@aventara/core 0.1.0-pilot.3 → 1.0.0-rc.0

package/dist/protocol/http-request.decoder.d.ts

@@ -2,13 +2,7 @@ import type { FrameworkContracts } from "../compiler/contract.compiler.js";
 import type { ClientOperationRequest } from "../runtime/operation-request.js";
 import type { ClientTransactionRequest } from "../transactions/transaction-request.js";
 import type { AvProtocolResponse } from "./http-response.encoder.js";
-/**
- * One HTTP request as a host hands it to the protocol: what the decoders read, and
- * what each row of the fixture corpus carries as its `request`.
- *
- * Host-independent by construction: no host's request object, only the four facts
- * every host can supply.
- */
+/** One HTTP request as a host hands it to the protocol. */
 export type AvProtocolRequest = {
     /** The HTTP method as received. Anything but `POST` on a framework route is `A2012`. */
     readonly method: string;
@@ -27,13 +21,6 @@ export type AvProtocolRequest = {
     /**
      * The body, in one of two explicitly named arms — the decoder never guesses which
      * one it was given:
-     *
-     * - `raw`: the decoded body as received, bytes or text. The decoder enforces all
-     *   of it: the size limit (`A2010`), the content type (`A2011`), JSON syntax and
-     *   the body's shape (`A2000`). An absent body is zero bytes (`""`).
-     * - `parsed`: a value the host's own JSON parser already produced. Size, content
-     *   type and JSON syntax were the host's to enforce before the decoder ran; the
-     *   decoder still refuses a non-object shape (`A2000`).
      */
     readonly body: {
         readonly kind: "raw";
@@ -44,9 +31,9 @@ export type AvProtocolRequest = {
     };
 };
 /**
- * What a decoder answers: the request core executes, or the framework response
- * that answers the HTTP request instead — and, either way, the request id it runs
- * or is answered under, which the host passes to the encoder:
+ * What a decoder answers: the request core executes, or the framework response that
+ * answers the HTTP request instead — and, either way, the request id it runs or is
+ * answered under, which the host passes to the encoder:
  * `protocol.encodeOperation(response, decoded.requestId)`.
  */
 type Decoded<Request> = {
@@ -67,51 +54,23 @@ export type DecodedOperationRequest = Extract<DecodedOperation, {
 /** What `protocol.decodeTransaction` answers. */
 export type DecodedTransaction = Decoded<ClientTransactionRequest>;
 /**
- * `protocol.decodeOperation(request)` — one operation route's HTTP request as the
- * client-origin request `framework.execute` takes, or its answer.
- *
- * Total over ANY value: a value that is not an `AvProtocolRequest` at all — not an
- * object, a missing or mistyped member, a member behind a getter or trap that
- * throws — is malformed, `A2000` under a minted id, before anything else is read;
- * nothing it carries is believed. Otherwise, in order, each step answering before
- * the next runs:
- *
- * 1. the request id: `Aventara-Request-Id` adopted when it is 1–128 visible ASCII
- *    characters, otherwise minted by core's one helper — never a refusal;
- * 2. the path: `/_resources/<resource>/<family>/<variant>`, each segment
- *    URL-decoded once and none empty, or `A2000`;
- * 3. identity and absence, with no body read: a request missing either identity
- *    header is malformed; then the protocol version (`A2006`), the ClientContract
- *    hash (`A2005`), the Resource (`A2001`) and the operation (`A2002`), each
- *    core's own envelope — so an unadvertised triple never reaches `execute`, in
- *    either route style;
- * 4. the method: anything but `POST` is `A2012`, carrying `Allow: POST` (RFC 9110
- *    §15.5.6);
- * 5. the body. On the RAW arm the decoder enforces all of it: the content type
- *    must be `application/json` (`A2011`; parameters are not read), the decoded
- *    byte count must not exceed the ClientContract's `limits.maxRequestBytes`, and
- *    the bytes must be UTF-8 JSON (`A2000`). On the PARSED arm the host's own
- *    parser already read the bytes, so size, content type and JSON syntax were the
- *    HOST's to enforce — answering its parser's failures with `protocol.failure` —
- *    and the decoder checks none of them. Both arms then refuse a body that is not
- *    a JSON object — an array, a scalar, `null`, or none (`A2000`). One gap is the
- *    host's by construction: a parser that turns an absent body into `{}` makes
- *    absence indistinguishable from `{}`, which is valid.
- *
- * The request is client origin, always: nothing the caller sends spells
- * application origin. `transport` carries `POST` and the request's headers. The
- * body is the operation's arguments verbatim: the decoder never reads into it, so
- * routing metadata in it is core's to refuse, and a parsed body reaches core as
- * the same object.
+ * `protocol.decodeOperation(request)` — one operation route's HTTP request as
+ * the client-origin request `framework.execute` takes, or its answer.
  */
 export declare function decodeOperationRequest(contracts: FrameworkContracts, received: AvProtocolRequest): DecodedOperation;
 /**
- * `protocol.decodeTransaction(request)` — the `/_transactions` request as the
- * client-origin plan request `framework.executeTransaction` takes, or its answer.
- * The same steps as {@link decodeOperationRequest}, with the path exactly
- * `/_transactions` and its absence being a ClientContract without interactive
- * transactions. Every step of the plan then runs under ClientContract rules: the
- * plan is client origin and cannot say otherwise. The body is the plan verbatim.
+ * `protocol.decodeTransaction(request)` — the `/_transactions` request as the client-
+ * origin plan request `framework.executeTransaction` takes, or its answer. The same
+ * steps as {@link decodeOperationRequest}, with the path exactly `/_transactions` and
+ * its absence being a ClientContract without interactive transactions. Every step of
+ * the plan then runs under ClientContract rules: the plan is client origin and cannot
+ * say otherwise. The body is the plan verbatim.
  */
 export declare function decodeTransactionRequest(contracts: FrameworkContracts, received: AvProtocolRequest): DecodedTransaction;
+/**
+ * Whether `value` is a body this decoder parsed from raw content. Only the protocol's
+ * own shortcuts ask, about a request they have just decoded, before any host code
+ * could hold it; it is exported from no entry point.
+ */
+export declare function isParsedByDecoder(value: unknown): boolean;
 export {};

package/dist/protocol/http-request.decoder.js

@@ -16,7 +16,7 @@ export function decodeOperationRequest(contracts, received) {
         ? {
             ok: true,
             request: {
-                scope: "client",
+                origin: "client",
                 requestId: read.requestId,
                 resource: route.resource,
                 ...route.operation,
@@ -42,7 +42,7 @@ export function decodeTransactionRequest(contracts, received) {
         ? {
             ok: true,
             request: {
-                scope: "client",
+                origin: "client",
                 requestId: read.requestId,
                 protocol: route.protocol,
                 transport: transportOf(read),
@@ -85,7 +85,15 @@ function bodyValue(body, contentType, maxRequestBytes) {
     catch {
         return "A2000";
     }
-    return isJsonObject(value) ? { value } : "A2000";
+    if (!isJsonObject(value)) {
+        return "A2000";
+    }
+    PARSED_HERE.add(value);
+    return { value };
+}
+const PARSED_HERE = new WeakSet();
+export function isParsedByDecoder(value) {
+    return typeof value === "object" && value !== null && PARSED_HERE.has(value);
 }
 function isJsonMediaType(contentType) {
     return (contentType

package/dist/protocol/http-request.reader.d.ts

@@ -11,9 +11,9 @@ export declare const POST_ONLY: readonly string[];
 /** The methods the contract route accepts: `GET`, only. */
 export declare const GET_ONLY: readonly string[];
 /**
- * Whether a path lies in the protocol's namespace: underscore-prefixed paths
- * beneath the entrypoint are reserved for framework facilities; every other path
- * is the host's.
+ * Whether a path lies in the protocol's namespace: underscore-prefixed paths beneath
+ * the entrypoint are reserved for framework facilities; every other path is the
+ * host's.
  */
 export declare function isProtocolPath(path: string): boolean;
 /** A request the protocol could read, with what every route reads off it first. */
@@ -34,8 +34,8 @@ export type UnreadableRequest = {
     readonly requestId: string;
 };
 /**
- * The host's value read as a request, or — when it is not an `AvProtocolRequest`
- * at all — the `400 A2000` answering it, under a minted id.
+ * The host's value read as a request, or — when it is not an `AvProtocolRequest` at
+ * all — the `400 A2000` answering it, under a minted id.
  */
 export declare function readRequest(received: unknown): ReadRequest | UnreadableRequest;
 /**

package/dist/protocol/http-response.encoder.d.ts

@@ -10,37 +10,31 @@ export type AvProtocolResponse = {
     /** `AvProtocol.httpStatus` of the envelope's code. */
     readonly status: number;
     /**
-     * The headers the framework owns on this response, canonically spelled:
-     * `Content-Type: application/json` and the `Aventara-Request-Id` it echoes.
+     * The headers to send, canonically spelled: `Content-Type: application/json`
+     * and the echoed `Aventara-Request-Id`.
      */
     readonly headers: Readonly<Record<string, string>>;
     /** The JSON text of the envelope, its data in wire forms. */
     readonly body: string;
 };
 /**
- * Where an encoder hands the raw failure behind an `A3003` — the binding's
- * diagnostics channel — with the plan step it blames, if any. The wire never
- * carries it.
+ * Where an encoder hands the raw failure behind an `A3003` — the binding's diagnostics
+ * channel — with the plan step it blames, if any. The wire never carries it.
  */
 export type UnencodableReport = (error: unknown, operation?: number) => void;
 /**
- * `protocol.encodeOperation(response, requestId)`: one operation's framework
- * response as the HTTP response a host writes. Status is the code's; `data` is
- * wire-encoded; `requestId` is echoed as `Aventara-Request-Id` — pass the id the
- * request ran under, which the decoder supplies.
- *
- * Total: a result it cannot encode — and a response whose code is not allocated —
- * answers `A3003` → 500 with the framework's own text, and none of the result
- * reaches the body.
+ * `protocol.encodeOperation(response, requestId)`: one operation's framework response
+ * as the HTTP response a host writes. Status is the code's; `data` is wire-encoded;
+ * `requestId` is echoed as `Aventara-Request-Id` — pass the id the request ran under,
+ * which the decoder supplies.
  */
 export declare function encodeOperationResponse(response: OperationResponse, requestId: string, report?: UnencodableReport): AvProtocolResponse;
 /**
- * `protocol.encodeTransaction(response, requestId)`: the same for a plan's
- * response. A committed plan is `200 A1009` — even when it created something —
- * with each operation's data wire-encoded in plan order by the same walker as
- * {@link encodeOperationResponse}; a rolled-back plan answers its failing
- * operation's own status. A step whose result cannot be encoded answers `A3003` →
- * 500 naming that step as `cause.operation`, as every internal failure inside a
- * plan does.
+ * `protocol.encodeTransaction(response, requestId)`: the same for a plan's response. A
+ * committed plan is `200 A1009` — even when it created something — with each
+ * operation's data wire-encoded in plan order by the same walker as {@link
+ * encodeOperationResponse}; a rolled-back plan answers its failing operation's own
+ * status. A step whose result cannot be encoded answers `A3003` → 500 naming that step
+ * as `cause.operation`, as every internal failure inside a plan does.
  */
 export declare function encodeTransactionResponse(response: TransactionResponse, requestId: string, report?: UnencodableReport): AvProtocolResponse;

package/dist/protocol/http-status.table.d.ts

@@ -1,14 +1,6 @@
 import type { OperationCode } from "../runtime/operation-response.js";
 /**
  * `AvProtocol.httpStatus` — the HTTP status each A-code carries, as passive data.
- *
- * So this one table serves both encoders — an operation's response and a plan's —
- * and a rolled-back plan answers its failing operation's own status. The status is
- * the coarse signal; the A-code is the exact one.
- *
- * Total by type: the literal `satisfies` the mapped type over `OperationCode`, so
- * a code added to core does not compile until its status is written here. Passive:
- * numbers only, frozen, emitted by value where a consumer needs it.
  */
 export declare const httpStatus: {
     readonly [C in OperationCode]: number;

package/dist/protocol/index.d.ts

@@ -1,11 +1,6 @@
 /**
- * `@aventara/core/protocol` — the HTTP protocol, as passive data and pure
- * functions over core. It mounts nothing and imports no HTTP library.
- *
- * The direction is one-way: this entry may import core's internals, and no module
- * of core's execution side imports anything under `protocol/`
- * (`protocol-direction.spec.ts`). The main `@aventara/core` entry exports no name
- * from here.
+ * `@aventara/core/protocol` — the HTTP protocol, as passive data and pure functions
+ * over core. It mounts nothing and imports no HTTP library.
  */
 export * as AvProtocol from "./av-protocol.js";
 export type { AvProtocolRequest } from "./http-request.decoder.js";

package/dist/protocol/operation-response.guard.d.ts

@@ -1,20 +1,5 @@
 import { type OperationResponse } from "../runtime/operation-response.js";
 /**
  * The HTTP status plays no part — a code is read even at an unexpected status.
- *
- * `value` is the body as parsed JSON, or `undefined` when there was no body or it
- * was not JSON (neither is an envelope). An envelope here is:
- *
- * - an object (not an array) with an own `data` member and an allocated `code`;
- * - for an A1xxx code, a `cause` of exactly `null`, and `data` of `null` when the
- *   code is `A1001`;
- * - for every other code, `data` of `null` and a cause: an object whose `message`
- *   is a string, whose `issues`, if present, is a list of objects each with an
- *   allocated V-code, a string `message` and, if present, a `path` of strings and
- *   integers, and whose `operation`, if present, is a non-negative integer.
- *
- * The generated client's own check (`envelopeOf` in its emitted transport) is held
- * to agree with this one on every row of the fixture corpus's family 11, so the
- * two cannot drift apart silently.
  */
 export declare function isOperationResponse(value: unknown): value is OperationResponse;

package/dist/protocol/protocol-failure.d.ts

@@ -1,40 +1,21 @@
 import { type AvProtocolResponse } from "./http-response.encoder.js";
 import type { IdentityHeaderName } from "./protocol-headers.js";
 /**
- * The four transport codes: failures of the HTTP request itself, which the
- * protocol answers before any operation exists, so no execution path produces
- * them. Module type — not an entry export.
+ * The four transport codes: failures of the HTTP request itself, which the protocol
+ * answers before any operation exists, so no execution path produces them. Module type
+ * — not an entry export.
  */
 export type TransportFailureCode = "A2000" | "A2010" | "A2011" | "A2012";
 /**
- * pilot.1 — the `400 A2000` answering a request that did not send an identity
- * header: its message names the missing header or headers, and echoes nothing the
- * request sent — so a developer calling the API by hand learns what to add.
+ * The `400 A2000` answering a request that did not send an identity header: its
+ * message names the missing header or headers and echoes nothing the request sent.
  */
 export declare function identityHeadersMissing(missing: readonly IdentityHeaderName[], requestId: string): AvProtocolResponse;
 /**
  * `protocol.failure(code, requestId?)` / `protocol.failure("A2012", requestId,
- * allow)`: a transport code as the complete framework response — the envelope `{
- * data: null, code, cause: { message } }`, encoded exactly as
- * `protocol.encodeOperation` encodes it, at the code's status.
- *
- * The decoders produce their transport failures through it. A host that parses the
- * body itself answers its own parser's failures with it — `A2000` for text that is
- * not JSON, `A2010` for a body over the limit, `A2011` for another content type.
- *
- * `requestId` is echoed as `Aventara-Request-Id`: pass the id the decoder gave the
- * request when there is one. When there is none — or it is empty — core mints one
- * through its one helper, so a failure is never refused or left uncorrelated.
- *
- * `allow` belongs to `A2012`, and `A2012` requires it: every 405 carries the
- * `Allow` header naming the methods its route DOES accept, joined with `", "` —
- * `[]` is RFC 9110's "no method", still a header. `failure` knows no route, so the
- * caller names the methods; the decoders pass `["POST"]`.
- *
- * A code outside the four, `A2012` without `allow`, `allow` with any other code,
- * or a method that is not an RFC 9110 token is a programming error that the type
- * already refuses; an untyped caller gets a `TypeError`, and no envelope or header
- * is invented for it.
+ * allow)`: a transport code as the complete framework response — the envelope `{ data:
+ * null, code, cause: { message } }`, encoded exactly as `protocol.encodeOperation`
+ * encodes it, at the code's status.
  */
 export declare function transportFailure(code: "A2012", requestId: string | undefined, allow: readonly string[]): AvProtocolResponse;
 export declare function transportFailure(code: Exclude<TransportFailureCode, "A2012">, requestId?: string): AvProtocolResponse;

package/dist/protocol/protocol-headers.d.ts

@@ -1,21 +1,5 @@
 import type { ClientProtocolIdentity } from "../runtime/operation-request.js";
-/**
- * `AvProtocol.headers` — the header names the protocol owns, as passive data.
- *
- * - `protocolVersion`, `contractHash`: the two identity headers every
- *   generated-client resource and transaction request sends; the `_contract`
- *   request needs neither.
- * - `requestId`: the correlation header. A valid one is adopted as the request's
- *   id, an invalid one ignored, and every framework-produced response echoes it.
- *
- * Spelled as the canonical wire text. HTTP header names are case-insensitive, so a
- * reader matches them without regard to case; these spellings are what the
- * framework and the generated client SEND.
- *
- * Passive data: strings only, frozen, so a consumer — the client generator emits
- * it by value into generated source — can neither mutate it nor receive anything
- * `JSON.stringify` would drop or reshape.
- */
+/** `AvProtocol.headers` — the header names the protocol owns, as passive data. */
 export declare const headers: Readonly<{
     readonly protocolVersion: "Aventara-Protocol-Version";
     readonly contractHash: "Aventara-Contract-Hash";
@@ -24,46 +8,35 @@ export declare const headers: Readonly<{
 /** A request's headers as a host hands them over (`AvProtocolRequest.headers`). */
 type ReceivedHeaders = Readonly<Record<string, string | readonly string[] | undefined>>;
 /**
- * The request's headers as one spelling: names lower-cased, a repeated header's
- * values — a list, or one name received in several casings — joined with `", "` in
- * the order received (RFC 9110 §5.3), and an `undefined` entry or an empty list
- * dropped as absent. Values are otherwise as received. This is what a client
- * request's `transport.headers` carries to the developer's pipelines, and what
- * every header read below reads.
- *
- * Built with `Object.fromEntries`, so a header named `__proto__` stays data.
+ * The request's headers as one spelling: names lower-cased, a repeated header's values
+ * — a list, or one name received in several casings — joined with `", "` in the order
+ * received, and an `undefined` entry or an empty list dropped as absent. Values are
+ * otherwise as received. This is what a client request's `transport.headers` carries
+ * to the developer's pipelines, and what every header read below reads.
  */
 export declare function normalizeHeaders(received: ReceivedHeaders): Readonly<Record<string, string>>;
 /**
- * One header's value as the framework reads it, from {@link normalizeHeaders}'
- * output: surrounding spaces and tabs are not part of a field value (RFC 9110
- * §5.5), so they are removed. `undefined` when the header is absent.
+ * One header's value as the framework reads it, from {@link normalizeHeaders}' output:
+ * surrounding spaces and tabs are not part of a field value, so they are removed.
+ * `undefined` when the header is absent.
  */
 export declare function headerValue(normalized: Readonly<Record<string, string>>, name: string): string | undefined;
 /**
  * The identity headers as the `ClientProtocolIdentity` core checks, or `undefined`
- * when either is ABSENT — a request without them is malformed: it does not say
- * which protocol and ClientContract it speaks, so there is nothing to compare.
- *
- * Present values are read, never judged: whether they match is the Framework
- * Validation Layer's call (cross-phase invariant 13), made by core's one
- * stale-client check. A present version that is not a decimal integer (no sign, no
- * leading zero) reads as `NaN`, so it cannot match (`A2006`); a present hash is
- * passed as received (`A2005` unless it is the current one). Present includes
- * empty: a header sent with no value was still sent.
+ * when either is ABSENT — a request without them is malformed: it does not say which
+ * protocol and ClientContract it speaks, so there is nothing to compare.
  */
 export declare function protocolIdentityOf(normalized: Readonly<Record<string, string>>): ClientProtocolIdentity | undefined;
 /**
- * The identity headers a request did not send, in the order the framework sends
- * them — what the `A2000` answering it names (pilot.1). Empty exactly when {@link
- * protocolIdentityOf} reads an identity.
+ * The identity headers a request did not send, in the order the framework sends them —
+ * what the `A2000` answering it names. Empty exactly when {@link protocolIdentityOf}
+ * reads an identity.
  */
 export declare function missingIdentityHeaders(normalized: Readonly<Record<string, string>>): readonly IdentityHeaderName[];
 /** The two identity headers' names, as the framework spells them. */
 export type IdentityHeaderName = (typeof headers)["protocolVersion"] | (typeof headers)["contractHash"];
 /**
- * A repeated header joins with `", "`, which holds a space, so it is never
- * adopted.
+ * A repeated header joins with `", "`, which holds a space, so it is never adopted.
  */
 export declare function adoptedRequestId(normalized: Readonly<Record<string, string>>): string | undefined;
 export {};

package/dist/protocol/protocol-surface.d.ts

@@ -3,16 +3,6 @@ import { type OperationIdentity } from "../operations/operation-identity.js";
 /**
  * One route of the protocol surface: a route a host mounts for the bound
  * ClientContract, tagged by `kind`.
- *
- * - `operation`: a `(resource, family, variant)` the ClientContract advertises.
- *   `method` is always `POST` — every Resource operation is, reads included.
- *   `path` is `/_resources/<resource>/<family>/<variant>`, each segment
- *   percent-encoded exactly as the generated client sends it, so it decodes back
- *   to the exact registry key. Family and variant are one standard operation
- *   identity.
- * - `contract`: `GET /_contract` — always present.
- * - `transactions`: `POST /_transactions` — present exactly when the
- *   ClientContract's `transactions` is `"interactive"`.
  */
 export type SurfaceRoute = ({
     readonly kind: "operation";
@@ -33,17 +23,5 @@ export type SurfaceRoute = ({
  * deep-frozen — exactly the advertised operation triples in the Contract's own key
  * order, then `GET /_contract`, then `POST /_transactions` when, and only when,
  * `transactions === "interactive"`.
- *
- * Derived from the ClientContract alone — never configuration, the adapter model,
- * or another layer's Contract — so a client-hidden resource has no route, and a
- * resource whose every operation was restricted away keeps its `operations: {}`
- * and contributes nothing. Availability is read ONLY through
- * `isOperationVariantAvailable`, so a scope-qualified leaf is a route exactly as
- * `true` is, and the next widening of `OperationAvailability` reaches this reader
- * with every other. A family or variant key outside the standard operation set is
- * not a route: segments go through `parseOperationIdentity`, the same decoder that
- * reads a request's. The transaction route is tested against `"interactive"`
- * itself, never as "not `none`", so a capability value this reader does not know
- * mounts nothing.
  */
 export declare function surfaceOf(client: ClientContract): readonly SurfaceRoute[];

package/dist/protocol/protocol.binder.d.ts

@@ -6,9 +6,8 @@ import { type AvProtocolResponse } from "./http-response.encoder.js";
 import { transportFailure } from "./protocol-failure.js";
 import { type SurfaceRoute } from "./protocol-surface.js";
 /**
- * The protocol bound to ONE Framework instance — what `AvProtocol.bind` returns. A
- * host binds once, at startup, and calls these members per request; none takes a
- * Contract, an entrypoint or a limit, because the binding already read them.
+ * The protocol bound to one Framework instance, as `AvProtocol.bind` returns
+ * it. Bind once at startup and call these members per request.
  */
 export type AvProtocolBinding = {
     /**
@@ -19,10 +18,6 @@ export type AvProtocolBinding = {
      * `transactions` is `"interactive"`. Each path is relative to
      * `framework.entrypoint`. Read once at bind time: every call answers the same
      * deep-frozen list, which is passive data a host may serialize.
-     *
-     * A host that mounts one route per entry still needs a fallback for the paths it
-     * did not mount: that is the absence responder's, not a catch-all into framework
-     * handling.
      */
     readonly surface: () => readonly SurfaceRoute[];
     /**
@@ -42,9 +37,9 @@ export type AvProtocolBinding = {
     readonly decodeTransaction: (request: AvProtocolRequest) => DecodedTransaction;
     /**
      * One operation's framework response — what `framework.execute` answered — as the
-     * HTTP response a host writes: the code's status, `data` in wire forms,
-     * `Aventara-Request-Id` echoed. A result with no wire form answers `A3003` → 500.
-     * A diagnostic of one operation names it (`resource`, `family`, `variant`), so the
+     * HTTP response a host writes: the code's status, `data` in wire forms, `Aventara-
+     * Request-Id` echoed. A result with no wire form answers `A3003` → 500. A
+     * diagnostic of one operation names it (`resource`, `family`, `variant`), so the
      * `A3003` reaches the diagnostics sink only when the host passes `decoded` —
      * `decodeOperation`'s success value — as `handleOperation` does; without it the
      * answer is the same and nothing is reported.
@@ -53,15 +48,15 @@ export type AvProtocolBinding = {
     /**
      * The same for `/_transactions` — what `framework.executeTransaction` answered. An
      * `A3003` is reported to the Framework's diagnostics sink as a `"transaction"`
-     * diagnostic — client scope, this `requestId`, the step it blames as `operation` —
+     * diagnostic — client origin, this `requestId`, the step it blames as `operation` —
      * with the value that had no wire form (or what its getter threw) as `error`.
      */
     readonly encodeTransaction: (response: TransactionResponse, requestId: string) => AvProtocolResponse;
     /**
      * A transport code — `A2000`, `A2010`, `A2011` or `A2012` — as the complete
-     * framework response, with framework-authored text (ruled 2026-10-05). For a host
-     * that parses the body itself and must answer its parser's failure. `A2012`
-     * requires the methods its route allows, so every 405 carries `Allow`.
+     * framework response. For a host that parses the body itself and must answer
+     * its parser's failure. `A2012` requires the methods its route allows, so
+     * every 405 carries `Allow`.
      */
     readonly failure: typeof transportFailure;
     /**
@@ -89,22 +84,19 @@ export type AvProtocolBinding = {
      */
     readonly encodeContract: (request: AvProtocolRequest) => AvProtocolResponse;
     /**
-     * The absence responder: the fallback a host mounts for every path it did not
-     * mount from `surface()` — never a catch-all into framework handling (it reads no
-     * body, runs no pipeline, calls no Adapter). Answers what the catch-all decoder
-     * answers before a body — `A2000`, `A2006`, `A2005`, `A2001`, `A2002`, `A2012`
-     * with `Allow` — byte for byte; a route that exists reached with its own method as
-     * `500 A3000` (a host that mounted only part of the surface); and `undefined` for
-     * a path outside the protocol's namespace, which the host answers itself.
+     * The fallback for every path a host did not mount from `surface()`. It reads
+     * no body, runs no pipeline and calls no Adapter. It answers `A2000`, `A2006`,
+     * `A2005`, `A2001`, `A2002` or `A2012` (with `Allow`) as the operation routes
+     * would, `500 A3000` for a mounted route reached with its own method, and
+     * `undefined` for a path outside the protocol's namespace, which the host
+     * answers itself. An operation or `/_transactions` route answered `500 A3000`
+     * is also reported once to the Framework's diagnostics sink, as an
+     * `UnmountedRouteError` naming the route the host did not mount.
      */
     readonly answerAbsent: (request: AvProtocolRequest) => AvProtocolResponse | undefined;
 };
 /**
- * `AvProtocol.bind(framework)`: reads the instance's compiled ClientContract once
- * and returns the bound members, frozen.
- *
- * It validates nothing construction did not: `createFramework` already refused a
- * bad entrypoint and compiled the ClientContract this reads, so binding cannot
- * fail.
+ * `AvProtocol.bind(framework)`: reads the instance's compiled ClientContract
+ * once and returns the bound members, frozen.
  */
 export declare function bind(framework: Framework): AvProtocolBinding;

package/dist/protocol/protocol.binder.js

@@ -1,4 +1,5 @@
 import { diagnosticsSinkOf } from "../runtime/diagnostics-reporter.js";
+import { ownedExecutionOf } from "../runtime/owned-execution.registry.js";
 import { answerAbsentRequest } from "./absent-route.responder.js";
 import { contractDocumentOf, encodeContractRequest, } from "./contract-document.responder.js";
 import { decodeOperationRequest, decodeTransactionRequest, } from "./http-request.decoder.js";
@@ -15,6 +16,7 @@ export function bind(framework) {
         contracts,
         execute: (request) => framework.execute(request),
         executeTransaction: (request) => framework.executeTransaction(request),
+        owned: ownedExecutionOf(framework),
         sink,
     };
     return Object.freeze({
@@ -29,6 +31,6 @@ export function bind(framework) {
         handleOperation: (request) => handleOperationRequest(handler, request),
         handleTransaction: (request) => handleTransactionRequest(handler, request),
         encodeContract: (request) => encodeContractRequest(document, request),
-        answerAbsent: (request) => answerAbsentRequest(contracts, request),
+        answerAbsent: (request) => answerAbsentRequest(contracts, request, sink),
     });
 }

package/dist/protocol/protocol.handler.d.ts

@@ -2,47 +2,43 @@ import type { FrameworkContracts } from "../compiler/contract.compiler.js";
 import type { Framework } from "../framework/framework.js";
 import { type FrameworkDiagnosticsSink } from "../runtime/diagnostics-reporter.js";
 import type { ClientOperationRequest } from "../runtime/operation-request.js";
+import type { OwnedExecution } from "../runtime/owned-execution.registry.js";
 import { type AvProtocolRequest } from "./http-request.decoder.js";
 import { type AvProtocolResponse, type UnencodableReport } from "./http-response.encoder.js";
 /**
- * What the shortcuts read off the bound Framework: its compiled Contracts, the
- * execution seam, and its configured diagnostics sink.
+ * What the shortcuts read off the bound Framework: its compiled Contracts, its
+ * execution entry points — the public ones, and the owned ones that run a body this
+ * decoder parsed without copying it again (absent for anything but a
+ * constructed Framework) — and its configured diagnostics sink.
  */
 export type HandlerContext = {
     readonly contracts: FrameworkContracts;
     readonly execute: Framework["execute"];
     readonly executeTransaction: Framework["executeTransaction"];
+    readonly owned: OwnedExecution | undefined;
     readonly sink: FrameworkDiagnosticsSink | undefined;
 };
 /**
- * Where a plan's `A3003` goes: the Framework's diagnostics sink, as a
- * `"transaction"` diagnostic — client scope, the request id the plan ran under,
- * and the step the encoder blames as `operation` when it blames one. One spelling
- * for both `protocol.encodeTransaction` and `protocol.handleTransaction`.
+ * Where a plan's `A3003` goes: the Framework's diagnostics sink, as a `"transaction"`
+ * diagnostic — client origin, the request id the plan ran under, and the step the
+ * encoder blames as `operation` when it blames one. One spelling for both
+ * `protocol.encodeTransaction` and `protocol.handleTransaction`.
  */
 export declare function planUnencodableReport(sink: FrameworkDiagnosticsSink | undefined, requestId: string): UnencodableReport;
 /**
  * Where one operation's `A3003` goes: the Framework's diagnostics sink, as an
- * `"operation"` diagnostic carrying the decoded request's identity and id — the
- * shape the public `OperationDiagnostic` already has. One spelling for
+ * `"operation"` diagnostic carrying the decoded request's identity and id — the shape
+ * the public `OperationDiagnostic` already has. One spelling for
  * `protocol.handleOperation` and for `protocol.encodeOperation` given the decoded
  * request.
  */
 export declare function operationUnencodableReport(sink: FrameworkDiagnosticsSink | undefined, request: ClientOperationRequest): UnencodableReport;
 /**
- * `protocol.handleOperation(request)`: the three steps a host would otherwise
- * spell out — `decodeOperation` → `framework.execute` → `encodeOperation` — in one
- * call, resolving the `AvProtocolResponse` the host writes. A request the decoder
- * answers itself (a transport failure, an identity mismatch, an unadvertised
- * route) is answered without executing.
- *
- * Total over ANY value, never rejecting: the decoder answers every value,
- * `execute` resolves for every request it is handed, and the encoder answers every
- * response — a result with no wire form as `A3003` →
- * 500. That `A3003` reaches the Framework's diagnostics sink as an `"operation"`
- *      diagnostic carrying the decoded request's identity and id, which only this
- *      shortcut holds: the bare `encodeOperation` is given the response and the
- *      request id alone.
+ * `protocol.handleOperation(request)`: the three steps a host would otherwise spell
+ * out — `decodeOperation` → `framework.execute` → `encodeOperation` — in one call,
+ * resolving the `AvProtocolResponse` the host writes. A request the decoder answers
+ * itself (a transport failure, an identity mismatch, an unadvertised route) is
+ * answered without executing.
  */
 export declare function handleOperationRequest(context: HandlerContext, request: AvProtocolRequest): Promise<AvProtocolResponse>;
 /**
@@ -51,8 +47,8 @@ export declare function handleOperationRequest(context: HandlerContext, request:
  * decoded plan is client origin and cannot say otherwise, so every step runs under
  * ClientContract rules: a client-hidden field, a client-restricted variant or a
  * client-hidden Resource is refused as through its single-operation route, plus
- * `cause.operation`. A committed plan is `200 A1009`; a rolled-back one answers
- * its failing step's code at that code's status. Total over any value, as {@link
+ * `cause.operation`. A committed plan is `200 A1009`; a rolled-back one answers its
+ * failing step's code at that code's status. Total over any value, as {@link
  * handleOperationRequest} is; an `A3003` is reported through {@link
  * planUnencodableReport}.
  */