@aventara/core 0.1.0-pilot.1 → 0.1.0-pilot.3

package/dist/runtime/operation-runtime.d.ts

@@ -6,6 +6,7 @@ import type { ResolvedFrameworkConfig } from "../config/config.resolver.js";
 import type { Contract } from "../contracts/contract.js";
 import type { OperationValidationOptions, SemanticOperationArguments } from "../operations/operation-validator.js";
 import type { FrameworkTransactionRequest } from "../transactions/transaction-request.js";
+import { type CreateRequirementTable } from "./create-requirement.js";
 import type { DiagnosticsReporter } from "./diagnostics-reporter.js";
 import type { ClientProtocolIdentity, FrameworkOperationRequest, OperationExecutionRequest } from "./operation-request.js";
 import type { OperationFailureResponse, OperationResponse } from "./operation-response.js";
@@ -15,12 +16,14 @@ export type OperationRuntimeDependencies<M extends AdapterModel> = {
     readonly config: ResolvedFrameworkConfig<M>;
 };
 /**
- * What a validated operation's pipeline needs: everything except the root
- * Adapter. Its single Adapter call goes through the executor passed beside
- * it (D-706), so inside a transaction plan the root Adapter is unreachable by
- * type (C-724).
+ * What a validated operation's pipeline needs: everything except the root Adapter.
+ * Its single Adapter call goes through the executor passed beside it, so inside a
+ * transaction plan the root Adapter is unreachable by type.
  */
-export type OperationPipelineDependencies<M extends AdapterModel> = Omit<OperationRuntimeDependencies<M>, "adapter">;
+export type OperationPipelineDependencies<M extends AdapterModel> = Omit<OperationRuntimeDependencies<M>, "adapter"> & {
+    /** The Adapter's create requirements, read once at construction. */
+    readonly createRequirements: CreateRequirementTable;
+};
 /**
  * The executor core owns no diagnostics channel: the framework factory owns
  * it and hands in one reporter already bound to this request, so every
@@ -35,11 +38,11 @@ export declare function createOperationRuntime<M extends AdapterModel>(dependenc
 /** Validates the request-level protocol identity shared by both execution seams. */
 export declare function validateProtocolIdentity(contracts: FrameworkContracts, request: FrameworkOperationRequest | FrameworkTransactionRequest): OperationFailureResponse | undefined;
 /**
- * The stale-client check (§19.4, cross-phase invariant 15) on one client
- * protocol identity: the protocol version first (`A2006`), then the
- * ClientContract hash (`A2005`). Exact match only. The one implementation —
- * the protocol's decoders and absence answers (`@aventara/core/protocol`) call
- * it too, so a stale client hears the same envelope whichever layer answers.
+ * The stale-client check on one client protocol identity: the protocol version
+ * first (`A2006`), then the ClientContract hash (`A2005`). Exact match only. The
+ * one implementation — the protocol's decoders and absence answers
+ * (`@aventara/core/protocol`) call it too, so a stale client hears the same
+ * envelope whichever layer answers.
  */
 export declare function protocolIdentityFailure(contracts: FrameworkContracts, protocol: ClientProtocolIdentity): OperationFailureResponse | undefined;
 export type ValidatedOperationArguments = {
@@ -53,23 +56,22 @@ export type ValidatedOperationArguments = {
 export declare function validateOperationRequest(contract: Contract, request: FrameworkOperationRequest, options?: OperationValidationOptions): ValidatedOperationArguments;
 /**
  * Everything after the Framework Validation Layer: the developer/runtime path
- * wrapped in the post-validation error boundary. Validation failures never
- * reach this function, so developer filters never see them.
+ * wrapped in the post-validation error boundary. Validation failures never reach
+ * this function, so developer filters never see them.
  *
- * `executor` is the operation's single Adapter call site (D-706): standalone
- * execution passes the Adapter itself, a transaction plan passes the
- * transaction-scoped executor its Adapter callback received. Every call owns
- * one AdapterBoundary, so A3001/A3000 origin stays classified per operation.
+ * `executor` is the operation's single Adapter call site: standalone execution
+ * passes the Adapter itself, a transaction plan passes the transaction-scoped
+ * executor its Adapter callback received. Every call owns one AdapterBoundary, so
+ * A3001/A3000 origin stays classified per operation.
  *
- * The parameter types keep two values out of reach: `dependencies` carries no
- * root Adapter, so the executor is the only Adapter this function can call,
- * and `request` carries no `arguments`, so no stage can read the unvalidated
- * view instead of `validatedArguments`.
+ * The parameter types keep two values out of reach: `dependencies` carries no root
+ * Adapter, so the executor is the only Adapter this function can call, and
+ * `request` carries no `arguments`, so no stage can read the unvalidated view
+ * instead of `validatedArguments`.
  *
  * `argumentsPath` is the framework's own address for these arguments —
  * `["arguments"]` standalone, `["operations", i, "args"]` inside a plan. The
  * response boundary needs it to decide whether a thrower-supplied issue path
- * denotes the caller's own arguments or is unvouched text (ADR 0008
- * decision 4).
+ * denotes the caller's own arguments or is unvouched text.
  */
 export declare function executeValidatedOperation<M extends AdapterModel>(dependencies: OperationPipelineDependencies<M>, request: OperationExecutionRequest, contract: Contract, validatedArguments: unknown, argumentsPath: readonly (string | number)[], executor: AdapterOperationExecutor<M>, report: DiagnosticsReporter): Promise<OperationResponse>;

package/dist/runtime/operation-runtime.js

@@ -1,13 +1,14 @@
 import { AVENTARA_PROTOCOL_VERSION } from "../contracts/contract-protocol.js";
 import { validateOperationArguments } from "../operations/operation-validator.js";
 import { materializeReadOperation, planReadOperation, } from "./computed-read-runtime.js";
+import { missingCreateValues, } from "./create-requirement.js";
 import { AdapterBoundary, OPERATION_ARGUMENTS_PATH, resolveOperationFailure, sanitizeOperationFailure, } from "./error-boundary.js";
 import { applyWriteFieldBehaviors, stripVirtualMutationInput, } from "./mutation-planner.js";
 import { internalFailure, operationFailure } from "./operation-response.js";
 import { mapOperationOutcome, mapValidationOutcome } from "./outcome-mapper.js";
 import { validateOperationOutput } from "./output-validator.js";
+import { refusePipeOutput } from "./pipe-output.validator.js";
 import { normalizeOperationScalarValues } from "./scalar-runtime.js";
-/** Selects the Contract of the request's execution scope for both execution seams. */
 export function activeContract(contracts, request) {
     return request.scope === "application"
         ? contracts.application
@@ -35,13 +36,6 @@ function forbidden() {
         message: "Operation denied by a framework guard.",
     });
 }
-/**
- * Output validation is framework validation (spec 16.5), so its failure is
- * framework-owned however it arrives. Reading the result can itself throw -
- * an Adapter row may carry an accessor that explodes - and without this
- * boundary that throw would leave through the post-validation boundary and be
- * offered to developer filters, which could relabel it as any outcome.
- */
 function outputAccepted(contract, request, projection, data, report) {
     try {
         return validateOperationOutput(contract, request, projection, data).ok;
@@ -51,8 +45,12 @@ function outputAccepted(contract, request, projection, data, report) {
         return false;
     }
 }
-/** Creates the transport-independent operation executor owned by core. */
 export function createOperationRuntime(dependencies) {
+    const pipelineDependencies = {
+        contracts: dependencies.contracts,
+        config: dependencies.config,
+        createRequirements: dependencies.adapter.createRequirements ?? {},
+    };
     return async (request, report) => {
         let validated;
         try {
@@ -67,14 +65,9 @@ export function createOperationRuntime(dependencies) {
         if (!validated.ok) {
             return validated.response;
         }
-        return executeValidatedOperation(dependencies, request, validated.contract, validated.arguments, OPERATION_ARGUMENTS_PATH, dependencies.adapter, report);
+        return executeValidatedOperation(pipelineDependencies, request, validated.contract, validated.arguments, OPERATION_ARGUMENTS_PATH, dependencies.adapter, report);
     };
 }
-/**
- * The Framework Validation Layer (spec 16), inside its own boundary: an
- * unexpected throw here is sanitized directly and reaches zero developer
- * filters, exactly like a validation failure (spec 16.5, 17.3).
- */
 function validateOperation(dependencies, request) {
     const protocolFailure = validateProtocolIdentity(dependencies.contracts, request);
     if (protocolFailure !== undefined) {
@@ -87,19 +80,11 @@ function validateOperation(dependencies, request) {
     }
     return { ok: true, contract, arguments: validation.arguments };
 }
-/** Validates the request-level protocol identity shared by both execution seams. */
 export function validateProtocolIdentity(contracts, request) {
     return request.scope === "client"
         ? protocolIdentityFailure(contracts, request.protocol)
         : undefined;
 }
-/**
- * The stale-client check (§19.4, cross-phase invariant 15) on one client
- * protocol identity: the protocol version first (`A2006`), then the
- * ClientContract hash (`A2005`). Exact match only. The one implementation —
- * the protocol's decoders and absence answers (`@aventara/core/protocol`) call
- * it too, so a stale client hears the same envelope whichever layer answers.
- */
 export function protocolIdentityFailure(contracts, protocol) {
     if (protocol.version !== AVENTARA_PROTOCOL_VERSION) {
         return operationFailure("A2006", {
@@ -113,7 +98,6 @@ export function protocolIdentityFailure(contracts, protocol) {
     }
     return undefined;
 }
-/** Reusable per-operation Framework Validation Layer argument seam. */
 export function validateOperationRequest(contract, request, options) {
     const validation = validateOperationArguments(contract, request, options);
     if (!validation.ok) {
@@ -130,27 +114,6 @@ export function validateOperationRequest(contract, request, options) {
 function rejected(response) {
     return { ok: false, response };
 }
-/**
- * Everything after the Framework Validation Layer: the developer/runtime path
- * wrapped in the post-validation error boundary. Validation failures never
- * reach this function, so developer filters never see them.
- *
- * `executor` is the operation's single Adapter call site (D-706): standalone
- * execution passes the Adapter itself, a transaction plan passes the
- * transaction-scoped executor its Adapter callback received. Every call owns
- * one AdapterBoundary, so A3001/A3000 origin stays classified per operation.
- *
- * The parameter types keep two values out of reach: `dependencies` carries no
- * root Adapter, so the executor is the only Adapter this function can call,
- * and `request` carries no `arguments`, so no stage can read the unvalidated
- * view instead of `validatedArguments`.
- *
- * `argumentsPath` is the framework's own address for these arguments —
- * `["arguments"]` standalone, `["operations", i, "args"]` inside a plan. The
- * response boundary needs it to decide whether a thrower-supplied issue path
- * denotes the caller's own arguments or is unvouched text (ADR 0008
- * decision 4).
- */
 export async function executeValidatedOperation(dependencies, request, contract, validatedArguments, argumentsPath, executor, report) {
     const scopeConfig = activeScopeConfig(dependencies.config, request);
     const pipelines = scopeConfig.pipelines;
@@ -169,13 +132,22 @@ export async function executeValidatedOperation(dependencies, request, contract,
                 return forbidden();
             }
         }
-        for (const pipe of pipelines.pipes) {
+        for (const [index, pipe] of pipelines.pipes.entries()) {
             const nextArgs = await pipe(args, pipelineContext(contract, request, args));
             if (nextArgs !== undefined) {
                 args = nextArgs;
             }
+            const refused = refusePipeOutput({ core: dependencies.contracts.core, active: contract }, request, args, pipe, index);
+            if (refused !== undefined) {
+                report(refused.error, "A3004");
+                return refused.response;
+            }
         }
         args = await applyWriteFieldBehaviors({ core: dependencies.contracts.core, active: contract }, scopeConfig.behaviors, request, args, () => pipelineContext(contract, request, args));
+        const missing = missingCreateValues(contract, dependencies.createRequirements, request, args, argumentsPath);
+        if (missing.length > 0) {
+            return mapValidationOutcome(missing);
+        }
         for (const hook of pipelines.hooks.before) {
             await hook(pipelineContext(contract, request, args));
         }
@@ -189,12 +161,6 @@ export async function executeValidatedOperation(dependencies, request, contract,
         let invoke = async () => {
             const readPlan = planReadOperation(dependencies.contracts.core, contract, scopeConfig.behaviors, request, args);
             const adapterArguments = await stripVirtualMutationInput({ core: dependencies.contracts.core, active: contract }, request, readPlan.arguments);
-            // `family` and `variant` are a correlated pair, so they travel as one
-            // OperationIdentity value: naming them separately would let any family
-            // pair with any variant. Only `resource` is cast, and only to `M`'s
-            // key union - the runtime check standing in for the compiler is
-            // `validateOperationArguments`, which has already rejected any
-            // resource name the active Contract does not carry.
             const identity = request;
             const adapterData = await adapterBoundary.execute(() => executor.execute({
                 ...identity,

package/dist/runtime/outcome-mapper.js

@@ -1,8 +1,4 @@
 import { internalFailure, operationFailure, operationNoMatch, operationSuccess, } from "./operation-response.js";
-/**
- * Spec section 13.2 success table, resource-agnostic. The mapped key type
- * makes the compiler reject a missing or unknown variant.
- */
 const OUTCOME_TABLE = {
     "find.first": { success: "A1000", absence: "no-match" },
     "find.unique": { success: "A1000", absence: "not-found" },
@@ -21,12 +17,6 @@ const OUTCOME_TABLE = {
     "delete.count": { success: "A1007" },
     "upsert.unique": { success: "A1008" },
 };
-/**
- * `family` and `variant` are correlated on `OperationIdentity`, but the
- * template built from them is not: it spans every family/variant pair, of
- * which most are not operations. So the lookup is a genuine miss-or-hit and
- * says so, rather than asserting a key it cannot prove.
- */
 function outcomeRule(operation) {
     const table = OUTCOME_TABLE;
     return table[`${operation.family}.${operation.variant}`];
@@ -43,11 +33,6 @@ function absenceOutcome(absence) {
             return internalFailure();
     }
 }
-/**
- * Maps one validated operation result to its stable outcome envelope. The
- * result must already have passed output validation, so `null` can only
- * reach a variant whose cardinality admits it.
- */
 export function mapOperationOutcome(operation, data) {
     const rule = outcomeRule(operation);
     if (rule === undefined) {
@@ -57,12 +42,6 @@ export function mapOperationOutcome(operation, data) {
         ? absenceOutcome(rule.absence)
         : operationSuccess(data, rule.success);
 }
-/**
- * Spec section 13.2 failure table for the Framework Validation Layer: which
- * A-code a set of validation issues reports. The most specific rejection
- * wins - an unknown Resource before an unavailable operation, and a
- * structural-limit breach before an ordinary argument rejection.
- */
 function validationCode(issues) {
     if (issues.some((issue) => issue.path?.[0] === "resource")) {
         return "A2001";
@@ -84,7 +63,6 @@ function validationCode(issues) {
     }
     return "A2004";
 }
-/** Maps framework validation issues to their stable failure envelope. */
 export function mapValidationOutcome(issues) {
     return operationFailure(validationCode(issues), {
         message: "Operation arguments failed framework validation.",

package/dist/runtime/output-validator.js

@@ -168,7 +168,6 @@ function validateProjection(contract, operation, projection, value) {
         ? validateExactRecord(contract, value, projection, ["data"])
         : { ok: true };
 }
-/** Validate final operation output against fixed cardinality and executed projection. */
 export function validateOperationOutput(contract, operation, projection, value) {
     const cardinality = validateOperationOutputCardinality(operation, value);
     return cardinality.ok

package/dist/runtime/pipe-output.validator.d.ts

@@ -0,0 +1,48 @@
+import type { Contract, CoreContract } from "../contracts/contract.js";
+import type { OperationIdentity } from "../operations/operation-identity.js";
+import type { ValidationIssue } from "../operations/validation-code.js";
+import type { OperationFailureResponse } from "./operation-response.js";
+/**
+ * The check a pipe's output passes before it can reach the Adapter.
+ *
+ * The request was validated against the caller's own Contract. A pipe then
+ * rewrites it, and may legitimately write what the caller cannot: a field the
+ * client Contract hides (a password hash, an owner id taken from the session),
+ * a directive the caller's scope does not advertise. So the rewritten arguments
+ * are held to the **server's** rules — the Core Contract, plus the fields the
+ * active scope itself adds (they are virtual: computed, then stripped before
+ * the Adapter call) — in the values' runtime forms (`bigint`, `Date`,
+ * `Decimal`, `Uint8Array`), which is what every pipe receives.
+ *
+ * A refusal is the server's defect, not the caller's: `A3004
+ * PIPE_OUTPUT_INVALID`, a 500 that tells the caller no more than any internal
+ * failure does — {@link PIPE_OUTPUT_FAILURE_MESSAGE}, and the step in a plan.
+ * The pipe, the operation, the first offending field and its V-code go to the
+ * diagnostics channel only, as a {@link PipeOutputError}: they name server
+ * internals — a pipe's function name, a field the caller's Contract hides.
+ */
+/** The one text every `A3004` carries on the wire. */
+export declare const PIPE_OUTPUT_FAILURE_MESSAGE = "A server pipeline produced invalid arguments.";
+/** The error the diagnostics channel receives for a refused pipe output. */
+export declare class PipeOutputError extends Error {
+    readonly issues: readonly ValidationIssue[];
+    readonly name = "PipeOutputError";
+    constructor(message: string, issues: readonly ValidationIssue[]);
+}
+/**
+ * `undefined` when the pipe's output passes the server's rules; otherwise the
+ * `A3004` failure, and the error the diagnostics channel is told.
+ */
+export declare function refusePipeOutput(contracts: {
+    readonly core: CoreContract;
+    readonly active: Contract;
+}, request: OperationIdentity & {
+    readonly resource: string;
+}, args: unknown, 
+/** The pipe that produced `args`, named in the message by its function name. */
+pipe: unknown, 
+/** Its position in the effective pipe list (root pipes first). */
+index: number): {
+    readonly response: OperationFailureResponse;
+    readonly error: PipeOutputError;
+} | undefined;

package/dist/runtime/pipe-output.validator.js

@@ -0,0 +1,79 @@
+import { validateOperationArguments } from "../operations/operation-validator.js";
+import { operationFailure } from "./operation-response.js";
+import { normalizeOperationScalarValues } from "./scalar-runtime.js";
+export const PIPE_OUTPUT_FAILURE_MESSAGE = "A server pipeline produced invalid arguments.";
+function serverContract(core, active) {
+    const resources = {};
+    for (const [name, resource] of Object.entries(core.resources)) {
+        const scoped = Object.hasOwn(active.resources, name)
+            ? active.resources[name]
+            : undefined;
+        const added = scoped === undefined
+            ? {}
+            : Object.fromEntries(Object.entries(scoped.fields).filter(([field]) => !Object.hasOwn(resource.fields, field)));
+        resources[name] =
+            Object.keys(added).length === 0
+                ? resource
+                : { ...resource, fields: { ...resource.fields, ...added } };
+    }
+    return { ...core, resources };
+}
+const SERVER_VIEWS = new WeakMap();
+function serverContractFor(core, active) {
+    let view = SERVER_VIEWS.get(active);
+    if (view === undefined) {
+        view = serverContract(core, active);
+        SERVER_VIEWS.set(active, view);
+    }
+    return view;
+}
+function serverIssues(contract, request, args) {
+    const validation = validateOperationArguments(contract, {
+        ...request,
+        arguments: args,
+    });
+    if (!validation.ok) {
+        return validation.issues;
+    }
+    const normalization = normalizeOperationScalarValues(contract, { ...request, arguments: validation.arguments }, "application");
+    return normalization.ok ? [] : normalization.issues;
+}
+function pipeLabel(pipe, index) {
+    let name;
+    try {
+        name = pipe.name;
+    }
+    catch {
+        name = undefined;
+    }
+    return typeof name === "string" && name !== ""
+        ? `pipes[${index}] "${name}"`
+        : `pipes[${index}] (anonymous)`;
+}
+function fieldOf(issue) {
+    const path = issue.path ?? [];
+    const relative = path[0] === "arguments" ? path.slice(1) : path;
+    return relative.length === 0 ? "(arguments)" : relative.join(".");
+}
+export class PipeOutputError extends Error {
+    issues;
+    name = "PipeOutputError";
+    constructor(message, issues) {
+        super(message);
+        this.issues = issues;
+    }
+}
+export function refusePipeOutput(contracts, request, args, pipe, index) {
+    const issues = serverIssues(serverContractFor(contracts.core, contracts.active), request, args);
+    const [first] = issues;
+    if (first === undefined) {
+        return undefined;
+    }
+    const message = `Pipe ${pipeLabel(pipe, index)} returned arguments for ${request.resource}.${request.family}.${request.variant} that the server contract refuses at "${fieldOf(first)}" (${first.code}: ${first.message})`;
+    return {
+        response: operationFailure("A3004", {
+            message: PIPE_OUTPUT_FAILURE_MESSAGE,
+        }),
+        error: new PipeOutputError(message, issues),
+    };
+}

package/dist/runtime/pipeline.d.ts

@@ -5,16 +5,13 @@ import type { Contract } from "../contracts/contract.js";
 import type { OperationFamily } from "../operations/operation-identity.js";
 import type { FrameworkError } from "./framework-error.js";
 /**
- * What a pipeline is told about the HTTP request a client-origin operation
- * arrived on — a **deliberate exception** to core's transport-agnosticism
- * (F-609; the architect, Phase 10 Q7; ADR 0010). Specification §17.2 states
- * this shape, and developers may read it in their pipelines: the verb, always
- * `POST` on a framework route, and the request's headers.
+ * What a pipeline is told about the HTTP request a client-origin operation arrived
+ * on — a **deliberate exception** to core's transport-agnosticism.
  *
- * Core never parses HTTP to fill it. `@aventara/core/protocol`'s decoders do,
- * with header names **lower-cased** and a repeated header's values joined with
- * `", "` (RFC 9110 §5.3), so a pipeline reads one spelling. An application-scope
- * request carries none (`ClientOperationRequest.transport` is optional).
+ * Core never parses HTTP to fill it. `@aventara/core/protocol`'s decoders do, with
+ * header names **lower-cased** and a repeated header's values joined with `", "`
+ * (RFC 9110 §5.3), so a pipeline reads one spelling. An application-scope request
+ * carries none (`ClientOperationRequest.transport` is optional).
  */
 export type PipelineTransportContext = {
     readonly method: "POST";
@@ -23,27 +20,24 @@ export type PipelineTransportContext = {
 /**
  * What a pipeline callback is told about the operation it is wrapping.
  *
- * `resource` reads its key set from the **AdapterModel**, not from a
- * `Contract`: `Contract["resources"]` is an open `Record<string, …>`, so the
- * `C extends Contract` parameter this type used to take could never name the
- * Resources an author actually has — it erased to `string`. `M` can name
- * them, and configuration cannot add Resources, so `M` is the whole answer.
+ * `resource` reads its key set from the **AdapterModel**, not from a `Contract`:
+ * `Contract["resources"]` is an open `Record<string, …>`, so the `C extends
+ * Contract` parameter this type used to take could never name the Resources an
+ * author actually has — it erased to `string`. `M` can name them, and
+ * configuration cannot add Resources, so `M` is the whole answer.
  *
- * **No `Cfg`, unlike B8 as written.** `Cfg` narrows *field-key* positions,
- * and this type has none: `contract` is passive compiled data, `args` is
- * `unknown` until Phase 9 (F-701), and `resource` comes from `M` alone. A
- * `Cfg` parameter here would be referenced nowhere — `biome` flags it
+ * A `Cfg` parameter here would be referenced nowhere — `biome` flags it
  * (`lint/correctness/noUnusedVariables`) and it would encode no semantic
- * dependency. `FrameworkScopeConfig` already has the precedent one line
- * above `pipelines`: `fields` takes `M` only.
+ * dependency. `FrameworkScopeConfig` already has the precedent one line above
+ * `pipelines`: `fields` takes `M` only.
  *
- * `contract` stays the erased {@link Contract} deliberately: a compiled
- * Contract is passive semantic data whose result "stays untyped by design"
- * (ADR 0009). Threading configuration into it would rebuild the
- * authoring-config-to-compiled-contract bridge this work bypasses.
+ * `contract` stays the erased {@link Contract} deliberately: a compiled Contract
+ * is passive semantic data whose result "stays untyped by design". Threading
+ * configuration into it would rebuild the authoring-config-to-compiled-contract
+ * bridge this work bypasses.
  *
- * Under the default `M` the key set degenerates to `string`, so an
- * unannotated `PipelineContext` is what it was before (B4).
+ * Under the default `M` the key set degenerates to `string`, so an unannotated
+ * `PipelineContext` is what it was before.
  */
 export type PipelineContext<M extends AdapterModel = AdapterModel> = {
     readonly contract: Contract;

package/dist/runtime/referential-action.d.ts

@@ -1,35 +1,30 @@
 /**
  * Core's referential-action vocabulary, and the transitive cascade closure the
- * transaction planner reads (F-806, Phase 9 S10).
+ * transaction planner reads.
  *
  * The facts are an Adapter's: which relation edges exist, and what deleting a
- * referenced row does to the rows that reference it. The reasoning over them is
- * core's — the architect rejected keeping it below the seam on 2026-10-02,
- * because every Adapter would then re-implement it. So the words here are
+ * referenced row does to the rows that reference it. So the words here are
  * Aventara's, stated as the effect on the referencing rows, and an Adapter
  * translates its own provider's vocabulary into them.
  *
- * None of this enters a Contract. It is not part of the semantic model a
- * Contract is compiled from, so it moves no Contract value and no hash; it is a
- * planning fact, read once when the Framework is constructed.
+ * None of this enters a Contract. It is not part of the semantic model a Contract
+ * is compiled from, so it moves no Contract value and no hash; it is a planning
+ * fact, read once when the Framework is constructed.
  */
 /**
- * What deleting a referenced row does to the rows that reference it. The five
- * words are the architect's (binding, 2026-10-04), and mirror SQL's
- * referential actions one to one, so no adapter has to choose between two of
- * them:
+ * What deleting a referenced row does to the rows that reference it.
  *
- * - `cascade` — they are deleted with it, and their own referencing rows in
- *   turn (SQL `ON DELETE CASCADE`).
+ * - `cascade` — they are deleted with it, and their own referencing rows in turn
+ *   (SQL `ON DELETE CASCADE`).
  * - `restrict` — the delete is refused while they reference it (`RESTRICT`).
  * - `noAction` — the delete is refused while they reference it (`NO ACTION`).
- *   Measured identical to `restrict` on both pilot engines (Phase 9 S0, U4):
- *   neither declares the constraint `DEFERRABLE`, so the end-of-statement check
- *   answers one delete exactly as `RESTRICT` does. It stays a distinct word
- *   because it is a distinct schema fact.
+ *   Measured identical to `restrict` on both pilot engines: neither declares the
+ *   constraint `DEFERRABLE`, so the end-of-statement check answers one delete
+ *   exactly as `RESTRICT` does. It stays a distinct word because it is a distinct
+ *   schema fact.
  * - `setNull` — they are kept, the reference set to null (`SET NULL`).
- * - `setDefault` — they are kept, the reference set to its column default
- *   (`SET DEFAULT`).
+ * - `setDefault` — they are kept, the reference set to its column default (`SET
+ *   DEFAULT`).
  *
  * Only `cascade` takes rows away, so only `cascade` is followed by the closure.
  */

package/dist/runtime/referential-action.js

@@ -1,26 +1,5 @@
-/**
- * Core's referential-action vocabulary, and the transitive cascade closure the
- * transaction planner reads (F-806, Phase 9 S10).
- *
- * The facts are an Adapter's: which relation edges exist, and what deleting a
- * referenced row does to the rows that reference it. The reasoning over them is
- * core's — the architect rejected keeping it below the seam on 2026-10-02,
- * because every Adapter would then re-implement it. So the words here are
- * Aventara's, stated as the effect on the referencing rows, and an Adapter
- * translates its own provider's vocabulary into them.
- *
- * None of this enters a Contract. It is not part of the semantic model a
- * Contract is compiled from, so it moves no Contract value and no hash; it is a
- * planning fact, read once when the Framework is constructed.
- */
 const NO_CASCADE = new Set();
-/**
- * Builds the closure over an Adapter's table, once. An absent table is the
- * answer of an Adapter that cannot state its referential actions; it is
- * believed, so nothing cascades.
- */
 export function resolveCascadeClosure(table) {
-    // target → the Resources a delete of it cascades into, one hop.
     const removedBy = new Map();
     for (const [resource, edges] of Object.entries(table ?? {})) {
         for (const edge of edges) {
@@ -41,8 +20,6 @@ export function resolveCascadeClosure(table) {
         const closure = new Set();
         const frontier = [...(removedBy.get(resource) ?? [])];
         for (let next = frontier.pop(); next !== undefined; next = frontier.pop()) {
-            // The visited set is what makes a self-referential or cyclic cascade
-            // terminate: each Resource is expanded at most once.
             if (closure.has(next)) {
                 continue;
             }

package/dist/runtime/request-id.js

@@ -1,27 +1,6 @@
-/**
- * The one place core mints a request id (Q10 = B; F-833). The typed façades and
- * the typed transaction runner call it when the caller supplies no usable id.
- * It is internal: neither the main entry nor `@aventara/core/protocol` exports
- * a minting helper. A host's correlation id reaches core as data —
- * `ExecutionOptions.requestId` in process, or the `requestId` of a request the
- * protocol decoders build from an adopted `Aventara-Request-Id` (Phase 10 S7,
- * which mints through this module when none was adopted).
- */
 function createRequestId() {
     return globalThis.crypto.randomUUID();
 }
-/**
- * The request id of one façade call or transaction run: the caller's
- * `ExecutionOptions.requestId` when it is a non-empty string, otherwise a minted
- * one. Nothing is refused (the call runs either way); the empty string is read
- * as absent, because it names nothing a log line or a diagnostic could be
- * correlated by.
- *
- * Read as `unknown` because the façades are total for untyped callers too: a
- * value the type refuses — a non-string id, a non-object options argument, a
- * getter that throws — is ignored rather than carried into a `string` slot or
- * thrown out of a call that must resolve.
- */
 export function requestIdOf(options) {
     if (typeof options === "object" && options !== null) {
         let requestId;

package/dist/runtime/scalar-runtime.d.ts

@@ -20,14 +20,13 @@ export type ScalarValueNormalizationResult = {
 };
 type Path = readonly (string | number)[];
 /**
- * The one discriminant between an argument OBJECT and a VALUE wherever a
- * position admits both — a filter position above all: a **plain** record is an
- * operator object, and anything else — a `Date`, a core `Decimal`, a
- * `Uint8Array` — is a value, which equality shorthand then holds to the field's
- * scalar (spec §9.1). The validator (`operation-validator-core.ts`) reads a
- * filter position through this same answer, and an adapter's filter translation
- * is expected to, so a position cannot be operators to one reader and a value to
- * another.
+ * The one discriminant between an argument OBJECT and a VALUE wherever a position
+ * admits both — a filter position above all: a **plain** record is an operator
+ * object, and anything else — a `Date`, a core `Decimal`, a `Uint8Array` — is a
+ * value, which equality shorthand then holds to the field's scalar. The validator
+ * (`operation-validator-core.ts`) reads a filter position through this same
+ * answer, and an adapter's filter translation is expected to, so a position cannot
+ * be operators to one reader and a value to another.
  */
 export declare function isPlainRecord(value: unknown): value is Readonly<Record<string, unknown>>;
 /**
@@ -36,14 +35,13 @@ export declare function isPlainRecord(value: unknown): value is Readonly<Record<
  */
 export declare function normalizeScalarFieldValue(contract: Contract, field: ScalarField<Contract>, value: unknown, scope: RequestOrigin | "runtime", path: Path): ScalarValueNormalizationResult;
 /**
- * Copies one validated runtime value of a scalar field into a value the
- * framework owns, per scalar codec (DA-25): `datetime` → a new `Date`,
- * `bytes` → a sliced `Uint8Array`, `json` → a structured deep copy, and a list
- * → a new array of copied items. `decimal` keeps its identity, and strings,
- * numbers, booleans, bigints, enum members and `null` are immutable and
- * returned unchanged. {@link SCALAR_ATOM_COPIERS} is exhaustive over
- * {@link BuiltInScalar}, so a new codec cannot reach this function without
- * declaring its copy.
+ * Copies one validated runtime value of a scalar field into a value the framework
+ * owns, per scalar codec: `datetime` → a new `Date`, `bytes` → a sliced
+ * `Uint8Array`, `json` → a structured deep copy, and a list → a new array of
+ * copied items. `decimal` keeps its identity, and strings, numbers, booleans,
+ * bigints, enum members and `null` are immutable and returned unchanged. {@link
+ * SCALAR_ATOM_COPIERS} is exhaustive over {@link BuiltInScalar}, so a new codec
+ * cannot reach this function without declaring its copy.
  */
 export declare function copyScalarFieldValue(field: ScalarField<Contract>, value: unknown): unknown;
 /**