@fougere/core 0.6.0-alpha.0 → 0.8.0-alpha.0

package/src/store.ts

@@ -0,0 +1,191 @@
+/** The thirteen gestures of {@link Storage}, derived from four. */
+import { applyCreate, applyUpdate, Lifecycle, Role, type SchemaView } from '@fougere/schema';
+import { comparisonOf, comparisonsIn, type Comparison } from './criterion.js';
+import type { Storage, StorageFactory } from './storage.js';
+
+/** One instance, as every realization hands it over. */
+export type Values = Record<string, unknown>;
+
+/** Instances addressed by key — what an adapter supplies, and all of it. */
+export interface Store {
+  get(key: string): Promise<Values | undefined>;
+  has(key: string): Promise<boolean>;
+  set(key: string, values: Values): Promise<void>;
+  delete(key: string): Promise<boolean>;
+  /** Everything it holds. A realization that cannot answer this cheaply says so in its doc. */
+  all(): Promise<Values[]>;
+  /** Handed on as `Storage.client` — the Map, the directory, whatever it is. */
+  readonly client: unknown;
+}
+
+export function storageOver(open: (entity: SchemaView, name: string) => Store): StorageFactory {
+  return (entity: SchemaView, name: string): Storage => {
+    const fields = entity.getFields();
+    const store = open(entity, name);
+    const pk = Object.entries(fields).find(([, field]) => Role.of(field).isPrimary)?.[0] ?? 'id';
+    // `Storage.findById(id: string)` — but a key can hold a number, and a Map keyed on
+    // `1` does not answer `'1'`. SQL never had the question; here the divergence was
+    // silent and only on this storage.
+    const keyOf = (value: unknown) => String(value);
+    // Same contract as SQL: a criterion may name a SET, and an empty set matches nothing.
+    // A comparison is told from a value by the FIELD, never by the criterion's own shape.
+    const matches = (values: Record<string, unknown>, criteria: Record<string, unknown>) =>
+      Object.entries(criteria).every(([key, value]) => {
+        const comparison = comparisonOf(fields[key], value);
+        if (comparison) return compares(values[key], comparison);
+
+        return Array.isArray(value)
+          ? value.some((v) => Object.is(values[key], v))
+          : Object.is(values[key], value);
+      });
+
+    // A store holds whole instances and reads them whole, so the scope SQL puts in its
+    // SELECT is applied here on the way out. Same set of gestures either way: everything
+    // that hands back an instance, which leaves `delete` and `upsertAll` alone.
+    const scoped = (selected?: Set<string>): Storage => {
+      const pick = (values: Values): Values => (selected
+        ? Object.fromEntries(Object.entries(values).filter(([key]) => selected.has(key)))
+        : values);
+
+      return {
+        client: store.client,
+        async list(options?: any) {
+          let items = await store.all();
+          if (options?.where) items = items.filter((values) => matches(values, options.where));
+          // Held before the page is cut, and after the filter: `total` answers "how many
+          // match", which is what a paginator divides. Reading `store.size` at the end
+          // answered a different question — everything the store holds, including the ones
+          // the filter exists to keep out of this caller's sight.
+          const matching = items.length;
+          const limit = options?.limit;
+          const offset = options?.page && limit ? (options.page - 1) * limit : options?.offset ?? 0;
+          if (offset > 0) items = items.slice(offset);
+          const hasMore = limit ? items.length > limit : false;
+          if (limit) items = items.slice(0, limit);
+          // The cursor is read before the scope cuts: a view that drops the key still
+          // pages, the way it does over SQL.
+          const endCursor = items.length > 0 ? String((items[items.length - 1] as any)[pk] ?? '') : undefined;
+          const result = items.map(pick) as any;
+          result.hasMore = hasMore;
+          result.endCursor = endCursor;
+          if (options?.count) result.total = matching;
+          return result;
+        },
+        async findById(id: string) {
+          const values = await store.get(keyOf(id));
+          return values && pick(values);
+        },
+        async findBy(criteria: Record<string, unknown>) {
+          const values = (await store.all()).find((held) => matches(held, criteria));
+          return values && pick(values);
+        },
+        async findAllBy(criteria: Record<string, unknown>) {
+          return (await store.all()).filter((values) => matches(values, criteria)).map(pick);
+        },
+        // Same contract as SQL: a map keyed by the primary key, a miss being an absent key.
+        async findByKeys(ids: readonly string[]) {
+          const found = new Map<string, Record<string, unknown>>();
+          for (const id of ids) {
+            const values = await store.get(keyOf(id));
+            if (values) found.set(String(id), pick(values));
+          }
+          return found;
+        },
+        // The dual, same contract as SQL: grouped by the value read off the instance.
+        async findAllByKeys(field: string, keys: readonly string[]) {
+          const grouped = new Map<string, Record<string, unknown>[]>();
+          if (keys.length === 0) return grouped;
+          const wanted = new Set(keys.map(String));
+          for (const values of await store.all()) {
+            const key = String(values[field]);
+            if (!wanted.has(key)) continue;
+            const bucket = grouped.get(key);
+            if (bucket) bucket.push(pick(values)); else grouped.set(key, [pick(values)]);
+          }
+          return grouped;
+        },
+        // Same contract as SQL: the key and the creation stamps survive an overwrite.
+        async upsert(input: Partial<Record<string, unknown>>) {
+          const values = applyCreate(fields, applyUpdate(fields, input));
+          const id = values[pk] as string | undefined;
+          if (id === undefined) throw new Error(`${name}.upsert(): no \`${pk}\` — an upsert needs the key it writes at.`);
+          const previous = await store.get(keyOf(id));
+          if (previous) {
+            for (const [key, field] of Object.entries(fields)) {
+              if (key === pk || Lifecycle.of(field).stampedOnce) values[key] = previous[key];
+            }
+          }
+          await store.set(keyOf(id), values);
+          return pick(values);
+        },
+        async upsertAll(inputs: readonly Partial<Record<string, unknown>>[]) {
+          for (const input of inputs) await this.upsert(input);
+          return inputs.length;
+        },
+        async create(input: Partial<Record<string, unknown>>) {
+          const values = applyCreate(fields, input);
+          const id = values[pk] as string | undefined;
+          // `primary(text())` declares no generator, so nothing fills the hole and the
+          // caller has to. Keying on `undefined` would let the second create overwrite the
+          // first, in silence — the old version hid this by inventing an `id` field the
+          // entity never declared.
+          if (id === undefined) {
+            throw new Error(`${name}.create: '${pk}' is the primary key and nothing supplied it — this entity declares no generator for it.`);
+          }
+          // A create is not an upsert. `Map.set` overwrites, so a second create under the
+          // same key answered "created" while destroying the previous instance — SQL answers a
+          // constraint violation, and a store that loses data silently is worse than one
+          // that fails.
+          if (await store.has(keyOf(id))) {
+            throw new Error(`${name}.create: '${pk}' ${JSON.stringify(id)} already exists.`);
+          }
+          await store.set(keyOf(id), values);
+          return pick(values);
+        },
+        async update(id: string, input: Partial<Record<string, unknown>>) {
+          const existing = await store.get(keyOf(id));
+          if (!existing) throw new Error(`Not found: ${id}`);
+          const updated = { ...existing, ...applyUpdate(fields, input), [pk]: existing[pk] };
+          await store.set(keyOf(id), updated);
+          return pick(updated);
+        },
+        async delete(id: string) { return await store.delete(keyOf(id)); },
+        output(schema: SchemaView) { return scoped(new Set(Object.keys(schema.getFields()))); },
+      };
+    };
+
+    return scoped();
+  };
+}
+
+/**
+ * The same comparisons SQL compiles, answered in memory. Every one a criterion names has
+ * to hold — the rule two criteria already follow.
+ */
+function compares(held: unknown, comparison: Comparison): boolean {
+  return comparisonsIn(comparison).every(([name, asked]) => {
+    switch (name) {
+      case 'gte': return ordered(held, asked, (a, b) => a >= b);
+      case 'lte': return ordered(held, asked, (a, b) => a <= b);
+      case 'gt': return ordered(held, asked, (a, b) => a > b);
+      case 'lt': return ordered(held, asked, (a, b) => a < b);
+      case 'ne': return !Object.is(held, asked);
+      case 'contains': return String(held ?? '').includes(String(asked));
+      case 'notIn': return !(asked as readonly unknown[]).some((one) => Object.is(held, one));
+      case 'isNull': return (held === null || held === undefined) === Boolean(asked);
+      case 'between': {
+        const [low, high] = asked as [unknown, unknown];
+
+        return ordered(held, low, (a, b) => a >= b) && ordered(held, high, (a, b) => a <= b);
+      }
+    }
+  });
+}
+
+/** A row that holds nothing compares to nothing — the answer SQL gives for NULL. */
+const ordered = (held: unknown, asked: unknown, holds: (a: number, b: number) => boolean): boolean =>
+  held === null || held === undefined ? false : holds(order(held), order(asked));
+
+/** What a Date and a number have in common, and a string keeps for itself. */
+const order = (value: unknown): number =>
+  value instanceof Date ? value.getTime() : (value as number);

package/src/verify.ts

@@ -5,24 +5,11 @@ import { storageKeyOf } from './storage.js';
 import { presenterKeyOf } from './prefab/presenter.js';
 import { collectorKeyOf } from './prefab/collector.js';
 
-/**
- * What a rule found in an app.
- *
- * `message` is the sentence the rule replaces — the prose a human used to have
- * to remember. `Known issues` says "Keep collectors in the consuming frond";
- * this is that sentence, told about a specific handler, by something that runs.
- */
+/** What a rule found in an app. */
 export interface Violation {
   /** Rule name, stable — 'cross-frond-dependency'. */
   rule: string;
-  /**
-   * What it costs, decided by the rule that raises it — never by whoever renders it.
-   *
-   * The two rules here are not the same animal: a cross-frond dependency resolves
-   * today and stops resolving the day the other frond answers over the wire, while a
-   * collector declared elsewhere is already wrong in one process. A reader holding a
-   * table of rule names would be a second opinion on a fact the rule already has.
-   */
+  /** What it costs, decided by the rule that raises it — never by whoever renders it. */
   severity: 'blocking' | 'warning';
   /** The frond the subject lives in. */
   frond: string;
@@ -30,15 +17,7 @@ export interface Violation {
   subject: string;
   /** Where to go and look. */
   filePath: string;
-  /**
-   * What the subject reaches for, and where it actually lives.
-   *
-   * `frond` above is the CONSUMER; the target used to exist only inside the
-   * sentence. A reader that has to parse prose to learn which frond a violation
-   * points at is a second opinion on a fact the checker already held — so the
-   * boot can ask "does this violation target a frond named in `remotes:`?" by
-   * reading a field.
-   */
+  /** What the subject reaches for, and where it actually lives. */
   dependsOn: { key: string; frond: string; kind: string };
   /** What breaks, and what the caller gets instead. */
   message: string;
@@ -48,20 +27,16 @@ export interface Violation {
 type Registration = { frond: string; kind: string };
 
 /**
- * The container keys a frond registers in its own scope, keyed as a handler's
- * `deps` spell them — DI resolves by type name, so both sides are PascalCase.
- *
- * Every key comes from the function that states it, never from a derivation
- * respelled here: a second reader that spells one differently finds nothing and
- * reports nothing wrong, which is the failure mode a checker must not have.
+ * The container keys a frond registers in its own scope, keyed as a handler's `deps` spell them —
+ * DI resolves by type name, so both sides are PascalCase.
  */
 function registrationsOf(frond: FrondDescriptor): Map<string, Registration> {
   const out = new Map<string, Registration>();
   const put = (key: string, kind: string) => out.set(key, { frond: frond.name, kind });
 
-  for (const p of frond.providers) put(p.ctor.name, 'provider');
-  for (const p of frond.presenters) put(presenterKeyOf(p.entityName), 'presenter');
-  for (const c of frond.collectors) put(collectorKeyOf(c.typeName), 'collector');
+  for (const provider of frond.providers) put(provider.ctor.name, 'provider');
+  for (const presenter of frond.presenters) put(presenterKeyOf(presenter.entityName), 'presenter');
+  for (const collector of frond.collectors) put(collectorKeyOf(collector.typeName), 'collector');
   for (const e of frond.entities) {
     put(storageKeyOf(e.name), 'storage');
     put(repositoryKeyOf(e.name), 'repository');
@@ -69,11 +44,7 @@ function registrationsOf(frond: FrondDescriptor): Map<string, Registration> {
   return out;
 }
 
-/**
- * Everything in a frond that is constructed by DI, so carries `deps`.
- * Handlers, presenters and collectors are all built from a constructor whose
- * argument types the scan read; each one can therefore reach across.
- */
+/** Everything in a frond that is constructed by DI, so carries `deps`. */
 function injectablesOf(frond: FrondDescriptor) {
   return [
     ...frond.handlers.map((h) => ({ name: h.ctor.name, deps: h.deps, filePath: h.filePath })),
@@ -83,20 +54,8 @@ function injectablesOf(frond: FrondDescriptor) {
 }
 
 /**
- * Does this app survive being split?
- *
- * A frond runs in-process or in its own process behind JSON-RPC with identical
- * user code — that is the whole claim. What the claim does not say is that
- * *every* app survives the move: a dependency that crosses a frond boundary
- * resolves today because both scopes live in one container, and resolves to
- * nothing the day the other frond answers over the wire.
- *
- * The question only exists where a module boundary is meant to become a process
- * boundary later. Where every inter-module call is already remote there is
- * nothing to check, and where no exit is planned there is nothing to check
- * either. Here it means something, and until now it had no answer.
- *
- * Pure over `app.fronds`: no mount, no process, no file. Call it from a test.
+ * Does this app survive being split? A frond runs in-process or in its own process behind JSON-RPC
+ * with identical user code — that is the whole claim.
  */
 export function verify(app: { fronds: readonly FrondDescriptor[] }): Violation[] {
   const index = new Map<string, Registration>();
@@ -109,7 +68,7 @@ export function verify(app: { fronds: readonly FrondDescriptor[] }): Violation[]
   // they need their own index and their own rule.
   const collectorFronds = new Map<string, string>();
   for (const frond of app.fronds) {
-    for (const c of frond.collectors) collectorFronds.set(c.typeName, frond.name);
+    for (const collector of frond.collectors) collectorFronds.set(collector.typeName, frond.name);
   }
 
   const violations: Violation[] = [];
@@ -144,8 +103,8 @@ export function verify(app: { fronds: readonly FrondDescriptor[] }): Violation[]
 
     // Rule 2 — an operation parameter that wanted a collector this frond has not
     // got. The preliminary binding convention can only see this frond's collector
-    // set, so it produces body evidence. EffectiveOperation refuses that evidence
-    // before boot: another frond's collector proves the provenance is not a body.
+    // set, so it produces input evidence. EffectiveOperation refuses that evidence
+    // before boot: another frond's collector proves the provenance is not an input.
     const own = new Set(frond.collectors.map((c) => c.typeName));
     for (const handler of frond.handlers) {
       for (const [opName, op] of handler.operations) {
@@ -156,7 +115,7 @@ export function verify(app: { fronds: readonly FrondDescriptor[] }): Violation[]
           const wanted = lowerFirst(param.type.name);
           if (own.has(wanted)) continue;
           const elsewhere = collectorFronds.get(wanted);
-          // No collector anywhere for that type may be an ordinary body parameter.
+          // No collector anywhere for that type may be an ordinary input parameter.
           // Only a collector that exists in the wrong place makes that interpretation
           // provably false.
           if (!elsewhere) continue;
@@ -170,7 +129,7 @@ export function verify(app: { fronds: readonly FrondDescriptor[] }): Violation[]
             message:
               `'${param.name}' is typed ${param.type.name}, and the collector that produces one ` +
               `is declared in frond '${elsewhere}'. A binding plan only sees its own frond's ` +
-              `collectors, so the preliminary body interpretation is invalid. Fougere refuses ` +
+              `collectors, so the preliminary input interpretation is invalid. Fougere refuses ` +
               `the operation before it can receive what the caller sent. ` +
               `Move the collector into '${frond.name}'.`,
           });

package/src/wire/CallLog.ts

@@ -0,0 +1,30 @@
+import type { RouteKind } from './RouteAddress.js';
+
+/** What crosses the door. */
+export interface CallRecord {
+  /** Monotonic, and the whole cursor protocol: a reader asks for what is above its own. */
+  seq: number;
+  frond?: string;
+  entity: string;
+  operation: string;
+  surface?: string;
+  /** Known at `resolved`, so absent on a call that never found a route. */
+  route?: RouteKind;
+  /** The traceparent the invocation carried, when one did. */
+  trace?: string;
+  /** The peer that established this call, when one did. */
+  caller?: string;
+  startedAt: number;
+  /** Known at `settled`. */
+  ms?: number;
+  verdict: 'running' | 'ok' | 'failed';
+  refusal?: { code?: string; message: string };
+}
+
+/** One page of the ring. */
+export interface CallPage {
+  calls: CallRecord[];
+  cursor: number;
+  inFlight: number;
+  dropped: number;
+}

package/src/{contract → wire}/Invocation.ts

@@ -1,15 +1,16 @@
 export interface InvocationContext {
   params: Record<string, unknown>;
   query: Record<string, unknown>;
-  body: unknown;
+  input: unknown;
   state: Record<string, unknown>;
   trace?: string;
   identity?: string;
   caller?: string;
 }
 
-export type InvocationInput = Partial<InvocationContext>;
+export type PartialInvocation = Partial<InvocationContext>;
 
+/** Freezes plain data deeply, and leaves a class instance alone — a `Date` is not a record. */
 function canonicalValue(value: unknown): unknown {
   if (value === null || value === undefined || typeof value !== 'object') return value;
   if (Array.isArray(value)) return Object.freeze(value.map(canonicalValue));
@@ -19,6 +20,7 @@ function canonicalValue(value: unknown): unknown {
   return canonicalRecord(value);
 }
 
+/** Drops the keys set to `undefined`, so an input and its JSON round-trip agree. */
 function canonicalRecord(value: unknown): Record<string, unknown> {
   if (!value || typeof value !== 'object' || Array.isArray(value)) return Object.freeze({});
 
@@ -33,33 +35,37 @@ function canonicalRecord(value: unknown): Record<string, unknown> {
 export class Invocation implements InvocationContext {
   readonly params: Record<string, unknown>;
   readonly query: Record<string, unknown>;
-  readonly body: unknown;
+  readonly input: unknown;
   readonly state: Record<string, unknown>;
   readonly trace?: string;
   readonly identity?: string;
   readonly caller?: string;
 
-  private constructor(input: InvocationInput) {
-    this.params = canonicalRecord(input.params);
-    this.query = canonicalRecord(input.query);
-    this.body = canonicalValue(input.body);
+  /** Gives every entry and every transport the same seven-member value, frozen. */
+  private constructor(context: PartialInvocation) {
+    this.params = canonicalRecord(context.params);
+    this.query = canonicalRecord(context.query);
+    this.input = canonicalValue(context.input);
     // State is host-owned and may still be enriched by existing middlewares. Moving it
     // to immutable lifecycle context is a separate migration.
-    this.state = input.state ?? {};
-    if (input.trace !== undefined) this.trace = input.trace;
-    if (input.identity !== undefined) this.identity = input.identity;
-    if (input.caller !== undefined) this.caller = input.caller;
+    this.state = context.state ?? {};
+    if (context.trace !== undefined) this.trace = context.trace;
+    if (context.identity !== undefined) this.identity = context.identity;
+    if (context.caller !== undefined) this.caller = context.caller;
     Object.freeze(this);
   }
 
-  static from(input?: InvocationInput): Invocation {
-    return input instanceof Invocation ? input : new Invocation(input ?? {});
+  /** Takes a raw object or an invocation, so a caller never has to know which it holds. */
+  static from(context?: PartialInvocation): Invocation {
+    return context instanceof Invocation ? context : new Invocation(context ?? {});
   }
 
-  withBody(body: unknown): Invocation {
-    return new Invocation({ ...this, body });
+  /** Replaces the input — how the façade hands on the value it parsed. */
+  withInput(input: unknown): Invocation {
+    return new Invocation({ ...this, input });
   }
 
+  /** Replaces the host-owned state, which a middleware enriches before the handler runs. */
   withState(state: Record<string, unknown>): Invocation {
     return new Invocation({ ...this, state });
   }
@@ -67,6 +73,7 @@ export class Invocation implements InvocationContext {
 
 export const EMPTY_INVOCATION = Invocation.from();
 
-export function canonicalInvocation(input?: InvocationInput): Invocation {
-  return Invocation.from(input);
+/** Names the same gesture as `Invocation.from` for callers that read better this way. */
+export function canonicalInvocation(context?: PartialInvocation): Invocation {
+  return Invocation.from(context);
 }

package/src/{contract → wire}/RouteAddress.ts

@@ -7,11 +7,13 @@ export interface RouteAddressInput {
   surface?: string;
 }
 
+/** Refuses an empty segment, so no address can be built that nothing can serve. */
 function required(value: string, name: string): string {
   if (value.trim().length === 0) throw new TypeError(`Route ${name} cannot be empty`);
   return value;
 }
 
+/** Applies the same refusal to a segment that may be absent, but not blank. */
 function optional(value: string | undefined, name: string): string | undefined {
   return value === undefined ? undefined : required(value, name);
 }
@@ -22,6 +24,7 @@ export class RouteAddress {
   readonly operation: string;
   readonly surface?: string;
 
+  /** Names one callable operation, and freezes it so a registry key cannot drift. */
   constructor(input: RouteAddressInput) {
     this.entity = required(input.entity, 'entity');
     this.operation = required(input.operation, 'operation');
@@ -29,19 +32,23 @@ export class RouteAddress {
     Object.freeze(this);
   }
 
+  /** Serializes the three segments so a route can be looked up in a `Map`. */
   key(): string {
     return JSON.stringify([this.surface ?? null, this.entity, this.operation]);
   }
 
+  /** Compares two addresses by their key, so `surface` counts as much as the operation. */
   equals(other: RouteAddress): boolean {
     return this.key() === other.key();
   }
 
+  /** Writes the address the way a log and an error message name it. */
   toString(): string {
     const audience = this.surface ? `${this.surface}/` : '';
     return `${audience}${this.entity}.${this.operation}`;
   }
 
+  /** Sends the address over the wire without `surface: undefined` riding along. */
   toJSON(): RouteAddressInput {
     return {
       entity: this.entity,

package/src/wire/binding.ts

@@ -1,10 +1,6 @@
 /**
- * Where each parameter of an operation gets its value — decided once at boot from the
- * parsed signature, replayed per call by `resolveArgs`.
- *
- * The branches are ORDERED and each states why it sits where it does; the list used to
- * be repeated here too, and it had already lost `Fact` — the one whose position is
- * load-bearing, since the fall-through would otherwise hand it the caller's body.
+ * Where each parameter of an operation gets its value — decided once at boot from the parsed
+ * signature, replayed per call by `resolveArgs`.
  */
 import type { Param } from './signature.js';
 import { lowerFirst } from '@fougere/schema';
@@ -13,17 +9,10 @@ import { lowerFirst } from '@fougere/schema';
 
 type ParamSource =
   | { kind: 'collector'; typeName: string }
-  /**
-   * `Fact<PostPublished>` — something that happened, not something a caller typed.
-   *
-   * It resolves from the body exactly like `body` does, and that is deliberate: an
-   * emission and a direct call ARE the same call, so a subscriber cannot tell them apart
-   * and does not need to. The branch exists so the PLAN says what this parameter is —
-   * that sentence is what makes the subscriber index readable without reparsing types.
-   */
+  /** `Fact<PostPublished>` — something that happened, not something a caller typed. */
   | { kind: 'fact'; factName: string }
   | { kind: 'param'; name: string; coerce?: 'number' | 'boolean' }
-  | { kind: 'body' }
+  | { kind: 'input' }
   | { kind: 'context' }
   /** The whole query bag, for an op whose argument IS the options (list). */
   | { kind: 'query' };
@@ -48,12 +37,7 @@ function coercionFor(typeName: string): 'number' | 'boolean' | undefined {
 
 // ── Compute ───────────────────────────────────
 
-/**
- * Build a BindingPlan from parsed method params.
- *
- * @param params - Parsed parameter list from AST
- * @param collectorTypeNames - Registration keys of the types a Collector answers for
- */
+/** Build a BindingPlan from parsed method params. */
 export function computeBindingPlan(
   params: Param[],
   collectorTypeNames: Set<string>,
@@ -62,11 +46,11 @@ export function computeBindingPlan(
     const typeName = param.type.name;
     // `lowerFirst`, never `toLowerCase()`: the collector set is keyed the way the
     // scan spells it, and the two agree on one word only — `AuthorUser` looked up as
-    // `authoruser` missed `authorUser` and fell through to branch 4, the request body.
+    // `authoruser` missed `authorUser` and fell through to branch 4, the request input.
     const typeKey = lowerFirst(typeName);
 
     // 0. Fact — `Fact<X>` names itself, so nothing has to be known in advance. It comes
-    //    FIRST because branch 4 would otherwise hand it the caller's body under the name
+    //    FIRST because branch 4 would otherwise hand it the caller's input under the name
     //    of something that happened.
     const factOf = param.type.name === 'Fact' ? param.type.generics?.[0]?.name : undefined;
     if (factOf) {
@@ -108,10 +92,10 @@ export function computeBindingPlan(
       };
     }
 
-    // 4. Everything else — body
+    // 4. Everything else — input
     return {
       name: param.name,
-      source: { kind: 'body' as const },
+      source: { kind: 'input' as const },
       optional: param.optional ?? false,
     };
   });