@fougere/core 0.6.0-alpha.0 → 0.7.0-alpha.0

package/src/boot/frame.ts

@@ -1,24 +1,10 @@
 /**
- * The compensated realization of a frame — what `Together` becomes when its members do
- * not share an engine.
- *
- * A transaction is the engine's own answer and costs nothing to use: the members are
- * rebuilt over it and the engine gives both the unwind and the isolation. Across engines
- * there is no such thing, so the unwind is built here: every write through the port is
- * recorded with the image that preceded it, and a failure replays the inverses in reverse
- * order.
- *
- * **It gives all-or-nothing, never isolation.** Between two writes a reader sees the half,
- * and nothing here can hide it — that is the whole difference between the two realizations
- * and the reason the boot says which one it built.
- *
- * The port is thirteen known gestures, which is what makes the inverse derivable rather
- * than declared: a saga asks its author for an `undo` per step because its steps are
- * arbitrary code. Here they are not.
+ * The compensated realization of a frame — what `Together` becomes when its members do not share
+ * an engine.
  */
-import { FieldGroup, FieldSet, Unique, type Fields } from '@fougere/schema';
+import { FieldSet, Role, type SchemaView } from '@fougere/schema';
 import { dequal } from 'dequal';
-import type { Logger } from '../builtins/logger.js';
+import type { Logger } from '../builtin/logger.js';
 
 /** One write that landed, and how to take it back. */
 export interface Undo {
@@ -28,11 +14,8 @@ export interface Undo {
 }
 
 /**
- * The subset of the port a frame has to watch: every gesture that writes, plus the reads
- * that take one back.
- *
- * Not `StorageGuard`'s `Writer`, which is `create` and `update` — all a judge needs. Undoing
- * needs more: the deletes, and the reads that fetch the image to put back.
+ * The subset of the port a frame has to watch: every gesture that writes, plus the reads that take
+ * one back.
  */
 interface Undoable {
   create(input: Record<string, unknown>, ...rest: unknown[]): Promise<Record<string, unknown>>;
@@ -47,25 +30,11 @@ interface Undoable {
 const pick = (row: Record<string, unknown>, keys: readonly string[]): Record<string, unknown> =>
   Object.fromEntries(keys.map((key) => [key, row[key]]));
 
-/**
- * Whether an upsert's conflict can be something other than the primary key.
- *
- * The inverse of an upsert is derivable exactly when the conflict is the primary key: read
- * the rows by key first, then restore the ones that were there and delete the ones that
- * were not. `SqlStorage` spells `onConflict(pk)` on SQLite and Postgres, so that holds —
- * but MySQL's `onDuplicateKeyUpdate` fires on ANY unique constraint, and a row that
- * conflicts on a unique email while carrying a different key would be restored under a key
- * the write never touched.
- *
- * So the question is asked of the DECLARATION, not of the engine: an entity whose only
- * unique constraint is its key upserts unambiguously everywhere. This file knows no dialect
- * and should not learn one.
- */
-function mayConflictElsewhere(fields: Fields): boolean {
-  const groups = FieldGroup.groupsOf(fields, Unique);
-  if (groups.length > 0) return true;
-  // A sole `unique()` carries a one-member group, which `groupsOf` filters out.
-  return Object.values(fields).some((field) => FieldGroup.on(field, Unique).length > 0);
+/** Whether an upsert's conflict can be something other than the primary key. */
+function mayConflictElsewhere(schema: SchemaView): boolean {
+  if ((schema.getUnique() ?? []).length > 0) return true;
+
+  return Object.values(schema.getFields()).some((field) => Role.of(field).isUnique);
 }
 
 /** Refused where it is used, naming the group that makes the inverse ambiguous. */
@@ -79,17 +48,14 @@ function refuseAmbiguousUpsert(entity: string, gesture: string): never {
 }
 
 /**
- * The storage a member is handed inside a compensated frame: the same port, writing the same
- * rows, leaving an inverse behind each time.
- *
- * `Object.create` for the same reason `StorageGuard` uses it — the storage keeps every gesture
- * it had, including the ones this knows nothing about.
+ * The storage a member is handed inside a compensated frame: the same port, writing the same rows,
+ * leaving an inverse behind each time.
  */
-export function recording<T extends object>(storage: T, entity: string, fields: Fields, journal: Undo[]): T {
+export function recording<T extends object>(storage: T, entity: string, schema: SchemaView, journal: Undo[]): T {
   const base = storage as unknown as Undoable;
   if (typeof base.create !== 'function' || typeof base.update !== 'function') return storage;
 
-  const key = FieldSet.of(fields).primary;
+  const key = FieldSet.of(schema.getFields()).primary;
   if (!key) {
     throw new Error(
       `${entity} declares no primary field, so a write to it cannot be taken back by ` +
@@ -121,9 +87,16 @@ export function recording<T extends object>(storage: T, entity: string, fields:
       run: async () => {
         const current = await base.findById.call(this, id);
         if (!current) throw new Error(`${entity}#${id} is gone`);
+        // Reading and restoring are two statements, and there is no transaction here to make
+        // them one — a write landing between them is overwritten unseen. So this names what it
+        // FOUND, and claims nothing about what it did not: the frame was built because no
+        // engine could isolate it, and a check does not put the isolation back.
         const moved = touched.filter((field) => !dequal(current[field], wrote[field]));
         if (moved.length > 0) {
-          throw new Error(`${entity}#${id} was changed by someone else since (${moved.join(', ')})`);
+          throw new Error(
+            `${entity}#${id} no longer holds what this frame wrote (${moved.join(', ')}), so ` +
+            `restoring the previous values would drop whatever replaced them`,
+          );
         }
         await base.update.call(this, id, pick(before, touched));
       },
@@ -159,8 +132,8 @@ export function recording<T extends object>(storage: T, entity: string, fields:
   };
 
   if (typeof base.upsert === 'function') {
-    (recorded as unknown as Undoable).upsert = async function (input, ...rest) {
-      if (mayConflictElsewhere(fields)) refuseAmbiguousUpsert(entity, 'upsert');
+    recorded.upsert = async function (input, ...rest) {
+      if (mayConflictElsewhere(schema)) refuseAmbiguousUpsert(entity, 'upsert');
       const undo = await undoUpsert.call(this, [input]);
       const row = await base.upsert!.call(this, input, ...rest);
       journal.push(undo);
@@ -169,8 +142,8 @@ export function recording<T extends object>(storage: T, entity: string, fields:
   }
 
   if (typeof base.upsertAll === 'function') {
-    (recorded as unknown as Undoable).upsertAll = async function (inputs, ...rest) {
-      if (mayConflictElsewhere(fields)) refuseAmbiguousUpsert(entity, 'upsertAll');
+    recorded.upsertAll = async function (inputs, ...rest) {
+      if (mayConflictElsewhere(schema)) refuseAmbiguousUpsert(entity, 'upsertAll');
       const undo = await undoUpsert.call(this, inputs);
       const written = await base.upsertAll!.call(this, inputs, ...rest);
       journal.push(undo);
@@ -181,14 +154,7 @@ export function recording<T extends object>(storage: T, entity: string, fields:
   return recorded;
 }
 
-/**
- * Replay the inverses, most recent first, and report rather than pretend.
- *
- * Every one is attempted even after one fails: stopping at the first would leave writes
- * standing that could have been taken back. What cannot be undone is named — the caller is
- * about to tell a user their transfer failed, and "it failed and here is what is still in
- * the database" is the only honest version of that sentence.
- */
+/** Replay the inverses, most recent first, and report rather than pretend. */
 export async function unwind(journal: readonly Undo[], cause: unknown, log: Logger): Promise<never> {
   const stuck: string[] = [];
   for (const undo of [...journal].reverse()) {

package/src/boot/hosted.ts

@@ -1,21 +1,4 @@
-/**
- * What this app hosts — what it STATED, or what a scan FOUND.
- *
- * The PRESENCE of the key is the decision, the way `remotes:` states a topology: an app
- * that passes `fronds:` is saying "do not scan", and one that passes `scan:` is handing
- * over what a scanner read. There is no mode to configure because there is no third
- * behaviour to name.
- *
- * Both may arrive, and then they MERGE — but only where a scan costs nothing at runtime.
- * Under Nuxt the scan is a build artifact, so an app may state the frond it wants to own
- * and leave the rest to what the build found. Anywhere the scan would run at START, half a
- * statement buys nothing the whole one does: the disk is read either way.
- *
- * Merging is per frond NAME and per member. A stated frond wins outright on the members it
- * names — stating `entities: [Post]` where a scan found `[Post, Author]` yields `[Post]`,
- * because the point of stating is to decide. Empty is what "I named none" looks like, and
- * `frond()` builds every member, so an empty one is filled rather than enforced.
- */
+/** What this app hosts — what it STATED, or what a scan FOUND. */
 import type { FrondDescriptor } from '../descriptor/frond.js';
 import type { ScanResult } from '../scan/result.js';
 import { Fronds } from '../descriptor/Fronds.js';
@@ -28,22 +11,22 @@ export interface HostedSources {
   scan?: ScanResult | (() => Promise<ScanResult> | ScanResult);
 }
 
-/** The members a stated frond takes from a scan when it named none of its own. */
+/** The members a frond takes from a scan when it named none of its own. */
 type Fillable = 'providers' | 'entities' | 'handlers' | 'presenters' | 'collectors' | 'seeds';
 
-/** A stated frond, completed by what a scan found under the same name. */
-function completed(stated: FrondDescriptor, found: FrondDescriptor | undefined): FrondDescriptor {
-  if (!found) return stated;
+/** A frond the host passed, completed by what a scan found under the same name. */
+function completed(given: FrondDescriptor, found: FrondDescriptor | undefined): FrondDescriptor {
+  if (!found) return given;
 
   // Written out rather than looped: a loop over the key union asks TypeScript to prove
-  // `found[k]` fits `stated[k]` for every k at once, which it cannot — and the cast that
+  // `found[k]` fits `given[k]` for every k at once, which it cannot — and the cast that
   // silences it would also silence a member added to the descriptor and forgotten here.
   const fill = <K extends Fillable>(member: K): FrondDescriptor[K] =>
-    (stated[member].length === 0 ? found[member] : stated[member]);
+    (given[member].length === 0 ? found[member] : given[member]);
 
   return {
     ...found,
-    ...stated,
+    ...given,
     providers: fill('providers'),
     entities: fill('entities'),
     handlers: fill('handlers'),
@@ -53,12 +36,7 @@ function completed(stated: FrondDescriptor, found: FrondDescriptor | undefined):
   };
 }
 
-/**
- * What the app hosts, and what the scan — if it ran — could not do.
- *
- * Neither key is EMPTY rather than refused: whether an app with no frond is legitimate
- * depends on what else it declares, and this function is handed none of that.
- */
+/** What the app hosts, and what the scan — if it ran — could not do. */
 export async function hostedBy(sources: HostedSources): Promise<ScanResult> {
   const scanned = sources.scan
     ? await (typeof sources.scan === 'function' ? sources.scan() : sources.scan)
@@ -67,8 +45,8 @@ export async function hostedBy(sources: HostedSources): Promise<ScanResult> {
   if (!sources.fronds) return scanned ?? { fronds: Fronds.hosting([]), diagnostics: [] };
 
   const found = scanned?.fronds ?? [];
-  const stated = sources.fronds.map((f) => completed(f, found.find((s) => s.name === f.name)));
-  const unstated = found.filter((f) => !sources.fronds!.some((s) => s.name === f.name));
+  const configured = sources.fronds.map((f) => completed(f, found.find((s) => s.name === f.name)));
+  const discovered = found.filter((f) => !sources.fronds!.some((s) => s.name === f.name));
 
-  return { fronds: Fronds.hosting([...stated, ...unstated]), diagnostics: scanned?.diagnostics ?? [] };
+  return { fronds: Fronds.hosting([...configured, ...discovered]), diagnostics: scanned?.diagnostics ?? [] };
 }

package/src/boot/ownership.ts

@@ -1,17 +1,11 @@
 import { lowerFirst } from '@fougere/schema';
 import type { FrondDescriptor, ProviderEntry } from '../descriptor/frond.js';
+import { inheritsCrud } from '../prefab/crud.js';
 import { targetOf } from '../prefab/prefab.js';
 import { ownedBy, repositoryKeyOf } from '../prefab/repository.js';
 import { entityOfStorageKey } from '../storage.js';
 
-/**
- * Who owns an entity's storage.
- *
- * `Repository(Commande, Stock)` states it — an aggregate is the only thing that claims
- * entities it is not named after, and the arity is what says so. A repository of ONE owns
- * nothing: a boundary between one thing and nothing is not a boundary, and the judge is
- * already on that entity's rows.
- */
+/** Who owns an entity's storage. */
 export function ownersOf(providers: readonly ProviderEntry[]): Map<string, string> {
   const owners = new Map<string, string>();
   for (const provider of providers) {
@@ -46,21 +40,7 @@ function builtOn(ctor: unknown): string[] {
   return target?.name ? [lowerFirst(target.name)] : [];
 }
 
-/**
- * `Storage<E>` is not a word of the user's vocabulary — `<E>Repository` is the one way in.
- *
- * A door judges and projects; a HOLDER keeps the storage. So the rule is not about which
- * directory a file sits in but about which of the two a class is: a handler, a presenter and
- * a collector may never name the port, and a provider may name only the storage of what its
- * prefab was built on — which is `Repository` and `Mirror`, without either being named here.
- *
- * What it buys beyond one word instead of two: an entity that becomes owned later needs no
- * call site to move, because none of them ever spelled the storage.
- *
- * `known` answers what the key's suffix cannot: `FileStorage` is an ordinary class name.
- *
- * Refused at boot rather than reported by `verify`, which nothing calls at startup.
- */
+/** `Storage<E>` is not a word of the user's vocabulary — `<E>Repository` is the one way in. */
 export function refuseStorageInUserCode(
   frond: FrondDescriptor,
   owners: Map<string, string>,
@@ -103,25 +83,11 @@ export function refuseStorageInUserCode(
   }
 }
 
-/**
- * An owned entity has no automatic CRUD — said at boot, not at the first request.
- *
- * `HandlerFacade.deps()` asks for `<E>Repository` when a handler inherits the five gestures
- * and declares no constructor of its own, and an owned entity has no such key. That alone
- * refuses — but LAZILY, at the first call, on the container's own sentence: measured, the app
- * booted clean and answered every request with `'LedgerRepository' is not registered`. A
- * receiver that starts and then rejects everything is found in production, which is the
- * reason `serve()` checks its address at boot rather than per call.
- *
- * Recognized by FORM, like the façade recognizes it: a prototype carrying `list` and
- * `findById` needs storage of its own, whether `Crud()` put them there or an author did.
- */
+/** An owned entity has no automatic CRUD — said at boot, not at the first request. */
 export function refuseCrudOnOwned(frond: FrondDescriptor, owners: Map<string, string>): void {
   for (const handler of frond.handlers) {
     const owner = owners.get(handler.address);
-    if (!owner || handler.deps.length > 0) continue;
-    const proto = (handler.ctor as { prototype?: Record<string, unknown> }).prototype;
-    if (typeof proto?.list !== 'function' || typeof proto?.findById !== 'function') continue;
+    if (!owner || handler.deps.length > 0 || !inheritsCrud(handler.ctor)) continue;
 
     throw new Error(
       `[aggregate] ${handler.ctor.name} takes the five gestures on ${handler.address}, `

package/src/boot/ports.ts

@@ -1,19 +1,6 @@
 import type { ProviderEntry } from '../descriptor/frond.js';
 
-/**
- * A port is a class something already answers under. Nothing declares one — the
- * prototype chain states it, so `class StripePayment extends Payment` IS the whole
- * registration, and so is `class MyLogger extends Logger` over a builtin.
- *
- * This is the fourth reading of the rule the other three already apply: the type
- * names the SUBJECT (`Storage<E>`, `Emit<F>`, `Facade<H>`) and the container
- * holds the realization. Providers were the one case where the type named the
- * realization instead, so `constructor(private payment: Payment)` resolved to the
- * base class and a handler got an object whose method did not exist.
- *
- * Only the DIRECT base binds. A deeper chain binds each link to its own child, and
- * a case that wants otherwise states it in `ports:` — which wins over all of this.
- */
+/** A port is a class something already answers under. */
 export function portBindings(
   providers: ProviderEntry[],
   answers: (name: string) => boolean,

package/src/boot/remote.ts

@@ -1,32 +1,18 @@
-/**
- * Remote façade — what resolve() falls back to.
- *
- * When a handler isn't hosted locally and remotes are declared, resolve()
- * returns a façade-shaped stand-in: same call surface as a local facade,
- * every operation executed through a Transport. Routing is lazy — on the
- * first miss, each declared remote is asked what it hosts (rpc.discover)
- * and the answer is cached. A remote that can't be reached stays pending
- * and is retried on the next miss instead of being cached as absent.
- */
+/** Remote façade — what resolve() falls back to. */
 import type { FrondCall, Transport } from '../wire/call.js';
 import { assertIdentityCard, RPC_ENTITY } from '../wire/call.js';
 import { runMiddlewares, type AppMiddleware, type OperationContext } from '../wire/middleware.js';
-import { EMPTY_INVOCATION, type InvocationContext } from '../contract/Invocation.js';
+import { EMPTY_INVOCATION, type InvocationContext } from '../wire/Invocation.js';
 import { FougereError, ErrorCode } from '../wire/errors.js';
 import { Card, type SchemaView, type SchemaDescriptor } from '@fougere/schema';
-import { DynamicFacade } from '../entry/DynamicFacade.js';
+import { dynamicOperations } from '../entry/facade.js';
 
 interface Route {
   frond: string;
   transport: Transport;
   /**
-   * The entity's schema, rebuilt from the identity card — the same
-   * `SchemaConstructor` shape `entity({...})` produces, live validation
-   * included. Reconstructed once per entity, at discovery time.
-   *
-   * **Absent when the door stores nothing.** A handler may carry no entity, so the card
-   * publishes it with ops and no shape; there is nothing to rebuild and pretending
-   * otherwise would hand callers an empty schema that validates everything.
+   * The entity's schema, rebuilt from the identity card — the same `SchemaConstructor` shape
+   * `entity({...})` produces, live validation included.
    */
   schema?: SchemaView;
 }
@@ -79,27 +65,13 @@ export function createRemoteRouter(
         // adding one here would answer a call with a transport to a door that
         // does not exist.
         for (const door of frond.doors) {
-          const held = claimedBy.get(door.name);
-          /**
-           * Two remotes claiming one name is refused, not silently arbitrated.
-           *
-           * `byEntity` is keyed by the door name alone, so the second claim used to be
-           * dropped with `if (!byEntity.has(...))` — no warning, and the winner was
-           * whichever remote answered first. The local boot already refuses the same
-           * collision (`assertOneOwnerPerKey`) and it refused the OTHER duplicate: in
-           * process the last frond loaded won, here the first discovered did. One
-           * application, two topologies, two different handlers answering — which is
-           * precisely the gradient not holding.
-           *
-           * Refusing is the honest answer while a call names an entity and not a frond.
-           * `FrondCall` already carries an optional `frond`; the day it is required, this
-           * becomes a disambiguation instead of a refusal.
-           */
-          if (held !== undefined && held !== label) {
+          const first = claimedBy.get(door.name);
+          /** Two remotes claiming one name is refused, not silently arbitrated. */
+          if (first !== undefined && first !== label) {
             throw new FougereError({
               code: ErrorCode.INTERNAL_ERROR,
               message:
-                `Two remotes serve '${door.name}': '${held}' and '${label}'.\n`
+                `Two remotes serve '${door.name}': '${first}' and '${label}'.\n`
                 + `  A call names an entity, not a frond, so nothing could choose between them.\n`
                 + `  - Keep one of the two out of \`remotes:\`, or\n`
                 + `  - expose one of them under a different entity name.`,
@@ -140,26 +112,7 @@ export function createRemoteRouter(
 
 type Facade = Record<string, (invocation?: InvocationContext) => Promise<unknown>>;
 
-/**
- * Façade-shaped stand-in — the consumer can't tell it from a local facade.
- *
- * Every trap answers the same question, and that is the point: the runner asks
- * `Object.hasOwn(facade, op)` before calling, so a proxy that only trapped `get`
- * reported *no* operations and every split call came back `Unknown operation` —
- * `get` said yes, `hasOwn` said no, and the runner believed `hasOwn`.
- *
- * The stand-in claims every legal op name because it cannot know better: routing is
- * lazy on purpose (the card is fetched at the first miss), and the remote is the
- * authority on its own surface anyway. An op it does not serve comes back as its
- * NOT_FOUND — judged where it is owned, which is the same answer a local façade gives.
- *
- * It runs the app's middlewares, like `HandlerFacade` does, because "the consumer can't
- * tell it from a local facade" was false of the one thing a consumer installs: measured,
- * `runMiddlewares` had a single caller, so a frond that moved lost every middleware on
- * the calling side — no log, no retry, no cache — from a `remotes:` line alone.
- * The invocation the transport sends is the one the chain leaves behind, so a middleware
- * can still put something on the wire.
- */
+/** Façade-shaped stand-in — the consumer can't tell it from a local facade. */
 export function createRemoteFacade(
   entity: string,
   router: RemoteRouter,
@@ -175,5 +128,5 @@ export function createRemoteFacade(
       transport(call, ctx.invocation ?? invocation));
   };
 
-  return new DynamicFacade(opFn).operations as Facade;
+  return dynamicOperations(opFn) as Facade;
 }

package/src/boot/runner.ts

@@ -1,33 +1,16 @@
-/**
- * A Transport built from an app — the two ways a call enters this process.
- *
- * `Transport` is `wire/`'s shape; making one needs an App and the transport entry.
- */
+/** A Transport built from an app — the two ways a call enters this process. */
 import type { App } from './types.js';
 import type { Transport } from '../wire/call.js';
-import { createTransportEntry } from '../entry/TransportEntry.js';
+import { createTransportEntry } from '../entry/transport.js';
 
-/**
- * Build the local runner — the reference realization of Transport.
- *
- * Resolves strictly from the app's own container: a call that lands here is
- * judged here. A miss is a typed NOT_FOUND, never a forward to another remote.
- */
+/** Build the local runner — the reference realization of Transport. */
 export function createLocalRunner(app: App, surface?: string): Transport {
   return createTransportEntry(app.local, surface);
 }
 
 /**
- * Build the app runner — same judgment, but resolution follows the app's
- * topology: local façades and remote doublures alike. This is the runner
- * an app's own entry points (browser endpoint, bridges) stand on.
- *
- * `surface` is the audience this runner serves, and it belongs to the DOOR that
- * builds the runner, never to the call: a caller cannot name its own audience
- * any more than it can name its own identity (`state` is stamped server-side
- * for the same reason). Reaching the admin door IS the proof. So `FrondCall`
- * gains nothing and the wire format gains nothing — a remote frond's audience
- * is simply which URL `remotes:` points at.
+ * Build the app runner — same verdict, but resolution follows the app's topology: local façades
+ * and remote doublures alike.
  */
 export function createAppRunner(app: App, surface?: string): Transport {
   return createTransportEntry(app, surface);

package/src/boot/seed.ts

@@ -4,22 +4,7 @@ import type { FrondDescriptor, SeedEntry, SeedFactory } from '../descriptor/fron
 import type { App } from './types.js';
 import type { Extension } from './AppLifecycle.js';
 
-/**
- * Seeds in dependency order — a `ref()` target is planted before its referrer.
- *
- * The order is a fact about the entity graph, not about the surface running the seeds,
- * so it is stated once here. The Nuxt module read it off a pairwise comparator (which
- * `Array.sort` cannot make transitive: `a` before `b` and `b` before `c` never implies
- * `a` before `c`), and `boot()` had no order at all — the same fact, told twice and
- * wrong both times. A list seeded before its owner failed on the foreign key, and the
- * driver's error named neither the entity nor the file.
- *
- * Kahn, like `orderTables` in `@fougere/adapter-sql` — the same shape one level up: there
- * the nodes are tables and the edges FK columns, here they are seeds and the edges the
- * `one` relations of the entities they target. A cycle cannot be satisfied by ordering,
- * so its remaining seeds keep their scan order and land last: the driver refuses what is
- * genuinely impossible, and everything acyclic around it still gets planted.
- */
+/** Seeds in dependency order — a `ref()` target is planted before its referrer. */
 export function orderSeeds(fronds: FrondDescriptor[]): SeedEntry[] {
   const refs = new Map<string, Set<string>>();
   for (const frond of fronds) {
@@ -69,14 +54,7 @@ interface SeedDoor {
   write(item: unknown): Promise<unknown>;
 }
 
-/**
- * Plant a set of seeds, in the order given. Reports what it did, one line per entity.
- *
- * The one seeding loop. `boot()` had one and the Nuxt module generated a second into its
- * Nitro plugin, which had drifted: no storage fallback, so an entity with no façade was
- * skipped there and planted here. Two answers to "how does a row get in at boot" is one
- * too many, and the second was the one running in the browser.
- */
+/** Plant a set of seeds, in the order given. */
 export async function runSeeds(
   app: App,
   seeds: SeedEntry[],
@@ -114,11 +92,7 @@ export async function runSeeds(
   }
 }
 
-/**
- * A seed is not a client: it writes at boot, from inside. The façade is used when the
- * entity declares one (its judge catches a bad seed early), the storage when it does
- * not — an entity that exposes nothing is still an entity whose reference rows must land.
- */
+/** A seed is not a client. */
 function doorFor(app: App, entityName: string): SeedDoor | undefined {
   let handler: Record<string, Function> | undefined;
   try { handler = app.resolve<Record<string, Function>>(facadeKeyOf(entityName)); } catch {}
@@ -126,7 +100,7 @@ function doorFor(app: App, entityName: string): SeedDoor | undefined {
   if (typeof handler?.list === 'function' && typeof handler.create === 'function') {
     return {
       list: () => handler!.list() as Promise<unknown[]>,
-      write: (item) => handler!.create({ params: {}, query: {}, body: item, state: {} }),
+      write: (item) => handler!.create({ params: {}, query: {}, input: item, state: {} }),
     };
   }
 
@@ -139,13 +113,8 @@ function doorFor(app: App, entityName: string): SeedDoor | undefined {
 }
 
 /**
- * The framework's own ascent for rows, named — so a host can REPLACE it rather than take
- * over the whole post-boot to get its own.
- *
- * That is what Nuxt's Nitro plugin had to do: a bundler needs its seed modules spelled out
- * as static imports, so the plugin claimed everything after the boot and its copy of the
- * loop drifted. It now declares an extension under this same name instead, and the delta
- * is one member of a list.
+ * The framework's own ascent for rows, named — so a host can REPLACE it rather than take over the
+ * whole post-boot to get its own.
  */
 export function seeding(report?: (message: string) => void): Extension {
   return {

package/src/boot/statement-drift.ts

@@ -1,36 +1,17 @@
-/**
- * Where a STATED contract and the signature it is about have stopped agreeing.
- *
- * `frond.config.ts` states an operation's contract and wins over the scan — that order is
- * deliberate, and it is the only answer for a method inherited from an installed base class
- * the workspace scan cannot see. But winning silently is how a statement made about
- * `publish(id: string)` keeps applying after the parameter was renamed to `postId`: the
- * façade binds what the config said, the method receives `undefined`, and nothing anywhere
- * says the two disagree.
- *
- * So this compares, and only where BOTH exist — a statement about a signature the scan
- * never read is not drift, it is the case config was built for. It is a `warning` and not
- * a refusal: the statement is still the author's word, and a boot that ran yesterday must
- * not stop running because a parameter moved. What it must not do is stay quiet.
- */
+/** Where a STATED contract and the signature it is about have stopped agreeing. */
 import type { FrondDescriptor, HandlerEntry } from '../descriptor/frond.js';
 import type { ScanDiagnostic } from '../scan/result.js';
 import type { BindingPlan } from '../wire/binding.js';
 import type { Signature } from '../wire/signature.js';
 
-/** The parameters a stated binding names, against the ones the method declares. */
-function namesDisagreeing(stated: BindingPlan, signature: Signature): string[] {
+/** The parameters a binding plan names, against the ones the method declares. */
+function namesDisagreeing(plan: BindingPlan, signature: Signature): string[] {
   const declared = new Set(signature.params.map((p: { name: string }) => p.name));
 
-  return stated.map((b) => b.name).filter((name) => !declared.has(name));
+  return plan.map((b) => b.name).filter((name) => !declared.has(name));
 }
 
-/**
- * What a frond's stated contracts no longer match.
- *
- * Read by `resolveEffectiveOperations`, so the same answer reaches `fougere check` and a
- * boot — one comparison, two readers, no second opinion to drift on its own.
- */
+/** What a frond's stated contracts no longer match. */
 export function statementDrift(frond: FrondDescriptor, handler: HandlerEntry): ScanDiagnostic[] {
   const found: ScanDiagnostic[] = [];