@aventara/core 0.1.0-pilot.0 → 0.1.0-pilot.2

package/dist/runtime/execution-options.d.ts

@@ -1,11 +1,11 @@
 /**
  * The caller's say over an in-process request it does not write by hand: the
  * second argument of every `framework.application.*` / `framework.client.*` call
- * and of `framework.transaction` (Q10 = B, Q14; closes F-833).
+ * and of `framework.transaction`.
  *
- * Not "transport options": an in-process call has no transport. A deferred
- * handle (`framework.appTx.*` / `framework.clientTx.*`) takes none — a handle is
- * not a request, and the id belongs to the run that executes it.
+ * Not "transport options": an in-process call has no transport. A deferred handle
+ * (`framework.appTx.*` / `framework.clientTx.*`) takes none — a handle is not a
+ * request, and the id belongs to the run that executes it.
  */
 export type ExecutionOptions = {
     /**

package/dist/runtime/field-behavior.d.ts

@@ -8,18 +8,15 @@ import type { PipelineContext } from "./pipeline.js";
  * What a write-stage compute callback is told about the field it is computing.
  *
  * `R` is the Resource the behavior is bound to and `Cfg` the authored
- * configuration literal, so `resource` is the literal Resource name and
- * `field` — like every other field-key position in the framework — is
- * {@link EffectiveFieldKey}: what the adapter discovered plus what the
- * configuration added.
+ * configuration literal, so `resource` is the literal Resource name and `field` —
+ * like every other field-key position in the framework — is {@link
+ * EffectiveFieldKey}: what the adapter discovered plus what the configuration
+ * added.
  *
- * `data` is keyed on the same set and stays `unknown`-valued. Scalar-to-TS
- * *value* typing is `OperationResultFor`'s job in Phase 9 (F-701) and is out
- * of scope here by the plan's hard constraints; what this type buys a callback
- * author is the key set, not the value.
+ * `data` is keyed on the same set and stays `unknown`-valued.
  *
  * Under the default `Cfg` the key set degenerates to `string` and this is
- * byte-for-byte the shape it was before `Cfg` existed (B4).
+ * byte-for-byte the shape it was before `Cfg` existed.
  */
 type ComputedWriteContext<M extends AdapterModel, Cfg, R extends FrameworkResourceKey<M>> = {
     readonly scope: RequestOrigin;

package/dist/runtime/framework-error.js

@@ -1,7 +1,3 @@
-/**
- * Stable typed error used by server-side pipelines, behaviors and Adapters to
- * deliberately surface one framework error outcome.
- */
 export class FrameworkError extends Error {
     code;
     cause;

package/dist/runtime/mutation-planner.d.ts

@@ -4,12 +4,11 @@ import type { Contract, CoreContract } from "../contracts/contract.js";
 import type { OperationExecutionRequest } from "./operation-request.js";
 import type { PipelineContext } from "./pipeline.js";
 /**
- * The two Contracts a write reads (F-829, the write-side twin of D2/F-824). The
- * **Core** Contract decides what the Adapter is asked to store; the **active**
- * Contract adds the fields its scope declared under `application.fields` /
- * `client.fields`, which Core does not carry. Such a field is VIRTUAL by
- * construction (`contract.compiler.ts`), so its behaviours run and its value is
- * stripped before the Adapter call — never sent.
+ * The two Contracts a write reads. The **Core** Contract decides what the Adapter
+ * is asked to store; the **active** Contract adds the fields its scope declared
+ * under `application.fields` / `client.fields`, which Core does not carry. Such a
+ * field is VIRTUAL by construction (`contract.compiler.ts`), so its behaviours run
+ * and its value is stripped before the Adapter call — never sent.
  */
 export type WriteContracts = {
     readonly core: CoreContract;

package/dist/runtime/mutation-planner.js

@@ -2,13 +2,6 @@ import { lookupField, lookupResource } from "../contracts/contract-lookup.js";
 import { FrameworkError } from "./framework-error.js";
 import { INTERNAL_FAILURE_MESSAGE } from "./operation-response.js";
 import { normalizeScalarFieldValue } from "./scalar-runtime.js";
-/**
- * The scalar field `fieldName` names on `resourceName` for a write: Core's own
- * field when Core has one — a field the scope hides or narrows is still stored,
- * and its behaviours still run — else the scalar the active scope added. Its
- * values are normalized against Core's registries either way: a scope adds
- * fields, never a scalar or an enum.
- */
 function writeScalarField(contracts, resourceName, fieldName) {
     const field = lookupField(lookupResource(contracts.core, resourceName), fieldName) ??
         lookupField(lookupResource(contracts.active, resourceName), fieldName);
@@ -16,15 +9,6 @@ function writeScalarField(contracts, resourceName, fieldName) {
         ? field
         : undefined;
 }
-/**
- * The sole grammar for relation-mutation record operands. Every write pass
- * maps these sites with its own record leaf, leaving identifier-only
- * directives untouched. The identifier operands this table deliberately leaves
- * empty are described by `RELATION_MUTATION_SELECTOR_SITES` in
- * `transactions/operation-arguments-encoder.ts`, the only pass that has to
- * encode them; both tables are keyed by `RelationMutationDirective`, so a new
- * directive fails to compile in both places.
- */
 export const RELATION_MUTATION_RECORD_SITES = {
     $create: [{ key: undefined, stage: "create" }],
     $connect: [],
@@ -38,11 +22,6 @@ export const RELATION_MUTATION_RECORD_SITES = {
         { key: "update", stage: "update" },
     ],
 };
-/**
- * Narrows a caller-supplied own key to the shared directive vocabulary. Own
- * membership, not an assertion: `Object.prototype` members resolve through the
- * prototype chain and would otherwise reach a site loop with a non-iterable.
- */
 export function isRelationMutationDirective(key) {
     return Object.hasOwn(RELATION_MUTATION_RECORD_SITES, key);
 }
@@ -144,7 +123,6 @@ async function mapRelationMutationRecords(relation, value, leaf) {
     }
     return normalized;
 }
-/** Apply effective computed create/update field behavior to post-pipe logical args. */
 export async function applyWriteFieldBehaviors(contracts, behaviors, request, args, contextFactory) {
     if (behaviors === undefined || !isRecord(args)) {
         return args;
@@ -190,7 +168,6 @@ async function stripVirtualRecord(contracts, resourceName, data) {
     }
     return persisted;
 }
-/** Strip VIRTUAL scalar input only at the persistence boundary. */
 export async function stripVirtualMutationInput(contracts, request, args) {
     if (!isRecord(args)) {
         return args;

package/dist/runtime/operation-response.d.ts

@@ -1,5 +1,5 @@
 import type { ValidationIssue } from "../operations/validation-code.js";
-export declare const OPERATION_CODES: readonly ["A1000", "A1001", "A1002", "A1003", "A1004", "A1005", "A1006", "A1007", "A1008", "A1009", "A2000", "A2001", "A2002", "A2003", "A2004", "A2005", "A2006", "A2007", "A2008", "A2009", "A2010", "A2011", "A2012", "A2013", "A2014", "A3000", "A3001", "A3002", "A3003", "A4000", "A4001", "A4002"];
+export declare const OPERATION_CODES: readonly ["A1000", "A1001", "A1002", "A1003", "A1004", "A1005", "A1006", "A1007", "A1008", "A1009", "A2000", "A2001", "A2002", "A2003", "A2004", "A2005", "A2006", "A2007", "A2008", "A2009", "A2010", "A2011", "A2012", "A2013", "A2014", "A3000", "A3001", "A3002", "A3003", "A3004", "A4000", "A4001", "A4002"];
 export type OperationCode = (typeof OPERATION_CODES)[number];
 export type OperationSuccessCode = Extract<OperationCode, `A1${string}`>;
 export type OperationErrorCode = Exclude<OperationCode, OperationSuccessCode>;

package/dist/runtime/operation-response.js

@@ -28,37 +28,21 @@ export const OPERATION_CODES = [
     "A3001",
     "A3002",
     "A3003",
+    "A3004",
     "A4000",
     "A4001",
     "A4002",
 ];
-/**
- * Builds the success-with-data arm. The only sanctioned way to construct
- * one: a runtime-computed `code` (e.g. from a table-driven outcome mapper)
- * still yields a well-typed {@link OperationSuccessResponse}.
- */
 export function operationSuccess(data, code) {
     return { data, code, cause: null };
 }
-/** Builds the no-match success arm (A1001). */
 export function operationNoMatch() {
     return { data: null, code: "A1001", cause: null };
 }
-/**
- * Builds the failure arm. The only sanctioned way to construct one: a
- * runtime-computed error `code` still yields a well-typed
- * {@link OperationFailureResponse}.
- */
 export function operationFailure(code, cause) {
     return { data: null, code, cause };
 }
-/** The one generic internal-failure text; every A3000 carries it. */
 export const INTERNAL_FAILURE_MESSAGE = "Internal framework error.";
-/**
- * The generic internal-failure envelope. Nothing about an internal failure is
- * caller-actionable, so every A3000 the framework emits is this exact value -
- * one constant rather than one restatement per boundary.
- */
 export function internalFailure() {
     return operationFailure("A3000", { message: INTERNAL_FAILURE_MESSAGE });
 }

package/dist/runtime/operation-runtime.d.ts

@@ -6,6 +6,7 @@ import type { ResolvedFrameworkConfig } from "../config/config.resolver.js";
 import type { Contract } from "../contracts/contract.js";
 import type { OperationValidationOptions, SemanticOperationArguments } from "../operations/operation-validator.js";
 import type { FrameworkTransactionRequest } from "../transactions/transaction-request.js";
+import { type CreateRequirementTable } from "./create-requirement.js";
 import type { DiagnosticsReporter } from "./diagnostics-reporter.js";
 import type { ClientProtocolIdentity, FrameworkOperationRequest, OperationExecutionRequest } from "./operation-request.js";
 import type { OperationFailureResponse, OperationResponse } from "./operation-response.js";
@@ -15,12 +16,14 @@ export type OperationRuntimeDependencies<M extends AdapterModel> = {
     readonly config: ResolvedFrameworkConfig<M>;
 };
 /**
- * What a validated operation's pipeline needs: everything except the root
- * Adapter. Its single Adapter call goes through the executor passed beside
- * it (D-706), so inside a transaction plan the root Adapter is unreachable by
- * type (C-724).
+ * What a validated operation's pipeline needs: everything except the root Adapter.
+ * Its single Adapter call goes through the executor passed beside it, so inside a
+ * transaction plan the root Adapter is unreachable by type.
  */
-export type OperationPipelineDependencies<M extends AdapterModel> = Omit<OperationRuntimeDependencies<M>, "adapter">;
+export type OperationPipelineDependencies<M extends AdapterModel> = Omit<OperationRuntimeDependencies<M>, "adapter"> & {
+    /** The Adapter's create requirements, read once at construction. */
+    readonly createRequirements: CreateRequirementTable;
+};
 /**
  * The executor core owns no diagnostics channel: the framework factory owns
  * it and hands in one reporter already bound to this request, so every
@@ -35,11 +38,11 @@ export declare function createOperationRuntime<M extends AdapterModel>(dependenc
 /** Validates the request-level protocol identity shared by both execution seams. */
 export declare function validateProtocolIdentity(contracts: FrameworkContracts, request: FrameworkOperationRequest | FrameworkTransactionRequest): OperationFailureResponse | undefined;
 /**
- * The stale-client check (§19.4, cross-phase invariant 15) on one client
- * protocol identity: the protocol version first (`A2006`), then the
- * ClientContract hash (`A2005`). Exact match only. The one implementation —
- * the protocol's decoders and absence answers (`@aventara/core/protocol`) call
- * it too, so a stale client hears the same envelope whichever layer answers.
+ * The stale-client check on one client protocol identity: the protocol version
+ * first (`A2006`), then the ClientContract hash (`A2005`). Exact match only. The
+ * one implementation — the protocol's decoders and absence answers
+ * (`@aventara/core/protocol`) call it too, so a stale client hears the same
+ * envelope whichever layer answers.
  */
 export declare function protocolIdentityFailure(contracts: FrameworkContracts, protocol: ClientProtocolIdentity): OperationFailureResponse | undefined;
 export type ValidatedOperationArguments = {
@@ -53,23 +56,22 @@ export type ValidatedOperationArguments = {
 export declare function validateOperationRequest(contract: Contract, request: FrameworkOperationRequest, options?: OperationValidationOptions): ValidatedOperationArguments;
 /**
  * Everything after the Framework Validation Layer: the developer/runtime path
- * wrapped in the post-validation error boundary. Validation failures never
- * reach this function, so developer filters never see them.
+ * wrapped in the post-validation error boundary. Validation failures never reach
+ * this function, so developer filters never see them.
  *
- * `executor` is the operation's single Adapter call site (D-706): standalone
- * execution passes the Adapter itself, a transaction plan passes the
- * transaction-scoped executor its Adapter callback received. Every call owns
- * one AdapterBoundary, so A3001/A3000 origin stays classified per operation.
+ * `executor` is the operation's single Adapter call site: standalone execution
+ * passes the Adapter itself, a transaction plan passes the transaction-scoped
+ * executor its Adapter callback received. Every call owns one AdapterBoundary, so
+ * A3001/A3000 origin stays classified per operation.
  *
- * The parameter types keep two values out of reach: `dependencies` carries no
- * root Adapter, so the executor is the only Adapter this function can call,
- * and `request` carries no `arguments`, so no stage can read the unvalidated
- * view instead of `validatedArguments`.
+ * The parameter types keep two values out of reach: `dependencies` carries no root
+ * Adapter, so the executor is the only Adapter this function can call, and
+ * `request` carries no `arguments`, so no stage can read the unvalidated view
+ * instead of `validatedArguments`.
  *
  * `argumentsPath` is the framework's own address for these arguments —
  * `["arguments"]` standalone, `["operations", i, "args"]` inside a plan. The
  * response boundary needs it to decide whether a thrower-supplied issue path
- * denotes the caller's own arguments or is unvouched text (ADR 0008
- * decision 4).
+ * denotes the caller's own arguments or is unvouched text.
  */
 export declare function executeValidatedOperation<M extends AdapterModel>(dependencies: OperationPipelineDependencies<M>, request: OperationExecutionRequest, contract: Contract, validatedArguments: unknown, argumentsPath: readonly (string | number)[], executor: AdapterOperationExecutor<M>, report: DiagnosticsReporter): Promise<OperationResponse>;

package/dist/runtime/operation-runtime.js

@@ -1,13 +1,14 @@
 import { AVENTARA_PROTOCOL_VERSION } from "../contracts/contract-protocol.js";
 import { validateOperationArguments } from "../operations/operation-validator.js";
 import { materializeReadOperation, planReadOperation, } from "./computed-read-runtime.js";
+import { missingCreateValues, } from "./create-requirement.js";
 import { AdapterBoundary, OPERATION_ARGUMENTS_PATH, resolveOperationFailure, sanitizeOperationFailure, } from "./error-boundary.js";
 import { applyWriteFieldBehaviors, stripVirtualMutationInput, } from "./mutation-planner.js";
 import { internalFailure, operationFailure } from "./operation-response.js";
 import { mapOperationOutcome, mapValidationOutcome } from "./outcome-mapper.js";
 import { validateOperationOutput } from "./output-validator.js";
+import { refusePipeOutput } from "./pipe-output.validator.js";
 import { normalizeOperationScalarValues } from "./scalar-runtime.js";
-/** Selects the Contract of the request's execution scope for both execution seams. */
 export function activeContract(contracts, request) {
     return request.scope === "application"
         ? contracts.application
@@ -35,13 +36,6 @@ function forbidden() {
         message: "Operation denied by a framework guard.",
     });
 }
-/**
- * Output validation is framework validation (spec 16.5), so its failure is
- * framework-owned however it arrives. Reading the result can itself throw -
- * an Adapter row may carry an accessor that explodes - and without this
- * boundary that throw would leave through the post-validation boundary and be
- * offered to developer filters, which could relabel it as any outcome.
- */
 function outputAccepted(contract, request, projection, data, report) {
     try {
         return validateOperationOutput(contract, request, projection, data).ok;
@@ -51,8 +45,12 @@ function outputAccepted(contract, request, projection, data, report) {
         return false;
     }
 }
-/** Creates the transport-independent operation executor owned by core. */
 export function createOperationRuntime(dependencies) {
+    const pipelineDependencies = {
+        contracts: dependencies.contracts,
+        config: dependencies.config,
+        createRequirements: dependencies.adapter.createRequirements ?? {},
+    };
     return async (request, report) => {
         let validated;
         try {
@@ -67,14 +65,9 @@ export function createOperationRuntime(dependencies) {
         if (!validated.ok) {
             return validated.response;
         }
-        return executeValidatedOperation(dependencies, request, validated.contract, validated.arguments, OPERATION_ARGUMENTS_PATH, dependencies.adapter, report);
+        return executeValidatedOperation(pipelineDependencies, request, validated.contract, validated.arguments, OPERATION_ARGUMENTS_PATH, dependencies.adapter, report);
     };
 }
-/**
- * The Framework Validation Layer (spec 16), inside its own boundary: an
- * unexpected throw here is sanitized directly and reaches zero developer
- * filters, exactly like a validation failure (spec 16.5, 17.3).
- */
 function validateOperation(dependencies, request) {
     const protocolFailure = validateProtocolIdentity(dependencies.contracts, request);
     if (protocolFailure !== undefined) {
@@ -87,19 +80,11 @@ function validateOperation(dependencies, request) {
     }
     return { ok: true, contract, arguments: validation.arguments };
 }
-/** Validates the request-level protocol identity shared by both execution seams. */
 export function validateProtocolIdentity(contracts, request) {
     return request.scope === "client"
         ? protocolIdentityFailure(contracts, request.protocol)
         : undefined;
 }
-/**
- * The stale-client check (§19.4, cross-phase invariant 15) on one client
- * protocol identity: the protocol version first (`A2006`), then the
- * ClientContract hash (`A2005`). Exact match only. The one implementation —
- * the protocol's decoders and absence answers (`@aventara/core/protocol`) call
- * it too, so a stale client hears the same envelope whichever layer answers.
- */
 export function protocolIdentityFailure(contracts, protocol) {
     if (protocol.version !== AVENTARA_PROTOCOL_VERSION) {
         return operationFailure("A2006", {
@@ -113,7 +98,6 @@ export function protocolIdentityFailure(contracts, protocol) {
     }
     return undefined;
 }
-/** Reusable per-operation Framework Validation Layer argument seam. */
 export function validateOperationRequest(contract, request, options) {
     const validation = validateOperationArguments(contract, request, options);
     if (!validation.ok) {
@@ -130,27 +114,6 @@ export function validateOperationRequest(contract, request, options) {
 function rejected(response) {
     return { ok: false, response };
 }
-/**
- * Everything after the Framework Validation Layer: the developer/runtime path
- * wrapped in the post-validation error boundary. Validation failures never
- * reach this function, so developer filters never see them.
- *
- * `executor` is the operation's single Adapter call site (D-706): standalone
- * execution passes the Adapter itself, a transaction plan passes the
- * transaction-scoped executor its Adapter callback received. Every call owns
- * one AdapterBoundary, so A3001/A3000 origin stays classified per operation.
- *
- * The parameter types keep two values out of reach: `dependencies` carries no
- * root Adapter, so the executor is the only Adapter this function can call,
- * and `request` carries no `arguments`, so no stage can read the unvalidated
- * view instead of `validatedArguments`.
- *
- * `argumentsPath` is the framework's own address for these arguments —
- * `["arguments"]` standalone, `["operations", i, "args"]` inside a plan. The
- * response boundary needs it to decide whether a thrower-supplied issue path
- * denotes the caller's own arguments or is unvouched text (ADR 0008
- * decision 4).
- */
 export async function executeValidatedOperation(dependencies, request, contract, validatedArguments, argumentsPath, executor, report) {
     const scopeConfig = activeScopeConfig(dependencies.config, request);
     const pipelines = scopeConfig.pipelines;
@@ -169,13 +132,22 @@ export async function executeValidatedOperation(dependencies, request, contract,
                 return forbidden();
             }
         }
-        for (const pipe of pipelines.pipes) {
+        for (const [index, pipe] of pipelines.pipes.entries()) {
             const nextArgs = await pipe(args, pipelineContext(contract, request, args));
             if (nextArgs !== undefined) {
                 args = nextArgs;
             }
+            const refused = refusePipeOutput({ core: dependencies.contracts.core, active: contract }, request, args, pipe, index);
+            if (refused !== undefined) {
+                report(refused.error, "A3004");
+                return refused.response;
+            }
         }
         args = await applyWriteFieldBehaviors({ core: dependencies.contracts.core, active: contract }, scopeConfig.behaviors, request, args, () => pipelineContext(contract, request, args));
+        const missing = missingCreateValues(contract, dependencies.createRequirements, request, args, argumentsPath);
+        if (missing.length > 0) {
+            return mapValidationOutcome(missing);
+        }
         for (const hook of pipelines.hooks.before) {
             await hook(pipelineContext(contract, request, args));
         }
@@ -189,12 +161,6 @@ export async function executeValidatedOperation(dependencies, request, contract,
         let invoke = async () => {
             const readPlan = planReadOperation(dependencies.contracts.core, contract, scopeConfig.behaviors, request, args);
             const adapterArguments = await stripVirtualMutationInput({ core: dependencies.contracts.core, active: contract }, request, readPlan.arguments);
-            // `family` and `variant` are a correlated pair, so they travel as one
-            // OperationIdentity value: naming them separately would let any family
-            // pair with any variant. Only `resource` is cast, and only to `M`'s
-            // key union - the runtime check standing in for the compiler is
-            // `validateOperationArguments`, which has already rejected any
-            // resource name the active Contract does not carry.
             const identity = request;
             const adapterData = await adapterBoundary.execute(() => executor.execute({
                 ...identity,

package/dist/runtime/outcome-mapper.js

@@ -1,8 +1,4 @@
 import { internalFailure, operationFailure, operationNoMatch, operationSuccess, } from "./operation-response.js";
-/**
- * Spec section 13.2 success table, resource-agnostic. The mapped key type
- * makes the compiler reject a missing or unknown variant.
- */
 const OUTCOME_TABLE = {
     "find.first": { success: "A1000", absence: "no-match" },
     "find.unique": { success: "A1000", absence: "not-found" },
@@ -21,12 +17,6 @@ const OUTCOME_TABLE = {
     "delete.count": { success: "A1007" },
     "upsert.unique": { success: "A1008" },
 };
-/**
- * `family` and `variant` are correlated on `OperationIdentity`, but the
- * template built from them is not: it spans every family/variant pair, of
- * which most are not operations. So the lookup is a genuine miss-or-hit and
- * says so, rather than asserting a key it cannot prove.
- */
 function outcomeRule(operation) {
     const table = OUTCOME_TABLE;
     return table[`${operation.family}.${operation.variant}`];
@@ -43,11 +33,6 @@ function absenceOutcome(absence) {
             return internalFailure();
     }
 }
-/**
- * Maps one validated operation result to its stable outcome envelope. The
- * result must already have passed output validation, so `null` can only
- * reach a variant whose cardinality admits it.
- */
 export function mapOperationOutcome(operation, data) {
     const rule = outcomeRule(operation);
     if (rule === undefined) {
@@ -57,12 +42,6 @@ export function mapOperationOutcome(operation, data) {
         ? absenceOutcome(rule.absence)
         : operationSuccess(data, rule.success);
 }
-/**
- * Spec section 13.2 failure table for the Framework Validation Layer: which
- * A-code a set of validation issues reports. The most specific rejection
- * wins - an unknown Resource before an unavailable operation, and a
- * structural-limit breach before an ordinary argument rejection.
- */
 function validationCode(issues) {
     if (issues.some((issue) => issue.path?.[0] === "resource")) {
         return "A2001";
@@ -84,7 +63,6 @@ function validationCode(issues) {
     }
     return "A2004";
 }
-/** Maps framework validation issues to their stable failure envelope. */
 export function mapValidationOutcome(issues) {
     return operationFailure(validationCode(issues), {
         message: "Operation arguments failed framework validation.",

package/dist/runtime/output-validator.js

@@ -168,7 +168,6 @@ function validateProjection(contract, operation, projection, value) {
         ? validateExactRecord(contract, value, projection, ["data"])
         : { ok: true };
 }
-/** Validate final operation output against fixed cardinality and executed projection. */
 export function validateOperationOutput(contract, operation, projection, value) {
     const cardinality = validateOperationOutputCardinality(operation, value);
     return cardinality.ok

package/dist/runtime/pipe-output.validator.d.ts

@@ -0,0 +1,48 @@
+import type { Contract, CoreContract } from "../contracts/contract.js";
+import type { OperationIdentity } from "../operations/operation-identity.js";
+import type { ValidationIssue } from "../operations/validation-code.js";
+import type { OperationFailureResponse } from "./operation-response.js";
+/**
+ * The check a pipe's output passes before it can reach the Adapter.
+ *
+ * The request was validated against the caller's own Contract. A pipe then
+ * rewrites it, and may legitimately write what the caller cannot: a field the
+ * client Contract hides (a password hash, an owner id taken from the session),
+ * a directive the caller's scope does not advertise. So the rewritten arguments
+ * are held to the **server's** rules — the Core Contract, plus the fields the
+ * active scope itself adds (they are virtual: computed, then stripped before
+ * the Adapter call) — in the values' runtime forms (`bigint`, `Date`,
+ * `Decimal`, `Uint8Array`), which is what every pipe receives.
+ *
+ * A refusal is the server's defect, not the caller's: `A3004
+ * PIPE_OUTPUT_INVALID`, a 500 that tells the caller no more than any internal
+ * failure does — {@link PIPE_OUTPUT_FAILURE_MESSAGE}, and the step in a plan.
+ * The pipe, the operation, the first offending field and its V-code go to the
+ * diagnostics channel only, as a {@link PipeOutputError}: they name server
+ * internals — a pipe's function name, a field the caller's Contract hides.
+ */
+/** The one text every `A3004` carries on the wire. */
+export declare const PIPE_OUTPUT_FAILURE_MESSAGE = "A server pipeline produced invalid arguments.";
+/** The error the diagnostics channel receives for a refused pipe output. */
+export declare class PipeOutputError extends Error {
+    readonly issues: readonly ValidationIssue[];
+    readonly name = "PipeOutputError";
+    constructor(message: string, issues: readonly ValidationIssue[]);
+}
+/**
+ * `undefined` when the pipe's output passes the server's rules; otherwise the
+ * `A3004` failure, and the error the diagnostics channel is told.
+ */
+export declare function refusePipeOutput(contracts: {
+    readonly core: CoreContract;
+    readonly active: Contract;
+}, request: OperationIdentity & {
+    readonly resource: string;
+}, args: unknown, 
+/** The pipe that produced `args`, named in the message by its function name. */
+pipe: unknown, 
+/** Its position in the effective pipe list (root pipes first). */
+index: number): {
+    readonly response: OperationFailureResponse;
+    readonly error: PipeOutputError;
+} | undefined;

package/dist/runtime/pipe-output.validator.js

@@ -0,0 +1,79 @@
+import { validateOperationArguments } from "../operations/operation-validator.js";
+import { operationFailure } from "./operation-response.js";
+import { normalizeOperationScalarValues } from "./scalar-runtime.js";
+export const PIPE_OUTPUT_FAILURE_MESSAGE = "A server pipeline produced invalid arguments.";
+function serverContract(core, active) {
+    const resources = {};
+    for (const [name, resource] of Object.entries(core.resources)) {
+        const scoped = Object.hasOwn(active.resources, name)
+            ? active.resources[name]
+            : undefined;
+        const added = scoped === undefined
+            ? {}
+            : Object.fromEntries(Object.entries(scoped.fields).filter(([field]) => !Object.hasOwn(resource.fields, field)));
+        resources[name] =
+            Object.keys(added).length === 0
+                ? resource
+                : { ...resource, fields: { ...resource.fields, ...added } };
+    }
+    return { ...core, resources };
+}
+const SERVER_VIEWS = new WeakMap();
+function serverContractFor(core, active) {
+    let view = SERVER_VIEWS.get(active);
+    if (view === undefined) {
+        view = serverContract(core, active);
+        SERVER_VIEWS.set(active, view);
+    }
+    return view;
+}
+function serverIssues(contract, request, args) {
+    const validation = validateOperationArguments(contract, {
+        ...request,
+        arguments: args,
+    });
+    if (!validation.ok) {
+        return validation.issues;
+    }
+    const normalization = normalizeOperationScalarValues(contract, { ...request, arguments: validation.arguments }, "application");
+    return normalization.ok ? [] : normalization.issues;
+}
+function pipeLabel(pipe, index) {
+    let name;
+    try {
+        name = pipe.name;
+    }
+    catch {
+        name = undefined;
+    }
+    return typeof name === "string" && name !== ""
+        ? `pipes[${index}] "${name}"`
+        : `pipes[${index}] (anonymous)`;
+}
+function fieldOf(issue) {
+    const path = issue.path ?? [];
+    const relative = path[0] === "arguments" ? path.slice(1) : path;
+    return relative.length === 0 ? "(arguments)" : relative.join(".");
+}
+export class PipeOutputError extends Error {
+    issues;
+    name = "PipeOutputError";
+    constructor(message, issues) {
+        super(message);
+        this.issues = issues;
+    }
+}
+export function refusePipeOutput(contracts, request, args, pipe, index) {
+    const issues = serverIssues(serverContractFor(contracts.core, contracts.active), request, args);
+    const [first] = issues;
+    if (first === undefined) {
+        return undefined;
+    }
+    const message = `Pipe ${pipeLabel(pipe, index)} returned arguments for ${request.resource}.${request.family}.${request.variant} that the server contract refuses at "${fieldOf(first)}" (${first.code}: ${first.message})`;
+    return {
+        response: operationFailure("A3004", {
+            message: PIPE_OUTPUT_FAILURE_MESSAGE,
+        }),
+        error: new PipeOutputError(message, issues),
+    };
+}