@aventara/core 0.1.0-pilot.1 → 0.1.0-pilot.3

package/dist/runtime/decimal.js

@@ -1,10 +1,7 @@
 import { WIRE_SCALAR_PATTERNS } from "../contracts/wire-scalar-format.js";
-/** Provider-neutral exact decimal runtime value owned by Aventara. */
 export class Decimal {
     #value;
     constructor(value) {
-        // `RegExp#test` coerces its argument, so without this guard a number from
-        // untyped code passed as `"5"` and `toString()` then returned the number.
         if (typeof value !== "string") {
             throw new TypeError("Decimal value must be a string.");
         }
@@ -16,11 +13,6 @@ export class Decimal {
     toString() {
         return this.#value;
     }
-    /**
-     * The decimal string, exactly as given: what `JSON.stringify` writes for a
-     * Decimal (Q16), so a result a developer serializes by hand carries its
-     * digits rather than `{}`. The protocol's encoders do not rely on it.
-     */
     toJSON() {
         return this.#value;
     }

package/dist/runtime/diagnostics-reporter.d.ts

@@ -5,12 +5,12 @@ import type { FrameworkOperationRequest } from "./operation-request.js";
 import type { OperationErrorCode } from "./operation-response.js";
 /**
  * One unplanned failure as the framework saw it before sanitization: the raw
- * value, the outcome code actually emitted, and enough identity to act on
- * it. The code is usually an internal one, because the channel fires for
- * unplanned failures; it is the thrower's own code when the framework
- * dropped something it could not vouch for from an otherwise honoured
- * deliberate outcome (ADR 0008 decision 4), which changes no outcome. Server-side only — a diagnostic is never projected
- * onto the wire, which is precisely why it may carry the raw error.
+ * value, the outcome code actually emitted, and enough identity to act on it. The
+ * code is usually an internal one, because the channel fires for unplanned
+ * failures; it is the thrower's own code when the framework dropped something it
+ * could not vouch for from an otherwise honoured deliberate outcome, which changes
+ * no outcome. Server-side only — a diagnostic is never projected onto the wire,
+ * which is precisely why it may carry the raw error.
  */
 export type OperationDiagnostic = {
     readonly kind: "operation";

package/dist/runtime/diagnostics-reporter.js

@@ -1,9 +1,4 @@
-/** The default channel: no sink configured, so nothing is observed. */
 const IGNORE_DIAGNOSTIC = () => undefined;
-/**
- * A sink may return a promise. Reading `then` off an arbitrary return value
- * can itself throw, so this runs inside the reporter's own guard.
- */
 function isThenable(value) {
     if ((typeof value !== "object" || value === null) &&
         typeof value !== "function") {
@@ -11,12 +6,6 @@ function isThenable(value) {
     }
     return typeof value.then === "function";
 }
-/**
- * The channel bound to one diagnostic identity, as the reporters below bind
- * it. Exported for `@aventara/core/protocol`, whose binding reports a failure
- * only it can meet — a result with no wire form (`A3003`) — under the
- * identity it holds; never exported from the main entry.
- */
 export function createReporter(sink, identity) {
     if (sink === undefined) {
         return IGNORE_DIAGNOSTIC;
@@ -33,38 +22,15 @@ export function createReporter(sink, identity) {
         }
     };
 }
-/**
- * The sink each constructed Framework was configured with, keyed by the
- * Framework object `createFramework` returned. The protocol's binding
- * (`AvProtocol.bind(framework)`, `@aventara/core/protocol`) reads it here, so
- * the direction stays one-way — no execution module imports `protocol/` — and
- * the public `Framework` type gains no member. A WeakMap: it keeps no
- * Framework alive. A Framework built without a sink has no entry.
- */
 const CONFIGURED_SINKS = new WeakMap();
-/** Records the sink `framework` was configured with; called once, at construction. */
 export function recordDiagnosticsSink(framework, sink) {
     if (sink !== undefined) {
         CONFIGURED_SINKS.set(framework, sink);
     }
 }
-/** The sink `framework` was configured with, or `undefined` for none. */
 export function diagnosticsSinkOf(framework) {
     return CONFIGURED_SINKS.get(framework);
 }
-/**
- * Binds the configured sink to one operation request.
- *
- * Identity is captured on entry rather than at report time: by the moment a
- * failure is reported the request may be exactly what broke, and a diagnostic
- * naming no operation is not actionable. A request whose own identity cannot
- * be read is past observing, so it silently yields the no-op channel — the
- * outermost totality guard still answers with the generic envelope.
- *
- * The response must be unaffected by observation, so the reporter neither
- * awaits the sink nor lets anything the sink does escape: a throw, a rejected
- * promise and a booby-trapped thenable all end here.
- */
 export function createDiagnosticsReporter(sink, request, operation) {
     let identity;
     try {
@@ -83,7 +49,6 @@ export function createDiagnosticsReporter(sink, request, operation) {
     }
     return createReporter(sink, identity);
 }
-/** Binds the configured sink to one transaction request and its plan operations. */
 export function createTransactionDiagnosticsChannel(sink, request) {
     let identity;
     try {

package/dist/runtime/error-boundary.d.ts

@@ -17,9 +17,9 @@ export declare class AdapterBoundary {
     originOf(error: unknown): FailureOrigin;
 }
 /**
- * The one result-serialization text; every A3003 carries it. Its producer is
- * the protocol's response encoder (`@aventara/core/protocol`, P1), which
- * imports it from here so the code has one text wherever it is emitted.
+ * The one result-serialization text; every A3003 carries it. Its producer is the
+ * protocol's response encoder, which imports it from here so the code has one text
+ * wherever it is emitted.
  */
 export declare const SERIALIZATION_FAILURE_MESSAGE = "Result serialization failed.";
 /** Where a standalone operation's arguments sit in a framework issue path. */

package/dist/runtime/error-boundary.js

@@ -1,16 +1,10 @@
 import { VALIDATION_CODE_MESSAGES, VALIDATION_CODES, } from "../operations/validation-code.js";
 import { FrameworkError } from "./framework-error.js";
 import { INTERNAL_FAILURE_MESSAGE, internalFailure, OPERATION_CODES, operationFailure, } from "./operation-response.js";
-/** The one generic Adapter-failure text; every unexpected A3001 carries it. */
+import { PIPE_OUTPUT_FAILURE_MESSAGE } from "./pipe-output.validator.js";
 export const ADAPTER_FAILURE_MESSAGE = "Adapter execution failed.";
-/**
- * Structurally records every value thrown across the Adapter seam so the
- * final error boundary can classify origin by identity, never by inspecting
- * error text. One boundary instance belongs to one operation execution.
- */
 export class AdapterBoundary {
     #thrown = new Set();
-    /** Runs Adapter work, remembering anything it throws before re-throwing it. */
     async execute(work) {
         try {
             return await work();
@@ -24,29 +18,17 @@ export class AdapterBoundary {
         return this.#thrown.has(error) ? "adapter" : "runtime";
     }
 }
-/**
- * The one result-serialization text; every A3003 carries it. Its producer is
- * the protocol's response encoder (`@aventara/core/protocol`, P1), which
- * imports it from here so the code has one text wherever it is emitted.
- */
 export const SERIALIZATION_FAILURE_MESSAGE = "Result serialization failed.";
-/**
- * The framework's own text for each internal-failure code. An A3xxx cause is
- * never caller-actionable, so whatever text its thrower supplied is replaced
- * by this table — the realistic thrower is a careless Adapter forwarding a
- * provider message, and spec 13.5 forbids that text on the wire.
- */
 const INTERNAL_FAILURE_MESSAGES = {
     A3000: INTERNAL_FAILURE_MESSAGE,
     A3001: ADAPTER_FAILURE_MESSAGE,
     A3002: "Transaction failed.",
     A3003: SERIALIZATION_FAILURE_MESSAGE,
+    A3004: PIPE_OUTPUT_FAILURE_MESSAGE,
 };
-/** The internal code an unexpected failure of one origin is emitted under. */
 function unexpectedCode(origin) {
     return origin === "adapter" ? "A3001" : "A3000";
 }
-/** The generic, text-free envelope for an unexpected failure of one origin. */
 function unexpectedFailure(origin) {
     return origin === "adapter"
         ? operationFailure("A3001", { message: ADAPTER_FAILURE_MESSAGE })
@@ -58,10 +40,6 @@ function isInternalCode(code) {
 function isPathSegment(value) {
     return typeof value === "string" || typeof value === "number";
 }
-/**
- * Whether an untrusted value is a list. `Array.isArray` is not itself total:
- * it throws on a revoked Proxy, and a thrown value may be one.
- */
 function isList(value) {
     try {
         return Array.isArray(value);
@@ -70,15 +48,6 @@ function isList(value) {
         return false;
     }
 }
-/**
- * Copies an untrusted list into a plain array the framework owns. Traversal,
- * not just property reads, is untrusted here: an index accessor, a Proxy
- * trap, an overridden `map` and a hijacked `Symbol.species` all run
- * thrower-supplied code, and none of it may become the boundary's own
- * failure. Elements are read one at a time through {@link readProperty}, so
- * an unreadable element is `undefined` — a value every projection below
- * already rejects. `undefined` means the value is no list at all.
- */
 function readList(value) {
     if (!isList(value)) {
         return undefined;
@@ -93,12 +62,6 @@ function readList(value) {
     }
     return items;
 }
-/**
- * Projects an issue path onto a plain array of segments the framework owns.
- * Copying rather than forwarding is the point: a planted path arrives as a
- * live handle to a caller-held array, and its non-index properties would
- * otherwise ride into the envelope for every in-memory consumer of it.
- */
 function projectPath(value) {
     const items = readList(value);
     if (items === undefined) {
@@ -113,31 +76,13 @@ function projectPath(value) {
     }
     return path;
 }
-/** Where a standalone operation's arguments sit in a framework issue path. */
 export const OPERATION_ARGUMENTS_PATH = [
     "arguments",
 ];
-/** Where one plan operation's arguments sit in a framework issue path. */
 export function planOperationArgumentsPath(index) {
     return ["operations", index, "args"];
 }
-/** A segment that named no own, data-backed member of its container. */
 const UNRESOLVED = Symbol("unresolved-path-segment");
-/**
- * Reads one own, data-backed member of an untrusted container.
- *
- * Own only: satisfying a segment from the prototype chain would let `toString`
- * or `constructor` pose as caller data. Data-backed only: the descriptor is
- * consulted and only its `value` used, so a getter never runs — running a
- * caller's accessor while sanitizing an error is a side effect in the worst
- * possible place.
- *
- * The reflection itself can throw: a revoked Proxy rejects
- * `getOwnPropertyDescriptor`. That is not caught here. The whole walk has one
- * containment point, in {@link resolvesAgainstArguments}, so there is exactly
- * one place where an unwalkable path and an unresolvable one become the same
- * answer.
- */
 function readOwnMember(container, key) {
     if (typeof container !== "object" || container === null) {
         return UNRESOLVED;
@@ -147,7 +92,6 @@ function readOwnMember(container, key) {
         ? descriptor.value
         : UNRESOLVED;
 }
-/** Resolves one path segment; a numeric segment indexes an array and nothing else. */
 function readSegment(container, segment) {
     if (typeof segment === "number") {
         return Number.isInteger(segment) && segment >= 0 && isList(container)
@@ -156,22 +100,6 @@ function readSegment(container, segment) {
     }
     return readOwnMember(container, segment);
 }
-/**
- * Whether a thrower-supplied path denotes a member of the caller's own
- * arguments — the one thing that makes it safe to emit.
- *
- * A path that resolves echoes back a key sequence the caller already holds;
- * anything else is unvouched content on the same channel spec 13.5 closes for
- * the rest of `cause` (ADR 0008 decision 4, applied to the third axis). The
- * prefix must be the framework's own address for these arguments, and every
- * remaining segment must resolve: a resolving prefix does not license the
- * rest, so a partial match is no match.
- *
- * Total, like every step the boundary takes on a thrown value. The walk runs
- * over data the framework does not own — a revoked Proxy on it throws from
- * reflection alone — so the whole walk sits inside one guard: an unresolvable
- * path and an unwalkable one are the same answer.
- */
 function resolvesAgainstArguments(path, view) {
     try {
         if (path.length < view.path.length) {
@@ -199,41 +127,16 @@ function resolvesAgainstArguments(path, view) {
         return false;
     }
 }
-/**
- * Only an allocated Validation code (spec 13.3, amended by ADR 0006 DA-4) may
- * be emitted. This is ADR 0005's rule on the axis it did not cover: the union
- * is a compile-time promise a separately compiled Adapter or a developer
- * filter never made, so the set is tested by identity before emission.
- */
 function isValidationCode(value) {
     return (typeof value === "string" &&
         VALIDATION_CODES.includes(value));
 }
-/**
- * Projects one issue onto the spec ValidationIssue shape; unknown keys drop.
- *
- * All three fields are framework-owned by the time they are emitted.
- * An unrecognised `code` drops the whole issue rather than riding onto the
- * wire in a field the spec defines as a closed set — and rather than being
- * rewritten to a plausible neighbour, which would misreport what was wrong.
- * The `message` is replaced by the framework's own published text for that
- * code, because a thrower-supplied message is the same provider-text channel
- * spec 13.5 closes for the rest of `cause`. The `path` is emitted only when
- * every segment of it resolves against the caller's own arguments; it is an
- * open-ended string channel otherwise, and spec 13.1 makes the field
- * optional, so a path that cannot be vouched for is simply absent — the
- * issue, its code and the outcome are unchanged. Each dropped value is
- * appended to `unvouched`, so the boundary can hand it to the ADR 0004
- * diagnostics channel — the only place it still exists.
- */
 function projectIssue(value, unvouched, view) {
     if (typeof value !== "object" || value === null) {
         return undefined;
     }
     const code = readProperty(value, "code");
     if (!isValidationCode(code)) {
-        // `undefined` is an unreadable or absent code, not a supplied one:
-        // reporting it would be noise, and the issue is malformed either way.
         if (code !== undefined) {
             unvouched.push(code);
         }
@@ -255,18 +158,6 @@ function projectIssue(value, unvouched, view) {
     }
     return { path, code, message: owned };
 }
-/**
- * Projects a thrower-supplied cause onto the spec 13 `Cause` shape:
- * `{ message, issues?, operation? }`. Unknown keys are dropped rather than
- * forwarded, so a provider error assigned wholesale as a cause loses its
- * `sql`, `stack`, DSN and whatever else it carried. A cause without a string
- * message is no cause at all.
- *
- * Total, like every step the boundary takes on a thrown value: a cause it
- * cannot traverse yields the parts it could read, never an exception. A
- * throw here would escape the boundary that was sanitizing it and cost the
- * thrower the very outcome it deliberately named.
- */
 function projectCause(value, unvouched, view) {
     const message = readProperty(value, "message");
     if (typeof message !== "string") {
@@ -279,29 +170,16 @@ function projectCause(value, unvouched, view) {
         .filter((issue) => issue !== undefined);
     return {
         message,
-        // An empty list is no list: dropping every issue leaves the cause
-        // without issues rather than fabricating one to fill the field.
         ...(issues !== undefined && issues.length > 0 ? { issues } : {}),
         ...(Number.isInteger(rawOperation) && rawOperation >= 0
             ? { operation: rawOperation }
             : {}),
     };
 }
-/**
- * Internal failures carry no caller-actionable diagnostics: the message is
- * the framework's own and `issues` raised while validating computed/Adapter
- * output describe server internals and stay behind the boundary (available
- * to filters, never emitted).
- */
 function internalCause(code, cause) {
     const { issues: _issues, message: _message, ...emitted } = cause;
     return { ...emitted, message: INTERNAL_FAILURE_MESSAGES[code] };
 }
-/**
- * Reads one property of a thrown value. Thrown values are untrusted: a
- * getter or Proxy trap may itself throw, and that must never become the
- * boundary's own failure.
- */
 function readProperty(value, key) {
     try {
         return value[key];
@@ -318,34 +196,16 @@ function isFrameworkErrorInstance(error) {
         return false;
     }
 }
-/**
- * A {@link FrameworkError} that fails vetting. Its thrower deliberately named
- * an outcome the framework cannot honour, so the failure is the broken
- * outcome contract itself — an internal error, whatever the origin — and the
- * offending value is replaced, never echoed.
- */
 const MALFORMED_OUTCOME = {
     code: "A3000",
     cause: { message: INTERNAL_FAILURE_MESSAGE },
     unvouched: [],
 };
-/**
- * Only a recognised error code (spec 13.2) is a deliberate outcome. An
- * unknown code, or a success code arriving on the failure path, would break
- * the ADR 0003 union on the wire.
- */
 function isOperationErrorCode(value) {
     return (typeof value === "string" &&
         OPERATION_CODES.includes(value) &&
         !value.startsWith("A1"));
 }
-/**
- * Vets a value as a deliberate {@link FrameworkError}. `undefined` means it
- * is not one at all. Passing the `instanceof` check is not enough:
- * `Object.create(FrameworkError.prototype)`, a booby-trapped accessor, an
- * unrecognised code or a cause without a message all reach here, and each
- * is {@link MALFORMED_OUTCOME} rather than something to dereference or emit.
- */
 function vetDeliberateOutcome(error, view) {
     if (!isFrameworkErrorInstance(error)) {
         return undefined;
@@ -361,31 +221,16 @@ function vetDeliberateOutcome(error, view) {
     const cause = projectCause(rawCause, unvouched, view);
     return cause === undefined ? MALFORMED_OUTCOME : { code, cause, unvouched };
 }
-/**
- * Hands every dropped issue code and issue path to the ADR 0004 channel under
- * the outcome actually emitted. Dropping something the framework cannot vouch
- * for is no grounds to escalate the thrower's chosen outcome, so the code
- * stands and the channel carries the whole consequence. Reporting cannot
- * affect the response: the reporter is total and swallows whatever the sink
- * does.
- */
 function reportUnvouched(outcome, report) {
     for (const value of outcome.unvouched) {
         report(value, outcome.code);
     }
 }
-/** A deliberate outcome: the stable code and cause its thrower chose. */
 function deliberateFailure(outcome) {
     return operationFailure(outcome.code, isInternalCode(outcome.code)
         ? internalCause(outcome.code, outcome.cause)
         : outcome.cause);
 }
-/**
- * Final framework sanitization, shared by every boundary. A deliberate
- * {@link FrameworkError} carries its own stable outcome; anything else is
- * replaced by a generic cause so no provider text, stack, path, or secret
- * can cross the response boundary. Total: it never throws.
- */
 export function sanitizeOperationFailure(error, origin, report, view) {
     const outcome = vetDeliberateOutcome(error, view);
     if (outcome === undefined) {
@@ -398,13 +243,6 @@ export function sanitizeOperationFailure(error, origin, report, view) {
     reportUnvouched(outcome, report);
     return deliberateFailure(outcome);
 }
-/**
- * Post-validation exception flow (spec 17.3): effective filters are stored as
- * `[root..., scoped...]`, so reverse iteration tries scoped filters in reverse
- * registration order, then root filters in reverse, then final sanitization.
- * A filter handles an error only by returning a {@link FrameworkError};
- * returning `undefined` or throwing leaves the original error unhandled.
- */
 export async function resolveOperationFailure(error, filters, context, boundary, report, view) {
     for (let index = filters.length - 1; index >= 0; index -= 1) {
         const filter = filters[index];
@@ -413,9 +251,6 @@ export async function resolveOperationFailure(error, filters, context, boundary,
         }
         const handled = await attemptFilter(filter, error, context, view);
         if (handled !== undefined) {
-            // A filter that names an outcome the framework cannot honour has
-            // swallowed the original error on the developer's behalf; the
-            // diagnostics channel is the only place it still exists.
             if (handled === MALFORMED_OUTCOME) {
                 report(error, "A3000");
             }

package/dist/runtime/execution-options.d.ts

@@ -1,11 +1,11 @@
 /**
  * The caller's say over an in-process request it does not write by hand: the
  * second argument of every `framework.application.*` / `framework.client.*` call
- * and of `framework.transaction` (Q10 = B, Q14; closes F-833).
+ * and of `framework.transaction`.
  *
- * Not "transport options": an in-process call has no transport. A deferred
- * handle (`framework.appTx.*` / `framework.clientTx.*`) takes none — a handle is
- * not a request, and the id belongs to the run that executes it.
+ * Not "transport options": an in-process call has no transport. A deferred handle
+ * (`framework.appTx.*` / `framework.clientTx.*`) takes none — a handle is not a
+ * request, and the id belongs to the run that executes it.
  */
 export type ExecutionOptions = {
     /**

package/dist/runtime/field-behavior.d.ts

@@ -8,18 +8,15 @@ import type { PipelineContext } from "./pipeline.js";
  * What a write-stage compute callback is told about the field it is computing.
  *
  * `R` is the Resource the behavior is bound to and `Cfg` the authored
- * configuration literal, so `resource` is the literal Resource name and
- * `field` — like every other field-key position in the framework — is
- * {@link EffectiveFieldKey}: what the adapter discovered plus what the
- * configuration added.
+ * configuration literal, so `resource` is the literal Resource name and `field` —
+ * like every other field-key position in the framework — is {@link
+ * EffectiveFieldKey}: what the adapter discovered plus what the configuration
+ * added.
  *
- * `data` is keyed on the same set and stays `unknown`-valued. Scalar-to-TS
- * *value* typing is `OperationResultFor`'s job in Phase 9 (F-701) and is out
- * of scope here by the plan's hard constraints; what this type buys a callback
- * author is the key set, not the value.
+ * `data` is keyed on the same set and stays `unknown`-valued.
  *
  * Under the default `Cfg` the key set degenerates to `string` and this is
- * byte-for-byte the shape it was before `Cfg` existed (B4).
+ * byte-for-byte the shape it was before `Cfg` existed.
  */
 type ComputedWriteContext<M extends AdapterModel, Cfg, R extends FrameworkResourceKey<M>> = {
     readonly scope: RequestOrigin;

package/dist/runtime/framework-error.js

@@ -1,7 +1,3 @@
-/**
- * Stable typed error used by server-side pipelines, behaviors and Adapters to
- * deliberately surface one framework error outcome.
- */
 export class FrameworkError extends Error {
     code;
     cause;

package/dist/runtime/mutation-planner.d.ts

@@ -4,12 +4,11 @@ import type { Contract, CoreContract } from "../contracts/contract.js";
 import type { OperationExecutionRequest } from "./operation-request.js";
 import type { PipelineContext } from "./pipeline.js";
 /**
- * The two Contracts a write reads (F-829, the write-side twin of D2/F-824). The
- * **Core** Contract decides what the Adapter is asked to store; the **active**
- * Contract adds the fields its scope declared under `application.fields` /
- * `client.fields`, which Core does not carry. Such a field is VIRTUAL by
- * construction (`contract.compiler.ts`), so its behaviours run and its value is
- * stripped before the Adapter call — never sent.
+ * The two Contracts a write reads. The **Core** Contract decides what the Adapter
+ * is asked to store; the **active** Contract adds the fields its scope declared
+ * under `application.fields` / `client.fields`, which Core does not carry. Such a
+ * field is VIRTUAL by construction (`contract.compiler.ts`), so its behaviours run
+ * and its value is stripped before the Adapter call — never sent.
  */
 export type WriteContracts = {
     readonly core: CoreContract;

package/dist/runtime/mutation-planner.js

@@ -2,13 +2,6 @@ import { lookupField, lookupResource } from "../contracts/contract-lookup.js";
 import { FrameworkError } from "./framework-error.js";
 import { INTERNAL_FAILURE_MESSAGE } from "./operation-response.js";
 import { normalizeScalarFieldValue } from "./scalar-runtime.js";
-/**
- * The scalar field `fieldName` names on `resourceName` for a write: Core's own
- * field when Core has one — a field the scope hides or narrows is still stored,
- * and its behaviours still run — else the scalar the active scope added. Its
- * values are normalized against Core's registries either way: a scope adds
- * fields, never a scalar or an enum.
- */
 function writeScalarField(contracts, resourceName, fieldName) {
     const field = lookupField(lookupResource(contracts.core, resourceName), fieldName) ??
         lookupField(lookupResource(contracts.active, resourceName), fieldName);
@@ -16,15 +9,6 @@ function writeScalarField(contracts, resourceName, fieldName) {
         ? field
         : undefined;
 }
-/**
- * The sole grammar for relation-mutation record operands. Every write pass
- * maps these sites with its own record leaf, leaving identifier-only
- * directives untouched. The identifier operands this table deliberately leaves
- * empty are described by `RELATION_MUTATION_SELECTOR_SITES` in
- * `transactions/operation-arguments-encoder.ts`, the only pass that has to
- * encode them; both tables are keyed by `RelationMutationDirective`, so a new
- * directive fails to compile in both places.
- */
 export const RELATION_MUTATION_RECORD_SITES = {
     $create: [{ key: undefined, stage: "create" }],
     $connect: [],
@@ -38,11 +22,6 @@ export const RELATION_MUTATION_RECORD_SITES = {
         { key: "update", stage: "update" },
     ],
 };
-/**
- * Narrows a caller-supplied own key to the shared directive vocabulary. Own
- * membership, not an assertion: `Object.prototype` members resolve through the
- * prototype chain and would otherwise reach a site loop with a non-iterable.
- */
 export function isRelationMutationDirective(key) {
     return Object.hasOwn(RELATION_MUTATION_RECORD_SITES, key);
 }
@@ -144,7 +123,6 @@ async function mapRelationMutationRecords(relation, value, leaf) {
     }
     return normalized;
 }
-/** Apply effective computed create/update field behavior to post-pipe logical args. */
 export async function applyWriteFieldBehaviors(contracts, behaviors, request, args, contextFactory) {
     if (behaviors === undefined || !isRecord(args)) {
         return args;
@@ -190,7 +168,6 @@ async function stripVirtualRecord(contracts, resourceName, data) {
     }
     return persisted;
 }
-/** Strip VIRTUAL scalar input only at the persistence boundary. */
 export async function stripVirtualMutationInput(contracts, request, args) {
     if (!isRecord(args)) {
         return args;

package/dist/runtime/operation-response.d.ts

@@ -1,5 +1,5 @@
 import type { ValidationIssue } from "../operations/validation-code.js";
-export declare const OPERATION_CODES: readonly ["A1000", "A1001", "A1002", "A1003", "A1004", "A1005", "A1006", "A1007", "A1008", "A1009", "A2000", "A2001", "A2002", "A2003", "A2004", "A2005", "A2006", "A2007", "A2008", "A2009", "A2010", "A2011", "A2012", "A2013", "A2014", "A3000", "A3001", "A3002", "A3003", "A4000", "A4001", "A4002"];
+export declare const OPERATION_CODES: readonly ["A1000", "A1001", "A1002", "A1003", "A1004", "A1005", "A1006", "A1007", "A1008", "A1009", "A2000", "A2001", "A2002", "A2003", "A2004", "A2005", "A2006", "A2007", "A2008", "A2009", "A2010", "A2011", "A2012", "A2013", "A2014", "A3000", "A3001", "A3002", "A3003", "A3004", "A4000", "A4001", "A4002"];
 export type OperationCode = (typeof OPERATION_CODES)[number];
 export type OperationSuccessCode = Extract<OperationCode, `A1${string}`>;
 export type OperationErrorCode = Exclude<OperationCode, OperationSuccessCode>;

package/dist/runtime/operation-response.js

@@ -28,37 +28,21 @@ export const OPERATION_CODES = [
     "A3001",
     "A3002",
     "A3003",
+    "A3004",
     "A4000",
     "A4001",
     "A4002",
 ];
-/**
- * Builds the success-with-data arm. The only sanctioned way to construct
- * one: a runtime-computed `code` (e.g. from a table-driven outcome mapper)
- * still yields a well-typed {@link OperationSuccessResponse}.
- */
 export function operationSuccess(data, code) {
     return { data, code, cause: null };
 }
-/** Builds the no-match success arm (A1001). */
 export function operationNoMatch() {
     return { data: null, code: "A1001", cause: null };
 }
-/**
- * Builds the failure arm. The only sanctioned way to construct one: a
- * runtime-computed error `code` still yields a well-typed
- * {@link OperationFailureResponse}.
- */
 export function operationFailure(code, cause) {
     return { data: null, code, cause };
 }
-/** The one generic internal-failure text; every A3000 carries it. */
 export const INTERNAL_FAILURE_MESSAGE = "Internal framework error.";
-/**
- * The generic internal-failure envelope. Nothing about an internal failure is
- * caller-actionable, so every A3000 the framework emits is this exact value -
- * one constant rather than one restatement per boundary.
- */
 export function internalFailure() {
     return operationFailure("A3000", { message: INTERNAL_FAILURE_MESSAGE });
 }