@aventara/client 1.0.0-rc.1 → 1.0.0-rc.11

package/CHANGELOG.md

@@ -1,5 +1,252 @@
 # @aventara/client
 
+## 1.0.0-rc.11
+
+### Patch Changes
+
+- 6197c08: `@/aventara/universal`'s calls are the generated client's own calls again. The entry no longer wraps each one in
+  `io().then(call)`, so its own `signal`, `avClient.all`'s `signal` and strict abort, and `avLazy` all reach it, in the
+  browser and on the server. Next's `io()` is now awaited before the request is sent.
+
+  In the browser, the calls made in one tick are still grouped into one `/_all`. On the server, none is grouped: each
+  call has a client of its own with grouping off, and it is sent from the async context of the code that made it. Before,
+  one queue served every request. Calls from two concurrent requests, or a call inside `unstable_cache` and one outside
+  it, could share a flush and run with the first call's headers and `state`.
+
+  `avLazy` no longer keeps one answer for every request on a server:
+
+  - The generated client's `avLazy` keeps its answer in a page. On a server (no `location`) it keeps none, and each await
+    makes the call again.
+  - `@aventara/core`'s `avLazy` keeps none: each await makes the call again.
+  - `@/aventara/universal` now exports its own `avLazy`, which keeps one answer per request inside a React render
+    (React's `cache`, which the entry now imports) and none where React keeps no request.
+
+  Before, an `avLazy` made at module scope handed the first request's answer to every request after it.
+
+  `ready()`'s in-process path now splits a cached read's GET URL into its path and its `?q=&v=` query, with an empty
+  body, so the read reaches its GET route instead of being answered as absent.
+
+- 5ac10f7: The generated client's calls are grouped. A call runs when it is made, like `fetch` (a call never awaited still runs;
+  a transaction too), and `avLazy(() => call)`, exported beside `avClient`, makes one only when it is first awaited. The
+  calls made in one tick go out as one `POST /_all` Operation Set,
+  split at `limits.maxAll`, each resolving or throwing on its own as its streamed (NDJSON) or plain JSON answer arrives; a
+  call made alone keeps its own route. A call with `headers` or a `requestId`, a transaction, and any call made with
+  `grouping: false` (per call, or `new AvClient({ grouping: false })`) is sent alone. A server without `/_all` gets the calls
+  again one by one. A call's `signal` aborts that call only, and is never sent if it aborts first. `avClient.all({ … })`
+  awaits an object of calls: strict by default, or `{ settle: true }` for one settled entry per key, with a `signal` that
+  aborts its calls. `all` joins the client's reserved member names: a Resource named `all` is reached as `allModel`.
+
+  A read the ClientContract marks `cache` (a `cache({ for, maxAge })` stage) is sent as
+  `GET /_resources/<R>/find/<variant>?q=<args>&v=<hash>`, alone and never grouped, with only the caller's own headers: `q`
+  is the arguments' canonical JSON, percent-encoded or deflate-raw and base64url when shorter (plain where there is no
+  `CompressionStream`), and a URL longer than 4096 characters is POSTed instead. A client with a cached read carries two
+  more runtime modules, `runtime/cached-read.ts` and `runtime/canonical-json.ts` (core's writer, copied).
+
+- Updated dependencies [6197c08]
+- Updated dependencies [e0e89c1]
+- Updated dependencies [186bc29]
+- Updated dependencies [33b5f83]
+- Updated dependencies [6d8b589]
+- Updated dependencies [11ece49]
+- Updated dependencies [92fd093]
+- Updated dependencies [e5e98e6]
+- Updated dependencies [a05d970]
+  - @aventara/core@1.0.0-rc.11
+
+## 1.0.0-rc.10
+
+### Patch Changes
+
+- 7ee547b: A ClientContract whose `access` section states Aventara Access's `kiosk` verbs gives the generated client
+  `$access.switchUser`, `lock`, `setPin`, `enrollDevice` and `revokeDevice`, each a `POST` to Access's own route with its
+  arguments typed from the section's schema and its answer projected onto the result schema (`lock`, `setPin` and
+  `revokeDevice` resolve nothing). A section without them emits no member for them.
+- d7e7369: A ClientContract with the `access` section gives the generated client `$access`: `can(questions)` (one request to
+  `/_access/can`), and exactly the Aventara Access verbs the section states (`me` with `GET` and `cache: "no-store"`,
+  `signIn`, `signUp`, `signOut`, `resetPassword`), each result projected onto the section's schema. `AvAccessMe` is
+  `me`'s result type and `AvAccessError` what a non-2xx Access answer throws. A client without the section is emitted
+  byte for byte as before. A ClientContract whose Access URL is on another origin than the
+  entrypoint's is refused unless `framework.client.ts` lists that origin in the new `accessOrigins`.
+- 9d423f9: `avclient generate`'s reference step (a solution-style `tsconfig.json`) matches `${configDir}` entries of `files`,
+  `include` and `exclude`. `get-tsconfig` 4.10.0 makes them absolute and its file matcher joined them under the config's
+  directory again, so a referenced project including the client through `${configDir}` was passed over.
+- 04bb39a: `engines.node` is now `^22.23.4 || >=24.22.1`, the Node security releases of 2026-10-20 (CVE-2026-105481,
+  CVE-2026-105482, CVE-2026-105483, CVE-2026-106069, CVE-2026-106072, CVE-2026-106073, CVE-2026-106074,
+  CVE-2026-111497). The bins refuse an older Node in one sentence naming that range.
+- 88263a1: A value projected onto an `access` verb's result schema is refused with the projector's own `TypeError` when the schema
+  is outside the forms a Client Contract states (a free-form object or list, a tuple read past its length), whatever the
+  value, an empty one included. A Client Contract that passed its structure check never holds such a schema.
+- Updated dependencies [587dd01]
+- Updated dependencies [d7e7369]
+- Updated dependencies [7ee547b]
+- Updated dependencies [f52c499]
+- Updated dependencies [2907484]
+- Updated dependencies [a6bbdf0]
+- Updated dependencies [3e26549]
+- Updated dependencies [a6bbdf0]
+- Updated dependencies [6f3f6f6]
+- Updated dependencies [04bb39a]
+- Updated dependencies [3fb3333]
+- Updated dependencies [827ccb6]
+- Updated dependencies [7f5abc3]
+- Updated dependencies [88263a1]
+- Updated dependencies [10341d5]
+- Updated dependencies [8129844]
+- Updated dependencies [88263a1]
+- Updated dependencies [3020b5c]
+- Updated dependencies [88263a1]
+- Updated dependencies [88263a1]
+  - @aventara/core@1.0.0-rc.10
+
+## 1.0.0-rc.9
+
+### Patch Changes
+
+- 99278e4: `aventara-build` reads a Next.js project's files from `src/aventara/` and, with `--client`, writes its browser client.
+
+  - A project whose `package.json` depends on `@aventara/next` keeps its configuration and adapter in
+    `src/aventara/config.ts` and `src/aventara/adapter.ts`; the build runs them there, and a configuration that imports no
+    Resource tree has its generated files in `src/aventara/generated/`. Every other project keeps
+    `src/aventara.config.ts` and `src/aventara.adapter.ts`, unchanged. A missing file is named with where the project's
+    host keeps it, and a project depending on both `@aventara/nest` and `@aventara/next` is refused in one sentence.
+  - `aventara-build --client` also writes the browser client from the ClientContract it has just compiled, with no
+    running server: `src/aventara/client.ts` and the client's modules under `src/aventara/generated/`, the same modules
+    `avclient generate` writes for that ClientContract except that the entrypoint is the app's own `api` on the page's
+    origin (`/api`) and the regenerate instructions. Its imports are spelled as the project's `tsconfig.json` says, and nothing it writes imports
+    `@aventara/client`.
+  - `src/aventara/client.ts` exports `avClient` and `avHydrate`, and re-exports every name `avclient generate`'s
+    `AvClient.ts` exports besides its default (`AvClient`, the Resource types, the enums, `AvDecimal`, the error
+    classes), so `import { AvDecimal } from "@/aventara/client"` works. The generated files and the contract-mismatch
+    error say to regenerate with `aventara-build --client` (the project's `aventara:prepare` script). `avClient` calls the API from the browser; a call made
+    on the server (a Client Component rendering there) rejects with one sentence pointing to `@/aventara/server` and
+    `@/aventara/universal`, and sends nothing. `avHydrate` revives data `avDehydrate` sends from the server: tagged
+    dates, `bigint`s, byte arrays and decimals become `Date`, `bigint`, `Uint8Array` and the client's own `AvDecimal`,
+    for TanStack Query's `deserializeData` or an SWR `fallback`.
+  - `aventara-build --check --client` checks those files too: a missing or stale one, or one an earlier ClientContract's
+    client left, exits 1 naming it. `--client` is refused in a NestJS project, whose frontends keep using
+    `avclient generate`, which is unchanged.
+  - `@aventara/client` gains an `@aventara/client/internal` entry, which `@aventara/build` reads the generator through.
+    It is not public API.
+
+- Updated dependencies [205a379]
+- Updated dependencies [a0bb05e]
+- Updated dependencies [86ab319]
+- Updated dependencies [fdf52e6]
+  - @aventara/core@1.0.0-rc.9
+
+## 1.0.0-rc.8
+
+1.0.0-rc.5, rc.6 and rc.7 were tagged but never published; 1.0.0-rc.8 contains everything listed under them and the changes below.
+
+### Patch Changes
+
+- A generated client's results read as their value types in an editor: `body: string | null`, `published: boolean`,
+  `publishedAt: Date | null`, where a nullable, enum or `boolean` field was shown as `AvScalarValueType<…>` with the
+  client's Contract as its argument, and a result as `ProjectedFields<…>`. Run `avclient generate` again to pick it up.
+  What the client accepts and returns is unchanged.
+- Updated dependencies [1c8e4ee]
+  - @aventara/core@1.0.0-rc.8
+
+## 1.0.0-rc.7
+
+1.0.0-rc.5 and 1.0.0-rc.6 were tagged but never published; 1.0.0-rc.7 contains everything listed under them and the changes below.
+
+### Patch Changes
+
+- Updated dependencies [f917c1c]
+  - @aventara/core@1.0.0-rc.7
+
+## 1.0.0-rc.6
+
+1.0.0-rc.5 was tagged but never published. 1.0.0-rc.6 contains everything listed under 1.0.0-rc.5 and the fix below.
+
+### Patch Changes
+
+- Updated dependencies [1cf72e0]
+  - @aventara/core@1.0.0-rc.6
+
+## 1.0.0-rc.5
+
+### Patch Changes
+
+- Updated dependencies [4795ff1]
+- Updated dependencies [9e178ca]
+  - @aventara/core@1.0.0-rc.5
+
+## 1.0.0-rc.4
+
+### Patch Changes
+
+- Updated dependencies [e3d03a7]
+- Updated dependencies [d10639a]
+- Updated dependencies [f67e68c]
+- Updated dependencies [708556c]
+- Updated dependencies [3a0dfca]
+- Updated dependencies [99169d2]
+- Updated dependencies [0fd2608]
+- Updated dependencies [154e440]
+- Updated dependencies [2fcffdb]
+  - @aventara/core@1.0.0-rc.4
+
+## 1.0.0-rc.3
+
+### Patch Changes
+
+- Updated dependencies [b38034d]
+- Updated dependencies [b38034d]
+- Updated dependencies [b38034d]
+- Updated dependencies [b38034d]
+- Updated dependencies [b38034d]
+- Updated dependencies [b38034d]
+  - @aventara/core@1.0.0-rc.3
+
+## 1.0.0-rc.2
+
+### Patch Changes
+
+- The optional `typescript` peer range is `>=5.7.0` (it was `>=5.5.0`), the lowest TypeScript Aventara's types
+  compile under. `avclient generate` type-checks the client with TypeScript 5.7 or later; under an older one it parses
+  the output with Node's TypeScript parser (`checked: syntax`) and says so in one warning, as it did below 5.5.
+- A generated client sends an `undefined` array element (or a hole) as `null`, as `JSON.stringify` writes it, and its
+  `json` codec leaves out a key holding `undefined` and writes such an element as `null`. A `json` value
+  `{ a: undefined, b: [undefined] }` is sent as `{"b":[null]}`, the value the server stores when an in-process caller
+  passes it. In rc.1 the client refused the array element with a `TypeError` before sending. Regenerate the client.
+- A generated client's `json` values admit a key holding `undefined` in their type, as core's `AvJsonValue` now does,
+  so an object with optional properties can be passed where a `json` value is taken; the key is not sent. In rc.1 it
+  was a compile error. Regenerate the client.
+- A generated client refuses at compile time a filter `mode` or `path` that qualifies no operator: one alone, or one
+  whose only neighbour is a `not` holding operators (`{ mode: "insensitive", not: { contains: "x" } }`). Write it
+  inside the `not`. The server refuses the same filters (`A2004`, `V1001`). Regenerate the client.
+- A generated client types a filter's `mode` by the field: `"default"` always, and `"sensitive"` or `"insensitive"`
+  only where the ClientContract's `filterModes` lists them; any other mode is a compile error. On a `json` field an
+  operator object that names `path` takes the modes `pathFilterModes` lists instead, so on Postgres
+  `where: { meta: { stringContains: "x", mode: "insensitive" } }` is a compile error and
+  `where: { meta: { path: ["label"], stringContains: "x", mode: "insensitive" } }` compiles. `isEmpty` is typed as a boolean, `path` as an array of strings and a `json` field's `string*`
+  operand as a string. The server refuses the same values (`A2004`), so the client adds no runtime check of its own.
+  Regenerate the client: the Contract hash changes.
+- The generated client refuses an `undefined` value in a filter before anything is sent. JSON drops `undefined`, so
+  `avClient.Post.update.many({ where: { id: undefined }, data })` reached the server as `where: {}` and updated every
+  row; the same went for `find`, `count`, `delete` and a transaction step. Now an `undefined` anywhere inside a
+  `where` (`AND`, `OR`, `NOT`, relation filters, operator objects such as `{ equals: undefined }` or
+  `{ isEmpty: undefined }`, `in` lists), a `cursor`, a unique selector, the `where` or `cursor` of a relation in
+  `select` or `include`, or a nested write's selectors (`$connect`, `$disconnect`, `$set`, `$delete`, the `where` of
+  `$update`, `$upsert` and `$connectOrCreate`) throws `AvValidationError` (`A2004`) with a `V1001` issue at the path
+  the server uses (`["arguments", "where", "id"]`, or `["operations", 0, "args", "where", "id"]` with the step's
+  `operation` for a transaction), and no request is made. A `where`, `cursor`, `limit` or `offset` that is itself
+  `undefined` is refused the same way, with the server's code (`V1001`; `V1007` for a unique selector, `V1009` for a
+  cursor), at the top level, in a relation under `select` or `include`, and in a nested write's `where`. Leave the
+  key out to mean no filter. Write data is unchanged: an `undefined` field there is not sent. Regenerate the client
+  to get the check.
+- `avclient generate` in a directory with no config names the extensions it looks for as the docs list them:
+  `no framework.client.ts, .mts, .cts, .js, .mjs or .cjs in <directory>; …`. In rc.1 it read
+  `no framework.client.{js,ts,mjs,cjs,mts,cts} in <directory>`. `avclient --help` and `avclient generate --help` list
+  them in the same order: `framework.client.ts (or .mts, .cts, .js, .mjs, .cjs)`. Which files are read is unchanged.
+- Updated dependencies [9366e16]
+- Updated dependencies [9366e16]
+- Updated dependencies [9366e16]
+- Updated dependencies [9366e16]
+  - @aventara/core@1.0.0-rc.2
+
 ## 1.0.0-rc.1
 
 ### Patch Changes

package/README.md

@@ -96,7 +96,7 @@ A failed run leaves the previous output exactly as it was. The whole tree is wri
 `generateAt`, validated there as one program, and only then moved into place. A run killed part-way is repaired by the
 next run that writes, before it writes anything. A first run that fails removes the directories it created.
 
-The validate step is a real type check when your project has the optional peer `typescript` (5.5 to 6). It is resolved
+The validate step is a real type check when your project has the optional peer `typescript` (5.7 to 6). It is resolved
 from your project, so `npx @aventara/client@rc init` type-checks too, under a consumer's strictest plausible settings
 and with nothing outside the tree resolvable. Without it, or under TypeScript 7 (which has no classic compiler API to
 check with), the check falls back to a parse with Node's own TypeScript parser and says so in one warning. It is never
@@ -125,20 +125,112 @@ const maybe = await avClient.User.find.first({ where }); // User | null — a mi
   ClientContract (tests, SSR), and `fetch` is for a custom fetch.
 - The client has one property per Resource, one per family under it, and one per advertised variant. Only what the
   ClientContract advertises exists, in the type and at runtime. A Resource named like one of the client's own members
-  (`tx`, `transaction`, `then`, `constructor`, `Object.prototype`'s names) is reached as `<name>Model`, with one
+  (`all`, `tx`, `transaction`, `then`, `constructor`, `Object.prototype`'s names) is reached as `<name>Model`, with one
   warning; its wire name is unchanged.
 - A call resolves to the data: the record, a list, a count. A first-style miss (`A1001`) is `null`. Every other
   outcome throws the `AvError` subclass of its code (`AvNotFoundError` for a strict-unique miss,
   `AvContractMismatchError` for a stale client, …), or `AvTransportError` when no framework answer arrived.
 - Values are application values: `bigint`, `Date`, `Uint8Array`, the client's `AvDecimal`, JSON values as they are.
   Arguments are encoded and results revived for you; a value that cannot be read throws `AvTransportError`.
-- Per-call options (`AvCallOptions`) are never sent in the body: `signal` (an abort rejects with what `fetch` rejected
-  with), `headers` (the framework's own identity headers are refused), and `requestId`, sent as `Aventara-Request-Id`
-  and winning over that header in `headers`.
+- Per-call options (`AvCallOptions`) are never sent in the body: `signal` (aborts this call only, see below),
+  `headers` (the framework's own identity headers are refused), `requestId`, sent as `Aventara-Request-Id` and winning
+  over that header in `headers`, and `grouping: false` (see below).
 - The named types (`User`, `UserWhere`, `UserUniqueWhere`, `UserOrderBy`, `UserCreateData`, `UserUpdateData`,
   `UserSelect`, `UserInclude`) are named exports, each only when the operation it reads is advertised. A name that would
   clash walks the rename ladder (`User` beside a Resource `UserWhere` becomes `UserModel`), one warning each.
 
+## Calls run when made, together
+
+A call runs when you make it, as `fetch` does: it checks and encodes its arguments and is queued at once, and a call
+you never await still runs. A transaction too. Awaiting a call again does not send it again.
+
+The calls made in one tick go out as one request, `POST /_all` (an Operation Set):
+
+```ts
+const [campaigns, unread, me] = await Promise.all([
+	avClient.Campaign.find.many({ where: { ownerId } }),
+	avClient.Message.find.count({ where: { toId: ownerId, readAt: null } }),
+	avClient.User.find.unique({ where: { id: ownerId } }),
+]); // one request
+```
+
+- Each call runs on the server exactly as it would alone (validation, exposure, policy, limits, pipelines), concurrently
+  with the others and not atomically: a write that ran stays written whatever the others answered. Each call resolves
+  or throws on its own, as soon as its own answer arrives (the client asks for a streamed answer,
+  `Accept: application/x-ndjson`, where the runtime can read one, and reads a plain JSON answer otherwise, as on React
+  Native).
+- Together means made before the microtask queue settles: one `Promise.all`, several async functions run together,
+  `avClient.all`. No timer is involved, and a call made on its own goes to its own route as before.
+- A group larger than the ClientContract's `limits.maxAll` (or `limits.maxRequestBytes`) is split into several
+  requests.
+- Sent alone, never grouped: a call with `headers` or a `requestId` (they belong to one request), a call made with
+  `{ grouping: false }`, every call of a client made with `new AvClient({ grouping: false })`, and a transaction.
+- A server without `/_all` (it answers `A2002`) gets the calls again one by one, and that client stops grouping.
+
+### Aborting a call
+
+A call's `signal` aborts that call and nothing else. Aborted before it is sent, it is never sent. Aborted while its
+group is in flight, it rejects at once with the signal's reason (an `AbortError`), and the others in the request go on;
+the request itself is aborted once no call in it still waits for an answer. Sent alone, the abort aborts its request,
+as before. The server still finishes an operation it has already started: there is no way to cancel a database query
+once it runs.
+
+Nothing is aborted for you: there is no default timeout and no abort on navigation. Pass the signal your data library
+gives you (React Query and SWR pass one per query), or your own.
+
+### `avClient.all`
+
+```ts
+const { campaigns, unread } = await avClient.all({
+	campaigns: avClient.Campaign.find.many({ where: { ownerId } }),
+	unread: avClient.Message.find.count({ where: { toId: ownerId, readAt: null } }),
+});
+```
+
+`all` takes an object of calls and resolves one value per key, typed per key. It is strict: the first failure rejects
+it with that call's error and aborts its other calls. That is fail-fast, not atomic: a write that already ran stays
+written. With `{ settle: true }` every key settles on its own, as `{ status: "fulfilled", value }` or
+`{ status: "rejected", reason }`, and `all` never rejects for one key:
+
+```ts
+const panels = await avClient.all({ campaigns, unread }, { settle: true });
+if (panels.unread.status === "rejected") { /* show that panel's error */ }
+```
+
+`{ signal }` aborts every call of that `all`; a call inside it is aborted by its own signal or by the `all`'s. Calls
+grouped beside it but not in it are never touched. The keys are yours and are never sent.
+
+### `avLazy`: describe now, run later
+
+```ts
+import avClient, { avLazy } from "./api/AvClient";
+
+const posts = avLazy(() => avClient.Post.find.many({ where: { published: true } })); // nothing sent yet
+const list = await posts; // sent now (once, in a page)
+```
+
+`avLazy(() => call)` makes the call on its first `then`, `catch` or `finally`, and settles as that call does. In a
+page it makes the call once and keeps the answer. On a server, where one module serves every request, it keeps nothing:
+each await makes the call again. `avClient.all` accepts it as it accepts a call (its `signal` aborts that call too).
+
+## Cached reads are GETs
+
+A read the deployment caches (a `cache({ for, maxAge })` stage on it, which its ClientContract marks) is sent as a GET,
+so the browser, or a CDN when the stage allows one, may keep its answer:
+
+```
+GET <entrypoint>/_resources/Product/find/many?q=<arguments>&v=<ClientContract hash>
+```
+
+- `q` is the arguments' canonical JSON (keys sorted, so the same read is the same URL), percent-encoded, or that JSON
+  deflate-raw'd and base64url'd when that is shorter. Where the runtime has no `CompressionStream` the plain form is sent.
+- A cached read is never grouped into `/_all`: each keeps its own URL, its own cache entry. Your `headers` and
+  `requestId` go with the GET; it sends no header of its own, so a cross-origin read needs no CORS preflight. Its
+  `signal` aborts it as any call's does.
+- A URL longer than 4096 characters (the whole URL) is POSTed to the same route instead, uncached, as are arguments
+  canonical JSON cannot write.
+- The URL holds the arguments, so it lands in server and proxy logs and in browser history.
+
 ## Transactions
 
 When the ClientContract advertises `interactive` transactions, the client has `avClient.tx` and `avClient.transaction`
@@ -170,7 +262,7 @@ Its source field must have the same type as where it is written:
 
 A mismatch is a type error, and the server refuses it before anything runs (`A2007`/`V1011`).
 
-`avClient.tx.…` builds a handle and sends nothing. `avClient.transaction([...])` sends the plan once and resolves one
+`avClient.tx.…` builds a handle and sends nothing. `avClient.transaction([...])` sends the plan once, when made, and resolves one
 result per handle, typed, in order; a failing step throws its error with `cause.operation` naming the step. `$ref` binds
 to the handle's position in the list it runs with. Two mistakes are refused before anything is sent, as core refuses
 them in process: one handle twice (`AvValidationError`, `A2004`/`V1001`), and a `$ref` to a handle not in the list
@@ -192,6 +284,42 @@ The platform `fetch` is read when a call is made, not when the client is importe
 where there is no `fetch`; a call does, saying why. An entrypoint carrying credentials is refused when the config is
 resolved.
 
+## Aventara Access: `$access`
+
+When the deployment's ClientContract has the `access` section (the framework is configured with `access`), the client
+has `$access`:
+
+```ts
+const answers = await avClient.$access.can([
+	{ resource: "Order", action: "update", where: { id: 41 } },
+	{ resource: "Refund", action: "create" },
+]); // [boolean, boolean], one request to /_access/can
+await avClient.$access.signIn({ email, password }); // Access's own route
+const me = await avClient.$access.me(); // AvAccessMe | null
+```
+
+`can` is always there; `me`, `signIn`, `signUp`, `signOut` and `resetPassword`, and on Access's `kiosk` profile
+`switchUser`, `lock`, `setPin`, `enrollDevice` and `revokeDevice`, exactly when the section states them.
+Each verb calls Access's own route (`me` with `GET` and `cache: "no-store"`), and resolves its result projected onto the
+section's schema: members the schema does not declare are dropped. `AvAccessMe` is `me`'s result type. A non-2xx answer
+from Access throws `AvAccessError` (`status`, `code`, `message`); `can`'s refusals are `AvError`s, as every call's.
+Without the section there is no `$access`.
+
+Where Access lives decides where a sign-in's credentials go, so the generator emits an absolute Access URL only when it
+is on the entrypoint's origin, or on an origin `framework.client.ts` lists:
+
+```ts
+export default defineClientConfig({
+	entrypoint: env("AVENTARA_API_URL"),
+	generateAt: "./src/api",
+	accessOrigins: ["https://auth.example.com"],
+});
+```
+
+A verb on another origin carries cookies only when your `fetch` sends them: pass one that does
+(`new AvClient({ fetch: (url, init) => fetch(url, { ...init, credentials: "include" }) })`), and have Access allow
+that origin with credentials (CORS).
+
 ## Up to date
 
 A rerun asks the deployment conditionally (`If-None-Match`, the ClientContract hash of the output it finds), but only
@@ -208,7 +336,7 @@ repository uses. The `.d.ts` files are core's copied declarations under `generat
 and the named types in `generated/types.d.ts`; the `.ts` sources carry their own types.
 
 - `AvClient.ts`: the entry point you import: `avClient` (the default export), `AvClient`, `AvClientOptions`,
-  `AvCallOptions`, `AvFetch`, `AvOperation`, the named Resource types, the enums, `AvDecimal`, `AvError` and its
+  `AvCallOptions`, `AvFetch`, `AvOperation`, `avLazy`, the named Resource types, the enums, `AvDecimal`, `AvError` and its
   subclasses, `AvTransportError`, and the types `AvCause`, `AvValidationIssue`, `AvOperationCode` and `AvValidationCode`.
 - `generated/client.ts`: the typed client: the class `AvClient`, `AvClientOptions`, `AvCallOptions` and the ready
   instance `avClient`. Every argument and result type is an instantiation of core's own derivation.
@@ -219,6 +347,10 @@ and the named types in `generated/types.d.ts`; the `.ts` sources carry their own
 - `generated/enums.ts`: each enum as a union type and a same-named `as const` object.
 - `generated/metadata.ts`: the ClientContract hash and protocol version the client is bound to, and the entrypoint it
   was generated from, which is its default deployment (an entrypoint carrying credentials is refused at resolution).
+- `generated/runtime/cached-read.ts`: a cached read's GET: its `q` (canonical JSON, plain or deflate-raw), its
+  `v`, and the POST past 4096 characters. Emitted only when the ClientContract caches a read.
+- `generated/runtime/canonical-json.ts`: `@aventara/core`'s canonical JSON writer, its compiled source copied as it is
+  (unchecked: `// @ts-nocheck`). Emitted only when the ClientContract caches a read.
 - `generated/runtime/codec.ts`: the nine scalars' wire codecs, and the request-body serializer.
 - `generated/runtime/decimal.ts`: the framework's `AvDecimal`, with a constructor, `toString` and `toJSON`.
 - `generated/runtime/descriptor.ts`: what the runtime reads of the contract: the result fields it revives and the
@@ -235,12 +367,16 @@ and the named types in `generated/types.d.ts`; the `.ts` sources carry their own
   carries a check.
 - `generated/runtime/fingerprint.ts`: the operation fingerprint (RFC 8785 canonical JSON, SHA-256, base64url),
   dependency-free and pinned to core's. Emitted only when transactions are `interactive`.
+- `generated/runtime/operation-set.ts`: the calls, queued when made, the grouping of the calls made together into
+  Operation Sets
+  (`POST /_all`), per-call abort, and `avClient.all`.
 - `generated/runtime/transaction.ts`: `avClient.tx`'s deferred handles and `avClient.transaction`'s plan assembly,
   refusals and one POST to `/_transactions`. Emitted only when transactions are `interactive`.
-- `generated/runtime/transport.ts`: one POST per operation with the identity headers, and the response read by the
-  protocol's rule. Arguments are encoded by value, results revived by the decode table, and the platform's own `fetch`
-  type is accepted. Its `execute` primitive is module-private: no public file re-exports it, and `AvClient`'s methods
-  wrap it.
+- `generated/runtime/transport.ts`: one POST per operation, or one `POST /_all` per Operation Set (its answer read
+  streamed or whole), with the identity headers, and the response read by the protocol's rule. Arguments are encoded
+  by value, results revived by the decode table, and the platform's own `fetch` type is accepted. Its primitives are
+  module-private: no public file re-exports them, and `AvClient`'s methods reach them through
+  `generated/runtime/operation-set.ts`.
 - `generated/types.d.ts`: the named Resource types, as a declaration file (`User`, `UserWhere`, `UserUniqueWhere`,
   `UserOrderBy`, `UserCreateData`, `UserUpdateData`, `UserSelect`, `UserInclude`), each only when its operation is
   advertised.

package/dist/cli/command.parser.d.ts

@@ -1,5 +1,5 @@
-export declare const USAGE = "avclient \u2014 generate a typed Aventara client from a deployed ClientContract.\n\nUsage:\n  avclient generate [--yes]   Read framework.client.ts (or .js, .mjs, .cjs, .mts,\n                              .cts) in the current directory, fetch\n                              <entrypoint>/_contract, and write AvClient.ts and\n                              generated/ into its generateAt directory, its imports\n                              spelled as the project's tsconfig.json says.\n  avclient init [options]     Set up this frontend: write framework.client.ts, the\n                              .env entry, the avclient:generate script and the\n                              @aventara/client devDependency; install; generate.\n      --entrypoint <url>      The server's entrypoint [http://localhost:3000/api].\n      --env-var <NAME>        Read it from this variable [AVENTARA_API_URL].\n      --no-env-var            Write it into framework.client.ts as a literal.\n      --generate-at <dir>     Where the client goes [./src/api].\n      --package-manager <npm|pnpm>   [the lockfile's, else the launching one, else npm]\n      --skip-install          Print the install instead of running it.\n      --skip-generate         Do not generate now.\n      -y, --yes               Accept every default, and replace differing content.\n  avclient --help             Print this and exit 0.\n  avclient <command> --help   Print that command's usage and exit 0.\n  avclient --version, -v      Print this generator's version and exit 0.\n\nOptions:\n  -y, --yes   Overwrite or remove content in AvClient.ts and generated/ that the\n              generator did not produce, without asking. Without it, such content\n              is listed and you are asked; where nobody can answer (stdin is not a\n              terminal, as in CI), the run is refused and nothing is touched.\n\nThe generator owns AvClient.ts and generated/ in generateAt, and nothing else\nthere: your own files beside them are never read, moved or removed. Generated\nfiles are replaced on every run; do not edit them.\n\nBefore framework.client.ts is evaluated, the .env cascade is read from the\ncurrent directory, highest precedence first: the process environment,\n.env.<mode>.local, .env.<mode>, .env.local, .env \u2014 where mode is NODE_ENV, or\n\"development\".\n";
-export declare const GENERATE_USAGE = "Usage: avclient generate [--yes]\n\nRead framework.client.ts (or .js, .mjs, .cjs, .mts, .cts) in the current directory,\nfetch <entrypoint>/_contract, and write AvClient.ts and generated/ into its\ngenerateAt directory, its imports spelled as the project's tsconfig.json says.\n\nOptions:\n  -y, --yes   Overwrite or remove content in AvClient.ts and generated/ that the\n              generator did not produce, without asking. Without it, such content\n              is listed and you are asked; where nobody can answer (stdin is not a\n              terminal, as in CI), the run is refused and nothing is touched.\n\nThe generator owns AvClient.ts and generated/ in generateAt, and nothing else\nthere: your own files beside them are never read, moved or removed.\n\nBefore the config is evaluated, the .env cascade is read from the current\ndirectory, highest precedence first: the process environment, .env.<mode>.local,\n.env.<mode>, .env.local, .env \u2014 where mode is NODE_ENV, or \"development\".\n";
+export declare const USAGE = "avclient \u2014 generate a typed Aventara client from a deployed ClientContract.\n\nUsage:\n  avclient generate [--yes]   Read framework.client.ts (or .mts, .cts, .js, .mjs,\n                              .cjs) in the current directory, fetch\n                              <entrypoint>/_contract, and write AvClient.ts and\n                              generated/ into its generateAt directory, its imports\n                              spelled as the project's tsconfig.json says.\n  avclient init [options]     Set up this frontend: write framework.client.ts, the\n                              .env entry, the avclient:generate script and the\n                              @aventara/client devDependency; install; generate.\n      --entrypoint <url>      The server's entrypoint [http://localhost:3000/api].\n      --env-var <NAME>        Read it from this variable [AVENTARA_API_URL].\n      --no-env-var            Write it into framework.client.ts as a literal.\n      --generate-at <dir>     Where the client goes [./src/api].\n      --package-manager <npm|pnpm>   [the lockfile's, else the launching one, else npm]\n      --skip-install          Print the install instead of running it.\n      --skip-generate         Do not generate now.\n      -y, --yes               Accept every default, and replace differing content.\n  avclient --help             Print this and exit 0.\n  avclient <command> --help   Print that command's usage and exit 0.\n  avclient --version, -v      Print this generator's version and exit 0.\n\nOptions:\n  -y, --yes   Overwrite or remove content in AvClient.ts and generated/ that the\n              generator did not produce, without asking. Without it, such content\n              is listed and you are asked; where nobody can answer (stdin is not a\n              terminal, as in CI), the run is refused and nothing is touched.\n\nThe generator owns AvClient.ts and generated/ in generateAt, and nothing else\nthere: your own files beside them are never read, moved or removed. Generated\nfiles are replaced on every run; do not edit them.\n\nBefore framework.client.ts is evaluated, the .env cascade is read from the\ncurrent directory, highest precedence first: the process environment,\n.env.<mode>.local, .env.<mode>, .env.local, .env \u2014 where mode is NODE_ENV, or\n\"development\".\n";
+export declare const GENERATE_USAGE = "Usage: avclient generate [--yes]\n\nRead framework.client.ts (or .mts, .cts, .js, .mjs, .cjs) in the current directory,\nfetch <entrypoint>/_contract, and write AvClient.ts and generated/ into its\ngenerateAt directory, its imports spelled as the project's tsconfig.json says.\n\nOptions:\n  -y, --yes   Overwrite or remove content in AvClient.ts and generated/ that the\n              generator did not produce, without asking. Without it, such content\n              is listed and you are asked; where nobody can answer (stdin is not a\n              terminal, as in CI), the run is refused and nothing is touched.\n\nThe generator owns AvClient.ts and generated/ in generateAt, and nothing else\nthere: your own files beside them are never read, moved or removed.\n\nBefore the config is evaluated, the .env cascade is read from the current\ndirectory, highest precedence first: the process environment, .env.<mode>.local,\n.env.<mode>, .env.local, .env \u2014 where mode is NODE_ENV, or \"development\".\n";
 export declare const INIT_USAGE = "Usage: avclient init [options]\n\nSet up this frontend: write framework.client.ts, the .env entry, the avclient:generate\nscript and the @aventara/client devDependency; install; generate.\n\nOptions:\n  --entrypoint <url>             The server's entrypoint [http://localhost:3000/api].\n  --env-var <NAME>               Read it from this variable [AVENTARA_API_URL].\n  --no-env-var                   Write it into framework.client.ts as a literal.\n  --generate-at <dir>            Where the client goes [./src/api].\n  --package-manager <npm|pnpm>   [the lockfile's, else the launching one, else npm]\n  --skip-install                 Print the install instead of running it.\n  --skip-generate                Do not generate now.\n  --verbose                      Show the install's output as it runs.\n  -y, --yes                      Accept every default, and replace differing content.\n\nOn a terminal every unanswered question is asked; anywhere else, pass its flag\nor --yes, or the run stops before writing anything.\n";
 export type ClientInitCommand = {
     readonly command: "init";
@@ -12,7 +12,7 @@ export type ClientInitCommand = {
     readonly verbose?: boolean;
 };
 /** What the command line asked for. */
-export type CliCommand = {
+type CliCommand = {
     readonly command: "help";
     readonly topic?: "generate" | "init";
 } | {
@@ -30,3 +30,4 @@ export declare class AvCliCommandError extends Error {
  *   `--help`/`-h` or `--version`/`-v`.
  */
 export declare function parseCliCommand(argv: readonly string[]): CliCommand;
+export {};

package/dist/cli/command.parser.js

@@ -2,8 +2,8 @@ import { CLIENT_CONFIG_FILE } from "../config/config.loader.js";
 export const USAGE = `avclient — generate a typed Aventara client from a deployed ClientContract.
 
 Usage:
-  avclient generate [--yes]   Read ${CLIENT_CONFIG_FILE} (or .js, .mjs, .cjs, .mts,
-                              .cts) in the current directory, fetch
+  avclient generate [--yes]   Read ${CLIENT_CONFIG_FILE} (or .mts, .cts, .js, .mjs,
+                              .cjs) in the current directory, fetch
                               <entrypoint>/_contract, and write AvClient.ts and
                               generated/ into its generateAt directory, its imports
                               spelled as the project's tsconfig.json says.
@@ -39,7 +39,7 @@ current directory, highest precedence first: the process environment,
 `;
 export const GENERATE_USAGE = `Usage: avclient generate [--yes]
 
-Read ${CLIENT_CONFIG_FILE} (or .js, .mjs, .cjs, .mts, .cts) in the current directory,
+Read ${CLIENT_CONFIG_FILE} (or .mts, .cts, .js, .mjs, .cjs) in the current directory,
 fetch <entrypoint>/_contract, and write AvClient.ts and generated/ into its
 generateAt directory, its imports spelled as the project's tsconfig.json says.
 

package/dist/cli/generation-failure.renderer.d.ts

@@ -1,6 +1,7 @@
-export interface GenerationFailureReport {
+interface GenerationFailureReport {
     readonly exitCode: number;
     /** What goes to stderr, newline-terminated: the warnings carried, then the sentence. */
     readonly text: string;
 }
 export declare function renderGenerationFailure(error: unknown): GenerationFailureReport;
+export {};

package/dist/cli/generation-success.renderer.d.ts

@@ -6,7 +6,7 @@ import type { ClientGenerated, ClientUpToDate, ForeignOutputContent } from "../g
  * them — renames, the degraded check, crash recovery — so the same run prints the
  * same lines.
  */
-export interface GenerationSuccessReport {
+interface GenerationSuccessReport {
     /** What goes to stdout, newline-terminated. */
     readonly stdout: string;
     /** What goes to stderr: one line per warning, or nothing. */
@@ -29,3 +29,4 @@ export declare const FOREIGN_CONTENT_QUESTION = "avclient: overwrite them and ge
  * are reported as a refused one's are.
  */
 export declare function renderForeignContentCancellation(found: ForeignOutputContent, asked: boolean): string;
+export {};

package/dist/cli/step.reporter.d.ts

@@ -1,7 +1,7 @@
 export type ProgressMode = "live" | "plain" | "off";
 /** `live` only on a terminal that is not CI and accepts control sequences. */
 export declare function progressModeOf(isTTY: boolean | undefined, env: Readonly<Record<string, string | undefined>>): Exclude<ProgressMode, "off">;
-export type StepReporterOptions = {
+type StepReporterOptions = {
     /** Where the lines go: the tool's stderr, so its stdout stays its result. */
     readonly write: (text: string) => void;
     readonly mode: ProgressMode;
@@ -29,3 +29,4 @@ export type StepReporter = {
 /** `12.4s`, or `1m 02s` from a minute. */
 export declare function formatElapsed(milliseconds: number): string;
 export declare function createStepReporter(options: StepReporterOptions): StepReporter;
+export {};

package/dist/cli/terminal.prompter.d.ts

@@ -1,6 +1,7 @@
-export type TerminalPrompter = {
+type TerminalPrompter = {
     readonly ask: (prompt: string) => Promise<string>;
     readonly confirm: (question: string) => Promise<boolean>;
     readonly close: () => void;
 };
 export declare function createTerminalPrompter(): TerminalPrompter;
+export {};

package/dist/config/client-config.interface.d.ts

@@ -28,6 +28,13 @@ export interface AvClientConfigInput {
      * `generateAt` is used.
      */
     readonly tsconfigFile?: string;
+    /**
+     * The origins other than the entrypoint's that `$access` may send a
+     * sign-in to (`"https://auth.example.com"`): where the deployment mounted
+     * Aventara Access, when that is another origin. Absent, the generator
+     * refuses a ClientContract whose Access URL is on another origin.
+     */
+    readonly accessOrigins?: readonly AvClientConfigValue[];
 }
 /** A filesystem path known to be absolute. */
 export type AbsolutePath = string & {
@@ -44,11 +51,21 @@ export interface ClientEntrypoint {
     readonly deployment: URL;
     readonly path: EntrypointPath;
 }
+/** An entrypoint on the page's own origin: its mount path alone, such as `/api`. */
+export interface SameOriginEntrypoint {
+    /** Absent: the deployment is whichever origin served the page. */
+    readonly deployment?: undefined;
+    readonly path: EntrypointPath;
+}
+/** The entrypoint a generated client embeds as its default: a deployment's, or the page's own origin. */
+export type EmittedEntrypoint = ClientEntrypoint | SameOriginEntrypoint;
 export interface ResolvedClientConfig {
     readonly entrypoint: ClientEntrypoint;
     /** `generateAt`, made absolute. */
     readonly generateAt: AbsolutePath;
     /** `tsconfigFile`, made absolute; absent when the config names none. */
     readonly tsconfigFile?: AbsolutePath;
+    /** `accessOrigins`, each an http(s) origin (`scheme://host[:port]`); empty when the config names none. */
+    readonly accessOrigins: readonly string[];
     readonly mode: string;
 }

package/dist/config/config.loader.d.ts

@@ -1,11 +1,15 @@
 import type { AvClientConfigInput } from "./client-config.interface.js";
 /** Prisma's `SUPPORTED_EXTENSIONS`, in its order. */
 export declare const CLIENT_CONFIG_FILE_EXTENSIONS: readonly [".js", ".ts", ".mjs", ".cjs", ".mts", ".cts"];
-/** The config's name, before its extension. */
-export declare const CLIENT_CONFIG_BASENAME = "framework.client";
+/**
+ * The same extensions as the docs and `avclient --help` list them, TypeScript
+ * first: the order a sentence to the developer names them in. Lookup keeps
+ * {@link CLIENT_CONFIG_FILE_EXTENSIONS}' order, Prisma's.
+ */
+export declare const CLIENT_CONFIG_FILE_EXTENSIONS_AS_LISTED: readonly [".ts", ".mts", ".cts", ".js", ".mjs", ".cjs"];
 /** The config file `avclient init` writes when the project has none. */
 export declare const CLIENT_CONFIG_FILE = "framework.client.ts";
-export interface LoadedClientConfig {
+interface LoadedClientConfig {
     /** The config file's absolute path; `generateAt` resolves against its directory. */
     readonly file: string;
     readonly config: AvClientConfigInput;
@@ -30,3 +34,4 @@ export declare function findClientConfigFile(directory: string): string | undefi
  *   or the file does not evaluate, or does not default-export a client config.
  */
 export declare function loadClientConfigFile(directory: string): Promise<LoadedClientConfig>;
+export {};