@aventara/core 0.1.0-pilot.0 → 0.1.0-pilot.2

package/dist/runtime/pipeline.d.ts

@@ -5,16 +5,13 @@ import type { Contract } from "../contracts/contract.js";
 import type { OperationFamily } from "../operations/operation-identity.js";
 import type { FrameworkError } from "./framework-error.js";
 /**
- * What a pipeline is told about the HTTP request a client-origin operation
- * arrived on — a **deliberate exception** to core's transport-agnosticism
- * (F-609; the architect, Phase 10 Q7; ADR 0010). Specification §17.2 states
- * this shape, and developers may read it in their pipelines: the verb, always
- * `POST` on a framework route, and the request's headers.
+ * What a pipeline is told about the HTTP request a client-origin operation arrived
+ * on — a **deliberate exception** to core's transport-agnosticism.
  *
- * Core never parses HTTP to fill it. `@aventara/core/protocol`'s decoders do,
- * with header names **lower-cased** and a repeated header's values joined with
- * `", "` (RFC 9110 §5.3), so a pipeline reads one spelling. An application-scope
- * request carries none (`ClientOperationRequest.transport` is optional).
+ * Core never parses HTTP to fill it. `@aventara/core/protocol`'s decoders do, with
+ * header names **lower-cased** and a repeated header's values joined with `", "`
+ * (RFC 9110 §5.3), so a pipeline reads one spelling. An application-scope request
+ * carries none (`ClientOperationRequest.transport` is optional).
  */
 export type PipelineTransportContext = {
     readonly method: "POST";
@@ -23,27 +20,24 @@ export type PipelineTransportContext = {
 /**
  * What a pipeline callback is told about the operation it is wrapping.
  *
- * `resource` reads its key set from the **AdapterModel**, not from a
- * `Contract`: `Contract["resources"]` is an open `Record<string, …>`, so the
- * `C extends Contract` parameter this type used to take could never name the
- * Resources an author actually has — it erased to `string`. `M` can name
- * them, and configuration cannot add Resources, so `M` is the whole answer.
+ * `resource` reads its key set from the **AdapterModel**, not from a `Contract`:
+ * `Contract["resources"]` is an open `Record<string, …>`, so the `C extends
+ * Contract` parameter this type used to take could never name the Resources an
+ * author actually has — it erased to `string`. `M` can name them, and
+ * configuration cannot add Resources, so `M` is the whole answer.
  *
- * **No `Cfg`, unlike B8 as written.** `Cfg` narrows *field-key* positions,
- * and this type has none: `contract` is passive compiled data, `args` is
- * `unknown` until Phase 9 (F-701), and `resource` comes from `M` alone. A
- * `Cfg` parameter here would be referenced nowhere — `biome` flags it
+ * A `Cfg` parameter here would be referenced nowhere — `biome` flags it
  * (`lint/correctness/noUnusedVariables`) and it would encode no semantic
- * dependency. `FrameworkScopeConfig` already has the precedent one line
- * above `pipelines`: `fields` takes `M` only.
+ * dependency. `FrameworkScopeConfig` already has the precedent one line above
+ * `pipelines`: `fields` takes `M` only.
  *
- * `contract` stays the erased {@link Contract} deliberately: a compiled
- * Contract is passive semantic data whose result "stays untyped by design"
- * (ADR 0009). Threading configuration into it would rebuild the
- * authoring-config-to-compiled-contract bridge this work bypasses.
+ * `contract` stays the erased {@link Contract} deliberately: a compiled Contract
+ * is passive semantic data whose result "stays untyped by design". Threading
+ * configuration into it would rebuild the authoring-config-to-compiled-contract
+ * bridge this work bypasses.
  *
- * Under the default `M` the key set degenerates to `string`, so an
- * unannotated `PipelineContext` is what it was before (B4).
+ * Under the default `M` the key set degenerates to `string`, so an unannotated
+ * `PipelineContext` is what it was before.
  */
 export type PipelineContext<M extends AdapterModel = AdapterModel> = {
     readonly contract: Contract;

package/dist/runtime/referential-action.d.ts

@@ -1,35 +1,30 @@
 /**
  * Core's referential-action vocabulary, and the transitive cascade closure the
- * transaction planner reads (F-806, Phase 9 S10).
+ * transaction planner reads.
  *
  * The facts are an Adapter's: which relation edges exist, and what deleting a
- * referenced row does to the rows that reference it. The reasoning over them is
- * core's — the architect rejected keeping it below the seam on 2026-10-02,
- * because every Adapter would then re-implement it. So the words here are
+ * referenced row does to the rows that reference it. So the words here are
  * Aventara's, stated as the effect on the referencing rows, and an Adapter
  * translates its own provider's vocabulary into them.
  *
- * None of this enters a Contract. It is not part of the semantic model a
- * Contract is compiled from, so it moves no Contract value and no hash; it is a
- * planning fact, read once when the Framework is constructed.
+ * None of this enters a Contract. It is not part of the semantic model a Contract
+ * is compiled from, so it moves no Contract value and no hash; it is a planning
+ * fact, read once when the Framework is constructed.
  */
 /**
- * What deleting a referenced row does to the rows that reference it. The five
- * words are the architect's (binding, 2026-10-04), and mirror SQL's
- * referential actions one to one, so no adapter has to choose between two of
- * them:
+ * What deleting a referenced row does to the rows that reference it.
  *
- * - `cascade` — they are deleted with it, and their own referencing rows in
- *   turn (SQL `ON DELETE CASCADE`).
+ * - `cascade` — they are deleted with it, and their own referencing rows in turn
+ *   (SQL `ON DELETE CASCADE`).
  * - `restrict` — the delete is refused while they reference it (`RESTRICT`).
  * - `noAction` — the delete is refused while they reference it (`NO ACTION`).
- *   Measured identical to `restrict` on both pilot engines (Phase 9 S0, U4):
- *   neither declares the constraint `DEFERRABLE`, so the end-of-statement check
- *   answers one delete exactly as `RESTRICT` does. It stays a distinct word
- *   because it is a distinct schema fact.
+ *   Measured identical to `restrict` on both pilot engines: neither declares the
+ *   constraint `DEFERRABLE`, so the end-of-statement check answers one delete
+ *   exactly as `RESTRICT` does. It stays a distinct word because it is a distinct
+ *   schema fact.
  * - `setNull` — they are kept, the reference set to null (`SET NULL`).
- * - `setDefault` — they are kept, the reference set to its column default
- *   (`SET DEFAULT`).
+ * - `setDefault` — they are kept, the reference set to its column default (`SET
+ *   DEFAULT`).
  *
  * Only `cascade` takes rows away, so only `cascade` is followed by the closure.
  */

package/dist/runtime/referential-action.js

@@ -1,26 +1,5 @@
-/**
- * Core's referential-action vocabulary, and the transitive cascade closure the
- * transaction planner reads (F-806, Phase 9 S10).
- *
- * The facts are an Adapter's: which relation edges exist, and what deleting a
- * referenced row does to the rows that reference it. The reasoning over them is
- * core's — the architect rejected keeping it below the seam on 2026-10-02,
- * because every Adapter would then re-implement it. So the words here are
- * Aventara's, stated as the effect on the referencing rows, and an Adapter
- * translates its own provider's vocabulary into them.
- *
- * None of this enters a Contract. It is not part of the semantic model a
- * Contract is compiled from, so it moves no Contract value and no hash; it is a
- * planning fact, read once when the Framework is constructed.
- */
 const NO_CASCADE = new Set();
-/**
- * Builds the closure over an Adapter's table, once. An absent table is the
- * answer of an Adapter that cannot state its referential actions; it is
- * believed, so nothing cascades.
- */
 export function resolveCascadeClosure(table) {
-    // target → the Resources a delete of it cascades into, one hop.
     const removedBy = new Map();
     for (const [resource, edges] of Object.entries(table ?? {})) {
         for (const edge of edges) {
@@ -41,8 +20,6 @@ export function resolveCascadeClosure(table) {
         const closure = new Set();
         const frontier = [...(removedBy.get(resource) ?? [])];
         for (let next = frontier.pop(); next !== undefined; next = frontier.pop()) {
-            // The visited set is what makes a self-referential or cyclic cascade
-            // terminate: each Resource is expanded at most once.
             if (closure.has(next)) {
                 continue;
             }

package/dist/runtime/request-id.js

@@ -1,27 +1,6 @@
-/**
- * The one place core mints a request id (Q10 = B; F-833). The typed façades and
- * the typed transaction runner call it when the caller supplies no usable id.
- * It is internal: neither the main entry nor `@aventara/core/protocol` exports
- * a minting helper. A host's correlation id reaches core as data —
- * `ExecutionOptions.requestId` in process, or the `requestId` of a request the
- * protocol decoders build from an adopted `Aventara-Request-Id` (Phase 10 S7,
- * which mints through this module when none was adopted).
- */
 function createRequestId() {
     return globalThis.crypto.randomUUID();
 }
-/**
- * The request id of one façade call or transaction run: the caller's
- * `ExecutionOptions.requestId` when it is a non-empty string, otherwise a minted
- * one. Nothing is refused (the call runs either way); the empty string is read
- * as absent, because it names nothing a log line or a diagnostic could be
- * correlated by.
- *
- * Read as `unknown` because the façades are total for untyped callers too: a
- * value the type refuses — a non-string id, a non-object options argument, a
- * getter that throws — is ignored rather than carried into a `string` slot or
- * thrown out of a call that must resolve.
- */
 export function requestIdOf(options) {
     if (typeof options === "object" && options !== null) {
         let requestId;

package/dist/runtime/scalar-runtime.d.ts

@@ -20,14 +20,13 @@ export type ScalarValueNormalizationResult = {
 };
 type Path = readonly (string | number)[];
 /**
- * The one discriminant between an argument OBJECT and a VALUE wherever a
- * position admits both — a filter position above all: a **plain** record is an
- * operator object, and anything else — a `Date`, a core `Decimal`, a
- * `Uint8Array` — is a value, which equality shorthand then holds to the field's
- * scalar (spec §9.1). The validator (`operation-validator-core.ts`) reads a
- * filter position through this same answer, and an adapter's filter translation
- * is expected to, so a position cannot be operators to one reader and a value to
- * another.
+ * The one discriminant between an argument OBJECT and a VALUE wherever a position
+ * admits both — a filter position above all: a **plain** record is an operator
+ * object, and anything else — a `Date`, a core `Decimal`, a `Uint8Array` — is a
+ * value, which equality shorthand then holds to the field's scalar. The validator
+ * (`operation-validator-core.ts`) reads a filter position through this same
+ * answer, and an adapter's filter translation is expected to, so a position cannot
+ * be operators to one reader and a value to another.
  */
 export declare function isPlainRecord(value: unknown): value is Readonly<Record<string, unknown>>;
 /**
@@ -36,14 +35,13 @@ export declare function isPlainRecord(value: unknown): value is Readonly<Record<
  */
 export declare function normalizeScalarFieldValue(contract: Contract, field: ScalarField<Contract>, value: unknown, scope: RequestOrigin | "runtime", path: Path): ScalarValueNormalizationResult;
 /**
- * Copies one validated runtime value of a scalar field into a value the
- * framework owns, per scalar codec (DA-25): `datetime` → a new `Date`,
- * `bytes` → a sliced `Uint8Array`, `json` → a structured deep copy, and a list
- * → a new array of copied items. `decimal` keeps its identity, and strings,
- * numbers, booleans, bigints, enum members and `null` are immutable and
- * returned unchanged. {@link SCALAR_ATOM_COPIERS} is exhaustive over
- * {@link BuiltInScalar}, so a new codec cannot reach this function without
- * declaring its copy.
+ * Copies one validated runtime value of a scalar field into a value the framework
+ * owns, per scalar codec: `datetime` → a new `Date`, `bytes` → a sliced
+ * `Uint8Array`, `json` → a structured deep copy, and a list → a new array of
+ * copied items. `decimal` keeps its identity, and strings, numbers, booleans,
+ * bigints, enum members and `null` are immutable and returned unchanged. {@link
+ * SCALAR_ATOM_COPIERS} is exhaustive over {@link BuiltInScalar}, so a new codec
+ * cannot reach this function without declaring its copy.
  */
 export declare function copyScalarFieldValue(field: ScalarField<Contract>, value: unknown): unknown;
 /**

package/dist/runtime/scalar-runtime.js

@@ -4,20 +4,12 @@ import { routeTransactionReferenceCandidate } from "../transactions/transaction-
 import { Decimal } from "./decimal.js";
 const INT_MIN = -(2 ** 31);
 const INT_MAX = 2 ** 31 - 1;
+const BIGINT_MIN = -(2n ** 63n);
+const BIGINT_MAX = 2n ** 63n - 1n;
 const UUID_PATTERN = /^[0-9a-f]{8}-[0-9a-f]{4}-[1-8][0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$/i;
 function isRecord(value) {
     return value !== null && typeof value === "object" && !Array.isArray(value);
 }
-/**
- * The one discriminant between an argument OBJECT and a VALUE wherever a
- * position admits both — a filter position above all: a **plain** record is an
- * operator object, and anything else — a `Date`, a core `Decimal`, a
- * `Uint8Array` — is a value, which equality shorthand then holds to the field's
- * scalar (spec §9.1). The validator (`operation-validator-core.ts`) reads a
- * filter position through this same answer, and an adapter's filter translation
- * is expected to, so a position cannot be operators to one reader and a value to
- * another.
- */
 export function isPlainRecord(value) {
     if (!isRecord(value)) {
         return false;
@@ -45,20 +37,6 @@ function materializeJsonPath(root, link) {
     segments.reverse();
     return [...root, ...segments];
 }
-/**
- * A JSON scalar's interior is opaque to the Contract, so no semantic limit
- * bounds its depth - `maxNestingDepth` counts Contract nesting and
- * `maxRequestBytes` is a transport concern. The traversal therefore carries
- * its own stack on the heap: a payload deep enough to exhaust the call stack
- * must still normalize rather than become an internal failure.
- *
- * `seen` holds the ancestors of the value being visited, so a repeated
- * sibling reference is legal and only a genuine cycle is rejected.
- *
- * Every node it emits is typed {@link JsonValue}, so the public type and what
- * this traversal produces are one fact: a branch that emitted anything else
- * would not compile.
- */
 function normalizeJsonValue(value, path, seen) {
     const issues = [];
     let root;
@@ -238,6 +216,16 @@ function normalizeScalarAtom(contract, field, value, scope, path, allowNull) {
             else {
                 normalized = { ok: true, value: BigInt(value) };
             }
+            if (normalized.ok &&
+                typeof normalized.value === "bigint" &&
+                (normalized.value < BIGINT_MIN || normalized.value > BIGINT_MAX)) {
+                normalized = {
+                    ok: false,
+                    issues: [
+                        issue("V1004", path, "BigInt value is outside signed 64-bit range."),
+                    ],
+                };
+            }
             break;
         case "decimal":
             if (scope === "application") {
@@ -346,10 +334,6 @@ function normalizeScalarAtom(contract, field, value, scope, path, allowNull) {
     }
     return normalized;
 }
-/**
- * Normalizes one field value to Aventara's provider-neutral runtime form.
- * `runtime` is used for framework-produced values regardless of request origin.
- */
 export function normalizeScalarFieldValue(contract, field, value, scope, path) {
     if (value === null) {
         return field.nullable
@@ -377,32 +361,17 @@ export function normalizeScalarFieldValue(contract, field, value, scope, path) {
     }
     return normalizeScalarAtom(contract, field, value, scope === "runtime" ? "application" : scope, path, field.nullable);
 }
-/**
- * One copier per built-in scalar codec, keyed by a mapped type over
- * {@link BuiltInScalar}: a codec added to the protocol is a compile error
- * here until it declares how a framework-owned copy of its runtime form is
- * made, so DA-25 cannot silently degrade to identity sharing for it. The
- * immutable codecs name themselves rather than sharing a `default` branch.
- */
 const SCALAR_ATOM_COPIERS = {
     string: (value) => value,
     boolean: (value) => value,
     int: (value) => value,
     float: (value) => value,
     bigint: (value) => value,
-    // `Decimal` holds its digits in a `readonly` ES private field assigned once
-    // by its constructor and exposes no mutator, so one instance cannot connect
-    // two views of it.
     decimal: (value) => value,
     datetime: (value) => value instanceof Date ? new Date(value.getTime()) : value,
     bytes: (value) => (value instanceof Uint8Array ? value.slice() : value),
     json: (value) => structuredClone(value),
 };
-/**
- * The same table for a runtime lookup: a Contract's scalar name is a `string`
- * in the type system, so an unknown name yields no copier and the value is
- * returned as it is.
- */
 const SCALAR_ATOM_COPIER_LOOKUP = SCALAR_ATOM_COPIERS;
 function copyScalarAtom(field, value) {
     if (value === null || "enum" in field.type) {
@@ -411,16 +380,6 @@ function copyScalarAtom(field, value) {
     const copier = SCALAR_ATOM_COPIER_LOOKUP[field.type.scalar];
     return copier === undefined ? value : copier(value);
 }
-/**
- * Copies one validated runtime value of a scalar field into a value the
- * framework owns, per scalar codec (DA-25): `datetime` → a new `Date`,
- * `bytes` → a sliced `Uint8Array`, `json` → a structured deep copy, and a list
- * → a new array of copied items. `decimal` keeps its identity, and strings,
- * numbers, booleans, bigints, enum members and `null` are immutable and
- * returned unchanged. {@link SCALAR_ATOM_COPIERS} is exhaustive over
- * {@link BuiltInScalar}, so a new codec cannot reach this function without
- * declaring its copy.
- */
 export function copyScalarFieldValue(field, value) {
     if (!field.list || !Array.isArray(value)) {
         return copyScalarAtom(field, value);
@@ -780,10 +739,6 @@ function isUniqueOperation(request) {
             request.family === "delete" ||
             request.family === "upsert"));
 }
-/**
- * Normalizes every scalar leaf in one structurally valid standard operation.
- * Client wire values are decoded; application values are validated in runtime form.
- */
 export function normalizeOperationScalarValues(contract, request, scope, options) {
     const issues = [];
     const args = cloneRecord(request.arguments);

package/dist/transactions/deferred-operation.d.ts

@@ -17,9 +17,9 @@ declare const OPERATION_RESULT: unique symbol;
 declare const OPERATION_HANDLE: unique symbol;
 /**
  * Standard-library shapes that are objects but never a projected result row.
- * `ArrayBufferView` is TypeScript's shared structural base for every typed
- * array and `DataView`, so no constructor is enumerated and the declaration
- * stays portable ES2022 with no runtime dependency (D-719, DA-14).
+ * `ArrayBufferView` is TypeScript's shared structural base for every typed array
+ * and `DataView`, so no constructor is enumerated and the declaration stays
+ * portable ES2022 with no runtime dependency.
  */
 export type BuiltinNonRow = Date | RegExp | ReadonlyMap<unknown, unknown> | ReadonlySet<unknown> | PromiseLike<unknown> | ArrayBufferView;
 /**
@@ -32,18 +32,13 @@ export type BuiltinNonRow = Date | RegExp | ReadonlyMap<unknown, unknown> | Read
 export type SingleRowResult<T> = NonNullable<T> extends readonly unknown[] ? never : NonNullable<T> extends (...args: never[]) => unknown ? never : NonNullable<T> extends BuiltinNonRow ? never : NonNullable<T> extends object ? Extract<keyof NonNullable<T>, string> extends never ? never : NonNullable<T> : never;
 /** The field names a result row can be referenced by. */
 export type ReferenceableField<T> = Extract<keyof SingleRowResult<T>, string>;
-/** Builds a §14.2 `$ref` carrying the source field's own value type. */
 export type ReferenceBuilder<T> = <F extends ReferenceableField<T>>(field: F) => TransactionReference<SingleRowResult<T>[F]>;
 /** Contributes `$ref` only where the result is a referenceable single row. */
 export type OperationReferenceSurface<T> = [SingleRowResult<T>] extends [never] ? {} : {
     readonly $ref: ReferenceBuilder<T>;
 };
 /**
- * An opaque deferred-operation handle. It is not the passive §14.2 wire node:
- * it exposes no `resource`, `family`, `variant`, `args` or `fingerprint`, and
- * is never intersected with `DeferredOperation`. Phase 9 and the generated
- * Phase 12 builders construct handles; `T` is supplied by the caller until
- * Phase 9 derives it from a Contract as `OperationResultFor` (DA-11).
+ * An opaque deferred-operation handle.
  */
 export type Operation<T> = {
     readonly [OPERATION_HANDLE]: true;
@@ -54,13 +49,13 @@ export type TransactionResults<Ops extends readonly Operation<unknown>[]> = {
     readonly [I in keyof Ops]: Ops[I] extends Operation<infer R> ? R : never;
 };
 /**
- * The one typed transaction runner — `framework.transaction`'s own type. It
- * infers the handle tuple without `as const` at the call site, and resolves what
- * the runtime answers: the committed envelope (`A1009`) with each handle's
- * result in plan order, or the failure response. Never the bare result tuple.
+ * The one typed transaction runner — `framework.transaction`'s own type. It infers
+ * the handle tuple without `as const` at the call site, and resolves what the
+ * runtime answers: the committed envelope (`A1009`) with each handle's result in
+ * plan order, or the failure response. Never the bare result tuple.
  *
  * The second argument is the run's `ExecutionOptions`: its `requestId` is every
- * step's, under either origin (F-833). A handle takes none (Q14).
+ * step's, under either origin. A handle takes none.
  */
 export type TransactionRunner = <const Ops extends readonly Operation<unknown>[]>(operations: Ops, options?: ExecutionOptions) => Promise<TransactionCommittedResponse<TransactionResults<Ops>> | OperationFailureResponse>;
 export {};

package/dist/transactions/operation-arguments-encoder.d.ts

@@ -1,7 +1,6 @@
 import type { Contract } from "../contracts/contract.js";
 import type { OperationIdentity } from "../operations/operation-identity.js";
 import type { SemanticOperationArguments } from "../operations/operation-validator.js";
-/** Encodes validated application arguments into the §6.2 wire scalar form. */
 export declare function encodeOperationArgumentsForWire(contract: Contract, operation: OperationIdentity & {
     readonly resource: string;
 }, args: SemanticOperationArguments): unknown;

package/dist/transactions/operation-arguments-encoder.js

@@ -204,14 +204,6 @@ function encodeScalarMutation(field, value) {
     }
     return encoded;
 }
-/**
- * The identifier half of the relation-mutation grammar, and the companion of
- * `RELATION_MUTATION_RECORD_SITES`, which owns the record operands and leaves
- * identifier operands empty because the write planner never encodes them. This
- * pass does, so it describes them here rather than hand-walking the grammar a
- * second time. Both tables are keyed by `RelationMutationDirective`, so a new
- * directive cannot be added without this file failing to compile.
- */
 const RELATION_MUTATION_SELECTOR_SITES = {
     $create: [],
     $connect: [{ key: undefined, form: "unique" }],
@@ -222,11 +214,6 @@ const RELATION_MUTATION_SELECTOR_SITES = {
     $delete: [{ key: "where", form: "filter" }],
     $upsert: [{ key: "where", form: "unique" }],
 };
-/**
- * Encodes one site of a directive operand. A site with no key names the whole
- * operand; a keyed site names one own member of it and leaves an operand that
- * is not a plain record, or that does not carry the member, alone.
- */
 function encodeRelationSite(entry, key, encode) {
     if (key === undefined) {
         return encode(entry);
@@ -294,7 +281,6 @@ function isUniqueOperation(operation) {
             operation.family === "delete" ||
             operation.family === "upsert"));
 }
-/** Encodes validated application arguments into the §6.2 wire scalar form. */
 export function encodeOperationArgumentsForWire(contract, operation, args) {
     const encoded = cloneRecord(args);
     if (hasOwnWireProperty(args, "where")) {

package/dist/transactions/operation-fingerprint.js

@@ -13,7 +13,6 @@ function encodeBase64Url(bytes) {
 export function isOperationFingerprint(value) {
     return typeof value === "string" && OPERATION_FINGERPRINT_PATTERN.test(value);
 }
-/** Computes the v1 operation fingerprint from an already wire-form node. */
 export async function computeOperationFingerprint(node) {
     const canonical = canonicalizeJson({
         resource: node.resource,

package/dist/transactions/transaction-envelope.js

@@ -13,9 +13,6 @@ function inspectArrayDataProperty(value, key) {
         if (!("value" in descriptor)) {
             return { ok: false };
         }
-        // This can invoke a transparent proxy trap, but never an accessor: the
-        // descriptor above proved that the property is data-backed. The value
-        // consumed below remains the descriptor value.
         Reflect.get(value, key);
         return { ok: true, present: true, value: descriptor.value };
     }
@@ -23,12 +20,6 @@ function inspectArrayDataProperty(value, key) {
         return { ok: false };
     }
 }
-/**
- * Inspects the plan's operations tuple without dereferencing untrusted array
- * properties outside a reflection boundary. The caller uses the returned
- * length and per-index inspector rather than `operations.length` or
- * `operations[index]` directly.
- */
 export function inspectTransactionOperations(value) {
     try {
         if (!Array.isArray(value)) {
@@ -55,7 +46,6 @@ export function inspectTransactionOperations(value) {
         return operationsReflectionFailure("Transaction operations array reflection failed.");
     }
 }
-/** Reads one operations entry through its own data descriptor. */
 export function inspectTransactionOperationEntry(operations, index) {
     const entry = inspectArrayDataProperty(operations, String(index));
     if (!entry.ok) {
@@ -70,10 +60,6 @@ export function inspectTransactionOperationEntry(operations, index) {
     }
     return { ok: true, value: entry.value };
 }
-/**
- * Inspects an untrusted transaction envelope without reading any property value.
- * Proxies are unsupported; reflection failures are contained as envelope issues.
- */
 export function inspectTransactionEnvelope(value, schema) {
     if (typeof value !== "object" || value === null) {
         return issue(schema.invalidContainerPath, schema.invalidContainerMessage);

package/dist/transactions/transaction-integrity-error.d.ts

@@ -1,17 +1,16 @@
 /**
  * The ways an Adapter transaction can break the contract the framework's plan
- * executor depends on (C-750, DA-24). Each is answered `A3002`; the violation
- * is the only thing that tells them apart, so it is structured data rather
- * than message text (ADR 0006: never infer an outcome from error text).
+ * executor depends on. Each is answered `A3002`; the violation is the only thing
+ * that tells them apart, so it is structured data rather than message text.
  *
- * - `transaction-unavailable`: the Adapter's `transaction` function is gone
- *   at execution time (unreachable by construction under D-712).
- * - `resolved-after-abort`: the Adapter resolved although the framework threw
- *   its rollback request.
- * - `resolved-incomplete`: the Adapter resolved before every plan operation
- *   ran, so no committed `A1009` array exists (DA-1).
- * - `foreign-abort`: the Adapter rejected with the framework's rollback
- *   request although this plan never made one.
+ * - `transaction-unavailable`: the Adapter's `transaction` function is gone at
+ *   execution time.
+ * - `resolved-after-abort`: the Adapter resolved although the framework threw its
+ *   rollback request.
+ * - `resolved-incomplete`: the Adapter resolved before every plan operation ran,
+ *   so no committed `A1009` array exists.
+ * - `foreign-abort`: the Adapter rejected with the framework's rollback request
+ *   although this plan never made one.
  */
 export type TransactionIntegrityViolation = "transaction-unavailable" | "resolved-after-abort" | "resolved-incomplete" | "foreign-abort";
 /**

package/dist/transactions/transaction-integrity-error.js

@@ -4,11 +4,6 @@ const TRANSACTION_INTEGRITY_MESSAGES = {
     "resolved-incomplete": "Adapter transaction resolved before the plan completed.",
     "foreign-abort": "Adapter transaction rejected with a rollback request this plan never made.",
 };
-/**
- * The framework-owned failure reported to diagnostics when an Adapter
- * transaction violates its contract. It never reaches the wire: the response
- * is always the constant `A3002` envelope.
- */
 export class TransactionIntegrityError extends Error {
     violation;
     constructor(violation) {

package/dist/transactions/transaction-plan-assembler.d.ts

@@ -5,7 +5,6 @@ import type { ClientProtocolIdentity } from "../runtime/operation-request.js";
 import type { OperationFailureResponse } from "../runtime/operation-response.js";
 import type { Operation, OperationFingerprint } from "./deferred-operation.js";
 import type { TransactionOperationOrigin } from "./transaction-request.js";
-/** One §14.2 wire node, exactly as the transaction runtime receives it. */
 type WireOperationNode = {
     readonly resource: string;
     readonly family: string;

package/dist/transactions/transaction-plan-assembler.js

@@ -11,11 +11,6 @@ function isPlainRecord(value) {
     const prototype = Object.getPrototypeOf(value);
     return prototype === Object.prototype || prototype === null;
 }
-/**
- * The argument keys whose value holds DA-3 positions for `identity`: the
- * top-level mutation data. `create.many`/`create.count` hold a list of records
- * there; every other one holds one record.
- */
 function referenceKeys(identity) {
     switch (identity.family) {
         case "create":
@@ -27,11 +22,6 @@ function referenceKeys(identity) {
             return [];
     }
 }
-/**
- * Every DA-3 container `args` holds. A value that is not a plain record (or, for
- * a bulk create, a list of them) holds none: it reaches the validation layer as
- * it is, which answers it.
- */
 function referenceContainers(identity, args) {
     if (!isPlainRecord(args)) {
         return [];
@@ -44,10 +34,6 @@ function referenceContainers(identity, args) {
         return isPlainRecord(value) ? [{ path: [key], record: value }] : [];
     });
 }
-/**
- * Rebuilds `args` with each DA-3 container replaced by `rebuild(container)`,
- * cloning only the containing path; every other value is the caller's own.
- */
 function replaceContainers(identity, args, rebuild) {
     if (!isPlainRecord(args)) {
         return args;
@@ -66,34 +52,21 @@ function replaceContainers(identity, args, rebuild) {
     }
     return result;
 }
-/** A per-operation framework-validation refusal (`A2004`/`V1001`), at `["operation"]`. */
 function operationEntryFailure(operation, message) {
     return transactionOperationFailure(operationFailure("A2004", {
         message: "Transaction plan failed framework validation.",
         issues: [validationIssue("V1001", ["operation"], message)],
     }), operation);
 }
-/** A reference refusal, routed like every other reference issue (DA-4). */
 function referenceFailure(issue, operation) {
     return transactionOperationFailure(mapValidationOutcome([issue]), operation);
 }
-/**
- * One assembler per Framework: a handle is this Framework's or it is not a
- * handle, so a handle another instance built — typed against another model,
- * bound to other Contracts — is refused rather than run.
- */
 export function createTransactionPlanAssembler(contracts, protocol) {
     const handles = new WeakMap();
     const placeholders = new WeakMap();
     const originOf = (origin) => origin === "application"
         ? { scope: "application" }
         : { scope: "client", protocol };
-    /**
-     * Fixes the handle's DA-3 positions when it is built: each container is
-     * copied, so a later mutation of the caller's data object cannot move a
-     * reference — and, since a handle can only reference handles built before it,
-     * the references between handles are acyclic.
-     */
     const snapshot = (identity, args) => replaceContainers(identity, args, ({ record }) => ({ ...record }));
     const defer = (origin, resource, identity, args) => {
         const handle = Object.freeze({
@@ -146,7 +119,6 @@ export function createTransactionPlanAssembler(contracts, protocol) {
             positions.set(entry, index);
             records.push(record);
         }
-        // Every reference must name a handle in this list; the earliest refusal wins.
         for (const [index, record] of records.entries()) {
             for (const { path, record: container } of referenceContainers(record.identity, record.args)) {
                 for (const [field, value] of Object.entries(container)) {
@@ -201,13 +173,6 @@ export function createTransactionPlanAssembler(contracts, protocol) {
                 fingerprint: await fingerprintOf(record, args),
             };
         };
-        /**
-         * The DA-17 fingerprint the validation layer recomputes. When it cannot be
-         * computed here, the validation layer cannot compute it either and answers
-         * the operation itself first — an invalid argument before the fingerprint
-         * step, a value JCS cannot encode as `V1001` at it — so the declared value
-         * is never compared and is left `null`.
-         */
         const fingerprintOf = async (record, args) => {
             const operation = { resource: record.resource, ...record.identity };
             try {