@fougere/core 0.6.0-alpha.0 → 0.8.0-alpha.0

package/src/boot/ambient.queue.ts

@@ -1,9 +1,6 @@
 /**
- * The realization for a runtime with no async context: it cannot tell whose frame is
- * open, so it never guesses — it waits its turn.
- *
- * Two consequences the boot reports rather than hides: frames run one at a time, and a
- * frame opened inside another is not refused, it waits for itself and times out.
+ * The realization for a runtime with no async context: it cannot tell whose frame is open, so it
+ * never guesses — it waits its turn.
  */
 import type { Ambient } from './ambient-port.js';
 

package/src/boot/apply.ts

@@ -1,5 +1,5 @@
 import type { FougereConfig } from '../config-loader.js';
-import { setLogLevel, logLevel, envLevel } from '../builtins/logger.js';
+import { setLogLevel, logLevel, envLevel } from '../builtin/logger.js';
 import { dequal } from 'dequal';
 
 export interface ConfigApplication {
@@ -9,28 +9,21 @@ export interface ConfigApplication {
   pending: string[];
 }
 
-/**
- * What a (re-)read config changes in a process that is already running.
- *
- * The rule it realizes, and the only one worth remembering: **a value that is
- * CONSULTED can change under a running app; a value that was CONSUMED to build
- * something cannot, without rebuilding what it built.** `logLevel` is consulted at
- * every emission, so it moves. `db` opened a connection, `ports:` registered a class,
- * the entities built façades — those are consumed, and this function reports them
- * rather than pretending.
- *
- * The list of consulted keys is not declared anywhere: a key is consulted when this
- * function does something with it, which is the only definition that cannot go stale.
- */
+/** What a (re-)read config changes in a process that is already running. */
 export function applyConfig(next: FougereConfig, inForce?: FougereConfig): ConfigApplication {
   const applied: string[] = [];
   const pending: string[] = [];
 
   // The CLI speaks through the environment, so it keeps winning over the file — read
-  // through `envLevel`, which is where the environment is already judged. Casting it
+  // through `envLevel`, which is where the environment is already validated. Casting it
   // here was a second reader that validated nothing: `FOUGERE_LOG_LEVEL=verbose` set
   // the threshold to `undefined` and every log passed.
-  const wanted = envLevel() ?? next.logLevel ?? 'debug';
+  // A process that declares no level keeps the one it started with — `info`, or whatever
+  // the host set for itself before booting. Defaulting to `debug` here meant every caller
+  // of this function silently raised the threshold: the CLI sets `warn` and got `debug`
+  // back, and the day a web host started calling it, `pnpm dev` would have traced every
+  // dispatch of an app that asked for nothing.
+  const wanted = envLevel() ?? next.logLevel ?? logLevel();
   const before = logLevel();
   if (wanted !== before) {
     setLogLevel(wanted);

package/src/boot/auth.ts

@@ -5,13 +5,7 @@
 import type { SchemaView } from '@fougere/schema';
 import type { Storage, StorageFactory } from '../storage.js';
 
-/**
- * Lazy auth declaration written in fougere.config.ts.
- *
- * Each @fougere/auth-* package exports a factory (e.g. `betterAuth(opts)`) that
- * returns this shape. The `create()` method is called once at boot with the
- * resolved db + storageFactory, so the provider can wire its engine through Fougere.
- */
+/** Lazy auth declaration written in fougere.config.ts. */
 export interface AuthConfig {
   /** Build the runtime — invoked by createApp at boot with the resolved storage handles. */
   create(ctx: AuthContext): AuthRuntime | Promise<AuthRuntime>;
@@ -40,11 +34,7 @@ export interface AuthContext {
 export interface AuthRuntime {
   /** Entities used by the provider, including any defaults it filled in. */
   entities: Record<string, SchemaView>;
-  /**
-   * Per-entity ORMs the provider built for itself. Exposed so app code can
-   * query auth tables (e.g. list active sessions for a user) without rebuilding
-   * the same Storage.
-   */
+  /** Per-entity ORMs the provider built for itself. */
   storages: Record<string, Storage>;
   /** Web Standard handler that processes /auth/* requests. */
   handler: (request: Request) => Promise<Response>;

package/src/boot/boot.ts

@@ -2,7 +2,7 @@ import { createApp } from './bootstrap.js';
 import { seeding } from './seed.js';
 import { scanProject } from '../scan/scanner.js';
 import { loadConfig, type FougereConfig } from '../config-loader.js';
-import { Logger } from '../builtins/logger.js';
+import { Logger } from '../builtin/logger.js';
 import { applyConfig } from './apply.js';
 import type { App, CreateAppOptions } from './types.js';
 import { migrating, type Extension } from './AppLifecycle.js';
@@ -25,11 +25,7 @@ interface BootOptions {
   remotes?: Record<string, string>;
   /** Builds the transport to reach `remotes`. Supplied by a layer-2 package. */
   remoteTransport?: (url: string) => Transport;
-  /**
-   * Carries an announced fact out of this process. Forwarded rather than dropped: a
-   * caller handing one in has no other way to reach the emitter, and this path silently
-   * kept it to itself.
-   */
+  /** Carries an announced fact out of this process. */
   onEmit?: CreateAppOptions['onEmit'];
   /**
    * storage setup — returns the storage handle (db), an storageFactory, and its two halves.
@@ -38,11 +34,7 @@ interface BootOptions {
   db?: (config: FougereConfig) => {
     db?: unknown;
     storageFactory: CreateAppOptions['storageFactory'];
-    /**
-     * Bring the schema up to date — an extension's `up`, because it runs after the
-     * container. It used to be called `afterBoot`, a word that also meant the host's
-     * post-boot and was read in four places under two senses.
-     */
+    /** Bring the schema up to date — an extension's `up`, because it runs after the container. */
     migrate?: (app: App) => Promise<void> | void;
     /** Closes what the factory opened — `boot()` called it, so `boot()` releases it. */
     close?: () => Promise<void>;
@@ -54,12 +46,7 @@ interface BootOptions {
   extensions?: readonly (Extension | undefined)[];
 }
 
-/**
- * Boot a Fougere app from fougere.config.ts.
- *
- * Handles: config loading, container creation, DB setup, seeding.
- * Works for any surface (Nuxt, GraphQL standalone, CLI, tests).
- */
+/** Boot a Fougere app from fougere.config.ts. */
 export async function boot(options: BootOptions): Promise<App> {
   const bootStart = performance.now();
   const log = new Logger('boot');
@@ -103,12 +90,10 @@ export async function boot(options: BootOptions): Promise<App> {
     // it was opened before the container existed, so it closes after the container goes.
     onDispose: dbSetup?.close,
     /**
-     * The whole ascent, in one ordered list — tables, then rows, then whatever the host
-     * takes on. It was four call sites under the name `afterBoot`, two of which meant
-     * different things and one of which was generated into a Nitro plugin.
+     * The whole ascent, in one ordered list — tables, then rows, then whatever the host takes on.
      */
     extensions: [
-      migrating(dbSetup?.migrate),
+      migrating(dbSetup?.migrate, (message) => log.warn(message)),
       seeding((message) => log.debug(message)),
       ...(options.extensions ?? []),
     ],

package/src/boot/bootstrap.ts

@@ -1,16 +1,17 @@
 import type { Container } from '@fougere/container';
-import { lowerFirst, type SchemaView } from '@fougere/schema';
+import { lowerFirst, type Fields, type SchemaView } from '@fougere/schema';
+import { nameOf } from '../descriptor/frond.js';
 import type { EntityEntry, HandlerEntry, PresenterEntry } from '../descriptor/frond.js';
 import { hostedBy } from './hosted.js';
 import type { AuthRuntime } from './auth.js';
 import type { CreateAppOptions, App } from './types.js';
 import type { AppMiddleware } from '../wire/middleware.js';
-import { Logger } from '../builtins/logger.js';
-import { Config } from '../builtins/config.js';
+import { Logger } from '../builtin/logger.js';
+import { Config } from '../builtin/config.js';
 import { createRemoteRouter, createRemoteFacade } from './remote.js';
 import { registerFrames } from './together.js';
 import { Emissions } from './Emissions.js';
-import { HandlerFacade } from './HandlerFacade.js';
+import { HandlerFacade } from '../dispatch/HandlerFacade.js';
 import { targetOf } from '../prefab/prefab.js';
 import { ownersOf, refuseStorageInUserCode, refuseCrudOnOwned } from './ownership.js';
 import type { OperationContract, OperationsMap } from '../wire/operation.js';
@@ -25,48 +26,29 @@ import { InFlight } from '../dispatch/InFlight.js';
 import { facadeKeyOf, contractsKeyOf, type RpcAnswer } from '../wire/call.js';
 import { identityCardOf } from './card.js';
 import { AppLifecycle } from './AppLifecycle.js';
+import { inheritsCrud, subjectOf } from '../prefab/crud.js';
 import { repositoryKeyOf } from '../prefab/repository.js';
 import { storageKeyOf } from '../storage.js';
+import { declares } from '../source.js';
 import { presenterKeyOf } from '../prefab/presenter.js';
 import { collectorKeyOf } from '../prefab/collector.js';
-import { RouteAddress } from '../contract/RouteAddress.js';
+import { RouteAddress } from '../wire/RouteAddress.js';
 import { DispatchLifecycle } from '../dispatch/DispatchLifecycle.js';
 import { Dispatcher } from '../dispatch/Dispatcher.js';
 import { LocalRoutePolicy } from '../dispatch/LocalRoutePolicy.js';
 import { OperationRoute } from '../dispatch/OperationRoute.js';
-import { RemoteRouteResolver } from '../dispatch/RemoteRouteResolver.js';
+import { remoteRoutes } from '../dispatch/remoteRoutes.js';
 import { RouteRegistry } from '../dispatch/RouteRegistry.js';
-import { FacadeEntry } from '../entry/FacadeEntry.js';
+import { facadeOperations } from '../entry/facade.js';
 
 
-/**
- * The one wording for "nobody hosts this here", with both ways out. Said twice, and the
- * second copy (`schemaFor`) had lost the two remedies — the same dead end, strictly less
- * useful, for no reason.
- */
+/** The one wording for "nobody hosts this here", with both ways out. */
 const notLoaded = (entity: string) =>
   `Frond for '${entity}' is not loaded.\n` +
   `  - Add '${entity}' to --fronds flag\n` +
   `  - Or declare a remote: remotes: { ${entity}: 'http://...' }`;
 
-/**
- * Two fronds cannot claim one name — said at boot, because nothing else says it.
- *
- * A door lands on the ROOT container under `facadeKeyOf(address)`, and that key carries
- * no frond; a presenter lands there too. `registerValue` is a `Map.set`, so the second
- * frond loaded simply replaced the first and every call meant for one went to the other.
- * Silent in-process, and worse than silent under a split: `createRemoteRouter` guards its
- * index with `if (!byEntity.has(...))`, so THERE the first frond discovered wins. The same
- * application answered differently depending on how it was deployed.
- *
- * Refusing is the honest answer while a key cannot say which frond owns it. It is not the
- * last word: qualify the key and this boot can accept both. ORMs and repositories are not
- * checked because they are registered in the frond's own scope, where two fronds do not meet.
- *
- * A frond declared remote registers nothing locally, so it cannot collide here. Two REMOTE
- * fronds publishing one entity still shadow each other inside the router — a hole this
- * check does not reach.
- */
+/** Two fronds cannot claim one name — said at boot, because nothing else says it. */
 function assertOneOwnerPerKey(
   fronds: { name: string; handlers: HandlerEntry[]; presenters: PresenterEntry[] }[],
   remotes: Record<string, string> | undefined,
@@ -74,10 +56,10 @@ function assertOneOwnerPerKey(
   const owner = new Map<string, string>();
 
   const claim = (key: string, frond: string, what: string) => {
-    const held = owner.get(key);
-    if (held !== undefined && held !== frond) {
+    const first = owner.get(key);
+    if (first !== undefined && first !== frond) {
       throw new Error(
-        `Two fronds claim the key '${key}': '${held}' and '${frond}'.\n`
+        `Two fronds claim the key '${key}': '${first}' and '${frond}'.\n`
         + `  A ${what} is registered under a key that names no frond, so one would silently replace the other.\n`
         + `  - Rename one of the two classes, or\n`
         + `  - keep one of the two fronds out of this process (--fronds), or declare it in remotes:`,
@@ -133,22 +115,11 @@ export async function createApp(options: CreateAppOptions): Promise<App> {
   log.info(`read ${fronds.length} frond(s) in ${scanMs}ms`
     + (diagnostics.length ? ` — ${diagnostics.length} thing(s) the scan could not do` : ''));
 
-  /**
-   * Say what could not be read, at the one line everyone already watches.
-   *
-   * Not a refusal: an app whose `presenters/` is unreadable still serves its
-   * entities, and stopping the boot would trade a partial app for none. But it is
-   * an ERROR, not a debug line — the app now serves less than its source declares,
-   * and nothing downstream can tell that from a source that declares less.
-   */
+  /** Say what could not be read, at the one line everyone already watches. */
   for (const d of blocking) log.error(`[${d.code}] ${d.message}`, d.cause);
   for (const d of diagnostics) if (d.severity === 'warning') log.warn(`[${d.code}] ${d.message}`);
 
-  /**
-   * An ambiguous convention is not a partial scan. Every relevant declaration was read,
-   * but more than one executable contract can be built from it. Refuse before auth,
-   * storage, migrations or seeds make the boot observable.
-   */
+  /** An ambiguous convention is not a partial scan. */
   const invalidOperations = operationModel.resolutionDiagnostics
     .filter((diagnostic) => diagnostic.severity === 'blocking');
   if (invalidOperations.length > 0) {
@@ -180,7 +151,7 @@ export async function createApp(options: CreateAppOptions): Promise<App> {
     log.info(`auth ready — mounted at ${authRuntime.basePath}`);
   }
 
-  // Remote routing — judged at boot: declaring remotes without a transport is a config error.
+  // Remote routing — validated at boot: declaring remotes without a transport is a config error.
   // A remote declaration wins over local presence: `remotes: { blog: url }` IS
   // the topology statement — the frond's code may sit in fronds/**, it runs elsewhere.
   const declaredRemotes = Object.entries(options.remotes ?? {});
@@ -225,7 +196,7 @@ export async function createApp(options: CreateAppOptions): Promise<App> {
 
   assertOneOwnerPerKey(fronds, options.remotes);
 
-  // Every entity of every frond, by name — so a fact can be judged where it LANDS, and
+  // Every entity of every frond, by name — so a fact can be validated where it LANDS, and
   // so a `reads:` clause can name a neighbour's.
   const entityByName = fronds.schemas();
   // Which frond holds an entity — what turns "a member is remote" into a refusal that
@@ -302,7 +273,7 @@ export async function createApp(options: CreateAppOptions): Promise<App> {
     refuseCrudOnOwned(frond, owners);
 
     for (const provider of frond.providers) {
-      scope.register(provider.ctor.name, provider.ctor, { deps: provider.deps });
+      scope.register(nameOf(provider), provider.ctor, { deps: provider.deps });
     }
     // …and again under the port each one extends, so `private payment: Payment`
     // reaches the realization instead of the base class it is declared against.
@@ -314,14 +285,19 @@ export async function createApp(options: CreateAppOptions): Promise<App> {
       frondLog.debug(`port ${port} → ${impl.ctor.name}`);
     }
     if (frond.providers.length > 0) {
-      frondLog.debug(`${frond.providers.length} provider(s): ${frond.providers.map((p) => p.ctor.name).join(', ')}`);
+      frondLog.debug(`${frond.providers.length} provider(s): ${frond.providers.map(nameOf).join(', ')}`);
     }
 
     // Register Storage for each entity — PascalCase type name (e.g. 'PostStorage')
     // When a handler declares Crud(Entity, Output), scope the storage via .output(Output)
     if (options.storageFactory) {
+      const unenforced: string[] = [];
       for (const entity of frond.entities) {
         const key = storageKeyOf(entity.name);
+        const source = options.sourceOf?.(entity.name) ?? 'db';
+        if (declares(entity.entityClass, 'unique') && options.enforces?.(source, 'unique') === false) {
+          unenforced.push(`${entity.name} in '${source}'`);
+        }
         const baseStorage = options.storageFactory(entity.entityClass, entity.name);
 
         // Check if the default handler (no surface) declares an output override
@@ -355,6 +331,14 @@ export async function createApp(options: CreateAppOptions): Promise<App> {
       if (frond.entities.length > 0) {
         frondLog.debug(`${frond.entities.length} entity storage(s): ${frond.entities.map((e) => e.name).join(', ')}`);
       }
+      // The judge refuses a duplicate it can SEE — the row already stored. Two writes arriving
+      // together see the same absence, and only the place they land can refuse the second.
+      if (unenforced.length > 0) {
+        frondLog.warn(
+          `unique declared, and the source does not enforce it: ${unenforced.join(', ')} — `
+          + 'two concurrent writes can both pass',
+        );
+      }
     }
 
     // Frames, after the ORMs and before anything that may ask for one. A frame is read
@@ -370,6 +354,7 @@ export async function createApp(options: CreateAppOptions): Promise<App> {
         hostedHere: (name) => !(options.remotes && name in options.remotes),
         storageFactory: options.storageFactory,
         sourceOf: options.sourceOf,
+        transacts: options.transacts,
         transacted: options.transacted,
         log: frondLog,
       },
@@ -406,25 +391,25 @@ export async function createApp(options: CreateAppOptions): Promise<App> {
       targetScope: Container,
       facadeKey: string,
     ) => {
-      const facade = new HandlerFacade(
-        {
-          handler,
-          handlers: frond.handlers,
-          entity,
-          scope: targetScope,
-          key: facadeKey,
-          operations: operationModel.forHandler(handler),
-        },
-        {
-          frond: frond.name,
-          frondScope: scope,
-          log: frondLog,
-          collectors: collectorTypeNames,
-          presenters: presenterMap,
-          middlewaresFor: getMiddlewares,
-          emissions,
-        },
-      );
+      if (inheritsCrud(handler.ctor) && !entity) {
+        // An installed Crud subject may be absent from the local scan.
+        frondLog.debug(`${handler.ctor.name} extends Crud() and no scanned entity is named `
+          + `'${subjectOf(handler.ctor, handler.address)}' — installed entity, or a missing `
+          + `one: no storage will be injected`);
+      }
+
+      const facade = new HandlerFacade(handler, targetScope, {
+        key: facadeKey,
+        frond: frond.name,
+        handlers: frond.handlers,
+        operations: operationModel.forHandler(handler),
+        collectors: collectorTypeNames,
+        presenter: presenterMap.get(handler.address),
+        presenterScope: scope,
+        middlewares: () => getMiddlewares(handler.address),
+      });
+      // Emissions use the same contracts and execution path as direct calls.
+      emissions.note(facade.contracts, facadeKey);
       // The terms alongside the door, under the same audience — a surface that serves
       // fewer ops describes fewer ops.
       container.registerValue(contractsKeyOf(handler.address, handler.surface), facade.contracts);
@@ -451,18 +436,18 @@ export async function createApp(options: CreateAppOptions): Promise<App> {
           routeRegistry.register(new OperationRoute(
             'local',
             address,
-            (call) => facade.ops[operation](call.invocation),
+            (call) => facade.execute(operation, call.invocation),
           ));
         }
       }
 
-      const entry = new FacadeEntry(
+      const operations = facadeOperations(
         handler.surface ? localDispatcher : dispatcher,
         handler.address,
         routeRegistry.operationNames(handler.address, handler.surface),
         handler.surface,
       );
-      container.registerValue(facadeKey, entry.operations);
+      container.registerValue(facadeKey, operations);
     };
 
     // A presenter is about an entity — computed fields sit on a shape — so this walks
@@ -527,7 +512,14 @@ export async function createApp(options: CreateAppOptions): Promise<App> {
         const scoped = outputSchema && outputSchema !== entity.entityClass
           ? baseStorage.output(outputSchema)
           : baseStorage;
-        const guarded = new StorageGuard(entity.entityClass.getFields(), entity.name).guard(scoped);
+        // The view is handed over so a filter on a field this door hides is SAID. The
+        // guard holds no logger — a warning is the boot's to voice, as a seed's report is.
+        const guarded = new StorageGuard(entity.entityClass.getFields(), entity.name, {
+          ...(outputSchema && outputSchema !== entity.entityClass
+            ? { view: (outputSchema as { getFields(): Fields }).getFields() }
+            : {}),
+          outOfView: (message) => frondLog.warn(message),
+        }).guard(scoped);
         surfaceScope.registerValue(storageKeyOf(entity.name), guarded);
         surfaceScope.registerValue(repositoryKeyOf(entity.name), guarded);
       }
@@ -573,17 +565,7 @@ export async function createApp(options: CreateAppOptions): Promise<App> {
   // Once every door exists: what is announced here and what is listened to are both known.
   emissions.register();
 
-  /**
-   * The last resort, held by the container so every resolution path shares it.
-   *
-   * It used to live on `app.resolve` alone, which meant the runner found a remote façade
-   * and dependency injection did not — a handler asking for a neighbour that had moved
-   * got `is not registered` while the very same call over the wire worked. One door now.
-   *
-   * Surface-scoped keys ('admin:productHandler') stay local: a named surface resolves in
-   * this container only, so fabricating one for a remote frond would answer NOT_FOUND on
-   * everything (see Known issues).
-   */
+  /** The last resort, held by the container so every resolution path shares it. */
   container.setFallback?.((name) => {
     if (!remoteRouter) return undefined;
     if (!name.endsWith('Handler') || name.includes(':')) return undefined;
@@ -591,19 +573,15 @@ export async function createApp(options: CreateAppOptions): Promise<App> {
     // `lowerFirst` because a DEPENDENCY names the type as written — `ProductHandler`,
     // PascalCase — while a card declares `product`, so the raw strip asked the router for
     // 'Product' and every by-type dependency on a remote handler answered NOT_FOUND.
-    return new FacadeEntry(
+    return facadeOperations(
       dispatcher,
       lowerFirst(name.replace(/Handler$/, '')),
-    ).operations;
+    );
   });
 
   /**
-   * Everything this app holds, let go in reverse of how it was taken: what an extension
-   * took on last, then the container's own, then whoever handed a resource in.
-   *
-   * It does NOT wait for running calls — `drain()` is that, and it is a separate gesture
-   * because waiting and releasing do not have the same owner: a test releases at once, a
-   * host turning the ring wants the work finished first.
+   * Everything this app holds, let go in reverse of how it was taken: what an extension took on
+   * last, then the container's own, then whoever handed a resource in.
    */
   const release = async (): Promise<void> => {
     // Every level is told to close even when one refuses, and the refusals leave together —
@@ -626,13 +604,7 @@ export async function createApp(options: CreateAppOptions): Promise<App> {
     }
   };
 
-  /**
-   * Stop taking calls, and resolve once the ones already running are done.
-   *
-   * Refuses on `timeoutMs` rather than resolving anyway: a drain that gives up quietly
-   * reads exactly like a drain that succeeded, and the caller — who is about to release
-   * a storage connection under whatever is left — is the one who must decide.
-   */
+  /** Stop taking calls, and resolve once the ones already running are done. */
   const drain = async (timeoutMs?: number): Promise<void> => {
     inflight.close();
     if (timeoutMs === undefined) return inflight.whenIdle();
@@ -687,28 +659,7 @@ export async function createApp(options: CreateAppOptions): Promise<App> {
     }
   };
 
-  /**
-   * THE membership rule, stated once — every projection reads this and nothing
-   * else. It used to live twice, verbatim, in the REST and GraphQL adapters,
-   * and two other readers invented their own answer.
-   *
-   * Naming an audience closes it. Two ways to name an entity into a surface,
-   * in precedence order:
-   *   - `surfaces:` in frond.config.ts — when the list exists, it IS the list;
-   *   - a handler under `handlers/<surface>/` — which also restricts the façade.
-   * `@expose` is a THIRD way and this rule does not read it: the scan sets a
-   * boolean, read by the two adapters and by `exposedAdapters` — never here.
-   * What neither of the two names is not served. It used to be the reverse: no
-   * `public:categoryHandler` meant the FULL CategoryHandler rode the public
-   * door, create/update/delete included (measured on demos/nuxt-blog).
-   *
-   * A named entity with no façade of its own falls back to the default one —
-   * that is not the old widening, it is the author saying "this one, as it is".
-   * The leak was exposure with no statement behind it.
-   *
-   * A surface key stays local: a doublure serves whatever the remote's own door
-   * serves, which is the remote's business and not ours to re-audience.
-   */
+  /** THE membership rule, stated once — every projection reads this and nothing else. */
   const facadeFor = (entity: string, surface?: string): Record<string, Function> | undefined => {
     if (!surface) return facadeAt(facadeKeyOf(entity), true);
 
@@ -720,18 +671,18 @@ export async function createApp(options: CreateAppOptions): Promise<App> {
 
     const fallback = facadeAt(facadeKeyOf(entity), false);
     return fallback
-      ? new FacadeEntry(
+      ? facadeOperations(
           localDispatcher,
           entity,
           routeRegistry.operationNames(entity, surface),
           surface,
-        ).operations
+        )
       : undefined;
   };
 
   if (remoteRouter) {
     const remoteFacades = new Map<string, Record<string, Function>>();
-    routeRegistry.addResolver(new RemoteRouteResolver((entity) => {
+    routeRegistry.addResolver(remoteRoutes((entity) => {
       const known = remoteFacades.get(entity);
       if (known) return known;
       const facade = createRemoteFacade(entity, remoteRouter, getMiddlewares);
@@ -753,13 +704,8 @@ export async function createApp(options: CreateAppOptions): Promise<App> {
   };
 
   /**
-   * The storage an entity is backed by — the dual of `facadeFor`, which serves its
-   * client-facing door. Both are ways in; an entity that opens none of them still has rows.
-   *
-   * It resolves through the owning frond's scope, because that is where entity ORMs live:
-   * `resolve('UserStorage')` reads the ROOT container and never finds one, so callers outside
-   * the frond concluded there was no storage. The seed loop did exactly that, and skipped
-   * every entity with no façade — the one case its own fallback existed for.
+   * The storage an entity is backed by — the dual of `facadeFor`, which serves its client-facing
+   * door.
    */
   const storageFor = (entity: string): unknown | undefined => {
     const owner = fronds.owner(entity);
@@ -773,14 +719,7 @@ export async function createApp(options: CreateAppOptions): Promise<App> {
     }
   };
 
-  /**
-   * The presenter of an entity, resolved through its owning frond's scope.
-   *
-   * Same shape as `storageFor`, and it exists for the same reason: without it an adapter
-   * has to spell the container key itself. `schema-graphql` did — a hand-written
-   * `${Name}Presenter` — and a key respelled elsewhere finds nothing and says nothing
-   * the day the convention moves, which is exactly the failure `verify.ts` refuses.
-   */
+  /** The presenter of an entity, resolved through its owning frond's scope. */
   const presenterFor = (entity: string): unknown | undefined => {
     const owner = fronds.owner(entity);
     if (!owner) return undefined;
@@ -852,7 +791,23 @@ export async function createApp(options: CreateAppOptions): Promise<App> {
 
   // The last thing the boot does, and the first thing a release undoes. An extension may
   // await here — which is what a provider needing to OPEN something could never do.
-  await appLifecycle.up(app);
+  //
+  // A refusal here has to release what the boot took, because the caller cannot: it handed
+  // `onDispose` over BEFORE this line and never receives the app that would carry it back.
+  // Whoever opened a connection to give it to us would otherwise leak it on every failed boot.
+  try {
+    await appLifecycle.up(app);
+  } catch (cause) {
+    try {
+      await release();
+    } catch (refused) {
+      throw new AggregateError(
+        [cause, ...(refused instanceof AggregateError ? refused.errors : [refused])],
+        `The boot failed and could not release everything it had taken: ${(cause as Error)?.message ?? String(cause)}`,
+      );
+    }
+    throw cause;
+  }
 
   return app;
 }

package/src/boot/card.ts

@@ -1,35 +1,14 @@
-/**
- * What an app says about ITSELF — the `rpc.discover` answer, built from the app.
- *
- * The shape is `wire/`'s: it crosses a process boundary. Building one needs an App,
- * which is why the function lives here and the shape does not.
- */
+/** What an app says about ITSELF — the `rpc.discover` answer, built from the app. */
 import { Card } from '@fougere/schema';
 import type { App } from './types.js';
 import { factsAnnouncedBy } from '../emit.js';
-import type { InvocationContext } from '../contract/Invocation.js';
+import type { InvocationContext } from '../wire/Invocation.js';
 import { facadeKeyOf, contractsKeyOf, type CardOp, type IdentityCard } from '../wire/call.js';
 import type { OperationContract } from '../wire/operation.js';
 
 type AnyFacade = Record<string, (invocation?: InvocationContext) => Promise<unknown>>;
 
-/**
- * Serialize what the app hosts, for one audience. Served on `rpc.discover`,
- * cached by callers.
- *
- * Hosting means answering: an entity with no façade declares no operation, so
- * it is not among the DOORS — publishing its shape would hand an anonymous caller
- * the structure of tables it can never reach (the auth tables, typically), and
- * `fougere sync` would rebuild a schema with nothing to call on it.
- *
- * `facts` is the one thing that shape-without-a-door rule does not cover, and the
- * reason is the opposite of a leak: an entity nobody exposed is silent, whereas a
- * fact was explicitly declared to leave.
- *
- * `surface` makes that sentence audience-aware rather than app-wide: a door
- * answers with what IT serves. Nothing falls back to the full façade — under a
- * named surface, an entity with no façade of its own is simply not there.
- */
+/** Serialize what the app hosts, for one audience. */
 export function identityCardOf(app: App, surface?: string): IdentityCard {
   const declared = app.fronds.schemas();
 
@@ -59,15 +38,7 @@ export function identityCardOf(app: App, surface?: string): IdentityCard {
             ...(entity ? { schema: Card.fromSchema(entity.entityClass, address).descriptor } : {}),
           }];
         }),
-        /**
-         * What leaves on its own — the same list on every surface, deliberately.
-         *
-         * A door has an audience; a fact does not. `Emit<T>` names a subject and *the
-         * number of readers is not the emitter's business* (`emit.ts`), so narrowing this
-         * by `surface` would invent an axis the primitive refuses. The consequence is
-         * stated rather than hidden: a fact's SHAPE is readable by anyone who can read the
-         * card at all. What must not be published must not be announced.
-         */
+        /** What leaves on its own — the same list on every surface, deliberately. */
         facts: factsAnnouncedBy(frond.handlers).map((name) => {
           const entityClass = declared.get(name);
           return { name, ...(entityClass ? { schema: Card.fromSchema(entityClass, name).descriptor } : {}) };