@aventara/client 1.0.0-rc.1 → 1.0.0-rc.10

package/dist/config/tsconfig.locator.d.ts

@@ -4,7 +4,7 @@ export interface LocatedTsconfig {
     readonly path: string;
     readonly config: TsConfigJsonResolved;
 }
-export interface TsconfigLocation {
+interface TsconfigLocation {
     /** The absolute `generateAt`: the search starts there. */
     readonly generateAt: string;
     /** The generated entry file the project must include, absolute. */
@@ -19,3 +19,4 @@ export interface TsconfigLocation {
  * @throws AvClientConfigError when the named `tsconfigFile` is missing or unreadable.
  */
 export declare function locateTsconfig(location: TsconfigLocation): LocatedTsconfig | undefined;
+export {};

package/dist/config/tsconfig.locator.js

@@ -11,18 +11,30 @@ export function locateTsconfig(location) {
         return undefined;
     }
     if (found.config.references === undefined ||
-        createFilesMatcher(found)(location.entryFile) !== undefined) {
+        includesEntry(found, location.entryFile)) {
         return found;
     }
     for (const reference of found.config.references) {
         const referenced = referencedTsconfig(found.path, reference.path);
         if (referenced !== undefined &&
-            createFilesMatcher(referenced)(location.entryFile) !== undefined) {
+            includesEntry(referenced, location.entryFile)) {
             return referenced;
         }
     }
     return found;
 }
+function includesEntry(tsconfig, file) {
+    const directory = path.dirname(tsconfig.path);
+    const local = (entries) => entries.map((entry) => path.isAbsolute(entry) ? path.relative(directory, entry) || "." : entry);
+    const { files, include, exclude } = tsconfig.config;
+    const config = {
+        ...tsconfig.config,
+        ...(files === undefined ? {} : { files: local(files) }),
+        ...(include === undefined ? {} : { include: local(include) }),
+        ...(exclude === undefined ? {} : { exclude: local(exclude) }),
+    };
+    return (createFilesMatcher({ path: tsconfig.path, config })(file) !== undefined);
+}
 function namedTsconfig(file) {
     try {
         readFileSync(file, "utf8");

package/dist/contract/contract.acceptance.d.ts

@@ -1,5 +1,4 @@
 import type { AvContractClient } from "@aventara/core";
-export declare const SUPPORTED_PROTOCOL_VERSIONS: ReadonlySet<number>;
 export type ContractRejectionReason = "protocol-unsupported" | "hash-mismatch" | "structure-invalid";
 export type ContractAccepted = {
     readonly accepted: true;

package/dist/contract/contract.acceptance.js

@@ -1,5 +1,5 @@
 import { AVENTARA_PROTOCOL_VERSION, AvCanonicalJsonError, computeClientContractHash, validateClientContractStructure, } from "@aventara/core/internal";
-export const SUPPORTED_PROTOCOL_VERSIONS = new Set([
+const SUPPORTED_PROTOCOL_VERSIONS = new Set([
     AVENTARA_PROTOCOL_VERSION,
 ]);
 const REFUSED_EXIT_CODE = 1;

package/dist/contract/contract.fetcher.d.ts

@@ -7,7 +7,7 @@ export type ContractFetch = (url: URL, init: {
     readonly headers?: Readonly<Record<string, string>>;
 }) => Promise<ContractResponse>;
 export declare const CONTRACT_NOT_MODIFIED: unique symbol;
-export type ContractTransportFailureReason = 
+type ContractTransportFailureReason = 
 /** No response at all: DNS, refused connection, TLS, abort. */
 "request-failed"
 /** A response that is not 2xx — nothing was served for the protocol to judge. */
@@ -28,3 +28,4 @@ export declare function displayUrl(url: URL): string;
  * @throws AvContractTransportError when no JSON value arrives.
  */
 export declare function fetchClientContractBody(entrypoint: ClientEntrypoint, fetch?: ContractFetch, ifNoneMatch?: string): Promise<unknown>;
+export {};

package/dist/contract/contract.loader.d.ts

@@ -1,7 +1,7 @@
 import type { AvContractClient } from "@aventara/core";
 import type { ClientEntrypoint } from "../config/client-config.interface.js";
 import { type ContractFetch } from "./contract.fetcher.js";
-export interface ClientContractLoadInput {
+interface ClientContractLoadInput {
     readonly entrypoint: ClientEntrypoint;
     readonly fetch?: ContractFetch;
 }
@@ -10,7 +10,7 @@ export interface ClientContractLoadInput {
  * @throws AvContractProtocolError when what arrived is refused.
  */
 export declare function loadClientContract(input: ClientContractLoadInput): Promise<AvContractClient>;
-export interface ClientContractSince {
+interface ClientContractSince {
     readonly contract: AvContractClient;
     /** The deployment answered `304`: `contract` is the one the caller held. */
     readonly notModified: boolean;
@@ -22,3 +22,4 @@ export interface ClientContractSince {
  * `stored` the GET is unconditional.
  */
 export declare function loadClientContractSince(input: ClientContractLoadInput, stored: AvContractClient | undefined): Promise<ClientContractSince>;
+export {};

package/dist/emit/access.emitter.d.ts

@@ -0,0 +1,12 @@
+import type { AvContractClient } from "@aventara/core";
+import { ACCESS_VERB_NAMES, ACCESS_VERBS } from "@aventara/core/internal";
+import type { EmittedModule } from "./emitted-tree.interface.js";
+import { type ClientModuleStyle } from "./module-style.interface.js";
+/** One verb `$access` offers beside `can`. */
+export type AccessVerbName = (typeof ACCESS_VERB_NAMES)[number];
+/** Whether a verb takes arguments, and what it resolves (core's verb table). */
+export declare function accessVerbShape(name: AccessVerbName): (typeof ACCESS_VERBS)[AccessVerbName];
+/** The verbs the section states, in `$access`'s order; none without `verbs`. */
+export declare function accessVerbsOf(contract: AvContractClient): readonly AccessVerbName[];
+/** `runtime/access.ts`, or nothing when the section states no verb. */
+export declare function emitAccessModules(contract: AvContractClient, style: ClientModuleStyle): readonly EmittedModule[];

package/dist/emit/access.emitter.js

@@ -0,0 +1,263 @@
+import { ACCESS_VERB_NAMES, ACCESS_VERBS } from "@aventara/core/internal";
+import { importSpecifier, } from "./module-style.interface.js";
+export function accessVerbShape(name) {
+    return ACCESS_VERBS[name];
+}
+export function accessVerbsOf(contract) {
+    const verbs = contract.access?.verbs;
+    return verbs === undefined
+        ? []
+        : ACCESS_VERB_NAMES.filter((name) => verbs[name] !== undefined);
+}
+export function emitAccessModules(contract, style) {
+    const verbs = contract.access?.verbs;
+    const names = accessVerbsOf(contract);
+    if (verbs === undefined || names.length === 0) {
+        return [];
+    }
+    const from = (module) => JSON.stringify(importSpecifier(module, style));
+    const table = names
+        .map((name) => {
+        const verb = verbs[name];
+        return `\t${name}: { method: ${JSON.stringify(verb?.method)}, path: ${JSON.stringify(verb?.path)}, result: ${JSON.stringify(verb?.result)} },\n`;
+    })
+        .join("");
+    return [
+        {
+            path: "runtime/access.ts",
+            source: `import { AvTransportError } from ${from("./errors")};
+import type { AvCallOptions, PlatformSignal, TransportConnection } from ${from("./transport")};
+
+/**
+ * Aventara Access's verbs, as this deployment's ClientContract states them:
+ * each one a request to Access's own route, its result projected onto the
+ * schema the ClientContract promises.
+ */
+
+/**
+ * Aventara Access answered a verb with a status that is not 2xx. It carries the
+ * status and Access's own code and message; it is no AvError, because Access's
+ * answers are not framework envelopes.
+ */
+export class AvAccessError extends Error {
+	override readonly name: string = "AvAccessError";
+	/** The HTTP status Access answered. */
+	readonly status: number;
+	/** Access's own error code, or null when its answer named none. */
+	readonly code: string | null;
+
+	constructor(message: string, status: number, code: string | null) {
+		super(message);
+		this.status = status;
+		this.code = code;
+	}
+}
+
+/** Where the app mounted Aventara Access. */
+const ACCESS_URL = ${JSON.stringify(contract.access?.url ?? "")};
+
+/** Each verb this client offers: its route under ACCESS_URL and its result's schema. */
+const VERBS = {
+${table}} as const;
+
+/** One verb this client offers. */
+export type AccessVerb = keyof typeof VERBS;
+
+/** A schema node, as the projection reads it. */
+type Schema = { readonly [key: string]: unknown };
+
+/** What a verb hands fetch. */
+interface AccessInit {
+	readonly method: "GET" | "POST";
+	readonly headers: Readonly<Record<string, string>>;
+	readonly body?: string;
+	readonly cache?: "no-store";
+	readonly signal?: PlatformSignal;
+}
+
+/** What a verb reads of fetch's answer. */
+interface AccessAnswer {
+	readonly status: number;
+	text(): Promise<string>;
+}
+
+/** The URL of a verb's route: a root-relative ACCESS_URL put under an absolute entrypoint's origin. */
+function routeOf(entrypoint: string, path: string): string {
+	const base = ACCESS_URL.replace(/\\/+$/, "");
+	const origin = /^[a-z][a-z0-9+.-]*:\\/\\/[^/?#]*/i.exec(entrypoint)?.[0];
+	return base.startsWith("/") && origin !== undefined ? origin + base + path : base + path;
+}
+
+function isRecord(value: unknown): value is Readonly<Record<string, unknown>> {
+	return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+
+/**
+ * \`schema\` as a member's schema.
+ *
+ * @throws TypeError when it is none (a free-form object or list, a tuple read
+ *   past its length): outside the forms a ClientContract states.
+ */
+function memberSchema(schema: unknown): Schema {
+	if (!isRecord(schema)) {
+		throw new TypeError("the schema is not one of the forms a ClientContract states");
+	}
+	return schema as Schema;
+}
+
+/** Whether \`value\` can be read by \`schema\` at all: its JSON type. */
+function fits(value: unknown, schema: Schema): boolean {
+	if (Object.hasOwn(schema, "const")) {
+		return value === schema["const"];
+	}
+	if (Array.isArray(schema["enum"])) {
+		return schema["enum"].includes(value);
+	}
+	for (const keyword of ["anyOf", "oneOf"]) {
+		const options = schema[keyword];
+		if (Array.isArray(options)) {
+			return options.some((option) => fits(value, option as Schema));
+		}
+	}
+	switch (schema["type"]) {
+		case "null":
+			return value === null;
+		case "boolean":
+			return typeof value === "boolean";
+		case "string":
+			return typeof value === "string";
+		case "number":
+			return typeof value === "number";
+		case "integer":
+			return Number.isInteger(value);
+		case "array":
+			return Array.isArray(value);
+		case "object":
+			return isRecord(value);
+		default:
+			return false;
+	}
+}
+
+/**
+ * \`value\` projected onto \`schema\`: every object down to the members the schema
+ * declares, a list member by member. The schema is the promise.
+ *
+ * @throws TypeError when the value is not one the schema describes.
+ */
+function projected(value: unknown, schema: Schema): unknown {
+	if (!fits(value, schema)) {
+		throw new TypeError("the value is not the one the ClientContract describes");
+	}
+	for (const keyword of ["anyOf", "oneOf"]) {
+		const options = schema[keyword];
+		if (Array.isArray(options)) {
+			const option = options.find((candidate) => fits(value, candidate as Schema)) as Schema;
+			return projected(value, option);
+		}
+	}
+	if (Array.isArray(value)) {
+		const prefix = schema["prefixItems"];
+		const items = Array.isArray(prefix) ? undefined : memberSchema(schema["items"]);
+		return Object.freeze(
+			value.map((member: unknown, index: number) =>
+				projected(member, items ?? memberSchema((prefix as readonly unknown[])[index])),
+			),
+		);
+	}
+	if (isRecord(value)) {
+		const properties = schema["properties"];
+		if (isRecord(properties)) {
+			const copy: Record<string, unknown> = {};
+			for (const [key, member] of Object.entries(properties)) {
+				if (Object.hasOwn(value, key) && value[key] !== undefined) {
+					copy[key] = projected(value[key], member as Schema);
+				}
+			}
+			return Object.freeze(copy);
+		}
+		const values = memberSchema(schema["additionalProperties"]);
+		return Object.freeze(Object.fromEntries(Object.entries(value).map(([key, member]) => [key, projected(member, values)])));
+	}
+	return value;
+}
+
+/** Access's error answer, read for its code and message. */
+function refusalOf(verb: AccessVerb, status: number, text: string): AvAccessError {
+	let body: unknown;
+	try {
+		body = JSON.parse(text);
+	} catch {
+		body = undefined;
+	}
+	const code = isRecord(body) && typeof body["code"] === "string" ? body["code"] : null;
+	const message =
+		isRecord(body) && typeof body["message"] === "string" ? body["message"] : "Aventara Access refused $access." + verb + " (HTTP " + status + ").";
+	return new AvAccessError(message, status, code);
+}
+
+/**
+ * Runs one Access verb: one request to its route, its 2xx answer projected onto
+ * its result schema (\`null\` stays \`null\`: no one is signed in).
+ *
+ * @throws AvAccessError on a non-2xx answer; AvTransportError when no answer
+ *   arrived, or the answer is not the value the ClientContract describes. A
+ *   caller's abort rejects with what fetch rejected with.
+ */
+export async function callAccess(
+	connection: TransportConnection,
+	verb: AccessVerb,
+	args: unknown,
+	options: AvCallOptions = {},
+): Promise<unknown> {
+	const { method, path, result } = VERBS[verb];
+	const operation = "$access." + verb;
+	const headers: Record<string, string> = { ...options.headers };
+	let init: AccessInit;
+	if (method === "GET") {
+		init = { method, headers, cache: "no-store" };
+	} else {
+		headers["Content-Type"] = "application/json";
+		init = { method, headers, body: JSON.stringify(args ?? {}) };
+	}
+	if (options.signal !== undefined) {
+		init = { ...init, signal: options.signal };
+	}
+	const fetch = connection.fetch as unknown as (url: string, init: AccessInit) => Promise<AccessAnswer>;
+	let answer: AccessAnswer;
+	let text: string;
+	try {
+		answer = await fetch(routeOf(connection.entrypoint, path), init);
+		text = await answer.text();
+	} catch (error) {
+		if (options.signal?.aborted === true) {
+			throw error;
+		}
+		throw new AvTransportError("The request for " + operation + " failed before any answer arrived.", null);
+	}
+	if (answer.status < 200 || answer.status > 299) {
+		throw refusalOf(verb, answer.status, text);
+	}
+	let value: unknown;
+	try {
+		value = text.trim() === "" ? null : JSON.parse(text);
+	} catch {
+		throw new AvTransportError("The answer to " + operation + " (HTTP " + answer.status + ") is not JSON.", answer.status);
+	}
+	if (value === null) {
+		return null;
+	}
+	try {
+		return projected(value, result as Schema);
+	} catch (error) {
+		throw new AvTransportError(
+			"The answer to " + operation + " (HTTP " + answer.status + ") holds a value this client cannot read: " +
+				(error instanceof Error ? error.message : String(error)),
+			answer.status,
+		);
+	}
+}
+`,
+        },
+    ];
+}

package/dist/emit/banner.emitter.d.ts

@@ -1,7 +1,12 @@
 export declare const GENERATED_OWNERSHIP_LINE = "/* !!! Generated by @aventara/client. Do not edit. !!! */";
+/** The command a generated file says to regenerate it with: a command in backticks, then any words about it. */
+export type RegenerateCommand = `\`${string}\`${string}`;
+/** `avclient generate`'s own: what its banner and errors say. */
+export declare const AVCLIENT_REGENERATE: RegenerateCommand;
+/** `avclient generate`'s banner. */
 export declare const GENERATED_BANNER: readonly string[];
 /** `source` with the banner before it and one blank line between. */
-export declare function withGeneratedBanner(source: string): string;
+export declare function withGeneratedBanner(source: string, regenerate?: RegenerateCommand): string;
 /**
  * How far into a file the ownership line is looked for. The banner opens every
  * emitted file, so the line sits well inside this; a reader never has to read a

package/dist/emit/banner.emitter.js

@@ -1,12 +1,16 @@
 export const GENERATED_OWNERSHIP_LINE = "/* !!! Generated by @aventara/client. Do not edit. !!! */";
-export const GENERATED_BANNER = [
-    "// biome-ignore-all format: generated output",
-    "// biome-ignore-all lint: generated output",
-    GENERATED_OWNERSHIP_LINE,
-    "/* Regenerate with `avclient generate`. */",
-];
-export function withGeneratedBanner(source) {
-    return `${GENERATED_BANNER.join("\n")}\n\n${source}`;
+export const AVCLIENT_REGENERATE = "`avclient generate`";
+function generatedBanner(regenerate = AVCLIENT_REGENERATE) {
+    return [
+        "// biome-ignore-all format: generated output",
+        "// biome-ignore-all lint: generated output",
+        GENERATED_OWNERSHIP_LINE,
+        `/* Regenerate with ${regenerate}. */`,
+    ];
+}
+export const GENERATED_BANNER = generatedBanner();
+export function withGeneratedBanner(source, regenerate = AVCLIENT_REGENERATE) {
+    return `${generatedBanner(regenerate).join("\n")}\n\n${source}`;
 }
 export const GENERATED_OWNERSHIP_HEAD_BYTES = 1024;
 export function carriesGeneratedOwnership(head) {

package/dist/emit/client-surface.emitter.js

@@ -1,5 +1,7 @@
+import { ACCESS_VERB_NAMES } from "@aventara/core/internal";
+import { accessVerbShape, accessVerbsOf, } from "./access.emitter.js";
 import { contractHasFieldChecks } from "./field-check.emitter.js";
-import { shapedContractType } from "./json-shape.emitter.js";
+import { jsonSchemaType, shapedContractType } from "./json-shape.emitter.js";
 import { importSpecifier, } from "./module-style.interface.js";
 import { ownPropertyKey } from "./name.deriver.js";
 export function emitClientSurfaceModule(contract, names, style) {
@@ -18,6 +20,58 @@ export function emitClientSurfaceModule(contract, names, style) {
     const renamedEntries = renamed.length === 0
         ? ""
         : ` ${renamed.map((property) => `${ownPropertyKey(property.contractName)}: ${JSON.stringify(property.property)}`).join(", ")} `;
+    const access = contract.access;
+    const verbs = accessVerbsOf(contract);
+    const argsType = (name) => {
+        const schema = access?.verbs?.[name]?.args;
+        return schema === undefined
+            ? "undefined"
+            : jsonSchemaType(schema);
+    };
+    const argsMembers = ACCESS_VERB_NAMES.filter((name) => accessVerbShape(name).args)
+        .map((name) => `readonly ${name}: ${argsType(name)}`)
+        .join("; ");
+    const accessTypes = access === undefined
+        ? ""
+        : "\n" +
+            "/** One question `$access.can` takes: an action on a Resource, or on the one row its unique `where` names. */\n" +
+            "type AccessQuestion = {\n" +
+            "\treadonly [R in Resource]: {\n" +
+            "\t\treadonly resource: R;\n" +
+            '\t\treadonly action: "read" | "create" | "update" | "delete";\n' +
+            `\t\treadonly where?: AvUniqueWhereInput<${C}, R, ClientScalarForms>;\n` +
+            "\t};\n" +
+            "}[Resource];\n" +
+            "\n" +
+            "/** `avClient.$access`: `can`, and the Aventara Access verbs this deployment offers. */\n" +
+            "type AccessSurface = Pick<\n" +
+            "\tAvAccessVerbs<\n" +
+            "\t\tAccessQuestion,\n" +
+            `\t\t${verbs.includes("me") ? "AvAccessMe" : "never"},\n` +
+            `\t\t{ ${argsMembers} },\n` +
+            "\t\tAvCallOptions\n" +
+            "\t>,\n" +
+            `\t${["can", ...verbs].map((name) => JSON.stringify(name)).join(" | ")}\n` +
+            ">;\n";
+    const accessMember = (name) => {
+        const shape = accessVerbShape(name);
+        const quoted = JSON.stringify(name);
+        const parameters = shape.args
+            ? "args: unknown, callOptions: AvCallOptions = {}"
+            : "callOptions: AvCallOptions = {}";
+        const args = shape.args ? "args" : "undefined";
+        return shape.resolves === "nothing"
+            ? `\t\t\t\t${name}: async (${parameters}): Promise<void> => {\n\t\t\t\t\tawait callAccess(connect(), ${quoted}, ${args}, callOptions);\n\t\t\t\t},\n`
+            : `\t\t\t\t${name}: async (${parameters}) => callAccess(connect(), ${quoted}, ${args}, callOptions),\n`;
+    };
+    const accessRuntime = access === undefined
+        ? ""
+        : '\t\tObject.defineProperty(this, "$access", {\n' +
+            "\t\t\tvalue: Object.freeze({\n" +
+            "\t\t\t\tcan: async (questions: readonly unknown[], callOptions: AvCallOptions = {}) => askCan(connect(), questions, callOptions),\n" +
+            verbs.map(accessMember).join("") +
+            "\t\t\t}),\n" +
+            "\t\t});\n";
     const surface = (name, call) => `type ${name} = {\n` +
         `\treadonly [${resourceKey}]: {\n` +
         "\t\treadonly [F in keyof Grammar[R]]: {\n" +
@@ -32,14 +86,22 @@ export function emitClientSurfaceModule(contract, names, style) {
                 ? ""
                 : `import type { JsonFieldType } from ${from("./derivation/contracts/json-shape")};\n`) +
             `import type { AvApplicationScalarForms } from ${from("./derivation/contracts/scalar-value-type")};\n` +
-            `import type { AvOperationArgumentsFor, AvResourceKey } from ${from("./derivation/operations/operation-arguments")};\n` +
+            (access === undefined
+                ? `import type { AvOperationArgumentsFor, AvResourceKey } from ${from("./derivation/operations/operation-arguments")};\n`
+                : `import type { AvOperationArgumentsFor, AvResourceKey, AvUniqueWhereInput } from ${from("./derivation/operations/operation-arguments")};\n`) +
             `import type { ${interactive ? "AvDeferredOperationCall, " : ""}AvOperationCall, AvOperationGrammar } from ${from("./derivation/operations/operation-call")};\n` +
             `import type { AvOperationFamily, AvOperationIdentity } from ${from("./derivation/operations/operation-identity")};\n` +
             `import type { AdmittedOperationResult } from ${from("./derivation/operations/operation-result")};\n` +
             (interactive
                 ? `import type { AvOperation, AvTransactionResults } from ${from("./derivation/transactions/deferred-operation")};\n`
                 : "") +
+            (access === undefined
+                ? ""
+                : `import type { AvAccessVerbs } from ${from("./derivation/policy/access-verbs")};\n`) +
             `import { DEFAULT_ENTRYPOINT } from ${from("./metadata")};\n` +
+            (verbs.length === 0
+                ? ""
+                : `import { callAccess } from ${from("./runtime/access")};\n`) +
             `import type { AvDecimal } from ${from("./runtime/decimal")};\n` +
             `import { ADVERTISED_OPERATIONS } from ${from("./runtime/descriptor")};\n` +
             (checked
@@ -48,7 +110,12 @@ export function emitClientSurfaceModule(contract, names, style) {
             (interactive
                 ? `import { deferOperation, runTransaction } from ${from("./runtime/transaction")};\n`
                 : "") +
-            `import { type AvCallOptions, execute, type AvFetch, type TransportConnection } from ${from("./runtime/transport")};\n` +
+            (access === undefined
+                ? `import { type AvCallOptions, execute, type AvFetch, type TransportConnection } from ${from("./runtime/transport")};\n`
+                : `import { askCan, type AvCallOptions, execute, type AvFetch, type TransportConnection } from ${from("./runtime/transport")};\n`) +
+            (verbs.includes("me")
+                ? `import type { AvAccessMe } from ${from("./types")};\n`
+                : "") +
             "\n" +
             `export type { AvCallOptions } from ${from("./runtime/transport")};\n` +
             "\n" +
@@ -102,6 +169,7 @@ export function emitClientSurfaceModule(contract, names, style) {
                     "\toptions?: AvCallOptions,\n" +
                     ") => Promise<AvTransactionResults<Steps>>;\n"
                 : "") +
+            accessTypes +
             "\n" +
             "/** The generated client: one property per Resource this deployment's ClientContract advertises. */\n" +
             "export interface AvClient extends AvClientSurface {}\n" +
@@ -120,6 +188,11 @@ export function emitClientSurfaceModule(contract, names, style) {
                     " */\n"
                 : "/** The generated client. */\n") +
             "export class AvClient {\n" +
+            (access === undefined
+                ? ""
+                : "\t/** The policy's answers for the UI (`can`), and the Aventara Access verbs this deployment offers. */\n" +
+                    "\tdeclare readonly $access: AccessSurface;\n" +
+                    (interactive ? "" : "\n")) +
             (interactive
                 ? "\t/** Deferred operations, for `transaction`. */\n" +
                     "\tdeclare readonly tx: AvTxSurface;\n" +
@@ -134,10 +207,8 @@ export function emitClientSurfaceModule(contract, names, style) {
             "\t\tfor (const [resource, families] of operationTree(\n" +
             "\t\t\t(resource, family, variant): OperationMethod =>\n" +
             (checked
-                ? "\t\t\t\tasync (args = {}, callOptions = {}) => {\n" +
-                    "\t\t\t\t\tcheckOperation(resource, family, args);\n" +
-                    "\t\t\t\t\treturn execute(connect(), resource, family, variant, args, callOptions);\n" +
-                    "\t\t\t\t},\n"
+                ? "\t\t\t\tasync (args = {}, callOptions = {}) =>\n" +
+                    "\t\t\t\t\texecute(connect(), resource, family, variant, args, callOptions, checkOperation),\n"
                 : "\t\t\t\tasync (args = {}, callOptions = {}) =>\n" +
                     "\t\t\t\t\texecute(connect(), resource, family, variant, args, callOptions),\n") +
             "\t\t)) {\n" +
@@ -160,6 +231,7 @@ export function emitClientSurfaceModule(contract, names, style) {
                         : "\t\t\t\trunTransaction(connect(), steps, callOptions),\n") +
                     "\t\t});\n"
                 : "") +
+            accessRuntime +
             "\t}\n" +
             "}\n" +
             "\n" +

package/dist/emit/client-tree.emitter.d.ts

@@ -1,8 +1,15 @@
 import type { AvContractClient } from "@aventara/core";
-import type { ClientEntrypoint } from "../config/client-config.interface.js";
+import type { EmittedEntrypoint } from "../config/client-config.interface.js";
+import { type RegenerateCommand } from "./banner.emitter.js";
 import { type ClientEmission } from "./emitted-tree.interface.js";
 import { type ClientModuleStyle } from "./module-style.interface.js";
 /**
  * @throws AvGeneratedNameError when a name cannot be emitted, even renamed.
+ * @throws AvClientConfigError when the ClientContract's Access URL is on an
+ *   origin other than the entrypoint's that `accessOrigins` does not list.
  */
-export declare function emitClientTree(contract: AvContractClient, entrypoint: ClientEntrypoint, style: ClientModuleStyle): ClientEmission;
+export declare function emitClientTree(contract: AvContractClient, entrypoint: EmittedEntrypoint, style: ClientModuleStyle, regenerate?: RegenerateCommand, accessOrigins?: readonly string[]): ClientEmission;
+/** How an entry re-exports `AvClient`: the class itself, or its type alone. */
+export type ClientClassExport = "value" | "type";
+/** The entry's re-exports, its default aside, as source: one statement per module. */
+export declare function clientEntryReExports(style: ClientModuleStyle, clientClass?: ClientClassExport, accessVerbs?: boolean): string;