@fougere/core 0.5.0-alpha.1 → 0.7.0-alpha.0

package/src/identity.ts

@@ -1,35 +1,4 @@
-/**
- * Who is calling — the proof, not the claim.
- *
- * `InvocationContext.state` is what a caller SAYS about itself, and a split receiver
- * used to believe it: identity read straight off the wire, so a reader could post
- * `{ state: { user: { role: 'admin' } } }` and be one. This module is what turns that
- * sack into something a receiver establishes instead of accepts.
- *
- * Two signatures, one public key to distribute:
- *
- *   GRANT      the root says "this key is `blog`"   — issued once, at deployment
- *   ENVELOPE   `blog` says "here is my whole call"   — signed per call
- *
- * The envelope binds the CALL and not only its state: address, params, query, a digest
- * of the body. Signing the state alone proved WHO without proving WHAT, so anyone on the
- * wire could replay a captured envelope against another operation for as long as it
- * stayed valid — `post.list` re-sent as `post.delete`, same signature, still good.
- *
- * A receiver holds the root's public key and nothing else: it validates any frond it
- * has never seen, which is what a per-caller list could not do. The private root key
- * signs grants and never leaves the machine that issued them.
- *
- * Ed25519 and a JWS-shaped grant rather than X.509: node can PARSE a certificate but
- * not ISSUE one, so a real chain would mean openssl or a library. The grant says the
- * same thing — a name bound to a public key, signed by the root — with no dependency.
- *
- * The Ed25519 itself comes through `#crypto`, which has two realizations: `node:crypto`
- * everywhere, WebCrypto under `workerd`. Everything here is therefore async — WebCrypto
- * has no synchronous form — and a key is parsed ONCE, into a `Signer` or a `Verifier`,
- * never per call. Making the keys and issuing grants happen at a deployment and live in
- * `identity-keys.ts`, on the Node entry.
- */
+/** Who is calling — the proof, not the claim. */
 import { crypto } from '#crypto';
 import type { PublicJwk, Signer, Verifier } from './crypto/port.js';
 import { b64url, unb64url, bytesOf, textOf, unb64 } from './crypto/encoding.js';
@@ -50,13 +19,13 @@ export interface FrondIdentity {
   grant: string;
 }
 
-/** The body's fingerprint. Absence and explicit null are different signed calls. */
-async function digestOf(body: unknown): Promise<string> {
+/** The input's fingerprint. Absence and explicit null are different signed calls. */
+async function digestOf(input: unknown): Promise<string> {
   // The tag is outside the caller value, so no user object can collide with it. JSON's
   // own omission rule still applies inside `value`, matching what crosses the wire.
-  const canonical = body === undefined
+  const canonical = input === undefined
     ? { kind: 'undefined' }
-    : { kind: 'value', value: body };
+    : { kind: 'value', value: input };
   return b64url(await crypto.sha256(bytesOf(JSON.stringify(canonical))));
 }
 
@@ -67,7 +36,7 @@ async function boundTo(call: SignedCall) {
     op: call.op,
     params: call.params ?? {},
     query: call.query ?? {},
-    body: await digestOf(call.body),
+    input: await digestOf(call.input),
   };
 }
 
@@ -85,11 +54,7 @@ async function signJws(header: object, payload: object, signer: Signer): Promise
   return `${signingInput}.${b64url(await signer.sign(bytesOf(signingInput)))}`;
 }
 
-/**
- * The payload, once the signature holds. Throws rather than returning a falsy value:
- * every caller here is deciding whether to admit a call, and an unverified payload
- * must never be reachable by forgetting a check.
- */
+/** The payload, once the signature holds. */
 async function verifyJws(token: string, verifier: Verifier, what: string): Promise<Record<string, unknown>> {
   const parts = token.split('.');
   if (parts.length !== 3) throw new Error(`Malformed ${what}`);
@@ -111,13 +76,7 @@ function headerOf(token: string): Record<string, unknown> {
   return JSON.parse(textOf(unb64url(encodedHeader))) as Record<string, unknown>;
 }
 
-/**
- * Sign one call, whole: who is asking, what is asked, and on whose behalf.
- *
- * The private key is parsed on every call here, which is the convenience form. A process
- * that signs in a request path builds its signer once — `identityFromEnv` does exactly
- * that, and `sign` on the value it returns holds the parsed key.
- */
+/** Sign one call, whole. */
 export async function signEnvelope(identity: FrondIdentity, call: SignedCall): Promise<string> {
   return sealWith(await crypto.signerOf(identity.privateKey), identity.grant, call);
 }
@@ -133,11 +92,7 @@ async function sealWith(signer: Signer, grant: string, call: SignedCall): Promis
   );
 }
 
-/**
- * Establish the caller, or throw. Order matters: the grant is checked against the ROOT
- * first, and only the key it carries verifies the envelope — reading the envelope's own
- * claim of who it is before that would be believing the thing under examination.
- */
+/** Establish the caller, or throw. */
 export async function verifyEnvelope(token: string, rootPublicKey: string, presented: SignedCall): Promise<VerifiedCall> {
   return openWith(await crypto.verifierOf(rootPublicKey), token, presented);
 }
@@ -173,13 +128,7 @@ async function openWith(root: Verifier, token: string, presented: SignedCall): P
 
 /** The two halves a boot needs, and the environment they come from. */
 export interface CallIdentity {
-  /**
-   * Signs an outgoing call, whole. Absent when this process holds no key — it only answers.
-   *
-   * A promise because WebCrypto has no synchronous form. On Node the work stays
-   * synchronous inside and only the answer is wrapped: measured at 14.28 µs awaited
-   * against 14.30 µs called directly, while WebCrypto on the same curve costs 22.72.
-   */
+  /** Signs an outgoing call, whole. */
   sign?: (call: SignedCall) => Promise<string>;
   /** Establishes an incoming caller, against the call that actually arrived. */
   verify?: (identity: string, presented: SignedCall) => Promise<VerifiedCall>;
@@ -187,29 +136,12 @@ export interface CallIdentity {
   requireIdentity: boolean;
 }
 
-/**
- * A PEM, however the deployment chose to carry it.
- *
- * A PEM is multi-line and an environment variable that spans lines survives poorly —
- * docker-compose, systemd and CI secret stores each mangle it differently — so
- * `fougere keys` prints base64. Both forms are read here rather than one being decreed:
- * a human pasting a real PEM is not making a mistake.
- */
+/** A PEM, however the deployment chose to carry it. */
 function pemOf(value: string): string {
   return value.trimStart().startsWith('-----') ? value : textOf(unb64(value));
 }
 
-/**
- * What the deployment injected, read once at boot.
- *
- * Three variables, no config key: a private key never belongs in a committed file, and
- * `fougere keys` prints exactly these. A process may hold either half or both — a frond
- * that only answers has no key, one that only calls trusts no root, one in the middle
- * does both.
- *
- * Trusting a root IS asking to refuse: there is no separate flag, because a deployment
- * that names an authority and then accepts unsigned calls has said two things at once.
- */
+/** What the deployment injected, read once at boot. */
 export async function identityFromEnv(env: Record<string, string | undefined> = envOfProcess()): Promise<CallIdentity> {
   const root = env.FOUGERE_ROOT_KEY ? pemOf(env.FOUGERE_ROOT_KEY) : undefined;
   const privateKey = env.FOUGERE_KEY ? pemOf(env.FOUGERE_KEY) : undefined;

package/src/imports.ts

@@ -1,31 +1,8 @@
-/**
- * A frond reaching into another one by FILE PATH.
- *
- * `verify()` next door answers the same question — does this app survive a split? — from
- * the MODEL: what a constructor asks for, what a parameter is typed. This one can only be
- * answered from the source text, so it reads files and lives apart rather than making
- * `verify` lose the sentence that says it reads none.
- *
- * ```ts
- * import User from '../../user/entities/User.js';   // these two folders are neighbours
- * import User from '@fronds/user/entities/User';    // I depend on the frond named user
- * ```
- *
- * Both resolve today, and that is exactly the trap: a frond declared in `remotes:` is
- * still scanned, its code is still on this disk, so the relative form keeps working right
- * up to the day the folder is not there — an extraction into its own repository, an image
- * that copies one frond. Then it fails at build time, with a message about a file path
- * that says nothing about the model.
- *
- * So a relative path across a boundary is not a bug. It is a **colocation constraint that
- * nothing declares**: real, load-bearing, and invisible to the scan, to the identity card
- * and to `remotes:`. The named form states the same dependency in terms the model can
- * read — and it is the form `fougere sync` writes, so it survives the move.
- */
+/** A frond reaching into another one by FILE PATH. */
 import type ts from '@typescript/typescript6';
 import { readdir, readFile } from 'node:fs/promises';
 import { join, resolve, dirname, relative, isAbsolute } from 'node:path';
-import type { FrondDescriptor } from './scan/frond.js';
+import type { FrondDescriptor } from './descriptor/frond.js';
 
 let _ts: typeof ts | undefined;
 async function loadTs(): Promise<typeof ts> {
@@ -71,13 +48,7 @@ async function sourcesUnder(dir: string): Promise<string[]> {
   return out;
 }
 
-/**
- * Every relative import that resolves outside its own frond.
- *
- * `preProcessFile` rather than a regex or a full parse: it is TypeScript's own scanner for
- * exactly this question, so `// import x from '../../other'` in a comment is not a finding
- * and a specifier split across lines still is.
- */
+/** Every relative import that resolves outside its own frond. */
 export async function crossFrondImports(
   fronds: readonly Pick<FrondDescriptor, 'name' | 'source'>[],
 ): Promise<CrossFrondImport[]> {

package/src/index.ts

@@ -1,16 +1,7 @@
-/**
- * What a consumer writes, and nothing else.
- *
- * `exports` publishes this barrel and `./contract`, so an import that is not here
- * cannot be reached from outside the package at all — which is what makes this file
- * the contract rather than a convenience. The machinery the boot uses to keep its own
- * promises stays inside: container keys, the binding plan, the mixin's runtime
- * accessors, the config merge. Measured on 2026-08-16, none of them had a single
- * importer anywhere in the workspace.
- */
+/** What a consumer writes, and nothing else. */
 export { createApp } from './boot/bootstrap.js';
 export { orderSeeds, runSeeds, seeding } from './boot/seed.js';
-export { AppLifecycle, AppLifecycle as Lifecycle, migrating } from './boot/AppLifecycle.js';
+export { AppLifecycle, migrating } from './boot/AppLifecycle.js';
 export type { Extension } from './boot/AppLifecycle.js';
 export { defineFougere } from './define.js';
 export type { AdapterConfig, FougereConfig } from './config-loader.js';
@@ -24,33 +15,33 @@ export { Presenter } from './prefab/presenter.js';
 export type { PresenterViews } from './prefab/presenter.js';
 export { Collector } from './prefab/collector.js';
 export { Repository, type RepositoryOf, type RepositoryConstructor, type AggregateOf, type AggregateConstructor } from './prefab/repository.js';
-export { Invocation, canonicalInvocation, EMPTY_INVOCATION } from './contract/Invocation.js';
-export type { InvocationContext, InvocationInput } from './contract/Invocation.js';
-export { Call } from './contract/Call.js';
-export { RouteAddress } from './contract/RouteAddress.js';
-export type { RouteAddressInput } from './contract/RouteAddress.js';
+export { Invocation, canonicalInvocation, EMPTY_INVOCATION } from './wire/Invocation.js';
+export type { InvocationContext, PartialInvocation } from './wire/Invocation.js';
+export { Call } from './wire/call.js';
+export { RouteAddress } from './wire/RouteAddress.js';
+export type { RouteAddressInput } from './wire/RouteAddress.js';
 export { DispatchLifecycle } from './dispatch/DispatchLifecycle.js';
 export { Dispatcher } from './dispatch/Dispatcher.js';
 // The class and not only its type: an observer RECEIVES these, so a package that folds
 // them — or a test of one — has to be able to make one through the door.
 export { DispatchEvent } from './dispatch/DispatchEvent.js';
-export type { CallPage, CallRecord } from './contract/CallLog.js';
+export type { CallPage, CallRecord } from './wire/CallLog.js';
 export { driftOf, agrees, explain, type CardDrift } from './wire/drift.js';
 export type { DispatchObserver } from './dispatch/DispatchEvent.js';
 export type { DispatchPort } from './dispatch/DispatchPort.js';
 export {
   inferOperationKind,
-  resolveContracts,
   resolveIsReadOp,
   resolveOperationKind,
 } from './wire/operation.js';
+export { resolveContracts } from './effective-operation.js';
 export type {
   OperationContract,
   OperationKind,
   OperationKindInference,
   OperationsMap,
-  ParsedParam,
-  ParsedType,
+  Param,
+  TypeRef,
 } from './wire/operation.js';
 export {
   EFFECTIVE_OPERATION_SEMANTICS,
@@ -67,16 +58,17 @@ export type {
 export type { ModuleLoader } from './loader.js';
 export { FougereError, ErrorCode, validationErrorsOf, type FougereErrorOptions } from './wire/errors.js';
 export type { OperationContext, AppNext, AppMiddleware } from './wire/middleware.js';
-export { createLocalRunner, createAppRunner, assertIdentityCard, RPC_ENTITY, MAX_BODY_BYTES } from './wire/call.js';
+export { assertIdentityCard, RPC_ENTITY, MAX_BODY_BYTES } from './wire/call.js';
+export { createLocalRunner, createAppRunner } from './boot/runner.js';
 
 // A frond an app STATES, for a boot that will not scan. No disk, no `typescript` — which
 // is why it sits here and not in `/node`, beside the scanner that reads a project.
-export { frond } from './scan/declare.js';
-export type { FrondDeclaration, Declared, DeclaredSubject } from './scan/declare.js';
+export { frond } from './declare.js';
+export type { FrondDeclaration, Declared, DeclaredSubject } from './declare.js';
 // What this app would answer to `rpc.discover`. Served by the boot, and reached until now
 // only by tests through a deep path — a consumer comparing its own card to a producer's
 // had to dispatch a call to ask a question about itself.
-export { identityCardOf } from './wire/call.js';
+export { identityCardOf } from './boot/card.js';
 export type {
   FrondCall, Transport, IdentityCard, CardOp, Facade, RpcAnswer,
   TopologyReport, FrondPlacement, Edge,
@@ -86,17 +78,20 @@ export { callValueOf } from './contract.js';
 export type { CallValue } from './contract.js';
 export { toHttpError, toPublicError } from './wire/http-error.js';
 export { loggerMiddleware } from './wire/loggerMiddleware.js';
-export { Logger, setLogLevel, logLevel, envLevel, onLog } from './builtins/logger.js';
-export type { LogLevel, LogRecord, LogSink } from './builtins/logger.js';
+export { Logger, setLogLevel, logLevel, envLevel, onLog } from './builtin/logger.js';
+export type { LogLevel, LogRecord, LogSink } from './builtin/logger.js';
 // What a re-read config changes in a running process — and what it cannot.
 export { applyConfig, type ConfigApplication } from './boot/apply.js';
-export { Config } from './builtins/config.js';
-export type { EntityOrm, OrmFactory, ListOptions, ListResult, Together } from './orm.js';
-export { togetherKeyOf, membersOfTogetherKey } from './orm.js';
+export { Config } from './builtin/config.js';
+export type { Storage, StorageFactory, ListOptions, ListResult, Together } from './storage.js';
+export { togetherKeyOf, membersOfTogetherKey } from './storage.js';
+export type { Source, SourceConfig, SourceView } from './source.js';
+export { Sources } from './source.js';
+export { storageOver } from './store.js';
+export type { Store, Values } from './store.js';
 export type { App, CreateAppOptions } from './boot/types.js';
+export type { ScanResult, ScanDiagnostic } from './scan/result.js';
 export type {
-  ScanResult,
-  ScanDiagnostic,
   FrondDescriptor,
   FrondSource,
   ProviderEntry,
@@ -107,9 +102,9 @@ export type {
   PresenterEntry,
   PresenterFieldMeta,
   CollectorEntry,
-} from './scan/frond.js';
+} from './descriptor/frond.js';
 export type { AuthConfig, AuthContext, AuthRuntime } from './boot/auth.js';
-export { Fronds } from './scan/Fronds.js';
+export { Fronds } from './descriptor/Fronds.js';
 export { verify, assertSplittable, type Violation } from './verify.js';
 // Same question as verify(), answered from the source text instead of the model.
 export type { CrossFrondImport } from './imports.js';

package/src/loader.ts

@@ -1,21 +1,7 @@
-/**
- * How a source file becomes a module — one registry, two readers.
- *
- * The scanner loads fronds and `config-loader` loads a config, and both must use the
- * loader the host installed: a TS file needs jiti under Nuxt and plain `import` under
- * tsx. It lived in `scan/scanner.ts`, so reading a config dragged the scanner, its AST
- * parser and the TypeScript compiler behind it.
- */
+/** How a source file becomes a module — one registry, two readers. */
 import { pathToFileURL } from 'node:url';
 
-/**
- * Module loader — can be swapped (e.g. jiti for TS files in Nuxt context).
- *
- * `fresh` asks for a file that may have changed since it was last read. Every loader
- * caches, so without it a second read of an EDITED file hands back the first one —
- * which is what re-reading a config is for. A loader that cannot honour it may ignore
- * the flag; it then answers with what it already had.
- */
+/** Module loader — can be swapped (e.g. */
 export type ModuleLoader = (
   filePath: string,
   options?: { fresh?: boolean },

package/src/node.ts

@@ -1,14 +1,4 @@
-/**
- * What Fougere does with a filesystem — the half of core that a Worker cannot run.
- *
- * The line is not "build vs runtime": `boot()` and `loadConfig` run in production, on a
- * server, every time. It is whether the thing reaches for a disk. Everything here does,
- * transitively, and nothing on the main entry does — which is what lets a bundler for a
- * runtime without `node:fs` trace the main entry and find no builtin at all.
- *
- * The third entry, `@fougere/core/contract`, answers a different question: what crosses a
- * process boundary. A foreign frond reads it without reading our boot.
- */
+/** What Fougere does with a filesystem — the half of core that a Worker cannot run. */
 export { boot } from './boot/boot.js';
 
 export { scanProject, frondAliases, watchPathsOf } from './scan/scanner.js';
@@ -23,6 +13,7 @@ export { setModuleLoader, getModuleLoader } from './loader.js';
 export { loadConfig, loadCascadedConfig } from './config-loader.js';
 export { defineFrond } from './frond-config.js';
 export { crossFrondImports } from './imports.js';
+export { adaptersOf } from './scan/adapters.js';
 
 // Making a key and binding a name to it happen once, at a deployment, on a machine with
 // a filesystem — the CLI speaking. Verifying happens per call, everywhere, and stays on

package/src/prefab/collector.ts

@@ -1,25 +1,4 @@
-/**
- * Collector(Type) — resolves one handler input parameter from the invocation context.
- *
- * The target is a NAME matched against the parameter's type, never a schema: nothing
- * here nor in the scan reads its fields. So `Ability`, built per call from state, sits
- * beside `User`, loaded from a row.
- *
- * The dual of Presenter only in direction. A presenter's subject is a ROW — it adds
- * computed fields to one, so its target must be an entity. A collector's subject is a
- * PARAMETER.
- *
- * Usage:
- * ```ts
- * export default class UserCollector extends Collector(User) {
- *   constructor(private userOrm: UserOrm) { super(); }
- *
- *   async collect(ctx: InvocationContext) {
- *     return this.userOrm.findById(ctx.state.userId as string);
- *   }
- * }
- * ```
- */
+/** Collector(Type) — resolves one handler input parameter from the invocation context. */
 
 import { upperFirst } from '@fougere/schema';
 

package/src/prefab/crud.ts

@@ -1,48 +1,42 @@
-import type { EntityOrm, ListOptions, ListResult } from '../orm.js';
+import { lowerFirst, type EntityConstructor, type SchemaView } from '@fougere/schema';
+import type { Storage, ListOptions, ListResult } from '../storage.js';
 import type { OperationContract } from '../wire/operation.js';
-import type { EntityConstructor, SchemaView } from '@fougere/schema';
+import { targetOf } from './prefab.js';
 
-/** The id of the row an op acts on — a route segment, or a query fallback. */
-const byId = { name: 'id', source: { kind: 'param' as const, name: 'id' }, optional: false };
-const fromBody = { name: 'input', source: { kind: 'body' as const }, optional: false };
+/**
+ * So a class is recognized by what it ANSWERS, since the mixin leaves no other trace.
+ * FR : pour qu'une classe se reconnaisse à ce qu'elle répond, le mixin ne laissant rien d'autre.
+ * `inheritsCrud(class PostHandler extends Crud(Post) {})` → `true`
+ */
+export function inheritsCrud(ctor: unknown): boolean {
+  const proto = (ctor as { prototype?: Record<string, unknown> } | undefined)?.prototype;
+
+  return typeof proto?.list === 'function' && typeof proto?.findById === 'function';
+}
 
 /**
- * The same five, written as the scan would have written them.
- *
- * `binding` says WHERE an argument is read from; it never says of what type, and a
- * GraphQL argument needs the type. So a producer that fills only `binding` leaves
- * `adapter/graphql` with nothing to declare — it drops the op (`registerOperations`,
- * `if (!sig) continue`) and four of the five CRUD ops vanish from the schema while
- * the façade and REST still serve them. Measured on an installed app: 16 handlers,
- * 14 with unresolvable heritage, zero `createX` in the schema.
+ * So storage follows the shape the handler was built on, which may differ from its address.
+ * FR : pour que le stockage suive la forme sur laquelle le handler est bâti.
+ * `subjectOf(class Draft extends Crud(Post) {}, 'draft')` → `'post'`
  */
+export function subjectOf(ctor: unknown, address: string): string {
+  const target = targetOf(ctor);
+
+  return target?.name ? lowerFirst(target.name) : address;
+}
+
+/** The id of the row an op acts on — a route segment, or a query fallback. */
+const byId = { name: 'id', source: { kind: 'param' as const, name: 'id' }, optional: false };
+const fromBody = { name: 'input', source: { kind: 'input' as const }, optional: false };
+
+/** The same five, written as the scan would have written them. */
 const idParam = { name: 'id', type: { raw: 'string', name: 'string' } };
 const inputParam = (entity: string) => ({ name: 'input', type: { raw: `Partial<${entity}>`, name: entity } });
 const returns = (raw: string, name: string, extra?: { array?: boolean; nullable?: boolean }) =>
   ({ raw, name, ...extra });
 
-/**
- * The five ops a Crud handler brings, declared rather than discovered.
- *
- * The mixin built them, so it alone knows their contract in full: what judges
- * their input, where each argument comes from. It says so on the class, at
- * runtime — which is what makes the guarantee independent of the AST scan (an
- * installed app cannot resolve this file, and never needs to).
- */
-/**
- * `output` says the entity, and saying it costs nothing at runtime.
- *
- * The façade already projected onto the entity when nothing else was named, so this
- * changes no result: `outputFieldsFor` reads `contractOutput` and falls back to the
- * entity, and both are the same shape here. What changes is that the sentence now
- * EXISTS — the identity card publishes `output` per op, and a card was measured
- * carrying none at all (2026-08-06, ten ops, zero outputs), which typed every remote
- * return as `unknown` for anyone building on it.
- *
- * It does not close the view: only an explicit `__opOutputs` does (`closed: perOp !==
- * undefined`), so a named view still wins and a presenter's computed fields still ride
- * out. `delete` names none — a boolean is not a shape.
- */
+/** The five ops a Crud handler brings, declared rather than discovered. */
+/** `output` says the entity, and saying it costs nothing at runtime. */
 function crudOps(entity: SchemaView & { partial?: () => SchemaView }): Record<string, OperationContract> {
   const name = (entity as { name?: string }).name ?? 'Entity';
   const input = inputParam(name);
@@ -76,15 +70,7 @@ function crudOps(entity: SchemaView & { partial?: () => SchemaView }): Record<st
   };
 }
 
-/**
- * The mixin's single "trust me" point — the twin of `asSchemaConstructor` in @fougere/schema.
- *
- * The implementation returns whatever the ORM hands back; the declaration names the view
- * each op emits at the port. TypeScript cannot connect the two (the view is a runtime
- * argument, the type is a generic), so one assertion states that the mixin honours what it
- * declared — and the façade makes it true, projecting each op's result onto its view
- * (`outputFieldsFor` in `bootstrap.ts`).
- */
+/** The mixin's single "trust me" point — the twin of `asSchemaConstructor` in @fougere/schema. */
 function asCrudConstructor<T, V>(impl: object): CrudConstructor<T, V> {
   return impl as CrudConstructor<T, V>;
 }
@@ -95,12 +81,7 @@ export type CrudOpName = 'list' | 'findById' | 'create' | 'update' | 'delete';
 /** Which view each op speaks — omitted ops speak the entity, the trivial view. */
 export type CrudViews = Partial<Record<CrudOpName, EntityConstructor>>;
 
-/**
- * The view an op emits, fabricated: the one declared for it, the single view when the
- * whole handler declares one, the entity otherwise. `PostCard` is not a hand-written
- * type — `Post.pick(...)` derives it field by field, so an op's return is a projection
- * of the entity exactly like the entity is the projection that keeps everything.
- */
+/** The view an op emits, fabricated. */
 type OutOf<V, K extends CrudOpName, T> =
   // Bracketed on purpose: a naked `V extends …` DISTRIBUTES, and the no-view default
   // is the empty map, whose `keyof` is `never` — distribution would then collapse
@@ -109,19 +90,9 @@ type OutOf<V, K extends CrudOpName, T> =
   : K extends keyof V ? (V[K] extends EntityConstructor ? InstanceType<V[K]> : T)
   : T;
 
-/**
- * The five ops, typed from the entity and its views.
- *
- * Two things the mixin declares but does not own. The **output** is the view the
- * handler names (`Crud(Post, { list: PostCard })`) — fabricated, so a redefinition
- * that returns cards stays assignable. The **trailing parameters** are resolved by
- * type from the container (`delete(id, user?: User)` gets its user from a
- * collector): the mixin cannot know them, they belong to the app, so it declares that
- * a tail exists and that it supplies none — which is what `never` says, and what keeps
- * a judged redefinition assignable.
- */
+/** The five ops, typed from the entity and its views. */
 export interface CrudOps<T, V = {}> {
-  orm: EntityOrm<T>;
+  storage: Storage<T>;
   list(options?: ListOptions, ...collected: never[]): Promise<ListResult<OutOf<V, 'list', T>>>;
   findById(id: string, ...collected: never[]): Promise<OutOf<V, 'findById', T> | undefined>;
   create(input: Partial<T>, ...collected: never[]): Promise<OutOf<V, 'create', T>>;
@@ -131,30 +102,17 @@ export interface CrudOps<T, V = {}> {
 
 /** The prefab handler class — its ops, plus the statics the bootstrap and adapters read. */
 export interface CrudConstructor<T, V = {}> {
-  // `EntityOrm<T>`, not the bare `EntityOrm`: a handler that injects a second ORM has to
-  // spell its own constructor, and `super(orm)` with the ORM the container hands it —
-  // typed on the entity, as the `orm` property below already says — was refused.
-  new (orm: EntityOrm<T>): CrudOps<T, V>;
+  // `Storage<T>`, not the bare `Storage`: a handler that injects a second storage has to
+  // spell its own constructor, and `super(storage)` with the storage the container hands it —
+  // typed on the entity, as the `storage` property below already says — was refused.
+  new (storage: Storage<T>): CrudOps<T, V>;
   readonly __entity: unknown;
   readonly __output: unknown;
   readonly __opOutputs?: CrudViews;
   readonly __ops: Record<string, OperationContract>;
 }
 
-/**
- * Mixin — extends Crud(Entity) to get all 5 typed CRUD methods.
- *
- * The second argument (optional) names the view the ops emit, and comes in two
- * spellings of one idea — a view per op, or one view for all five:
- *
- * Crud(Post)                      → every op emits Post
- * Crud(Post, { list: PostCard })  → list emits cards, the rest emit Post. Declaration
- *                                   only: the handler keeps its full-row ORM, so a
- *                                   judge can still read `body`.
- * Crud(Post, PostPublic)          → every op emits PostPublic, and the bootstrap
- *                                   scopes the injected ORM via .output(PostPublic) —
- *                                   the whole handler speaks the restricted view.
- */
+/** Mixin — extends Crud(Entity) to get all 5 typed CRUD methods. */
 export function Crud<E extends EntityConstructor, V extends CrudViews | EntityConstructor = {}>(
   entity: E,
   output?: V,
@@ -168,21 +126,24 @@ export function Crud<E extends EntityConstructor, V extends CrudViews | EntityCo
 
   return asCrudConstructor<T, V>(class CrudHandler {
     static __entity = entity;
-    /** Handler-wide view only — a per-op map must NOT scope the ORM the judges read. */
+    /** Handler-wide view only — a per-op map must NOT scope the storage the validators read. */
     static __output = wholeHandler ?? entity;
     static __opOutputs = perOp;
-    /** What this prefab handler declares — read by the façade, merged under the author's own methods. */
+    /**
+     * What this prefab handler declares — read by the façade, merged under the author's own
+     * methods.
+     */
     static __ops: Record<string, OperationContract> = crudOps(entity as unknown as SchemaView & { partial?: () => SchemaView });
 
-    orm: EntityOrm<T>;
-    constructor(orm: EntityOrm) {
-      this.orm = orm as EntityOrm<T>;
+    storage: Storage<T>;
+    constructor(storage: Storage) {
+      this.storage = storage as Storage<T>;
     }
 
-    async list(options?: ListOptions): Promise<ListResult<T>> { return this.orm.list(options) as Promise<ListResult<T>>; }
-    async findById(id: string): Promise<T | undefined> { return this.orm.findById(id); }
-    async create(input: Partial<T>): Promise<T> { return this.orm.create(input); }
-    async update(id: string, input: Partial<T>): Promise<T> { return this.orm.update(id, input); }
-    async delete(id: string): Promise<boolean> { return this.orm.delete(id); }
+    async list(options?: ListOptions): Promise<ListResult<T>> { return this.storage.list(options) as Promise<ListResult<T>>; }
+    async findById(id: string): Promise<T | undefined> { return this.storage.findById(id); }
+    async create(input: Partial<T>): Promise<T> { return this.storage.create(input); }
+    async update(id: string, input: Partial<T>): Promise<T> { return this.storage.update(id, input); }
+    async delete(id: string): Promise<boolean> { return this.storage.delete(id); }
   });
 }