@aventara/core 0.1.0-pilot.0 → 0.1.0-pilot.2

package/dist/protocol/http-request.reader.js

@@ -1,36 +1,14 @@
 import { requestIdOf } from "../runtime/request-id.js";
 import { transportFailure } from "./protocol-failure.js";
 import { adoptedRequestId, normalizeHeaders, protocolIdentityOf, } from "./protocol-headers.js";
-/**
- * Reading a host's request before any route answers it: the request as a
- * value of its declared type, read once; the request id it is answered under
- * (Q13); its headers as one spelling (Q7); its identity headers; and the
- * route paths the protocol owns (§12.1). Shared by the decoders, the absence
- * responder and the contract responder, so each reads a request one way.
- */
-/** `<entrypoint>/_resources/:resource/:family/:variant` (§12.1). */
 const OPERATION_ROUTE = /^\/_resources\/([^/]*)\/([^/]*)\/([^/]*)$/;
-/** `POST <entrypoint>/_transactions` (§12.1). */
 export const TRANSACTIONS_ROUTE = "/_transactions";
-/** `GET <entrypoint>/_contract` (§12.1, §12.5). */
 export const CONTRACT_ROUTE = "/_contract";
-/** The methods an operation or `/_transactions` route accepts: `POST`, only (§12.2). */
 export const POST_ONLY = Object.freeze(["POST"]);
-/** The methods the contract route accepts: `GET`, only (§12.2). */
 export const GET_ONLY = Object.freeze(["GET"]);
-/**
- * Whether a path lies in the protocol's namespace: underscore-prefixed paths
- * beneath the entrypoint are reserved for framework facilities; every other
- * path is the host's (§12.1).
- */
 export function isProtocolPath(path) {
     return path.startsWith("/_");
 }
-/**
- * The host's value read as a request, or — when it is not an
- * `AvProtocolRequest` at all — the `400 A2000` answering it, under a minted
- * id (the director, 2026-10-05).
- */
 export function readRequest(received) {
     const request = wellFormedRequest(received);
     if (request === undefined) {
@@ -45,10 +23,6 @@ export function readRequest(received) {
         protocol: protocolIdentityOf(headers),
     };
 }
-/**
- * The three segments of an operation route, each URL-decoded and none empty
- * (§12.6 refuses an empty-resource route); `undefined` when it is not one.
- */
 export function operationRouteSegments(path) {
     const match = OPERATION_ROUTE.exec(path);
     if (match === null) {
@@ -61,7 +35,6 @@ export function operationRouteSegments(path) {
         ? { resource, family, variant }
         : undefined;
 }
-/** One path segment, URL-decoded once; `undefined` when it is not decodable. */
 function decodeSegment(segment) {
     try {
         return decodeURIComponent(segment);
@@ -70,11 +43,6 @@ function decodeSegment(segment) {
         return undefined;
     }
 }
-/**
- * The answer to a value that is not an `AvProtocolRequest`: `A2000` under a
- * freshly minted id — the value's own headers are not believed, so no id is
- * adopted from them.
- */
 function malformedRequest() {
     const requestId = requestIdOf(undefined);
     return {
@@ -83,20 +51,8 @@ function malformedRequest() {
         requestId,
     };
 }
-/**
- * The host's request, read ONCE into a value of its declared type, or
- * `undefined` when it is not one: not an object, a `method` or `path` that is
- * not text, `headers` that are not a record of text or lists of text, or a
- * `body` of neither arm (Q11) — raw content that is neither text nor bytes
- * has no byte count to measure. Each member is read once, so a getter cannot
- * answer one check and lie to the next, and one that throws — like any trap —
- * makes the request malformed rather than the decoder throw. A parsed body's
- * value is kept as the same object, never read into (§12.3).
- */
 function wellFormedRequest(received) {
     try {
-        // `null` and `undefined` throw here; any other non-object has no
-        // members, so its `method` is not text.
         const { method, path, headers, body } = received;
         const copied = headerRecord(headers);
         const armed = armedBody(body);
@@ -130,7 +86,6 @@ function headerRecord(headers) {
             return undefined;
         }
     }
-    // `fromEntries` defines each member, so a header named `__proto__` stays data.
     return Object.fromEntries(copied);
 }
 function armedBody(body) {

package/dist/protocol/http-response.encoder.d.ts

@@ -7,41 +7,40 @@ import type { TransactionResponse } from "../transactions/transaction-response.j
  * text, and adds nothing of the framework's.
  */
 export type AvProtocolResponse = {
-    /** `AvProtocol.httpStatus` of the envelope's code (§13.2). */
+    /** `AvProtocol.httpStatus` of the envelope's code. */
     readonly status: number;
     /**
      * The headers the framework owns on this response, canonically spelled:
-     * `Content-Type: application/json` and the `Aventara-Request-Id` it echoes
-     * (Q13).
+     * `Content-Type: application/json` and the `Aventara-Request-Id` it echoes.
      */
     readonly headers: Readonly<Record<string, string>>;
-    /** The JSON text of the envelope (§13.1), its data in wire forms (P1). */
+    /** The JSON text of the envelope, its data in wire forms. */
     readonly body: string;
 };
 /**
  * Where an encoder hands the raw failure behind an `A3003` — the binding's
- * diagnostics channel (the director, 2026-10-05) — with the plan step it
- * blames, if any. The wire never carries it (Q5).
+ * diagnostics channel — with the plan step it blames, if any. The wire never
+ * carries it.
  */
 export type UnencodableReport = (error: unknown, operation?: number) => void;
 /**
  * `protocol.encodeOperation(response, requestId)`: one operation's framework
- * response as the HTTP response a host writes. Status is the code's (§13.2);
- * `data` is wire-encoded (P1); `requestId` is echoed as `Aventara-Request-Id`
- * (Q13) — pass the id the request ran under, which the decoder supplies.
+ * response as the HTTP response a host writes. Status is the code's; `data` is
+ * wire-encoded; `requestId` is echoed as `Aventara-Request-Id` — pass the id the
+ * request ran under, which the decoder supplies.
  *
- * Total: a result it cannot encode — and a response whose code is not
- * allocated — answers `A3003` → 500 with the framework's own text, and none of
- * the result reaches the body.
+ * Total: a result it cannot encode — and a response whose code is not allocated —
+ * answers `A3003` → 500 with the framework's own text, and none of the result
+ * reaches the body.
  */
 export declare function encodeOperationResponse(response: OperationResponse, requestId: string, report?: UnencodableReport): AvProtocolResponse;
 /**
  * `protocol.encodeTransaction(response, requestId)`: the same for a plan's
- * response (§14). A committed plan is `200 A1009` — even when it created
- * something (P3) — with each operation's data wire-encoded in plan order by
- * the same walker as {@link encodeOperationResponse}; a rolled-back plan
- * answers its failing operation's own status (Q4). A step whose result cannot
- * be encoded answers `A3003` → 500 naming that step as `cause.operation`, as
- * every internal failure inside a plan does (Q5).
+ * response. A committed plan is `200 A1009` — even when it created something —
+ * with each operation's data wire-encoded in plan order by the same walker as
+ * {@link encodeOperationResponse}; a rolled-back plan answers its failing
+ * operation's own status. A step whose result cannot be encoded answers `A3003` →
+ * 500 naming that step as `cause.operation`, as every internal failure inside a
+ * plan does.
  */
 export declare function encodeTransactionResponse(response: TransactionResponse, requestId: string, report?: UnencodableReport): AvProtocolResponse;

package/dist/protocol/http-response.encoder.js

@@ -4,16 +4,6 @@ import { SERIALIZATION_FAILURE_MESSAGE } from "../runtime/error-boundary.js";
 import { operationFailure, } from "../runtime/operation-response.js";
 import { httpStatus } from "./http-status.table.js";
 import { headers } from "./protocol-headers.js";
-/**
- * `protocol.encodeOperation(response, requestId)`: one operation's framework
- * response as the HTTP response a host writes. Status is the code's (§13.2);
- * `data` is wire-encoded (P1); `requestId` is echoed as `Aventara-Request-Id`
- * (Q13) — pass the id the request ran under, which the decoder supplies.
- *
- * Total: a result it cannot encode — and a response whose code is not
- * allocated — answers `A3003` → 500 with the framework's own text, and none of
- * the result reaches the body.
- */
 export function encodeOperationResponse(response, requestId, report) {
     try {
         return written(response, toWire(response.data, new Set()), requestId);
@@ -23,15 +13,6 @@ export function encodeOperationResponse(response, requestId, report) {
         return written(serializationFailure(), null, requestId);
     }
 }
-/**
- * `protocol.encodeTransaction(response, requestId)`: the same for a plan's
- * response (§14). A committed plan is `200 A1009` — even when it created
- * something (P3) — with each operation's data wire-encoded in plan order by
- * the same walker as {@link encodeOperationResponse}; a rolled-back plan
- * answers its failing operation's own status (Q4). A step whose result cannot
- * be encoded answers `A3003` → 500 naming that step as `cause.operation`, as
- * every internal failure inside a plan does (Q5).
- */
 export function encodeTransactionResponse(response, requestId, report) {
     if (response.code !== "A1009") {
         return encodeOperationResponse(response, requestId, report);
@@ -53,18 +34,12 @@ export function encodeTransactionResponse(response, requestId, report) {
         return written(serializationFailure(step), null, requestId);
     }
 }
-/** The one A3003 envelope: the framework's text, plus the step in a plan. */
 function serializationFailure(operation) {
     return operationFailure("A3003", {
         message: SERIALIZATION_FAILURE_MESSAGE,
         ...(operation === undefined ? {} : { operation }),
     });
 }
-/**
- * Writes an envelope whose data is already in wire form. Throws for a code
- * with no status (only an untyped caller can supply one), which every caller
- * turns into `A3003`.
- */
 function written(response, wireData, requestId) {
     const { code, cause } = response;
     if (!Object.hasOwn(httpStatus, code)) {
@@ -79,37 +54,9 @@ function written(response, wireData, requestId) {
         body: JSON.stringify({ data: wireData, code, cause }),
     };
 }
-/**
- * What the walker throws for a value with no wire form — never past an
- * encoder, which answers `A3003` and hands it to the diagnostics channel, so
- * it names the offending value as its `cause` for the developer.
- */
 function unencodable(value) {
     return new TypeError("A result value has no wire form.", { cause: value });
 }
-/**
- * The P1 wire walker: a result's runtime value as the JSON value the wire
- * carries. Value-directed, with no Contract read: exactly four runtime classes
- * are scalars whose wire form differs from their runtime form (A6), and a
- * `json` value is a `JsonValue`, which contains none of them —
- *
- * - `bigint` → its base-10 string;
- * - `Decimal` (core's) → its decimal string (not through `toJSON`, Q16);
- * - `Date` → `toISOString()`, which must match the datetime wire grammar — an
- *   invalid Date, or a year the grammar's four digits cannot spell, has none;
- * - `Uint8Array` → canonical base64.
- *
- * Everything else must already be JSON: `null`, a boolean, a string, a finite
- * number, a list, or a plain record (prototype `Object.prototype` or `null`).
- * A record member whose value is `undefined` is omitted, as JSON omits it; any
- * other value — `undefined` in a list or a hole, a non-finite number, a
- * function, a symbol, any other object, a cycle — has no wire form, and the
- * walk throws. So does a getter or a proxy that throws; the encoders catch all
- * of it.
- *
- * `ancestors` holds the containers on the current path only, so a shared
- * reference is encoded twice, as JSON writes it, while a cycle is refused.
- */
 function toWire(value, ancestors) {
     switch (typeof value) {
         case "string":
@@ -163,11 +110,6 @@ function toWireList(list, ancestors) {
     }
     return wire;
 }
-/**
- * One list element. A hole has no wire form (JSON would write `null`), and is
- * never filled from the prototype chain; an `undefined` element has none
- * either ({@link toWire}).
- */
 function toWireElement(list, index, ancestors) {
     if (!Object.hasOwn(list, index)) {
         throw unencodable(list);
@@ -186,6 +128,5 @@ function toWireRecord(record, ancestors) {
             members.push([key, toWire(member, ancestors)]);
         }
     }
-    // `fromEntries` defines each member, so an own `__proto__` key stays data.
     return Object.fromEntries(members);
 }

package/dist/protocol/http-status.table.d.ts

@@ -1,18 +1,14 @@
 import type { OperationCode } from "../runtime/operation-response.js";
 /**
- * `AvProtocol.httpStatus` — the HTTP status each A-code carries (§13.2's
- * "default HTTP" column), as passive data.
+ * `AvProtocol.httpStatus` — the HTTP status each A-code carries, as passive data.
  *
- * Status is a function of the code alone (N14): §13.2 gives every code exactly
- * one status, and its success table's two 201s are exactly `A1002` and `A1003`.
- * So this one table serves both encoders — an operation's response and a
- * plan's — and a rolled-back plan answers its failing operation's own status
- * (Q4). The status is the coarse signal; the A-code is the exact one.
+ * So this one table serves both encoders — an operation's response and a plan's —
+ * and a rolled-back plan answers its failing operation's own status. The status is
+ * the coarse signal; the A-code is the exact one.
  *
- * Total by type: the literal `satisfies` the mapped type over `OperationCode`,
- * so a code added to core does not compile until its status is written here.
- * Passive (P5): numbers only, frozen, emitted by value where a consumer needs
- * it.
+ * Total by type: the literal `satisfies` the mapped type over `OperationCode`, so
+ * a code added to core does not compile until its status is written here. Passive:
+ * numbers only, frozen, emitted by value where a consumer needs it.
  */
 export declare const httpStatus: {
     readonly [C in OperationCode]: number;

package/dist/protocol/http-status.table.js

@@ -1,18 +1,3 @@
-/**
- * `AvProtocol.httpStatus` — the HTTP status each A-code carries (§13.2's
- * "default HTTP" column), as passive data.
- *
- * Status is a function of the code alone (N14): §13.2 gives every code exactly
- * one status, and its success table's two 201s are exactly `A1002` and `A1003`.
- * So this one table serves both encoders — an operation's response and a
- * plan's — and a rolled-back plan answers its failing operation's own status
- * (Q4). The status is the coarse signal; the A-code is the exact one.
- *
- * Total by type: the literal `satisfies` the mapped type over `OperationCode`,
- * so a code added to core does not compile until its status is written here.
- * Passive (P5): numbers only, frozen, emitted by value where a consumer needs
- * it.
- */
 export const httpStatus = Object.freeze({
     A1000: 200,
     A1001: 200,
@@ -43,6 +28,7 @@ export const httpStatus = Object.freeze({
     A3001: 500,
     A3002: 500,
     A3003: 500,
+    A3004: 500,
     A4000: 401,
     A4001: 403,
     A4002: 403,

package/dist/protocol/index.d.ts

@@ -1,11 +1,11 @@
 /**
  * `@aventara/core/protocol` — the HTTP protocol, as passive data and pure
- * functions over core (§Q1). It mounts nothing and imports no HTTP library.
+ * functions over core. It mounts nothing and imports no HTTP library.
  *
- * The direction is one-way: this entry may import core's internals, and no
- * module of core's execution side imports anything under `protocol/`
- * (`protocol-direction.spec.ts`). The main `@aventara/core` entry exports no
- * name from here.
+ * The direction is one-way: this entry may import core's internals, and no module
+ * of core's execution side imports anything under `protocol/`
+ * (`protocol-direction.spec.ts`). The main `@aventara/core` entry exports no name
+ * from here.
  */
 export * as AvProtocol from "./av-protocol.js";
 export type { AvProtocolRequest } from "./http-request.decoder.js";

package/dist/protocol/index.js

@@ -1,10 +1 @@
-/**
- * `@aventara/core/protocol` — the HTTP protocol, as passive data and pure
- * functions over core (§Q1). It mounts nothing and imports no HTTP library.
- *
- * The direction is one-way: this entry may import core's internals, and no
- * module of core's execution side imports anything under `protocol/`
- * (`protocol-direction.spec.ts`). The main `@aventara/core` entry exports no
- * name from here.
- */
 export * as AvProtocol from "./av-protocol.js";

package/dist/protocol/operation-response.guard.d.ts

@@ -1,27 +1,20 @@
 import { type OperationResponse } from "../runtime/operation-response.js";
 /**
- * `AvProtocol.isOperationResponse` — whether a parsed response body is a
- * framework envelope (§13.1), the boundary §13.5 draws: an envelope's A1xxx
- * resolves and its every other code is a `FrameworkError`; anything else means
- * no envelope arrived, which a client raises as `TransportError`. The HTTP
- * status plays no part — a code is read even at an unexpected status.
+ * The HTTP status plays no part — a code is read even at an unexpected status.
  *
- * `value` is the body as parsed JSON, or `undefined` when there was no body or
- * it was not JSON (neither is an envelope). An envelope here is:
+ * `value` is the body as parsed JSON, or `undefined` when there was no body or it
+ * was not JSON (neither is an envelope). An envelope here is:
  *
  * - an object (not an array) with an own `data` member and an allocated `code`;
- * - for an A1xxx code, a `cause` of exactly `null`, and `data` of `null` when
- *   the code is `A1001`;
- * - for every other code, `data` of `null` and a cause: an object whose
- *   `message` is a string, whose `issues`, if present, is a list of objects each
- *   with an allocated V-code, a string `message` and, if present, a `path` of
- *   strings and integers, and whose `operation`, if present, is a non-negative
- *   integer.
+ * - for an A1xxx code, a `cause` of exactly `null`, and `data` of `null` when the
+ *   code is `A1001`;
+ * - for every other code, `data` of `null` and a cause: an object whose `message`
+ *   is a string, whose `issues`, if present, is a list of objects each with an
+ *   allocated V-code, a string `message` and, if present, a `path` of strings and
+ *   integers, and whose `operation`, if present, is a non-negative integer.
  *
- * Members §13.1 does not define are no reason to refuse; a reader drops them.
- *
- * The generated client's own check (`envelopeOf` in its emitted transport) is
- * held to agree with this one on every row of the fixture corpus's family 11
- * (R5, `packages/client`), so the two cannot drift apart silently.
+ * The generated client's own check (`envelopeOf` in its emitted transport) is held
+ * to agree with this one on every row of the fixture corpus's family 11, so the
+ * two cannot drift apart silently.
  */
 export declare function isOperationResponse(value: unknown): value is OperationResponse;

package/dist/protocol/operation-response.guard.js

@@ -1,30 +1,5 @@
 import { VALIDATION_CODES } from "../operations/validation-code.js";
 import { OPERATION_CODES, } from "../runtime/operation-response.js";
-/**
- * `AvProtocol.isOperationResponse` — whether a parsed response body is a
- * framework envelope (§13.1), the boundary §13.5 draws: an envelope's A1xxx
- * resolves and its every other code is a `FrameworkError`; anything else means
- * no envelope arrived, which a client raises as `TransportError`. The HTTP
- * status plays no part — a code is read even at an unexpected status.
- *
- * `value` is the body as parsed JSON, or `undefined` when there was no body or
- * it was not JSON (neither is an envelope). An envelope here is:
- *
- * - an object (not an array) with an own `data` member and an allocated `code`;
- * - for an A1xxx code, a `cause` of exactly `null`, and `data` of `null` when
- *   the code is `A1001`;
- * - for every other code, `data` of `null` and a cause: an object whose
- *   `message` is a string, whose `issues`, if present, is a list of objects each
- *   with an allocated V-code, a string `message` and, if present, a `path` of
- *   strings and integers, and whose `operation`, if present, is a non-negative
- *   integer.
- *
- * Members §13.1 does not define are no reason to refuse; a reader drops them.
- *
- * The generated client's own check (`envelopeOf` in its emitted transport) is
- * held to agree with this one on every row of the fixture corpus's family 11
- * (R5, `packages/client`), so the two cannot drift apart silently.
- */
 export function isOperationResponse(value) {
     if (!isRecord(value) || !Object.hasOwn(value, "data")) {
         return false;
@@ -72,10 +47,6 @@ function isValidationIssue(value) {
         (Array.isArray(path) &&
             everyElement(path, (segment) => typeof segment === "string" || Number.isInteger(segment))));
 }
-/**
- * Every element, holes included (a hole reads as `undefined`, which no member
- * test accepts) — unlike `Array.prototype.every`, which skips them.
- */
 function everyElement(list, test) {
     for (const element of list) {
         if (!test(element)) {

package/dist/protocol/protocol-failure.d.ts

@@ -1,37 +1,40 @@
 import { type AvProtocolResponse } from "./http-response.encoder.js";
+import type { IdentityHeaderName } from "./protocol-headers.js";
 /**
- * The four transport codes (§13.2): failures of the HTTP request itself, which
- * the protocol answers before any operation exists, so no execution path
- * produces them (N4). Module type — not an entry export.
+ * The four transport codes: failures of the HTTP request itself, which the
+ * protocol answers before any operation exists, so no execution path produces
+ * them. Module type — not an entry export.
  */
 export type TransportFailureCode = "A2000" | "A2010" | "A2011" | "A2012";
+/**
+ * pilot.1 — the `400 A2000` answering a request that did not send an identity
+ * header: its message names the missing header or headers, and echoes nothing the
+ * request sent — so a developer calling the API by hand learns what to add.
+ */
+export declare function identityHeadersMissing(missing: readonly IdentityHeaderName[], requestId: string): AvProtocolResponse;
 /**
  * `protocol.failure(code, requestId?)` / `protocol.failure("A2012", requestId,
- * allow)` (§5.9; a bound member, ruled 2026-10-05): a transport code as the
- * complete framework response — the envelope `{ data: null, code, cause: {
- * message } }`, encoded exactly as `protocol.encodeOperation` encodes it, at
- * the code's status.
+ * allow)`: a transport code as the complete framework response — the envelope `{
+ * data: null, code, cause: { message } }`, encoded exactly as
+ * `protocol.encodeOperation` encodes it, at the code's status.
  *
- * The decoders produce their transport failures through it. A host that
- * parses the body itself (Q11's parsed arm) answers its own parser's failures
- * with it — `A2000` for text that is not JSON, `A2010` for a body over the
- * limit, `A2011` for another content type.
+ * The decoders produce their transport failures through it. A host that parses the
+ * body itself answers its own parser's failures with it — `A2000` for text that is
+ * not JSON, `A2010` for a body over the limit, `A2011` for another content type.
  *
- * `requestId` is echoed as `Aventara-Request-Id` (Q13): pass the id the
- * decoder gave the request when there is one. When there is none — or it is
- * empty — core mints one through its one helper (Q10), so a failure is never
- * refused or left uncorrelated.
+ * `requestId` is echoed as `Aventara-Request-Id`: pass the id the decoder gave the
+ * request when there is one. When there is none — or it is empty — core mints one
+ * through its one helper, so a failure is never refused or left uncorrelated.
  *
  * `allow` belongs to `A2012`, and `A2012` requires it: every 405 carries the
- * `Allow` header naming the methods its route DOES accept (RFC 9110 §15.5.6;
- * the director, 2026-10-05), joined with `", "` — `[]` is RFC 9110's "no
- * method", still a header. `failure` knows no route, so the caller names the
- * methods; the decoders pass `["POST"]`.
+ * `Allow` header naming the methods its route DOES accept, joined with `", "` —
+ * `[]` is RFC 9110's "no method", still a header. `failure` knows no route, so the
+ * caller names the methods; the decoders pass `["POST"]`.
  *
- * A code outside the four, `A2012` without `allow`, `allow` with any other
- * code, or a method that is not an RFC 9110 token is a programming error that
- * the type already refuses; an untyped caller gets a `TypeError`, and no
- * envelope or header is invented for it.
+ * A code outside the four, `A2012` without `allow`, `allow` with any other code,
+ * or a method that is not an RFC 9110 token is a programming error that the type
+ * already refuses; an untyped caller gets a `TypeError`, and no envelope or header
+ * is invented for it.
  */
 export declare function transportFailure(code: "A2012", requestId: string | undefined, allow: readonly string[]): AvProtocolResponse;
 export declare function transportFailure(code: Exclude<TransportFailureCode, "A2012">, requestId?: string): AvProtocolResponse;

package/dist/protocol/protocol-failure.js

@@ -1,18 +1,18 @@
 import { operationFailure } from "../runtime/operation-response.js";
 import { requestIdOf } from "../runtime/request-id.js";
 import { encodeOperationResponse, } from "./http-response.encoder.js";
-/**
- * The framework's own text for each transport code. It names the defect and
- * never echoes the request (§13.5): no body, no content type, no method, no
- * configured limit.
- */
 const TRANSPORT_FAILURE_MESSAGES = Object.freeze({
     A2000: "The request is malformed and cannot be interpreted.",
     A2010: "The request body exceeds the maximum request size.",
     A2011: "The request content type is not supported; send application/json.",
     A2012: "The HTTP method is not allowed on this framework route.",
 });
-/** An HTTP method as RFC 9110 §9.1 spells one: a `token` (§5.6.2). */
+export function identityHeadersMissing(missing, requestId) {
+    const named = missing.length === 1
+        ? `The ${missing[0]} header is`
+        : `The ${missing.join(" and ")} headers are`;
+    return encodeOperationResponse(operationFailure("A2000", { message: `${named} missing.` }), requestIdOf({ requestId }));
+}
 const METHOD_TOKEN = /^[!#$%&'*+.^_`|~0-9A-Za-z-]+$/;
 export function transportFailure(code, requestId, allow) {
     if (!Object.hasOwn(TRANSPORT_FAILURE_MESSAGES, code)) {

package/dist/protocol/protocol-headers.d.ts

@@ -3,19 +3,18 @@ import type { ClientProtocolIdentity } from "../runtime/operation-request.js";
  * `AvProtocol.headers` — the header names the protocol owns, as passive data.
  *
  * - `protocolVersion`, `contractHash`: the two identity headers every
- *   generated-client resource and transaction request sends (§12.4); the
- *   `_contract` request needs neither.
- * - `requestId`: the correlation header (Q13). A valid one is adopted as the
- *   request's id, an invalid one ignored, and every framework-produced
- *   response echoes it.
+ *   generated-client resource and transaction request sends; the `_contract`
+ *   request needs neither.
+ * - `requestId`: the correlation header. A valid one is adopted as the request's
+ *   id, an invalid one ignored, and every framework-produced response echoes it.
  *
- * Spelled as the canonical wire text. HTTP header names are case-insensitive
- * (§12.4), so a reader matches them without regard to case; these spellings are
- * what the framework and the generated client SEND.
+ * Spelled as the canonical wire text. HTTP header names are case-insensitive, so a
+ * reader matches them without regard to case; these spellings are what the
+ * framework and the generated client SEND.
  *
- * Passive data (P5): strings only, frozen, so a consumer — the client generator
- * emits it by value into generated source — can neither mutate it nor receive
- * anything `JSON.stringify` would drop or reshape.
+ * Passive data: strings only, frozen, so a consumer — the client generator emits
+ * it by value into generated source — can neither mutate it nor receive anything
+ * `JSON.stringify` would drop or reshape.
  */
 export declare const headers: Readonly<{
     readonly protocolVersion: "Aventara-Protocol-Version";
@@ -25,10 +24,9 @@ export declare const headers: Readonly<{
 /** A request's headers as a host hands them over (`AvProtocolRequest.headers`). */
 type ReceivedHeaders = Readonly<Record<string, string | readonly string[] | undefined>>;
 /**
- * The request's headers as one spelling (Q7, accepted 2026-10-04): names
- * lower-cased (they are case-insensitive, §12.4), a repeated header's values —
- * a list, or one name received in several casings — joined with `", "` in the
- * order received (RFC 9110 §5.3), and an `undefined` entry or an empty list
+ * The request's headers as one spelling: names lower-cased, a repeated header's
+ * values — a list, or one name received in several casings — joined with `", "` in
+ * the order received (RFC 9110 §5.3), and an `undefined` entry or an empty list
  * dropped as absent. Values are otherwise as received. This is what a client
  * request's `transport.headers` carries to the developer's pipelines, and what
  * every header read below reads.
@@ -43,24 +41,29 @@ export declare function normalizeHeaders(received: ReceivedHeaders): Readonly<Re
  */
 export declare function headerValue(normalized: Readonly<Record<string, string>>, name: string): string | undefined;
 /**
- * The identity headers (§12.4) as the `ClientProtocolIdentity` core checks, or
- * `undefined` when either is ABSENT — a request without them is malformed
- * (`A2000`; the architect, 2026-10-05): it does not say which protocol and
- * ClientContract it speaks, so there is nothing to compare.
+ * The identity headers as the `ClientProtocolIdentity` core checks, or `undefined`
+ * when either is ABSENT — a request without them is malformed: it does not say
+ * which protocol and ClientContract it speaks, so there is nothing to compare.
  *
  * Present values are read, never judged: whether they match is the Framework
  * Validation Layer's call (cross-phase invariant 13), made by core's one
- * stale-client check. A present version that is not a decimal integer (no
- * sign, no leading zero) reads as `NaN`, so it cannot match (`A2006`); a
- * present hash is passed as received (`A2005` unless it is the current one).
- * Present includes empty: a header sent with no value was still sent.
+ * stale-client check. A present version that is not a decimal integer (no sign, no
+ * leading zero) reads as `NaN`, so it cannot match (`A2006`); a present hash is
+ * passed as received (`A2005` unless it is the current one). Present includes
+ * empty: a header sent with no value was still sent.
  */
 export declare function protocolIdentityOf(normalized: Readonly<Record<string, string>>): ClientProtocolIdentity | undefined;
 /**
- * Q13 (the architect's, 2026-10-04): the request's `Aventara-Request-Id` when
- * it is 1–128 characters of visible ASCII; otherwise `undefined` — the header
- * is ignored, never refused, and core mints an id instead. A repeated header
- * joins with `", "`, which holds a space, so it is never adopted.
+ * The identity headers a request did not send, in the order the framework sends
+ * them — what the `A2000` answering it names (pilot.1). Empty exactly when {@link
+ * protocolIdentityOf} reads an identity.
+ */
+export declare function missingIdentityHeaders(normalized: Readonly<Record<string, string>>): readonly IdentityHeaderName[];
+/** The two identity headers' names, as the framework spells them. */
+export type IdentityHeaderName = (typeof headers)["protocolVersion"] | (typeof headers)["contractHash"];
+/**
+ * A repeated header joins with `", "`, which holds a space, so it is never
+ * adopted.
  */
 export declare function adoptedRequestId(normalized: Readonly<Record<string, string>>): string | undefined;
 export {};