@fougere/core 0.6.0-alpha.0 → 0.8.0-alpha.0

package/dist/boot/apply.js

@@ -1,26 +1,19 @@
-import { setLogLevel, logLevel, envLevel } from '../builtins/logger.js';
+import { setLogLevel, logLevel, envLevel } from '../builtin/logger.js';
 import { dequal } from 'dequal';
-/**
- * What a (re-)read config changes in a process that is already running.
- *
- * The rule it realizes, and the only one worth remembering: **a value that is
- * CONSULTED can change under a running app; a value that was CONSUMED to build
- * something cannot, without rebuilding what it built.** `logLevel` is consulted at
- * every emission, so it moves. `db` opened a connection, `ports:` registered a class,
- * the entities built façades — those are consumed, and this function reports them
- * rather than pretending.
- *
- * The list of consulted keys is not declared anywhere: a key is consulted when this
- * function does something with it, which is the only definition that cannot go stale.
- */
+/** What a (re-)read config changes in a process that is already running. */
 export function applyConfig(next, inForce) {
     const applied = [];
     const pending = [];
     // The CLI speaks through the environment, so it keeps winning over the file — read
-    // through `envLevel`, which is where the environment is already judged. Casting it
+    // through `envLevel`, which is where the environment is already validated. Casting it
     // here was a second reader that validated nothing: `FOUGERE_LOG_LEVEL=verbose` set
     // the threshold to `undefined` and every log passed.
-    const wanted = envLevel() ?? next.logLevel ?? 'debug';
+    // A process that declares no level keeps the one it started with — `info`, or whatever
+    // the host set for itself before booting. Defaulting to `debug` here meant every caller
+    // of this function silently raised the threshold: the CLI sets `warn` and got `debug`
+    // back, and the day a web host started calling it, `pnpm dev` would have traced every
+    // dispatch of an app that asked for nothing.
+    const wanted = envLevel() ?? next.logLevel ?? logLevel();
     const before = logLevel();
     if (wanted !== before) {
         setLogLevel(wanted);

package/dist/boot/apply.js.map

@@ -1 +1 @@
-{"version":3,"file":"apply.js","sourceRoot":"","sources":["../../src/boot/apply.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,WAAW,EAAE,QAAQ,EAAE,QAAQ,EAAE,MAAM,uBAAuB,CAAC;AACxE,OAAO,EAAE,MAAM,EAAE,MAAM,QAAQ,CAAC;AAShC;;;;;;;;;;;;GAYG;AACH,MAAM,UAAU,WAAW,CAAC,IAAmB,EAAE,OAAuB;IACtE,MAAM,OAAO,GAAa,EAAE,CAAC;IAC7B,MAAM,OAAO,GAAa,EAAE,CAAC;IAE7B,mFAAmF;IACnF,mFAAmF;IACnF,mFAAmF;IACnF,qDAAqD;IACrD,MAAM,MAAM,GAAG,QAAQ,EAAE,IAAI,IAAI,CAAC,QAAQ,IAAI,OAAO,CAAC;IACtD,MAAM,MAAM,GAAG,QAAQ,EAAE,CAAC;IAC1B,IAAI,MAAM,KAAK,MAAM,EAAE,CAAC;QACtB,WAAW,CAAC,MAAM,CAAC,CAAC;QACpB,OAAO,CAAC,IAAI,CAAC,aAAa,MAAM,MAAM,MAAM,EAAE,CAAC,CAAC;IAClD,CAAC;IAED,KAAK,MAAM,GAAG,IAAI,IAAI,GAAG,CAAC,CAAC,GAAG,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,GAAG,MAAM,CAAC,IAAI,CAAC,OAAO,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACjF,IAAI,GAAG,KAAK,UAAU,IAAI,CAAC,OAAO;YAAE,SAAS;QAC7C,IAAI,CAAC,MAAM,CAAE,IAAgC,CAAC,GAAG,CAAC,EAAG,OAAmC,CAAC,GAAG,CAAC,CAAC,EAAE,CAAC;YAC/F,OAAO,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QACpB,CAAC;IACH,CAAC;IACD,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,CAAC;AAC9B,CAAC"}
+{"version":3,"file":"apply.js","sourceRoot":"","sources":["../../src/boot/apply.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,WAAW,EAAE,QAAQ,EAAE,QAAQ,EAAE,MAAM,sBAAsB,CAAC;AACvE,OAAO,EAAE,MAAM,EAAE,MAAM,QAAQ,CAAC;AAShC,4EAA4E;AAC5E,MAAM,UAAU,WAAW,CAAC,IAAmB,EAAE,OAAuB;IACtE,MAAM,OAAO,GAAa,EAAE,CAAC;IAC7B,MAAM,OAAO,GAAa,EAAE,CAAC;IAE7B,mFAAmF;IACnF,sFAAsF;IACtF,mFAAmF;IACnF,qDAAqD;IACrD,uFAAuF;IACvF,wFAAwF;IACxF,sFAAsF;IACtF,sFAAsF;IACtF,6CAA6C;IAC7C,MAAM,MAAM,GAAG,QAAQ,EAAE,IAAI,IAAI,CAAC,QAAQ,IAAI,QAAQ,EAAE,CAAC;IACzD,MAAM,MAAM,GAAG,QAAQ,EAAE,CAAC;IAC1B,IAAI,MAAM,KAAK,MAAM,EAAE,CAAC;QACtB,WAAW,CAAC,MAAM,CAAC,CAAC;QACpB,OAAO,CAAC,IAAI,CAAC,aAAa,MAAM,MAAM,MAAM,EAAE,CAAC,CAAC;IAClD,CAAC;IAED,KAAK,MAAM,GAAG,IAAI,IAAI,GAAG,CAAC,CAAC,GAAG,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,GAAG,MAAM,CAAC,IAAI,CAAC,OAAO,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACjF,IAAI,GAAG,KAAK,UAAU,IAAI,CAAC,OAAO;YAAE,SAAS;QAC7C,IAAI,CAAC,MAAM,CAAE,IAAgC,CAAC,GAAG,CAAC,EAAG,OAAmC,CAAC,GAAG,CAAC,CAAC,EAAE,CAAC;YAC/F,OAAO,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QACpB,CAAC;IACH,CAAC;IACD,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,CAAC;AAC9B,CAAC"}

package/dist/boot/auth.d.ts

@@ -4,13 +4,7 @@
  */
 import type { SchemaView } from '@fougere/schema';
 import type { Storage, StorageFactory } from '../storage.js';
-/**
- * Lazy auth declaration written in fougere.config.ts.
- *
- * Each @fougere/auth-* package exports a factory (e.g. `betterAuth(opts)`) that
- * returns this shape. The `create()` method is called once at boot with the
- * resolved db + storageFactory, so the provider can wire its engine through Fougere.
- */
+/** Lazy auth declaration written in fougere.config.ts. */
 export interface AuthConfig {
     /** Build the runtime — invoked by createApp at boot with the resolved storage handles. */
     create(ctx: AuthContext): AuthRuntime | Promise<AuthRuntime>;
@@ -37,11 +31,7 @@ export interface AuthContext {
 export interface AuthRuntime {
     /** Entities used by the provider, including any defaults it filled in. */
     entities: Record<string, SchemaView>;
-    /**
-     * Per-entity ORMs the provider built for itself. Exposed so app code can
-     * query auth tables (e.g. list active sessions for a user) without rebuilding
-     * the same Storage.
-     */
+    /** Per-entity ORMs the provider built for itself. */
     storages: Record<string, Storage>;
     /** Web Standard handler that processes /auth/* requests. */
     handler: (request: Request) => Promise<Response>;

package/dist/boot/auth.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"auth.d.ts","sourceRoot":"","sources":["../../src/boot/auth.ts"],"names":[],"mappings":"AAAA;;;GAGG;AACH,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,iBAAiB,CAAC;AAClD,OAAO,KAAK,EAAE,OAAO,EAAE,cAAc,EAAE,MAAM,eAAe,CAAC;AAE7D;;;;;;GAMG;AACH,MAAM,WAAW,UAAU;IACzB,0FAA0F;IAC1F,MAAM,CAAC,GAAG,EAAE,WAAW,GAAG,WAAW,GAAG,OAAO,CAAC,WAAW,CAAC,CAAC;IAC7D;;;OAGG;IACH,QAAQ,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,UAAU,CAAC,CAAC;CACvC;AAED;;;GAGG;AACH,MAAM,WAAW,WAAW;IAC1B,iFAAiF;IACjF,EAAE,EAAE,OAAO,CAAC;IACZ,gFAAgF;IAChF,cAAc,EAAE,cAAc,CAAC;CAChC;AAED;;;GAGG;AACH,MAAM,WAAW,WAAW;IAC1B,0EAA0E;IAC1E,QAAQ,EAAE,MAAM,CAAC,MAAM,EAAE,UAAU,CAAC,CAAC;IACrC;;;;OAIG;IACH,QAAQ,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAClC,4DAA4D;IAC5D,OAAO,EAAE,CAAC,OAAO,EAAE,OAAO,KAAK,OAAO,CAAC,QAAQ,CAAC,CAAC;IACjD,2EAA2E;IAC3E,GAAG,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAC7B,+EAA+E;IAC/E,QAAQ,EAAE,MAAM,CAAC;CAClB"}
+{"version":3,"file":"auth.d.ts","sourceRoot":"","sources":["../../src/boot/auth.ts"],"names":[],"mappings":"AAAA;;;GAGG;AACH,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,iBAAiB,CAAC;AAClD,OAAO,KAAK,EAAE,OAAO,EAAE,cAAc,EAAE,MAAM,eAAe,CAAC;AAE7D,0DAA0D;AAC1D,MAAM,WAAW,UAAU;IACzB,0FAA0F;IAC1F,MAAM,CAAC,GAAG,EAAE,WAAW,GAAG,WAAW,GAAG,OAAO,CAAC,WAAW,CAAC,CAAC;IAC7D;;;OAGG;IACH,QAAQ,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,UAAU,CAAC,CAAC;CACvC;AAED;;;GAGG;AACH,MAAM,WAAW,WAAW;IAC1B,iFAAiF;IACjF,EAAE,EAAE,OAAO,CAAC;IACZ,gFAAgF;IAChF,cAAc,EAAE,cAAc,CAAC;CAChC;AAED;;;GAGG;AACH,MAAM,WAAW,WAAW;IAC1B,0EAA0E;IAC1E,QAAQ,EAAE,MAAM,CAAC,MAAM,EAAE,UAAU,CAAC,CAAC;IACrC,qDAAqD;IACrD,QAAQ,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAClC,4DAA4D;IAC5D,OAAO,EAAE,CAAC,OAAO,EAAE,OAAO,KAAK,OAAO,CAAC,QAAQ,CAAC,CAAC;IACjD,2EAA2E;IAC3E,GAAG,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAC7B,+EAA+E;IAC/E,QAAQ,EAAE,MAAM,CAAC;CAClB"}

package/dist/boot/boot.d.ts

@@ -19,11 +19,7 @@ interface BootOptions {
     remotes?: Record<string, string>;
     /** Builds the transport to reach `remotes`. Supplied by a layer-2 package. */
     remoteTransport?: (url: string) => Transport;
-    /**
-     * Carries an announced fact out of this process. Forwarded rather than dropped: a
-     * caller handing one in has no other way to reach the emitter, and this path silently
-     * kept it to itself.
-     */
+    /** Carries an announced fact out of this process. */
     onEmit?: CreateAppOptions['onEmit'];
     /**
      * storage setup — returns the storage handle (db), an storageFactory, and its two halves.
@@ -32,11 +28,7 @@ interface BootOptions {
     db?: (config: FougereConfig) => {
         db?: unknown;
         storageFactory: CreateAppOptions['storageFactory'];
-        /**
-         * Bring the schema up to date — an extension's `up`, because it runs after the
-         * container. It used to be called `afterBoot`, a word that also meant the host's
-         * post-boot and was read in four places under two senses.
-         */
+        /** Bring the schema up to date — an extension's `up`, because it runs after the container. */
         migrate?: (app: App) => Promise<void> | void;
         /** Closes what the factory opened — `boot()` called it, so `boot()` releases it. */
         close?: () => Promise<void>;
@@ -47,12 +39,7 @@ interface BootOptions {
      */
     extensions?: readonly (Extension | undefined)[];
 }
-/**
- * Boot a Fougere app from fougere.config.ts.
- *
- * Handles: config loading, container creation, DB setup, seeding.
- * Works for any surface (Nuxt, GraphQL standalone, CLI, tests).
- */
+/** Boot a Fougere app from fougere.config.ts. */
 export declare function boot(options: BootOptions): Promise<App>;
 export {};
 //# sourceMappingURL=boot.d.ts.map

package/dist/boot/boot.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"boot.d.ts","sourceRoot":"","sources":["../../src/boot/boot.ts"],"names":[],"mappings":"AAGA,OAAO,EAAc,KAAK,aAAa,EAAE,MAAM,qBAAqB,CAAC;AAGrE,OAAO,KAAK,EAAE,GAAG,EAAE,gBAAgB,EAAE,MAAM,YAAY,CAAC;AACxD,OAAO,EAAa,KAAK,SAAS,EAAE,MAAM,mBAAmB,CAAC;AAC9D,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,iBAAiB,CAAC;AACjD,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,oBAAoB,CAAC;AAEpD,UAAU,WAAW;IACnB,+CAA+C;IAC/C,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,uDAAuD;IACvD,MAAM,CAAC,EAAE,OAAO,CAAC,aAAa,CAAC,CAAC;IAChC,mCAAmC;IACnC,eAAe,EAAE,MAAM,SAAS,CAAC;IACjC,sDAAsD;IACtD,MAAM,CAAC,EAAE,MAAM,EAAE,CAAC;IAClB;;;OAGG;IACH,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACjC,8EAA8E;IAC9E,eAAe,CAAC,EAAE,CAAC,GAAG,EAAE,MAAM,KAAK,SAAS,CAAC;IAC7C;;;;OAIG;IACH,MAAM,CAAC,EAAE,gBAAgB,CAAC,QAAQ,CAAC,CAAC;IACpC;;;OAGG;IACH,EAAE,CAAC,EAAE,CAAC,MAAM,EAAE,aAAa,KAAK;QAC9B,EAAE,CAAC,EAAE,OAAO,CAAC;QACb,cAAc,EAAE,gBAAgB,CAAC,gBAAgB,CAAC,CAAC;QACnD;;;;WAIG;QACH,OAAO,CAAC,EAAE,CAAC,GAAG,EAAE,GAAG,KAAK,OAAO,CAAC,IAAI,CAAC,GAAG,IAAI,CAAC;QAC7C,oFAAoF;QACpF,KAAK,CAAC,EAAE,MAAM,OAAO,CAAC,IAAI,CAAC,CAAC;KAC7B,CAAC;IACF;;;OAGG;IACH,UAAU,CAAC,EAAE,SAAS,CAAC,SAAS,GAAG,SAAS,CAAC,EAAE,CAAC;CACjD;AAED;;;;;GAKG;AACH,wBAAsB,IAAI,CAAC,OAAO,EAAE,WAAW,GAAG,OAAO,CAAC,GAAG,CAAC,CA8D7D"}
+{"version":3,"file":"boot.d.ts","sourceRoot":"","sources":["../../src/boot/boot.ts"],"names":[],"mappings":"AAGA,OAAO,EAAc,KAAK,aAAa,EAAE,MAAM,qBAAqB,CAAC;AAGrE,OAAO,KAAK,EAAE,GAAG,EAAE,gBAAgB,EAAE,MAAM,YAAY,CAAC;AACxD,OAAO,EAAa,KAAK,SAAS,EAAE,MAAM,mBAAmB,CAAC;AAC9D,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,iBAAiB,CAAC;AACjD,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,oBAAoB,CAAC;AAEpD,UAAU,WAAW;IACnB,+CAA+C;IAC/C,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,uDAAuD;IACvD,MAAM,CAAC,EAAE,OAAO,CAAC,aAAa,CAAC,CAAC;IAChC,mCAAmC;IACnC,eAAe,EAAE,MAAM,SAAS,CAAC;IACjC,sDAAsD;IACtD,MAAM,CAAC,EAAE,MAAM,EAAE,CAAC;IAClB;;;OAGG;IACH,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACjC,8EAA8E;IAC9E,eAAe,CAAC,EAAE,CAAC,GAAG,EAAE,MAAM,KAAK,SAAS,CAAC;IAC7C,qDAAqD;IACrD,MAAM,CAAC,EAAE,gBAAgB,CAAC,QAAQ,CAAC,CAAC;IACpC;;;OAGG;IACH,EAAE,CAAC,EAAE,CAAC,MAAM,EAAE,aAAa,KAAK;QAC9B,EAAE,CAAC,EAAE,OAAO,CAAC;QACb,cAAc,EAAE,gBAAgB,CAAC,gBAAgB,CAAC,CAAC;QACnD,8FAA8F;QAC9F,OAAO,CAAC,EAAE,CAAC,GAAG,EAAE,GAAG,KAAK,OAAO,CAAC,IAAI,CAAC,GAAG,IAAI,CAAC;QAC7C,oFAAoF;QACpF,KAAK,CAAC,EAAE,MAAM,OAAO,CAAC,IAAI,CAAC,CAAC;KAC7B,CAAC;IACF;;;OAGG;IACH,UAAU,CAAC,EAAE,SAAS,CAAC,SAAS,GAAG,SAAS,CAAC,EAAE,CAAC;CACjD;AAED,iDAAiD;AACjD,wBAAsB,IAAI,CAAC,OAAO,EAAE,WAAW,GAAG,OAAO,CAAC,GAAG,CAAC,CA4D7D"}

package/dist/boot/boot.js

@@ -2,15 +2,10 @@ import { createApp } from './bootstrap.js';
 import { seeding } from './seed.js';
 import { scanProject } from '../scan/scanner.js';
 import { loadConfig } from '../config-loader.js';
-import { Logger } from '../builtins/logger.js';
+import { Logger } from '../builtin/logger.js';
 import { applyConfig } from './apply.js';
 import { migrating } from './AppLifecycle.js';
-/**
- * Boot a Fougere app from fougere.config.ts.
- *
- * Handles: config loading, container creation, DB setup, seeding.
- * Works for any surface (Nuxt, GraphQL standalone, CLI, tests).
- */
+/** Boot a Fougere app from fougere.config.ts. */
 export async function boot(options) {
     const bootStart = performance.now();
     const log = new Logger('boot');
@@ -50,12 +45,10 @@ export async function boot(options) {
         // it was opened before the container existed, so it closes after the container goes.
         onDispose: dbSetup?.close,
         /**
-         * The whole ascent, in one ordered list — tables, then rows, then whatever the host
-         * takes on. It was four call sites under the name `afterBoot`, two of which meant
-         * different things and one of which was generated into a Nitro plugin.
+         * The whole ascent, in one ordered list — tables, then rows, then whatever the host takes on.
          */
         extensions: [
-            migrating(dbSetup?.migrate),
+            migrating(dbSetup?.migrate, (message) => log.warn(message)),
             seeding((message) => log.debug(message)),
             ...(options.extensions ?? []),
         ],

package/dist/boot/boot.js.map

@@ -1 +1 @@
-{"version":3,"file":"boot.js","sourceRoot":"","sources":["../../src/boot/boot.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,EAAE,MAAM,gBAAgB,CAAC;AAC3C,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AACpC,OAAO,EAAE,WAAW,EAAE,MAAM,oBAAoB,CAAC;AACjD,OAAO,EAAE,UAAU,EAAsB,MAAM,qBAAqB,CAAC;AACrE,OAAO,EAAE,MAAM,EAAE,MAAM,uBAAuB,CAAC;AAC/C,OAAO,EAAE,WAAW,EAAE,MAAM,YAAY,CAAC;AAEzC,OAAO,EAAE,SAAS,EAAkB,MAAM,mBAAmB,CAAC;AAiD9D;;;;;GAKG;AACH,MAAM,CAAC,KAAK,UAAU,IAAI,CAAC,OAAoB;IAC7C,MAAM,SAAS,GAAG,WAAW,CAAC,GAAG,EAAE,CAAC;IACpC,MAAM,GAAG,GAAG,IAAI,MAAM,CAAC,MAAM,CAAC,CAAC;IAE/B,MAAM,IAAI,GAAG,OAAO,CAAC,IAAI,IAAI,OAAO,CAAC,GAAG,EAAE,CAAC;IAC3C,GAAG,CAAC,IAAI,CAAC,SAAS,IAAI,EAAE,CAAC,CAAC;IAE1B,GAAG,CAAC,KAAK,CAAC,gBAAgB,CAAC,CAAC;IAC5B,MAAM,UAAU,GAAG,MAAM,UAAU,CAAC,IAAI,CAAC,CAAC;IAC1C,MAAM,MAAM,GAAkB,EAAE,GAAG,UAAU,EAAE,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC;IACnE,qFAAqF;IACrF,kFAAkF;IAClF,WAAW,CAAC,MAAM,CAAC,CAAC;IACpB,GAAG,CAAC,IAAI,CAAC,eAAe,CAAC,CAAC;IAE1B,IAAI,OAA+D,CAAC;IACpE,IAAI,OAAO,CAAC,EAAE,EAAE,CAAC;QACf,GAAG,CAAC,KAAK,CAAC,uBAAuB,CAAC,CAAC;QACnC,OAAO,GAAG,OAAO,CAAC,EAAE,CAAC,MAAM,CAAC,CAAC;QAC7B,GAAG,CAAC,IAAI,CAAC,sBAAsB,CAAC,CAAC;IACnC,CAAC;IAED,GAAG,CAAC,KAAK,CAAC,iCAAiC,CAAC,CAAC;IAC7C,MAAM,GAAG,GAAG,MAAM,SAAS,CAAC;QAC1B,mFAAmF;QACnF,6CAA6C;QAC7C,IAAI,EAAE,MAAM,WAAW,CAAC,IAAI,EAAE,OAAO,CAAC,MAAM,EAAE,MAAM,CAAC,WAAW,CAAC;QACjE,eAAe,EAAE,OAAO,CAAC,eAAe;QACxC,cAAc,EAAE,OAAO,EAAE,cAAc;QACvC,EAAE,EAAE,OAAO,EAAE,EAAE;QACf,IAAI,EAAE,MAAM,CAAC,IAAI;QACjB,OAAO,EAAE,OAAO,CAAC,OAAO;QACxB,KAAK,EAAE,MAAM,CAAC,KAAK;QACnB,qFAAqF;QACrF,0EAA0E;QAC1E,iFAAiF;QACjF,iFAAiF;QACjF,8CAA8C;QAC9C,QAAQ,EAAE,MAAM,CAAC,QAAQ;QACzB,sFAAsF;QACtF,qFAAqF;QACrF,SAAS,EAAE,OAAO,EAAE,KAAK;QACzB;;;;WAIG;QACH,UAAU,EAAE;YACV,SAAS,CAAC,OAAO,EAAE,OAAO,CAAC;YAC3B,OAAO,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;YACxC,GAAG,CAAC,OAAO,CAAC,UAAU,IAAI,EAAE,CAAC;SAC9B;QACD,MAAM,EAAE,OAAO,CAAC,MAAM;QACtB,eAAe,EAAE,OAAO,CAAC,eAAe;KACzC,CAAC,CAAC;IAEH,GAAG,CAAC,IAAI,CAAC,WAAW,GAAG,CAAC,UAAU,EAAE,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,kBAAkB,EAAE,CAAC,CAAC;IAE1E,MAAM,EAAE,GAAG,CAAC,WAAW,CAAC,GAAG,EAAE,GAAG,SAAS,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC;IACtD,GAAG,CAAC,IAAI,CAAC,YAAY,EAAE,QAAQ,GAAG,CAAC,MAAM,CAAC,MAAM,WAAW,CAAC,CAAC;IAE7D,OAAO,GAAG,CAAC;AACb,CAAC"}
+{"version":3,"file":"boot.js","sourceRoot":"","sources":["../../src/boot/boot.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,EAAE,MAAM,gBAAgB,CAAC;AAC3C,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AACpC,OAAO,EAAE,WAAW,EAAE,MAAM,oBAAoB,CAAC;AACjD,OAAO,EAAE,UAAU,EAAsB,MAAM,qBAAqB,CAAC;AACrE,OAAO,EAAE,MAAM,EAAE,MAAM,sBAAsB,CAAC;AAC9C,OAAO,EAAE,WAAW,EAAE,MAAM,YAAY,CAAC;AAEzC,OAAO,EAAE,SAAS,EAAkB,MAAM,mBAAmB,CAAC;AAyC9D,iDAAiD;AACjD,MAAM,CAAC,KAAK,UAAU,IAAI,CAAC,OAAoB;IAC7C,MAAM,SAAS,GAAG,WAAW,CAAC,GAAG,EAAE,CAAC;IACpC,MAAM,GAAG,GAAG,IAAI,MAAM,CAAC,MAAM,CAAC,CAAC;IAE/B,MAAM,IAAI,GAAG,OAAO,CAAC,IAAI,IAAI,OAAO,CAAC,GAAG,EAAE,CAAC;IAC3C,GAAG,CAAC,IAAI,CAAC,SAAS,IAAI,EAAE,CAAC,CAAC;IAE1B,GAAG,CAAC,KAAK,CAAC,gBAAgB,CAAC,CAAC;IAC5B,MAAM,UAAU,GAAG,MAAM,UAAU,CAAC,IAAI,CAAC,CAAC;IAC1C,MAAM,MAAM,GAAkB,EAAE,GAAG,UAAU,EAAE,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC;IACnE,qFAAqF;IACrF,kFAAkF;IAClF,WAAW,CAAC,MAAM,CAAC,CAAC;IACpB,GAAG,CAAC,IAAI,CAAC,eAAe,CAAC,CAAC;IAE1B,IAAI,OAA+D,CAAC;IACpE,IAAI,OAAO,CAAC,EAAE,EAAE,CAAC;QACf,GAAG,CAAC,KAAK,CAAC,uBAAuB,CAAC,CAAC;QACnC,OAAO,GAAG,OAAO,CAAC,EAAE,CAAC,MAAM,CAAC,CAAC;QAC7B,GAAG,CAAC,IAAI,CAAC,sBAAsB,CAAC,CAAC;IACnC,CAAC;IAED,GAAG,CAAC,KAAK,CAAC,iCAAiC,CAAC,CAAC;IAC7C,MAAM,GAAG,GAAG,MAAM,SAAS,CAAC;QAC1B,mFAAmF;QACnF,6CAA6C;QAC7C,IAAI,EAAE,MAAM,WAAW,CAAC,IAAI,EAAE,OAAO,CAAC,MAAM,EAAE,MAAM,CAAC,WAAW,CAAC;QACjE,eAAe,EAAE,OAAO,CAAC,eAAe;QACxC,cAAc,EAAE,OAAO,EAAE,cAAc;QACvC,EAAE,EAAE,OAAO,EAAE,EAAE;QACf,IAAI,EAAE,MAAM,CAAC,IAAI;QACjB,OAAO,EAAE,OAAO,CAAC,OAAO;QACxB,KAAK,EAAE,MAAM,CAAC,KAAK;QACnB,qFAAqF;QACrF,0EAA0E;QAC1E,iFAAiF;QACjF,iFAAiF;QACjF,8CAA8C;QAC9C,QAAQ,EAAE,MAAM,CAAC,QAAQ;QACzB,sFAAsF;QACtF,qFAAqF;QACrF,SAAS,EAAE,OAAO,EAAE,KAAK;QACzB;;WAEG;QACH,UAAU,EAAE;YACV,SAAS,CAAC,OAAO,EAAE,OAAO,EAAE,CAAC,OAAO,EAAE,EAAE,CAAC,GAAG,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;YAC3D,OAAO,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;YACxC,GAAG,CAAC,OAAO,CAAC,UAAU,IAAI,EAAE,CAAC;SAC9B;QACD,MAAM,EAAE,OAAO,CAAC,MAAM;QACtB,eAAe,EAAE,OAAO,CAAC,eAAe;KACzC,CAAC,CAAC;IAEH,GAAG,CAAC,IAAI,CAAC,WAAW,GAAG,CAAC,UAAU,EAAE,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,kBAAkB,EAAE,CAAC,CAAC;IAE1E,MAAM,EAAE,GAAG,CAAC,WAAW,CAAC,GAAG,EAAE,GAAG,SAAS,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC;IACtD,GAAG,CAAC,IAAI,CAAC,YAAY,EAAE,QAAQ,GAAG,CAAC,MAAM,CAAC,MAAM,WAAW,CAAC,CAAC;IAE7D,OAAO,GAAG,CAAC;AACb,CAAC"}

package/dist/boot/bootstrap.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"bootstrap.d.ts","sourceRoot":"","sources":["../../src/boot/bootstrap.ts"],"names":[],"mappings":"AAKA,OAAO,KAAK,EAAE,gBAAgB,EAAE,GAAG,EAAE,MAAM,YAAY,CAAC;AA0FxD,uCAAuC;AACvC,wBAAsB,SAAS,CAAC,OAAO,EAAE,gBAAgB,GAAG,OAAO,CAAC,GAAG,CAAC,CAyvBvE"}
+{"version":3,"file":"bootstrap.d.ts","sourceRoot":"","sources":["../../src/boot/bootstrap.ts"],"names":[],"mappings":"AAMA,OAAO,KAAK,EAAE,gBAAgB,EAAE,GAAG,EAAE,MAAM,YAAY,CAAC;AAuExD,uCAAuC;AACvC,wBAAsB,SAAS,CAAC,OAAO,EAAE,gBAAgB,GAAG,OAAO,CAAC,GAAG,CAAC,CA8tBvE"}

package/dist/boot/bootstrap.js

@@ -1,11 +1,12 @@
 import { lowerFirst } from '@fougere/schema';
+import { nameOf } from '../descriptor/frond.js';
 import { hostedBy } from './hosted.js';
-import { Logger } from '../builtins/logger.js';
-import { Config } from '../builtins/config.js';
+import { Logger } from '../builtin/logger.js';
+import { Config } from '../builtin/config.js';
 import { createRemoteRouter, createRemoteFacade } from './remote.js';
 import { registerFrames } from './together.js';
 import { Emissions } from './Emissions.js';
-import { HandlerFacade } from './HandlerFacade.js';
+import { HandlerFacade } from '../dispatch/HandlerFacade.js';
 import { targetOf } from '../prefab/prefab.js';
 import { ownersOf, refuseStorageInUserCode, refuseCrudOnOwned } from './ownership.js';
 import { resolveEffectiveOperations, } from '../effective-operation.js';
@@ -16,50 +17,31 @@ import { InFlight } from '../dispatch/InFlight.js';
 import { facadeKeyOf, contractsKeyOf } from '../wire/call.js';
 import { identityCardOf } from './card.js';
 import { AppLifecycle } from './AppLifecycle.js';
+import { inheritsCrud, subjectOf } from '../prefab/crud.js';
 import { repositoryKeyOf } from '../prefab/repository.js';
 import { storageKeyOf } from '../storage.js';
+import { declares } from '../source.js';
 import { presenterKeyOf } from '../prefab/presenter.js';
 import { collectorKeyOf } from '../prefab/collector.js';
-import { RouteAddress } from '../contract/RouteAddress.js';
+import { RouteAddress } from '../wire/RouteAddress.js';
 import { DispatchLifecycle } from '../dispatch/DispatchLifecycle.js';
 import { Dispatcher } from '../dispatch/Dispatcher.js';
 import { LocalRoutePolicy } from '../dispatch/LocalRoutePolicy.js';
 import { OperationRoute } from '../dispatch/OperationRoute.js';
-import { RemoteRouteResolver } from '../dispatch/RemoteRouteResolver.js';
+import { remoteRoutes } from '../dispatch/remoteRoutes.js';
 import { RouteRegistry } from '../dispatch/RouteRegistry.js';
-import { FacadeEntry } from '../entry/FacadeEntry.js';
-/**
- * The one wording for "nobody hosts this here", with both ways out. Said twice, and the
- * second copy (`schemaFor`) had lost the two remedies — the same dead end, strictly less
- * useful, for no reason.
- */
+import { facadeOperations } from '../entry/facade.js';
+/** The one wording for "nobody hosts this here", with both ways out. */
 const notLoaded = (entity) => `Frond for '${entity}' is not loaded.\n` +
     `  - Add '${entity}' to --fronds flag\n` +
     `  - Or declare a remote: remotes: { ${entity}: 'http://...' }`;
-/**
- * Two fronds cannot claim one name — said at boot, because nothing else says it.
- *
- * A door lands on the ROOT container under `facadeKeyOf(address)`, and that key carries
- * no frond; a presenter lands there too. `registerValue` is a `Map.set`, so the second
- * frond loaded simply replaced the first and every call meant for one went to the other.
- * Silent in-process, and worse than silent under a split: `createRemoteRouter` guards its
- * index with `if (!byEntity.has(...))`, so THERE the first frond discovered wins. The same
- * application answered differently depending on how it was deployed.
- *
- * Refusing is the honest answer while a key cannot say which frond owns it. It is not the
- * last word: qualify the key and this boot can accept both. ORMs and repositories are not
- * checked because they are registered in the frond's own scope, where two fronds do not meet.
- *
- * A frond declared remote registers nothing locally, so it cannot collide here. Two REMOTE
- * fronds publishing one entity still shadow each other inside the router — a hole this
- * check does not reach.
- */
+/** Two fronds cannot claim one name — said at boot, because nothing else says it. */
 function assertOneOwnerPerKey(fronds, remotes) {
     const owner = new Map();
     const claim = (key, frond, what) => {
-        const held = owner.get(key);
-        if (held !== undefined && held !== frond) {
-            throw new Error(`Two fronds claim the key '${key}': '${held}' and '${frond}'.\n`
+        const first = owner.get(key);
+        if (first !== undefined && first !== frond) {
+            throw new Error(`Two fronds claim the key '${key}': '${first}' and '${frond}'.\n`
                 + `  A ${what} is registered under a key that names no frond, so one would silently replace the other.\n`
                 + `  - Rename one of the two classes, or\n`
                 + `  - keep one of the two fronds out of this process (--fronds), or declare it in remotes:`);
@@ -110,24 +92,13 @@ export async function createApp(options) {
     const blocking = diagnostics.filter((d) => d.severity === 'blocking');
     log.info(`read ${fronds.length} frond(s) in ${scanMs}ms`
         + (diagnostics.length ? ` — ${diagnostics.length} thing(s) the scan could not do` : ''));
-    /**
-     * Say what could not be read, at the one line everyone already watches.
-     *
-     * Not a refusal: an app whose `presenters/` is unreadable still serves its
-     * entities, and stopping the boot would trade a partial app for none. But it is
-     * an ERROR, not a debug line — the app now serves less than its source declares,
-     * and nothing downstream can tell that from a source that declares less.
-     */
+    /** Say what could not be read, at the one line everyone already watches. */
     for (const d of blocking)
         log.error(`[${d.code}] ${d.message}`, d.cause);
     for (const d of diagnostics)
         if (d.severity === 'warning')
             log.warn(`[${d.code}] ${d.message}`);
-    /**
-     * An ambiguous convention is not a partial scan. Every relevant declaration was read,
-     * but more than one executable contract can be built from it. Refuse before auth,
-     * storage, migrations or seeds make the boot observable.
-     */
+    /** An ambiguous convention is not a partial scan. */
     const invalidOperations = operationModel.resolutionDiagnostics
         .filter((diagnostic) => diagnostic.severity === 'blocking');
     if (invalidOperations.length > 0) {
@@ -153,7 +124,7 @@ export async function createApp(options) {
         });
         log.info(`auth ready — mounted at ${authRuntime.basePath}`);
     }
-    // Remote routing — judged at boot: declaring remotes without a transport is a config error.
+    // Remote routing — validated at boot: declaring remotes without a transport is a config error.
     // A remote declaration wins over local presence: `remotes: { blog: url }` IS
     // the topology statement — the frond's code may sit in fronds/**, it runs elsewhere.
     const declaredRemotes = Object.entries(options.remotes ?? {});
@@ -180,7 +151,7 @@ export async function createApp(options) {
         return [...globalMiddlewares, ...scoped];
     }
     assertOneOwnerPerKey(fronds, options.remotes);
-    // Every entity of every frond, by name — so a fact can be judged where it LANDS, and
+    // Every entity of every frond, by name — so a fact can be validated where it LANDS, and
     // so a `reads:` clause can name a neighbour's.
     const entityByName = fronds.schemas();
     // Which frond holds an entity — what turns "a member is remote" into a refusal that
@@ -244,7 +215,7 @@ export async function createApp(options) {
         refuseStorageInUserCode(frond, owners, (entity) => entityByName.has(entity));
         refuseCrudOnOwned(frond, owners);
         for (const provider of frond.providers) {
-            scope.register(provider.ctor.name, provider.ctor, { deps: provider.deps });
+            scope.register(nameOf(provider), provider.ctor, { deps: provider.deps });
         }
         // …and again under the port each one extends, so `private payment: Payment`
         // reaches the realization instead of the base class it is declared against.
@@ -256,13 +227,18 @@ export async function createApp(options) {
             frondLog.debug(`port ${port} → ${impl.ctor.name}`);
         }
         if (frond.providers.length > 0) {
-            frondLog.debug(`${frond.providers.length} provider(s): ${frond.providers.map((p) => p.ctor.name).join(', ')}`);
+            frondLog.debug(`${frond.providers.length} provider(s): ${frond.providers.map(nameOf).join(', ')}`);
         }
         // Register Storage for each entity — PascalCase type name (e.g. 'PostStorage')
         // When a handler declares Crud(Entity, Output), scope the storage via .output(Output)
         if (options.storageFactory) {
+            const unenforced = [];
             for (const entity of frond.entities) {
                 const key = storageKeyOf(entity.name);
+                const source = options.sourceOf?.(entity.name) ?? 'db';
+                if (declares(entity.entityClass, 'unique') && options.enforces?.(source, 'unique') === false) {
+                    unenforced.push(`${entity.name} in '${source}'`);
+                }
                 const baseStorage = options.storageFactory(entity.entityClass, entity.name);
                 // Check if the default handler (no surface) declares an output override
                 const defaultHandler = frond.handlers.find((h) => h.address === entity.name && !h.surface);
@@ -294,6 +270,12 @@ export async function createApp(options) {
             if (frond.entities.length > 0) {
                 frondLog.debug(`${frond.entities.length} entity storage(s): ${frond.entities.map((e) => e.name).join(', ')}`);
             }
+            // The judge refuses a duplicate it can SEE — the row already stored. Two writes arriving
+            // together see the same absence, and only the place they land can refuse the second.
+            if (unenforced.length > 0) {
+                frondLog.warn(`unique declared, and the source does not enforce it: ${unenforced.join(', ')} — `
+                    + 'two concurrent writes can both pass');
+            }
         }
         // Frames, after the ORMs and before anything that may ask for one. A frame is read
         // from the same `deps` every other port is read from — asking for it IS declaring it,
@@ -304,6 +286,7 @@ export async function createApp(options) {
             hostedHere: (name) => !(options.remotes && name in options.remotes),
             storageFactory: options.storageFactory,
             sourceOf: options.sourceOf,
+            transacts: options.transacts,
             transacted: options.transacted,
             log: frondLog,
         });
@@ -330,22 +313,24 @@ export async function createApp(options) {
         const defaultHandlerMap = new Map(defaultHandlers.map((h) => [h.address, h]));
         /** Build the door of a handler and register it under the audience it serves. */
         const buildFacade = (entity, handler, targetScope, facadeKey) => {
-            const facade = new HandlerFacade({
-                handler,
-                handlers: frond.handlers,
-                entity,
-                scope: targetScope,
+            if (inheritsCrud(handler.ctor) && !entity) {
+                // An installed Crud subject may be absent from the local scan.
+                frondLog.debug(`${handler.ctor.name} extends Crud() and no scanned entity is named `
+                    + `'${subjectOf(handler.ctor, handler.address)}' — installed entity, or a missing `
+                    + `one: no storage will be injected`);
+            }
+            const facade = new HandlerFacade(handler, targetScope, {
                 key: facadeKey,
-                operations: operationModel.forHandler(handler),
-            }, {
                 frond: frond.name,
-                frondScope: scope,
-                log: frondLog,
+                handlers: frond.handlers,
+                operations: operationModel.forHandler(handler),
                 collectors: collectorTypeNames,
-                presenters: presenterMap,
-                middlewaresFor: getMiddlewares,
-                emissions,
+                presenter: presenterMap.get(handler.address),
+                presenterScope: scope,
+                middlewares: () => getMiddlewares(handler.address),
             });
+            // Emissions use the same contracts and execution path as direct calls.
+            emissions.note(facade.contracts, facadeKey);
             // The terms alongside the door, under the same audience — a surface that serves
             // fewer ops describes fewer ops.
             container.registerValue(contractsKeyOf(handler.address, handler.surface), facade.contracts);
@@ -366,11 +351,11 @@ export async function createApp(options) {
                         operation,
                         ...(surface !== undefined ? { surface } : {}),
                     });
-                    routeRegistry.register(new OperationRoute('local', address, (call) => facade.ops[operation](call.invocation)));
+                    routeRegistry.register(new OperationRoute('local', address, (call) => facade.execute(operation, call.invocation)));
                 }
             }
-            const entry = new FacadeEntry(handler.surface ? localDispatcher : dispatcher, handler.address, routeRegistry.operationNames(handler.address, handler.surface), handler.surface);
-            container.registerValue(facadeKey, entry.operations);
+            const operations = facadeOperations(handler.surface ? localDispatcher : dispatcher, handler.address, routeRegistry.operationNames(handler.address, handler.surface), handler.surface);
+            container.registerValue(facadeKey, operations);
         };
         // A presenter is about an entity — computed fields sit on a shape — so this walks
         // entities. Exposing the instance lazily; the bridge resolves it on first access.
@@ -432,7 +417,14 @@ export async function createApp(options) {
                 const scoped = outputSchema && outputSchema !== entity.entityClass
                     ? baseStorage.output(outputSchema)
                     : baseStorage;
-                const guarded = new StorageGuard(entity.entityClass.getFields(), entity.name).guard(scoped);
+                // The view is handed over so a filter on a field this door hides is SAID. The
+                // guard holds no logger — a warning is the boot's to voice, as a seed's report is.
+                const guarded = new StorageGuard(entity.entityClass.getFields(), entity.name, {
+                    ...(outputSchema && outputSchema !== entity.entityClass
+                        ? { view: outputSchema.getFields() }
+                        : {}),
+                    outOfView: (message) => frondLog.warn(message),
+                }).guard(scoped);
                 surfaceScope.registerValue(storageKeyOf(entity.name), guarded);
                 surfaceScope.registerValue(repositoryKeyOf(entity.name), guarded);
             }
@@ -468,17 +460,7 @@ export async function createApp(options) {
     }
     // Once every door exists: what is announced here and what is listened to are both known.
     emissions.register();
-    /**
-     * The last resort, held by the container so every resolution path shares it.
-     *
-     * It used to live on `app.resolve` alone, which meant the runner found a remote façade
-     * and dependency injection did not — a handler asking for a neighbour that had moved
-     * got `is not registered` while the very same call over the wire worked. One door now.
-     *
-     * Surface-scoped keys ('admin:productHandler') stay local: a named surface resolves in
-     * this container only, so fabricating one for a remote frond would answer NOT_FOUND on
-     * everything (see Known issues).
-     */
+    /** The last resort, held by the container so every resolution path shares it. */
     container.setFallback?.((name) => {
         if (!remoteRouter)
             return undefined;
@@ -488,15 +470,11 @@ export async function createApp(options) {
         // `lowerFirst` because a DEPENDENCY names the type as written — `ProductHandler`,
         // PascalCase — while a card declares `product`, so the raw strip asked the router for
         // 'Product' and every by-type dependency on a remote handler answered NOT_FOUND.
-        return new FacadeEntry(dispatcher, lowerFirst(name.replace(/Handler$/, ''))).operations;
+        return facadeOperations(dispatcher, lowerFirst(name.replace(/Handler$/, '')));
     });
     /**
-     * Everything this app holds, let go in reverse of how it was taken: what an extension
-     * took on last, then the container's own, then whoever handed a resource in.
-     *
-     * It does NOT wait for running calls — `drain()` is that, and it is a separate gesture
-     * because waiting and releasing do not have the same owner: a test releases at once, a
-     * host turning the ring wants the work finished first.
+     * Everything this app holds, let go in reverse of how it was taken: what an extension took on
+     * last, then the container's own, then whoever handed a resource in.
      */
     const release = async () => {
         // Every level is told to close even when one refuses, and the refusals leave together —
@@ -521,13 +499,7 @@ export async function createApp(options) {
             throw new AggregateError(refused, `${refused.length} refusal(s) while releasing the app`);
         }
     };
-    /**
-     * Stop taking calls, and resolve once the ones already running are done.
-     *
-     * Refuses on `timeoutMs` rather than resolving anyway: a drain that gives up quietly
-     * reads exactly like a drain that succeeded, and the caller — who is about to release
-     * a storage connection under whatever is left — is the one who must decide.
-     */
+    /** Stop taking calls, and resolve once the ones already running are done. */
     const drain = async (timeoutMs) => {
         inflight.close();
         if (timeoutMs === undefined)
@@ -577,28 +549,7 @@ export async function createApp(options) {
             return undefined;
         }
     };
-    /**
-     * THE membership rule, stated once — every projection reads this and nothing
-     * else. It used to live twice, verbatim, in the REST and GraphQL adapters,
-     * and two other readers invented their own answer.
-     *
-     * Naming an audience closes it. Two ways to name an entity into a surface,
-     * in precedence order:
-     *   - `surfaces:` in frond.config.ts — when the list exists, it IS the list;
-     *   - a handler under `handlers/<surface>/` — which also restricts the façade.
-     * `@expose` is a THIRD way and this rule does not read it: the scan sets a
-     * boolean, read by the two adapters and by `exposedAdapters` — never here.
-     * What neither of the two names is not served. It used to be the reverse: no
-     * `public:categoryHandler` meant the FULL CategoryHandler rode the public
-     * door, create/update/delete included (measured on demos/nuxt-blog).
-     *
-     * A named entity with no façade of its own falls back to the default one —
-     * that is not the old widening, it is the author saying "this one, as it is".
-     * The leak was exposure with no statement behind it.
-     *
-     * A surface key stays local: a doublure serves whatever the remote's own door
-     * serves, which is the remote's business and not ours to re-audience.
-     */
+    /** THE membership rule, stated once — every projection reads this and nothing else. */
     const facadeFor = (entity, surface) => {
         if (!surface)
             return facadeAt(facadeKeyOf(entity), true);
@@ -612,12 +563,12 @@ export async function createApp(options) {
             return own;
         const fallback = facadeAt(facadeKeyOf(entity), false);
         return fallback
-            ? new FacadeEntry(localDispatcher, entity, routeRegistry.operationNames(entity, surface), surface).operations
+            ? facadeOperations(localDispatcher, entity, routeRegistry.operationNames(entity, surface), surface)
             : undefined;
     };
     if (remoteRouter) {
         const remoteFacades = new Map();
-        routeRegistry.addResolver(new RemoteRouteResolver((entity) => {
+        routeRegistry.addResolver(remoteRoutes((entity) => {
             const known = remoteFacades.get(entity);
             if (known)
                 return known;
@@ -639,13 +590,8 @@ export async function createApp(options) {
             : undefined;
     };
     /**
-     * The storage an entity is backed by — the dual of `facadeFor`, which serves its
-     * client-facing door. Both are ways in; an entity that opens none of them still has rows.
-     *
-     * It resolves through the owning frond's scope, because that is where entity ORMs live:
-     * `resolve('UserStorage')` reads the ROOT container and never finds one, so callers outside
-     * the frond concluded there was no storage. The seed loop did exactly that, and skipped
-     * every entity with no façade — the one case its own fallback existed for.
+     * The storage an entity is backed by — the dual of `facadeFor`, which serves its client-facing
+     * door.
      */
     const storageFor = (entity) => {
         const owner = fronds.owner(entity);
@@ -659,14 +605,7 @@ export async function createApp(options) {
             return undefined;
         }
     };
-    /**
-     * The presenter of an entity, resolved through its owning frond's scope.
-     *
-     * Same shape as `storageFor`, and it exists for the same reason: without it an adapter
-     * has to spell the container key itself. `schema-graphql` did — a hand-written
-     * `${Name}Presenter` — and a key respelled elsewhere finds nothing and says nothing
-     * the day the convention moves, which is exactly the failure `verify.ts` refuses.
-     */
+    /** The presenter of an entity, resolved through its owning frond's scope. */
     const presenterFor = (entity) => {
         const owner = fronds.owner(entity);
         if (!owner)
@@ -733,7 +672,22 @@ export async function createApp(options) {
     app.serveRpc('discover', (_invocation, surface) => identityCardOf(app, surface));
     // The last thing the boot does, and the first thing a release undoes. An extension may
     // await here — which is what a provider needing to OPEN something could never do.
-    await appLifecycle.up(app);
+    //
+    // A refusal here has to release what the boot took, because the caller cannot: it handed
+    // `onDispose` over BEFORE this line and never receives the app that would carry it back.
+    // Whoever opened a connection to give it to us would otherwise leak it on every failed boot.
+    try {
+        await appLifecycle.up(app);
+    }
+    catch (cause) {
+        try {
+            await release();
+        }
+        catch (refused) {
+            throw new AggregateError([cause, ...(refused instanceof AggregateError ? refused.errors : [refused])], `The boot failed and could not release everything it had taken: ${cause?.message ?? String(cause)}`);
+        }
+        throw cause;
+    }
     return app;
 }
 //# sourceMappingURL=bootstrap.js.map