@fougere/core 0.5.0-alpha.0 → 0.6.0-alpha.0

package/src/boot/boot.ts

@@ -32,12 +32,12 @@ interface BootOptions {
    */
   onEmit?: CreateAppOptions['onEmit'];
   /**
-   * ORM setup — returns the storage handle (db), an ormFactory, and its two halves.
+   * storage setup — returns the storage handle (db), an storageFactory, and its two halves.
    * The `db` value is forwarded to the auth provider via AuthContext when `auth` is set.
    */
   db?: (config: FougereConfig) => {
     db?: unknown;
-    ormFactory: CreateAppOptions['ormFactory'];
+    storageFactory: CreateAppOptions['storageFactory'];
     /**
      * Bring the schema up to date — an extension's `up`, because it runs after the
      * container. It used to be called `afterBoot`, a word that also meant the host's
@@ -88,7 +88,7 @@ export async function boot(options: BootOptions): Promise<App> {
     // handed the answer and reaches for nothing.
     scan: await scanProject(root, options.fronds, config.conventions),
     createContainer: options.createContainer,
-    ormFactory: dbSetup?.ormFactory,
+    storageFactory: dbSetup?.storageFactory,
     db: dbSetup?.db,
     auth: config.auth,
     remotes: options.remotes,

package/src/boot/bootstrap.ts

@@ -1,6 +1,6 @@
 import type { Container } from '@fougere/container';
 import { lowerFirst, type SchemaView } from '@fougere/schema';
-import type { EntityEntry, HandlerEntry, PresenterEntry } from '../scan/frond.js';
+import type { EntityEntry, HandlerEntry, PresenterEntry } from '../descriptor/frond.js';
 import { hostedBy } from './hosted.js';
 import type { AuthRuntime } from './auth.js';
 import type { CreateAppOptions, App } from './types.js';
@@ -12,7 +12,7 @@ import { registerFrames } from './together.js';
 import { Emissions } from './Emissions.js';
 import { HandlerFacade } from './HandlerFacade.js';
 import { targetOf } from '../prefab/prefab.js';
-import { ownersOf, refuseOrmInUserCode, refuseCrudOnOwned } from './ownership.js';
+import { ownersOf, refuseStorageInUserCode, refuseCrudOnOwned } from './ownership.js';
 import type { OperationContract, OperationsMap } from '../wire/operation.js';
 import {
   resolveEffectiveOperations,
@@ -22,10 +22,11 @@ import { StorageGuard } from '../dispatch/StorageGuard.js';
 import { portBindings } from './ports.js';
 import { InFlight } from '../dispatch/InFlight.js';
 // The keys, each read from where its concept is declared — never respelled here.
-import { facadeKeyOf, contractsKeyOf, identityCardOf, type RpcAnswer } from '../wire/call.js';
+import { facadeKeyOf, contractsKeyOf, type RpcAnswer } from '../wire/call.js';
+import { identityCardOf } from './card.js';
 import { AppLifecycle } from './AppLifecycle.js';
 import { repositoryKeyOf } from '../prefab/repository.js';
-import { ormKeyOf } from '../orm.js';
+import { storageKeyOf } from '../storage.js';
 import { presenterKeyOf } from '../prefab/presenter.js';
 import { collectorKeyOf } from '../prefab/collector.js';
 import { RouteAddress } from '../contract/RouteAddress.js';
@@ -112,6 +113,16 @@ export async function createApp(options: CreateAppOptions): Promise<App> {
   // no builtin and a Worker can run what it builds.
   const scanStart = performance.now();
   const { fronds, diagnostics } = await hostedBy(options);
+  // An app that states nothing AND scans nothing is a mistake — unless something else it
+  // declares brings its own entities, which an auth provider does. Refused here and not in
+  // `hostedBy`, which is handed the frond sources and cannot see the rest of the app. The
+  // condition is the KEYS, not the count: a scan that found nothing is an ordinary answer.
+  if (!options.fronds && !options.scan && !options.auth) {
+    throw new Error(
+      'createApp needs `fronds:` (what this app states) or `scan:` (what a scanner found). '
+      + 'Neither was given, and nothing else declares entities of its own.',
+    );
+  }
   const operationModel = resolveEffectiveOperations(fronds, {
     diagnostics,
     remotes: options.remotes,
@@ -152,11 +163,11 @@ export async function createApp(options: CreateAppOptions): Promise<App> {
 
   // Auth runtime — built once from the lazy AuthConfig produced by a provider factory
   // (e.g. betterAuth({...})) in fougere.config.ts. The provider receives our db +
-  // ormFactory so all auth writes flow through EntityOrm.
+  // storageFactory so all auth writes flow through Storage.
   let authRuntime: AuthRuntime | undefined;
   if (options.auth) {
-    if (!options.ormFactory) {
-      throw new Error('createApp: `auth` is set but `ormFactory` is missing — auth providers need it to back their adapter.');
+    if (!options.storageFactory) {
+      throw new Error('createApp: `auth` is set but `storageFactory` is missing — auth providers need it to back their adapter.');
     }
     if (options.db === undefined) {
       throw new Error('createApp: `auth` is set but `db` is missing — pass the storage handle through CreateAppOptions.db.');
@@ -164,7 +175,7 @@ export async function createApp(options: CreateAppOptions): Promise<App> {
     log.info('initializing auth runtime');
     authRuntime = await options.auth.create({
       db: options.db,
-      ormFactory: options.ormFactory,
+      storageFactory: options.storageFactory,
     });
     log.info(`auth ready — mounted at ${authRuntime.basePath}`);
   }
@@ -254,14 +265,14 @@ export async function createApp(options: CreateAppOptions): Promise<App> {
     // `reads:` is what makes a cross-source reader exist here, and the list IS its
     // environment — a source holding none of these is never opened. Registered under
     // the type's own name, which is the key `depKeyOf` already derives for a plain
-    // parameter: `constructor(private sources: Sources)` and nothing else to say.
+    // parameter: `constructor(private reads: Reads)` and nothing else to say.
     // Declaring `reads:` with nothing to build the reader is a boot that ignores a
-    // clause: the handler asking for `Sources` then dies at its first call, on a
+    // clause: the handler asking for `Reads` then dies at its first call, on a
     // container message that names neither the clause nor what is missing.
     if (frond.reads?.length && !options.sourcesFactory) {
       frondLog.warn(
         `[reads] ${frond.reads.join(', ')} — declared in frond.config.ts, but this boot passes no `
-        + '`sourcesFactory`, so no reader is registered and a handler asking for `Sources` will fail '
+        + '`sourcesFactory`, so no reader is registered and a handler asking for `Reads` will fail '
         + 'at its first call. Pass one (`@fougere/adapter-duckdb`), or drop the clause.',
       );
     }
@@ -280,14 +291,14 @@ export async function createApp(options: CreateAppOptions): Promise<App> {
           + 'so a query naming one would find no table. Check the spelling, or the entity file.',
         );
       }
-      scope.registerValue('Sources', await options.sourcesFactory(named, frond.name));
+      scope.registerValue('Reads', await options.sourcesFactory(named, frond.name));
       frondLog.debug(`cross-source reader over ${named.length} entit(ies)`);
     }
 
     // Who owns what, and the rule that makes owning mean something. Before anything is
     // registered, so a bad line is named by this refusal rather than by the container's.
     const owners = ownersOf(frond.providers);
-    refuseOrmInUserCode(frond, owners);
+    refuseStorageInUserCode(frond, owners, (entity) => entityByName.has(entity));
     refuseCrudOnOwned(frond, owners);
 
     for (const provider of frond.providers) {
@@ -306,28 +317,28 @@ export async function createApp(options: CreateAppOptions): Promise<App> {
       frondLog.debug(`${frond.providers.length} provider(s): ${frond.providers.map((p) => p.ctor.name).join(', ')}`);
     }
 
-    // Register EntityOrm for each entity — PascalCase type name (e.g. 'PostOrm')
-    // When a handler declares Crud(Entity, Output), scope the ORM via .output(Output)
-    if (options.ormFactory) {
+    // Register Storage for each entity — PascalCase type name (e.g. 'PostStorage')
+    // When a handler declares Crud(Entity, Output), scope the storage via .output(Output)
+    if (options.storageFactory) {
       for (const entity of frond.entities) {
-        const ormName = ormKeyOf(entity.name);
-        const baseOrm = options.ormFactory(entity.entityClass, entity.name);
+        const key = storageKeyOf(entity.name);
+        const baseStorage = options.storageFactory(entity.entityClass, entity.name);
 
         // Check if the default handler (no surface) declares an output override
         const defaultHandler = frond.handlers.find((h) => h.address === entity.name && !h.surface);
         const outputSchema = defaultHandler?.outputOverride ?? (defaultHandler?.ctor as any)?.__output;
         const scoped = outputSchema && outputSchema !== entity.entityClass
-          ? baseOrm.output(outputSchema)
-          : baseOrm;
+          ? baseStorage.output(outputSchema)
+          : baseStorage;
 
         // Storage is a way out like the client surface — see `StorageGuard`.
         const guarded = new StorageGuard(entity.entityClass.getFields(), entity.name).guard(scoped);
-        scope.registerValue(ormName, guarded);
+        scope.registerValue(key, guarded);
 
         // The default repository IS the guarded port — it already answers every gesture a
         // declared one forwards, so the two forms have the same shape and a handler reads
-        // `repo.list()` either way. The wrapper that used to sit here (`{ orm: guarded }`)
-        // existed to make `repo.orm` true in both, back when `.orm` was the way in.
+        // `repo.list()` either way. The wrapper that used to sit here (`{ storage: guarded }`)
+        // existed to make `repo.storage` true in both, back when `.storage` was the way in.
         //
         // Not registered for an OWNED entity: an aggregate's members are reached through it
         // and nowhere else, and the default would be a second door under a name a handler
@@ -342,7 +353,7 @@ export async function createApp(options: CreateAppOptions): Promise<App> {
         }
       }
       if (frond.entities.length > 0) {
-        frondLog.debug(`${frond.entities.length} entity ORM(s): ${frond.entities.map((e) => e.name).join(', ')}`);
+        frondLog.debug(`${frond.entities.length} entity storage(s): ${frond.entities.map((e) => e.name).join(', ')}`);
       }
     }
 
@@ -357,7 +368,7 @@ export async function createApp(options: CreateAppOptions): Promise<App> {
         entityByName,
         frondOf,
         hostedHere: (name) => !(options.remotes && name in options.remotes),
-        ormFactory: options.ormFactory,
+        storageFactory: options.storageFactory,
         sourceOf: options.sourceOf,
         transacted: options.transacted,
         log: frondLog,
@@ -485,7 +496,7 @@ export async function createApp(options: CreateAppOptions): Promise<App> {
       const facadeKey = facadeKeyOf(handler.address);
       buildFacade(entity, handler, scope, facadeKey);
       frondLog.debug(`${facadeKey} [${Object.keys(container.resolve(facadeKey) as any).join(', ')}]`
-        + (entity ? '' : ' — no entity of that name: no ORM, no projection, no presenter'));
+        + (entity ? '' : ' — no entity of that name: no storage, no projection, no presenter'));
     }
 
     // The dual, and it stays: a shape that declares no operation answers nothing. Said
@@ -496,7 +507,7 @@ export async function createApp(options: CreateAppOptions): Promise<App> {
       }
     }
 
-    // Surface handlers — create sub-scope per surface handler with scoped ORM
+    // Surface handlers — create sub-scope per surface handler with scoped storage
     //
     // Pointing at nothing is legal HERE TOO. This loop used to `continue` when no entity
     // carried the handler's name, so `handlers/public/SearchHandler.ts` with no `Search`
@@ -506,25 +517,25 @@ export async function createApp(options: CreateAppOptions): Promise<App> {
       const entity = frond.entities.find((e) => e.name === handler.address);
       const surfaceScope = scope.createScope();
 
-      // Register scoped ORM if output override differs from entity — under the REPOSITORY
+      // Register scoped storage if output override differs from entity — under the REPOSITORY
       // key, which is what a Crud handler asks for, and under the port's own for a holder
       // that legitimately names it. Registering only the latter left a named surface with
       // no door at all once the façade stopped spelling the storage.
-      if (entity && options.ormFactory) {
-        const baseOrm = options.ormFactory(entity.entityClass, entity.name);
+      if (entity && options.storageFactory) {
+        const baseStorage = options.storageFactory(entity.entityClass, entity.name);
         const outputSchema = handler.outputOverride ?? (handler.ctor as any).__output;
         const scoped = outputSchema && outputSchema !== entity.entityClass
-          ? baseOrm.output(outputSchema)
-          : baseOrm;
+          ? baseStorage.output(outputSchema)
+          : baseStorage;
         const guarded = new StorageGuard(entity.entityClass.getFields(), entity.name).guard(scoped);
-        surfaceScope.registerValue(ormKeyOf(entity.name), guarded);
+        surfaceScope.registerValue(storageKeyOf(entity.name), guarded);
         surfaceScope.registerValue(repositoryKeyOf(entity.name), guarded);
       }
 
       const facadeKey = facadeKeyOf(handler.address, handler.surface);
       buildFacade(entity, handler, surfaceScope, facadeKey);
       frondLog.debug(`${facadeKey} [${Object.keys(container.resolve(facadeKey) as any).join(', ')}]`
-        + (entity ? '' : ' — no entity of that name: no ORM, no projection, no presenter'));
+        + (entity ? '' : ' — no entity of that name: no storage, no projection, no presenter'));
     }
 
     // A named surface is closed, so what it contains is a fact worth stating.
@@ -746,15 +757,15 @@ export async function createApp(options: CreateAppOptions): Promise<App> {
    * client-facing door. Both are ways in; an entity that opens none of them still has rows.
    *
    * It resolves through the owning frond's scope, because that is where entity ORMs live:
-   * `resolve('UserOrm')` reads the ROOT container and never finds one, so callers outside
+   * `resolve('UserStorage')` reads the ROOT container and never finds one, so callers outside
    * the frond concluded there was no storage. The seed loop did exactly that, and skipped
    * every entity with no façade — the one case its own fallback existed for.
    */
-  const ormFor = (entity: string): unknown | undefined => {
+  const storageFor = (entity: string): unknown | undefined => {
     const owner = fronds.owner(entity);
     if (!owner) return undefined;
 
-    const key = ormKeyOf(entity);
+    const key = storageKeyOf(entity);
     try {
       return container.resolve<Container>(`frond:${owner.name}`).resolve(key);
     } catch {
@@ -765,7 +776,7 @@ export async function createApp(options: CreateAppOptions): Promise<App> {
   /**
    * The presenter of an entity, resolved through its owning frond's scope.
    *
-   * Same shape as `ormFor`, and it exists for the same reason: without it an adapter
+   * Same shape as `storageFor`, and it exists for the same reason: without it an adapter
    * has to spell the container key itself. `schema-graphql` did — a hand-written
    * `${Name}Presenter` — and a key respelled elsewhere finds nothing and says nothing
    * the day the convention moves, which is exactly the failure `verify.ts` refuses.
@@ -799,7 +810,7 @@ export async function createApp(options: CreateAppOptions): Promise<App> {
     operationsFor,
     listensTo: () => emissions.listensTo(),
     deliver: (fact, payload) => emissions.deliver(fact, payload),
-    ormFor,
+    storageFor,
     presenterFor,
     dispose: release,
     drain,

package/src/boot/card.ts

@@ -0,0 +1,113 @@
+/**
+ * What an app says about ITSELF — the `rpc.discover` answer, built from the app.
+ *
+ * The shape is `wire/`'s: it crosses a process boundary. Building one needs an App,
+ * which is why the function lives here and the shape does not.
+ */
+import { Card } from '@fougere/schema';
+import type { App } from './types.js';
+import { factsAnnouncedBy } from '../emit.js';
+import type { InvocationContext } from '../contract/Invocation.js';
+import { facadeKeyOf, contractsKeyOf, type CardOp, type IdentityCard } from '../wire/call.js';
+import type { OperationContract } from '../wire/operation.js';
+
+type AnyFacade = Record<string, (invocation?: InvocationContext) => Promise<unknown>>;
+
+/**
+ * Serialize what the app hosts, for one audience. Served on `rpc.discover`,
+ * cached by callers.
+ *
+ * Hosting means answering: an entity with no façade declares no operation, so
+ * it is not among the DOORS — publishing its shape would hand an anonymous caller
+ * the structure of tables it can never reach (the auth tables, typically), and
+ * `fougere sync` would rebuild a schema with nothing to call on it.
+ *
+ * `facts` is the one thing that shape-without-a-door rule does not cover, and the
+ * reason is the opposite of a leak: an entity nobody exposed is silent, whereas a
+ * fact was explicitly declared to leave.
+ *
+ * `surface` makes that sentence audience-aware rather than app-wide: a door
+ * answers with what IT serves. Nothing falls back to the full façade — under a
+ * named surface, an entity with no façade of its own is simply not there.
+ */
+export function identityCardOf(app: App, surface?: string): IdentityCard {
+  const declared = app.fronds.schemas();
+
+  return {
+    fronds: app.fronds.map((frond) => {
+      // What the frond answers to, not what it stores. This walked `frond.entities`, so a
+      // handler carrying no entity — a health check, a search across shapes — was built,
+      // served, and absent from the card: `sync` could not generate its door and a remote
+      // consumer had no way to know it existed. The boot has said "pointing at nothing is
+      // legal" since handlers became the subject; the card had not caught up.
+      const byEntity = new Map(frond.entities.map((entity) => [entity.name, entity]));
+      const addresses = [...new Set([
+        ...frond.entities.map((entity) => entity.name),
+        ...frond.handlers.map((handler) => handler.address),
+      ])];
+
+      return {
+        name: frond.name,
+        doors: addresses.flatMap((address) => {
+          const ops = facadeOps(app, address, surface);
+          if (ops.length === 0) return [];
+          const entity = byEntity.get(address);
+          return [{
+            name: address,
+            ops,
+            // Absent when nothing of that name is stored. A door is still a door.
+            ...(entity ? { schema: Card.fromSchema(entity.entityClass, address).descriptor } : {}),
+          }];
+        }),
+        /**
+         * What leaves on its own — the same list on every surface, deliberately.
+         *
+         * A door has an audience; a fact does not. `Emit<T>` names a subject and *the
+         * number of readers is not the emitter's business* (`emit.ts`), so narrowing this
+         * by `surface` would invent an axis the primitive refuses. The consequence is
+         * stated rather than hidden: a fact's SHAPE is readable by anyone who can read the
+         * card at all. What must not be published must not be announced.
+         */
+        facts: factsAnnouncedBy(frond.handlers).map((name) => {
+          const entityClass = declared.get(name);
+          return { name, ...(entityClass ? { schema: Card.fromSchema(entityClass, name).descriptor } : {}) };
+        }),
+      };
+    }),
+  };
+}
+
+function facadeOps(app: App, entityName: string, surface?: string): CardOp[] {
+  let facade: AnyFacade;
+  try {
+    facade = app.container.resolve<AnyFacade>(facadeKeyOf(entityName, surface));
+  } catch {
+    return [];
+  }
+
+  // The façade is the list of names; the model is the resolved terms.
+  const effective = app.operationsFor(entityName, surface);
+  if (!effective) {
+    throw new Error(
+      `Facade '${facadeKeyOf(entityName, surface)}' exists without an effective operation table.`,
+    );
+  }
+
+  return Object.keys(facade).map((name) => {
+    const contract = effective.get(name);
+    if (!contract) {
+      throw new Error(
+        `Facade '${facadeKeyOf(entityName, surface)}' serves '${name}' without an effective contract.`,
+      );
+    }
+
+    return {
+      name,
+      ...(contract?.description && { description: contract.description }),
+      ...(contract?.input && { input: Card.fromSchema(contract.input, name).descriptor }),
+      ...(contract?.output && { output: Card.fromSchema(contract.output, name).descriptor }),
+      ...(contract?.cardinality && { cardinality: contract.cardinality }),
+      kind: contract.kind,
+    };
+  });
+}

package/src/boot/frame.ts

@@ -52,7 +52,7 @@ const pick = (row: Record<string, unknown>, keys: readonly string[]): Record<str
  *
  * The inverse of an upsert is derivable exactly when the conflict is the primary key: read
  * the rows by key first, then restore the ones that were there and delete the ones that
- * were not. `SqlEntityOrm` spells `onConflict(pk)` on SQLite and Postgres, so that holds —
+ * were not. `SqlStorage` spells `onConflict(pk)` on SQLite and Postgres, so that holds —
  * but MySQL's `onDuplicateKeyUpdate` fires on ANY unique constraint, and a row that
  * conflicts on a unique email while carrying a different key would be restored under a key
  * the write never touched.
@@ -79,15 +79,15 @@ function refuseAmbiguousUpsert(entity: string, gesture: string): never {
 }
 
 /**
- * The ORM a member is handed inside a compensated frame: the same port, writing the same
+ * The storage a member is handed inside a compensated frame: the same port, writing the same
  * rows, leaving an inverse behind each time.
  *
- * `Object.create` for the same reason `StorageGuard` uses it — the ORM keeps every gesture
+ * `Object.create` for the same reason `StorageGuard` uses it — the storage keeps every gesture
  * it had, including the ones this knows nothing about.
  */
-export function recording<T extends object>(orm: T, entity: string, fields: Fields, journal: Undo[]): T {
-  const base = orm as unknown as Undoable;
-  if (typeof base.create !== 'function' || typeof base.update !== 'function') return orm;
+export function recording<T extends object>(storage: T, entity: string, fields: Fields, journal: Undo[]): T {
+  const base = storage as unknown as Undoable;
+  if (typeof base.create !== 'function' || typeof base.update !== 'function') return storage;
 
   const key = FieldSet.of(fields).primary;
   if (!key) {
@@ -97,7 +97,7 @@ export function recording<T extends object>(orm: T, entity: string, fields: Fiel
     );
   }
 
-  const recorded = Object.create(orm) as T & Undoable;
+  const recorded = Object.create(storage) as T & Undoable;
 
   recorded.create = async function (...args) {
     const row = await base.create.apply(this, args);

package/src/boot/hosted.ts

@@ -16,8 +16,9 @@
  * because the point of stating is to decide. Empty is what "I named none" looks like, and
  * `frond()` builds every member, so an empty one is filled rather than enforced.
  */
-import type { FrondDescriptor, ScanResult } from '../scan/frond.js';
-import { Fronds } from '../scan/Fronds.js';
+import type { FrondDescriptor } from '../descriptor/frond.js';
+import type { ScanResult } from '../scan/result.js';
+import { Fronds } from '../descriptor/Fronds.js';
 
 /** Where an app's fronds come from — either, or both. */
 export interface HostedSources {
@@ -52,26 +53,22 @@ function completed(stated: FrondDescriptor, found: FrondDescriptor | undefined):
   };
 }
 
-/** What the app hosts, and what the scan — if it ran — could not do. */
+/**
+ * What the app hosts, and what the scan — if it ran — could not do.
+ *
+ * Neither key is EMPTY rather than refused: whether an app with no frond is legitimate
+ * depends on what else it declares, and this function is handed none of that.
+ */
 export async function hostedBy(sources: HostedSources): Promise<ScanResult> {
   const scanned = sources.scan
     ? await (typeof sources.scan === 'function' ? sources.scan() : sources.scan)
     : undefined;
 
-  if (!sources.fronds) {
-    if (!scanned) {
-      throw new Error(
-        'createApp needs `fronds:` (what this app states) or `scan:` (what a scanner found). '
-        + 'Neither was given, so nothing is hosted.',
-      );
-    }
-
-    return scanned;
-  }
+  if (!sources.fronds) return scanned ?? { fronds: Fronds.hosting([]), diagnostics: [] };
 
   const found = scanned?.fronds ?? [];
   const stated = sources.fronds.map((f) => completed(f, found.find((s) => s.name === f.name)));
   const unstated = found.filter((f) => !sources.fronds!.some((s) => s.name === f.name));
 
-  return { fronds: Fronds.scanned([...stated, ...unstated]), diagnostics: scanned?.diagnostics ?? [] };
+  return { fronds: Fronds.hosting([...stated, ...unstated]), diagnostics: scanned?.diagnostics ?? [] };
 }

package/src/boot/ownership.ts

@@ -1,8 +1,8 @@
 import { lowerFirst } from '@fougere/schema';
-import type { FrondDescriptor, ProviderEntry } from '../scan/frond.js';
+import type { FrondDescriptor, ProviderEntry } from '../descriptor/frond.js';
 import { targetOf } from '../prefab/prefab.js';
 import { ownedBy, repositoryKeyOf } from '../prefab/repository.js';
-import { ormKeyOf } from '../orm.js';
+import { entityOfStorageKey } from '../storage.js';
 
 /**
  * Who owns an entity's storage.
@@ -37,7 +37,7 @@ export function ownersOf(providers: readonly ProviderEntry[]): Map<string, strin
 
 /**
  * The entities a class was BUILT ON — what a prefab may legitimately be handed the storage
- * of. Empty for a plain service, which is why one cannot ask for an ORM at all.
+ * of. Empty for a plain service, which is why one cannot ask for a storage at all.
  */
 function builtOn(ctor: unknown): string[] {
   const owned = ownedBy(ctor);
@@ -47,19 +47,25 @@ function builtOn(ctor: unknown): string[] {
 }
 
 /**
- * `EntityOrm<E>` is not a word of the user's vocabulary — `<E>Repository` is the one way in.
+ * `Storage<E>` is not a word of the user's vocabulary — `<E>Repository` is the one way in.
  *
  * A door judges and projects; a HOLDER keeps the storage. So the rule is not about which
  * directory a file sits in but about which of the two a class is: a handler, a presenter and
- * a collector may never name an ORM, and a provider may name only the ORM of what its prefab
- * was built on — which is `Repository` and `Mirror`, without either being named here.
+ * a collector may never name the port, and a provider may name only the storage of what its
+ * prefab was built on — which is `Repository` and `Mirror`, without either being named here.
  *
  * What it buys beyond one word instead of two: an entity that becomes owned later needs no
  * call site to move, because none of them ever spelled the storage.
  *
+ * `known` answers what the key's suffix cannot: `FileStorage` is an ordinary class name.
+ *
  * Refused at boot rather than reported by `verify`, which nothing calls at startup.
  */
-export function refuseOrmInUserCode(frond: FrondDescriptor, owners: Map<string, string>): void {
+export function refuseStorageInUserCode(
+  frond: FrondDescriptor,
+  owners: Map<string, string>,
+  known: (entity: string) => boolean,
+): void {
   const doors = [
     ...frond.handlers.map((h) => ({ ...h, kind: 'handler' })),
     ...frond.presenters.map((p) => ({ ...p, kind: 'presenter' })),
@@ -70,7 +76,7 @@ export function refuseOrmInUserCode(frond: FrondDescriptor, owners: Map<string,
   for (const decl of [...doors, ...holders]) {
     const allowed = decl.kind === 'provider' ? builtOn(decl.ctor) : [];
     for (const dep of decl.deps) {
-      const entity = entityOfOrmKey(dep);
+      const entity = entityOfStorageKey(dep, known);
       if (!entity) continue;
 
       const owner = owners.get(entity);
@@ -128,10 +134,3 @@ export function refuseCrudOnOwned(frond: FrondDescriptor, owners: Map<string, st
     );
   }
 }
-
-/** `'PostOrm'` → `'post'`, and nothing for a key that is not one. */
-function entityOfOrmKey(dep: string): string | undefined {
-  if (!dep.endsWith('Orm') || dep === 'Orm') return undefined;
-  const entity = lowerFirst(dep.slice(0, -'Orm'.length));
-  return ormKeyOf(entity) === dep ? entity : undefined;
-}

package/src/boot/ports.ts

@@ -1,4 +1,4 @@
-import type { ProviderEntry } from '../scan/frond.js';
+import type { ProviderEntry } from '../descriptor/frond.js';
 
 /**
  * A port is a class something already answers under. Nothing declares one — the
@@ -6,7 +6,7 @@ import type { ProviderEntry } from '../scan/frond.js';
  * registration, and so is `class MyLogger extends Logger` over a builtin.
  *
  * This is the fourth reading of the rule the other three already apply: the type
- * names the SUBJECT (`EntityOrm<E>`, `Emit<F>`, `Facade<H>`) and the container
+ * names the SUBJECT (`Storage<E>`, `Emit<F>`, `Facade<H>`) and the container
  * holds the realization. Providers were the one case where the type named the
  * realization instead, so `constructor(private payment: Payment)` resolved to the
  * base class and a handler got an object whose method did not exist.

package/src/boot/runner.ts

@@ -0,0 +1,34 @@
+/**
+ * A Transport built from an app — the two ways a call enters this process.
+ *
+ * `Transport` is `wire/`'s shape; making one needs an App and the transport entry.
+ */
+import type { App } from './types.js';
+import type { Transport } from '../wire/call.js';
+import { createTransportEntry } from '../entry/TransportEntry.js';
+
+/**
+ * Build the local runner — the reference realization of Transport.
+ *
+ * Resolves strictly from the app's own container: a call that lands here is
+ * judged here. A miss is a typed NOT_FOUND, never a forward to another remote.
+ */
+export function createLocalRunner(app: App, surface?: string): Transport {
+  return createTransportEntry(app.local, surface);
+}
+
+/**
+ * Build the app runner — same judgment, but resolution follows the app's
+ * topology: local façades and remote doublures alike. This is the runner
+ * an app's own entry points (browser endpoint, bridges) stand on.
+ *
+ * `surface` is the audience this runner serves, and it belongs to the DOOR that
+ * builds the runner, never to the call: a caller cannot name its own audience
+ * any more than it can name its own identity (`state` is stamped server-side
+ * for the same reason). Reaching the admin door IS the proof. So `FrondCall`
+ * gains nothing and the wire format gains nothing — a remote frond's audience
+ * is simply which URL `remotes:` points at.
+ */
+export function createAppRunner(app: App, surface?: string): Transport {
+  return createTransportEntry(app, surface);
+}

package/src/boot/seed.ts

@@ -1,6 +1,6 @@
 import { Role } from '@fougere/schema';
 import { facadeKeyOf } from '../wire/call.js';
-import type { FrondDescriptor, SeedEntry, SeedFactory } from '../scan/frond.js';
+import type { FrondDescriptor, SeedEntry, SeedFactory } from '../descriptor/frond.js';
 import type { App } from './types.js';
 import type { Extension } from './AppLifecycle.js';
 
@@ -73,7 +73,7 @@ interface SeedDoor {
  * Plant a set of seeds, in the order given. Reports what it did, one line per entity.
  *
  * The one seeding loop. `boot()` had one and the Nuxt module generated a second into its
- * Nitro plugin, which had drifted: no ORM fallback, so an entity with no façade was
+ * Nitro plugin, which had drifted: no storage fallback, so an entity with no façade was
  * skipped there and planted here. Two answers to "how does a row get in at boot" is one
  * too many, and the second was the one running in the browser.
  */
@@ -88,7 +88,7 @@ export async function runSeeds(
 
     const door = doorFor(app, seed.entityName);
     if (!door) {
-      report(`  ${seed.entityName}: no handler façade nor ORM — skipping seed`);
+      report(`  ${seed.entityName}: no handler façade nor storage — skipping seed`);
       continue;
     }
 
@@ -130,12 +130,12 @@ function doorFor(app: App, entityName: string): SeedDoor | undefined {
     };
   }
 
-  const orm = app.ormFor(entityName) as
+  const storage = app.storageFor(entityName) as
     | { list: () => Promise<unknown[]>; create: (input: unknown) => Promise<unknown> }
     | undefined;
-  if (!orm) return undefined;
+  if (!storage) return undefined;
 
-  return { list: () => orm.list(), write: (item) => orm.create(item) };
+  return { list: () => storage.list(), write: (item) => storage.create(item) };
 }
 
 /**

package/src/boot/statement-drift.ts

@@ -13,12 +13,13 @@
  * a refusal: the statement is still the author's word, and a boot that ran yesterday must
  * not stop running because a parameter moved. What it must not do is stay quiet.
  */
-import type { FrondDescriptor, HandlerEntry, ScanDiagnostic } from '../scan/frond.js';
-import type { BindingPlan } from './binding.js';
-import type { ParsedMethod } from '../scan/handler-parser.js';
+import type { FrondDescriptor, HandlerEntry } from '../descriptor/frond.js';
+import type { ScanDiagnostic } from '../scan/result.js';
+import type { BindingPlan } from '../wire/binding.js';
+import type { Signature } from '../wire/signature.js';
 
 /** The parameters a stated binding names, against the ones the method declares. */
-function namesDisagreeing(stated: BindingPlan, signature: ParsedMethod): string[] {
+function namesDisagreeing(stated: BindingPlan, signature: Signature): string[] {
   const declared = new Set(signature.params.map((p: { name: string }) => p.name));
 
   return stated.map((b) => b.name).filter((name) => !declared.has(name));