One field, all the way down.

The Model is the seed. It states what exists, what rules govern it, and who may touch it — and it is the only place any of that is written.

enum LeadStatus { new  contacted  won  lost }

model Lead {
  id        Int        @id
  name      String     @length(1, 120) @trim
  email     String     @email @unique @lower
  status    LeadStatus @default(new)
  value     Float      @gte(0)
  ownerId   Int
  createdAt DateTime   @default(now())

  // Gate — the ordinal level check, per operation
  @@gate(2.4.4.5)

  // Policy — a row predicate, compiled into the SQL
  @@allow(read, ownerId == auth().id)
}

The Service is what the outside world can ask for. Here is the whole file — it is empty because everything in it would be a restatement of the Model.

// name  ← the filename      ('leads.service.ts' → /api/leads)
// model ← the service name  ('leads' → db.lead)
// db    ← app.db, scoped per call to the caller

export default createService({})

That gives find get create update patch remove at /api/leads, a 400 when email is not an email, a 401 below READER, and a list filtered by the policy — none of it written, all of it read from the Model at call time.

One call, one Context. It is the single argument every Hook and every Service method receives, and its parts have different rules — which is the part worth learning early.

A Hook is how you step into a call without owning it. Four phases, declared per method or for all, and they are the same four phases you will meet again in the UI realm.

export default createService({
  hooks: {
    around: { all:    [timing] },        // wraps the whole call
    before: { create: [stampOwner] },    // may mutate ctx.data or halt
    after:  { create: [queueWelcome] },  // sees ctx.result
    error:  { all:    [report] },        // sees ctx.error
  },
})

function stampOwner(ctx) {
  ctx.data.ownerId = ctx.user.id   // who, from the Context
}

Your Hooks run first, then the ones derived from the Model — so stampOwner can complete the record before the Gate check and the field rules judge it. Setting ctx.result in a before Hook ends the chain early; throwing sends it to error.

A Plugin extends the application and claims a name on it. Everything a Hook can then reach for — the queue, the mailer, the outbound boundary — arrived this way.

const app = createApp({ db, auth })

app.configure(caravan({ jobsDir: './jobs' }))  // → app.jobs
app.configure(conduit({ … }))                        // → app.conduit

// the after Hook from the previous stop
async function queueWelcome(ctx) {
  await ctx.app.jobs.dispatch('send-welcome', { email: ctx.result.data.email })
}

An Event is what happened. A Channel is who hears about it. A mutation is announced in exactly one place — the call itself — so no Hook and no method can forget to publish.

export default createService({
  channel: 'leads',   // the declared broadcast target
})

// one mutation, announced twice, from the same place:
app.events.on('leads:created', …)   // in-process Event bus
// 'leads created'                   → over the Channel, to the UI

A Resource is how the UI binds to a Service. It carries the data — and, because the Model's rules crossed the Boundary with it, it carries the rules too.

const leads = createResource('leads')

// "42" → 42 by the Model's declared type, '' → null on a nullable field, and
// the Model's own rules checked here before a round trip is spent — all three
// are on, and each takes an explicit false.

leads.fields.email   // { type, required, maxLength, format: 'email', … }
leads.can('delete')  // the Gate's answer, for hiding a control
leads.gate           // the four levels, as declared on the Model

The UI realm's Hooks are the API realm's Hooks. Same names, same order, same Context idea — learned once.

const leads = createResource('leads', {
  hooks: {
    around: { all: [async (ctx, next) => {
      busy = true; await next(); busy = false
    }] },
    error: { all: [(ctx) => toast(ctx.error.message)] },
  },
})

// and the Channel from the API realm arrives as an Event here —
// the list updates without asking again

The end of the journey. The input knows it is an email, knows it is required, knows its maximum length, and knows when it is wrong — and none of that is written here.

<script>
  import { Input, Select, Button } from '@frontierjs/ui'

  const leads = createResource('leads')
  let draft = leads.make()          // shaped by the Model

  // validate() returns [{ field, message }] — the components want a map
  $: errors = Object.fromEntries(
    leads.validate(draft, 'create').map(e => [e.field, e.message])
  )
</script>

<Input  label="Email" name="email" type="email"
        bind:value={draft.email} {errors} />

<Input  label="Name"  name="name"  bind:value={draft.name}  {errors} />
<Select label="Status" name="status" options={leads.fields.status.enum}
        bind:value={draft.status} {errors} />

<Button onclick={() => leads.service.create(draft)}>Save</Button>

coerce turns the string every control produces into the type the Model declared. validate checks it against the same rules the Service will apply. If both are switched off, nothing breaks — the server still says no. They only change where the answer arrives.