);
+
+          return collector ? collectedAs(collector, value) : value;
+        }
+        case 'param':
+          if (value === undefined && !binding.optional) throw refused(binding.source.name, 'Required');
+
+          return this.judged(binding.source, value);
+        case 'query':
+          return value;
+      }
+    });
+  }
+
   /**
    * A value the caller typed in a path or a query string. `null` is a value, not a miss: only
    * `undefined` means absent, so `T | null` stays apart from `T | undefined`.
@@ -77,6 +116,19 @@ export class ArgumentResolver {
     return coerced;
   }
 
+  /** `age: Sample['age']` obeys what `Sample.age` declares, after the query string was read. */
+  private judged(source: ParamSource, value: unknown): unknown {
+    if (value === undefined || !source.field) return value;
+
+    const field = this.entities?.(source.field.entity)?.getFields()[source.field.name];
+    if (!field) return value;
+
+    const verdict = FieldValueValidator.of(field).parse(value);
+    if ('message' in verdict) throw refused(source.name, verdict.message);
+
+    return verdict.value;
+  }
+
   private static number(value: unknown): number | undefined {
     if (typeof value === 'number') return Number.isNaN(value) ? undefined : value;
     if (typeof value !== 'string' || value.trim() === '') return undefined;

package/src/dispatch/EntityLookup.ts

@@ -0,0 +1,4 @@
+import type { SchemaView } from '@fougere/schema';
+
+/** An entity this process knows, by the name a type wrote — `Post` in `Post['id']`. */
+export type EntityLookup = (name: string) => SchemaView | undefined;

package/src/dispatch/Facade.ts

@@ -5,6 +5,7 @@ import type { HandlerEntry } from '../descriptor/HandlerEntry.js';
 import type { PresenterEntry } from '../descriptor/PresenterEntry.js';
 import type { StateShape } from '../wire/StateShape.js';
 import type { OwnLogger } from '../builtin/OwnLoggers.js';
+import type { EntityLookup } from './EntityLookup.js';
 
 /** What boot resolved around one handler, beyond the handler and the scope it resolves in. */
 export interface Facade {
@@ -16,6 +17,8 @@ export interface Facade {
   handlers: readonly HandlerEntry[];
   /** The canonical operation table resolved before boot performs any side effect. */
   operations: EffectiveOperationsMap;
+  /** Where a parameter typed `Post['title']` finds the rules of `title`. */
+  entities: EntityLookup;
   /** Entity names this frond has a collector for. */
   collectors: Set<string>;
   /** The presenter over this handler's entity, when the frond declares one. */

package/src/dispatch/HandlerFacade.ts

@@ -35,9 +35,7 @@ export class HandlerFacade {
   private instance: any;
   private readonly implementationKeys = new Map<string, string>();
   private readonly implementationInstances = new Map<string, any>();
-  private readonly arguments = new ArgumentResolver(
-    (typeName) => this.collectorResolver(typeName),
-  );
+  private readonly arguments: ArgumentResolver;
   /** A computed field's parameters and the collectors in scope are both boot-time facts. */
   private readonly presenterPlans: Map<string, BindingPlan>;
 
@@ -52,6 +50,7 @@ export class HandlerFacade {
     private readonly facade: Facade,
   ) {
     this.refuseCrudWithoutRepository(handler);
+    this.arguments = new ArgumentResolver((typeName) => this.collectorResolver(typeName), facade.entities);
 
     this.presenterPlans = facade.presenter
       ? presenterPlans(facade.presenter, facade.collectors)
@@ -124,22 +123,31 @@ export class HandlerFacade {
     entered: Record<string, unknown>,
   ): Promise<unknown> {
     const state = this.facade.state.judge(context.state, this.handler.address, op, entered);
-    const validated = validateInput(contract.input, { ...invocation, state });
+    const written = invocation.args !== undefined;
+    const validated = written ? { ...invocation, state } : validateInput(contract.input, { ...invocation, state });
     context.invocation = validated;
 
-    const args = contract.binding ? await this.arguments.resolve(contract.binding, validated) : [];
+    const args = await this.argumentsOf(contract, validated);
     const { instance, method } = this.resolveImplementation(op);
     const answered = await instance[method](...args);
 
     const view = this.viewOf(op);
     const { presenter } = this.facade;
-    const computed = view.closed || !presenter
+    const computed = written || view.closed || !presenter
       ? answered
       : await this.present(op, presenter, answered, validated);
 
     return view.project(computed);
   }
 
+  /** What code wrote, judged; or what a door received, read through the binding plan. */
+  private async argumentsOf(contract: OperationContract, invocation: InvocationContext): Promise<unknown[]> {
+    if (!contract.binding) return [];
+    if (invocation.args !== undefined) return this.arguments.given(contract.binding, contract.input, invocation);
+
+    return this.arguments.resolve(contract.binding, invocation);
+  }
+
   /**
    * The computed fields a presenter adds, over the rows the handler answered and BEFORE the
    * view projects them. A presenter runs on the server, so what it reads is the row the

package/src/entry/facade.ts

@@ -3,6 +3,7 @@ import { Call } from '../wire/Call.js';
 import { RouteAddress } from '../wire/RouteAddress.js';
 import type { DispatchPort } from '../dispatch/DispatchPort.js';
 import type { Received } from '../dispatch/Received.js';
+import type { PartialInvocation } from '../wire/PartialInvocation.js';
 
 type Operation = (...args: any[]) => unknown;
 
@@ -24,11 +25,14 @@ export function dynamicOperations(operation: (name: string) => Operation): Recor
 }
 
 /**
- * Turns facade method calls into canonical dispatches.
+ * The facade code calls: each operation takes the handler's own arguments.
  *
  * `received` is what this side puts back before handing the answer over: a row leaves as data
  * and `date-time` means a `Date` on both sides. A facade built without one hands over what the
  * wire carried, which is what a caller holding no schema can do.
+ *
+ * The trailing `undefined`s are dropped because a JSON array writes them `null`, and the far
+ * side would read a value where the caller left one out. An optional parameter is always last.
  */
 export function facadeOperations(
   dispatcher: DispatchPort,
@@ -37,7 +41,30 @@ export function facadeOperations(
   surface?: string,
   received?: Received,
 ): Record<string, Operation> {
-  const operation = (name: string): Operation => async (invocation) => {
+  const send = sending(dispatcher, address, surface, received);
+
+  return operationsOf((name) => (...args: unknown[]) => send(name, { args: withoutTrailingAbsence(args) }), operationNames);
+}
+
+/**
+ * What a door sends: the invocation it received, as a `Call`. A door holds a request, not the
+ * handler's arguments, so the binding plan reads it on the far side — collectors and presenter
+ * included.
+ */
+export function callOperations(
+  dispatcher: DispatchPort,
+  address: string,
+  operationNames?: Iterable<string>,
+  surface?: string,
+  received?: Received,
+): Record<string, Operation> {
+  const send = sending(dispatcher, address, surface, received);
+
+  return operationsOf((name) => (invocation?: PartialInvocation) => send(name, invocation), operationNames);
+}
+
+function sending(dispatcher: DispatchPort, address: string, surface?: string, received?: Received) {
+  return async (name: string, invocation?: PartialInvocation): Promise<unknown> => {
     const answer = await dispatcher.dispatch(new Call(
       new RouteAddress({
         address,
@@ -49,8 +76,17 @@ export function facadeOperations(
 
     return received ? received(name, answer) : answer;
   };
+}
 
+function operationsOf(operation: (name: string) => Operation, operationNames?: Iterable<string>): Record<string, Operation> {
   return operationNames
     ? Object.fromEntries([...operationNames].map((name) => [name, operation(name)]))
     : dynamicOperations(operation);
 }
+
+function withoutTrailingAbsence(args: unknown[]): unknown[] {
+  let length = args.length;
+  while (length > 0 && args[length - 1] === undefined) length--;
+
+  return args.slice(0, length);
+}

package/src/index.ts

@@ -23,6 +23,7 @@ export type { CrudConstructor } from './prefab/CrudConstructor.js';
 export type { CrudOpName } from './prefab/CrudOpName.js';
 export type { CrudOps } from './prefab/CrudOps.js';
 export type { CrudViews } from './prefab/CrudViews.js';
+export { Middleware } from './prefab/Middleware.js';
 export { Mirror } from './prefab/MirrorConstructor.js';
 export type { MirrorConstructor } from './prefab/MirrorConstructor.js';
 export type { MirrorOf } from './prefab/MirrorOf.js';
@@ -140,6 +141,7 @@ export type { App } from './boot/App.js';
 export type { CreateAppOptions } from './boot/CreateAppOptions.js';
 export type { ScanResult } from './scan.js';
 export type { Diagnostic } from './diagnostic.js';
+export { BootRefusal } from './BootRefusal.js';
 export { DEFAULT_CONVENTIONS, frondDirsOf, frondPackage, providerDirsOf, resolveConventions, type Conventions } from './Conventions.js';
 export { type ConventionsInput } from './ConventionsInput.js';
 export type { CollectorEntry } from './descriptor/CollectorEntry.js';

package/src/prefab/CrudConstructor.ts

@@ -30,14 +30,14 @@ export function subjectOf(ctor: unknown, address: string): string {
 }
 
 /** The id of the row an op acts on — `id: Post['id']`, which a route places before the op. */
-const byId = (entity: string) =>
-  ({ name: 'id', source: { kind: 'param' as const, name: 'id', identifies: entity }, optional: false });
+const byId = (entity: string, field: string) =>
+  ({ name: 'id', source: { kind: 'param' as const, name: 'id', field: { entity, name: field }, identifies: entity }, optional: false });
 
 const fromBody = { name: 'input', source: { kind: 'input' as const }, optional: false };
 
 /** The same five, written as the scan would have written them. */
 const idParam = (entity: string, field: string) =>
-  ({ name: 'id', type: { raw: `${entity}['${field}']`, name: 'string', identifies: { entity, field } } });
+  ({ name: 'id', type: { raw: `${entity}['${field}']`, name: 'string', field: { entity, name: field }, identifies: entity } });
 
 const inputParam = (entity: string) => ({ name: 'input', type: { raw: `Partial<${entity}>`, name: entity } });
 
@@ -52,8 +52,9 @@ const returns = (raw: string, name: string, extra?: { array?: boolean; nullable?
 function crudOps(entity: SchemaView & { partial?: () => SchemaView }): Record<string, OperationContract> {
   const name = (entity as { name?: string }).name ?? 'Entity';
   const input = inputParam(name);
-  const id = byId(name);
-  const idSignature = idParam(name, FieldSet.of(entity.getFields()).primary ?? 'id');
+  const primary = FieldSet.of(entity.getFields()).primary ?? 'id';
+  const id = byId(name, primary);
+  const idSignature = idParam(name, primary);
 
   return {
     list: {

package/src/prefab/Middleware.ts

@@ -0,0 +1,13 @@
+import type { AppNext } from '../wire/AppNext.js';
+import type { OperationContext } from '../wire/OperationContext.js';
+
+/**
+ * What runs around every operation of its frond, and of the fronds under it — a class in
+ * `middlewares/` that extends this one.
+ *
+ * It answers what `next()` answered, the same type: a caller reads the handler's signature,
+ * and nothing tells that signature a middleware stood in the way.
+ */
+export abstract class Middleware {
+  abstract around<T>(context: OperationContext, next: AppNext<T>): Promise<T>;
+}

package/src/wire/Facade.ts

@@ -1,23 +1,20 @@
 import { lowerFirst } from '@fougere/schema';
 
-import type { InvocationContext } from './InvocationContext.js';
-
 /**
  * The facade built in front of a handler — the framework's second port, after `Storage`.
  *
- * What the handler knows is WHICH operations exist and what each one answers. The two ends are
- * the port's own: an invocation goes in where the handler takes positional arguments, and a
- * promise comes back where the handler may answer a bare value. A facade is a crossing, and a
- * crossing is awaited before any transport — the dispatch resolves a route, runs the middlewares
- * and awaits the collectors, so `readLocation(): string` was typed as answering now and never did.
+ * It takes what the handler takes: code calling it already holds the values, so nothing is
+ * collected for it and nothing is presented — that is a door's work, done on what a door
+ * received. A promise comes back where the handler may answer a bare value, because a facade
+ * is a crossing and a crossing is awaited, whether or not a transport carries it.
  *
  * `Awaited` because a promise does not stack: `Promise.resolve(p)` IS `p`, so writing
  * `Promise<R>` over an async handler would describe a `Promise<Promise<Post>>` that no value can
  * have — `.then` would hand its callback a promise the runtime never delivers.
  */
 export type Facade<T> = {
-  [K in keyof T]: T[K] extends (...args: never[]) => infer R
-    ? (invocation?: InvocationContext) => Promise<Awaited<R>>
+  [K in keyof T]: T[K] extends (...args: infer A) => infer R
+    ? (...args: A) => Promise<Awaited<R>>
     : never;
 };
 

package/src/wire/Invocation.ts

@@ -31,6 +31,7 @@ export class Invocation implements InvocationContext {
   readonly params: Record<string, unknown>;
   readonly query: Record<string, unknown>;
   readonly input: unknown;
+  readonly args?: readonly unknown[];
   readonly state: Record<string, unknown>;
   readonly trace?: string;
   readonly identity?: string;
@@ -38,11 +39,12 @@ export class Invocation implements InvocationContext {
   readonly runAt?: number;
   readonly crossed?: true;
 
-  /** Gives every entry and every transport the same nine-member value, frozen. */
+  /** Gives every entry and every transport the same ten-member value, frozen. */
   private constructor(context: PartialInvocation) {
     this.params = canonicalRecord(context.params);
     this.query = canonicalRecord(context.query);
     this.input = canonicalValue(context.input);
+    if (context.args !== undefined) this.args = canonicalValue(context.args) as readonly unknown[];
     // State is host-owned and may still be enriched by existing middlewares. Moving it
     // to immutable lifecycle context is a separate migration.
     this.state = context.state ?? {};

package/src/wire/InvocationContext.ts

@@ -2,6 +2,12 @@ export interface InvocationContext {
   params: Record<string, unknown>;
   query: Record<string, unknown>;
   input: unknown;
+  /**
+   * The handler's own arguments, written by code that called its facade. A door writes
+   * `params`, `query` and `input` — what it received — and the binding plan reads them; code
+   * already holds the values, so nothing is collected and nothing is presented.
+   */
+  args?: readonly unknown[];
   state: Record<string, unknown>;
   trace?: string;
   identity?: string;

package/src/wire/OperationContract.ts

@@ -49,8 +49,8 @@ const PRIMITIVE_RETURNS = new Set(['boolean', 'string', 'number', 'void', 'undef
 
 /** Deliberately finite. */
 const QUERY_VERBS = new Set([
-  'all', 'check', 'count', 'exists', 'fetch', 'find', 'get', 'has', 'health', 'list',
-  'load', 'mine', 'ping', 'quote', 'read', 'search', 'stats', 'status', 'who',
+  'all', 'can', 'check', 'count', 'exists', 'fetch', 'find', 'get', 'has', 'health', 'is',
+  'list', 'load', 'mine', 'ping', 'quote', 'read', 'search', 'stats', 'status', 'who',
 ]);
 
 /**