@aventara/core 0.1.0-pilot.4 → 1.0.0-rc.0

package/dist/runtime/error-boundary.js

@@ -79,8 +79,11 @@ function projectPath(value) {
 export const OPERATION_ARGUMENTS_PATH = [
     "arguments",
 ];
+export function planStepPath(index) {
+    return ["operations", index];
+}
 export function planOperationArgumentsPath(index) {
-    return ["operations", index, "args"];
+    return [...planStepPath(index), "args"];
 }
 const UNRESOLVED = Symbol("unresolved-path-segment");
 function readOwnMember(container, key) {
@@ -100,38 +103,43 @@ function readSegment(container, segment) {
     }
     return readOwnMember(container, segment);
 }
-function resolvesAgainstArguments(path, view) {
+function vouchPath(path, view) {
     try {
-        if (path.length < view.path.length) {
-            return false;
-        }
-        for (let index = 0; index < view.path.length; index += 1) {
-            if (path[index] !== view.path[index]) {
-                return false;
-            }
+        const root = [view.path, OPERATION_ARGUMENTS_PATH].find((prefix) => startsWith(path, prefix));
+        if (root === undefined) {
+            return undefined;
         }
         let current = view.arguments;
-        for (let index = view.path.length; index < path.length; index += 1) {
+        for (let index = root.length; index < path.length; index += 1) {
             const segment = path[index];
             if (segment === undefined) {
-                return false;
+                return undefined;
             }
             current = readSegment(current, segment);
             if (current === UNRESOLVED) {
-                return false;
+                return undefined;
             }
         }
-        return true;
+        return [...view.path, ...path.slice(root.length)];
     }
     catch {
-        return false;
+        return undefined;
     }
 }
+function startsWith(path, prefix) {
+    return (path.length >= prefix.length &&
+        prefix.every((segment, index) => path[index] === segment));
+}
 function isValidationCode(value) {
     return (typeof value === "string" &&
         VALIDATION_CODES.includes(value));
 }
-function projectIssue(value, unvouched, view) {
+export const MAX_DEVELOPER_ISSUE_MESSAGE_LENGTH = 1_000;
+function isDeveloperMessage(message) {
+    return (message.length <= MAX_DEVELOPER_ISSUE_MESSAGE_LENGTH &&
+        message.trim().length > 0);
+}
+function projectIssue(value, unvouched, view, author) {
     if (typeof value !== "object" || value === null) {
         return undefined;
     }
@@ -142,23 +150,32 @@ function projectIssue(value, unvouched, view) {
         }
         return undefined;
     }
-    const message = readProperty(value, "message");
+    const supplied = readProperty(value, "message");
     const rawPath = readProperty(value, "path");
-    if (typeof message !== "string") {
+    if (typeof supplied !== "string") {
         return undefined;
     }
-    const owned = VALIDATION_CODE_MESSAGES[code];
+    let message = VALIDATION_CODE_MESSAGES[code];
+    if (author === "developer") {
+        if (isDeveloperMessage(supplied)) {
+            message = supplied;
+        }
+        else {
+            unvouched.push(supplied);
+        }
+    }
     if (rawPath === undefined) {
-        return { code, message: owned };
+        return { code, message };
     }
-    const path = projectPath(rawPath);
-    if (path === undefined || !resolvesAgainstArguments(path, view)) {
+    const projected = projectPath(rawPath);
+    const path = projected === undefined ? undefined : vouchPath(projected, view);
+    if (path === undefined) {
         unvouched.push(rawPath);
-        return { code, message: owned };
+        return { code, message };
     }
-    return { path, code, message: owned };
+    return { path, code, message };
 }
-function projectCause(value, unvouched, view) {
+function projectCause(value, unvouched, view, author) {
     const message = readProperty(value, "message");
     if (typeof message !== "string") {
         return undefined;
@@ -166,7 +183,7 @@ function projectCause(value, unvouched, view) {
     const rawIssues = readList(readProperty(value, "issues"));
     const rawOperation = readProperty(value, "operation");
     const issues = rawIssues
-        ?.map((issue) => projectIssue(issue, unvouched, view))
+        ?.map((issue) => projectIssue(issue, unvouched, view, author))
         .filter((issue) => issue !== undefined);
     return {
         message,
@@ -206,7 +223,7 @@ function isOperationErrorCode(value) {
         OPERATION_CODES.includes(value) &&
         !value.startsWith("A1"));
 }
-function vetDeliberateOutcome(error, view) {
+function vetDeliberateOutcome(error, view, author) {
     if (!isFrameworkErrorInstance(error)) {
         return undefined;
     }
@@ -218,7 +235,7 @@ function vetDeliberateOutcome(error, view) {
         return MALFORMED_OUTCOME;
     }
     const unvouched = [];
-    const cause = projectCause(rawCause, unvouched, view);
+    const cause = projectCause(rawCause, unvouched, view, author);
     return cause === undefined ? MALFORMED_OUTCOME : { code, cause, unvouched };
 }
 function reportUnvouched(outcome, report) {
@@ -226,13 +243,20 @@ function reportUnvouched(outcome, report) {
         report(value, outcome.code);
     }
 }
+function reportDeliberate(thrown, outcome, report) {
+    if (isInternalCode(outcome.code)) {
+        report(thrown, outcome.code, { deliberate: true });
+        return;
+    }
+    reportUnvouched(outcome, report);
+}
 function deliberateFailure(outcome) {
     return operationFailure(outcome.code, isInternalCode(outcome.code)
         ? internalCause(outcome.code, outcome.cause)
         : outcome.cause);
 }
 export function sanitizeOperationFailure(error, origin, report, view) {
-    const outcome = vetDeliberateOutcome(error, view);
+    const outcome = vetDeliberateOutcome(error, view, origin === "adapter" ? "adapter" : "developer");
     if (outcome === undefined) {
         report(error, unexpectedCode(origin));
         return unexpectedFailure(origin);
@@ -240,7 +264,9 @@ export function sanitizeOperationFailure(error, origin, report, view) {
     if (outcome === MALFORMED_OUTCOME) {
         report(error, "A3000");
     }
-    reportUnvouched(outcome, report);
+    else {
+        reportDeliberate(error, outcome, report);
+    }
     return deliberateFailure(outcome);
 }
 export async function resolveOperationFailure(error, filters, context, boundary, report, view) {
@@ -249,20 +275,24 @@ export async function resolveOperationFailure(error, filters, context, boundary,
         if (filter === undefined) {
             continue;
         }
-        const handled = await attemptFilter(filter, error, context, view);
+        const handled = await attemptFilter(filter, error, context, view, boundary);
         if (handled !== undefined) {
-            if (handled === MALFORMED_OUTCOME) {
+            if (handled.outcome === MALFORMED_OUTCOME) {
                 report(error, "A3000");
             }
-            reportUnvouched(handled, report);
-            return deliberateFailure(handled);
+            else {
+                reportDeliberate(handled.returned, handled.outcome, report);
+            }
+            return deliberateFailure(handled.outcome);
         }
     }
     return sanitizeOperationFailure(error, boundary.originOf(error), report, view);
 }
-async function attemptFilter(filter, error, context, view) {
+async function attemptFilter(filter, error, context, view, boundary) {
     try {
-        return vetDeliberateOutcome(await filter(error, context), view);
+        const returned = await filter(error, context);
+        const outcome = vetDeliberateOutcome(returned, view, boundary.originOf(returned) === "adapter" ? "adapter" : "developer");
+        return outcome === undefined ? undefined : { returned, outcome };
     }
     catch {
         return undefined;

package/dist/runtime/field-behavior.d.ts

@@ -8,7 +8,7 @@ import type { PipelineContext } from "./pipeline.js";
  * What a write-stage compute callback is told about the field it is computing.
  */
 type ComputedWriteContext<M extends AdapterModel, Cfg, R extends FrameworkResourceKey<M>> = {
-    readonly scope: RequestOrigin;
+    readonly origin: RequestOrigin;
     readonly resource: R;
     readonly field: EffectiveFieldKey<M, Cfg, R>;
     readonly value: unknown;
@@ -30,7 +30,7 @@ export type ComputeOnUpdate<M extends AdapterModel = AdapterModel, Cfg = AnyFram
  * and returns the value to return.
  */
 export type ComputeOnRead<M extends AdapterModel = AdapterModel, Cfg = AnyFrameworkConfig, R extends FrameworkResourceKey<M> = FrameworkResourceKey<M>> = (context: {
-    readonly scope: RequestOrigin;
+    readonly origin: RequestOrigin;
     readonly resource: R;
     readonly field: EffectiveFieldKey<M, Cfg, R>;
     readonly value: unknown;

package/dist/runtime/framework-error.d.ts

@@ -2,6 +2,18 @@ import type { Cause, OperationErrorCode } from "./operation-response.js";
 /**
  * Throw from a pipeline, behavior or Adapter to answer the request with one
  * framework error code and cause.
+ *
+ * For any code outside `A3xxx`, `cause.message` is sent to the caller exactly as
+ * written: put nothing in it you would not show the caller (no database text,
+ * SQL, stack, path or secret). So is each issue's `message`, when your own code
+ * (a pipe, guard, hook, interceptor, filter or behavior) throws it and it is not
+ * blank and at most 1,000 characters; otherwise, and for an issue an Adapter
+ * throws, the caller receives the framework's own text for the issue's code. An
+ * issue's `code` must be a validation code (`V1000` and up) and its `path` must
+ * name a member of the request's own arguments, or the issue, or the path, is
+ * not sent. For an `A3xxx` code the caller receives the framework's generic
+ * message instead, and nothing of the cause; the error itself reaches the root
+ * `diagnostics` sink once, marked `deliberate: true`.
  */
 export declare class FrameworkError extends Error {
     readonly code: OperationErrorCode;

package/dist/runtime/misuse-reporter.d.ts

@@ -0,0 +1,32 @@
+import type { RequestOrigin } from "../config/config-layer.js";
+import type { OperationFamily } from "../operations/operation-identity.js";
+/**
+ * One caller value the framework refused because it could not be read
+ * (`"unreadable-value"`: a revoked Proxy, a throwing getter or trap) or is not plain
+ * data (`"non-plain-value"`: a class instance other than `Date`, `Decimal` or
+ * `Uint8Array`). The caller received `A2004` with one `V1001` at `path`.
+ *
+ * The operation's identity is present when the framework could read it — absent for
+ * a request whose own envelope could not be read — and `operation` is the step's
+ * index in a transaction plan.
+ */
+export type FrameworkMisuseEvent = {
+    readonly kind: "unreadable-value" | "non-plain-value";
+    /** The issue path the caller received. */
+    readonly path: readonly (string | number)[];
+    readonly origin?: RequestOrigin;
+    readonly resource?: string;
+    readonly family?: OperationFamily;
+    readonly variant?: string;
+    readonly operation?: number;
+};
+/**
+ * Receives a {@link FrameworkMisuseEvent} for every caller value the framework
+ * refused as unreadable or not plain data. Set once, as the root configuration's
+ * `misuse`. What it returns, throws or rejects with never reaches the response.
+ */
+export type FrameworkMisuseSink = (event: FrameworkMisuseEvent) => void | Promise<void>;
+/** The channel as the runtime holds it: total, never awaited. */
+export type MisuseReporter = (event: FrameworkMisuseEvent) => void;
+/** Binds the configured sink; without one, nothing is observed. */
+export declare function createMisuseReporter(sink: FrameworkMisuseSink | undefined): MisuseReporter;

package/dist/runtime/misuse-reporter.js

@@ -0,0 +1,19 @@
+const IGNORE_MISUSE = () => undefined;
+export function createMisuseReporter(sink) {
+    if (sink === undefined) {
+        return IGNORE_MISUSE;
+    }
+    return (event) => {
+        try {
+            const settled = sink(event);
+            if (typeof settled === "object" &&
+                settled !== null &&
+                typeof settled.then === "function") {
+                settled.then(undefined, () => undefined);
+            }
+        }
+        catch {
+            return;
+        }
+    };
+}

package/dist/runtime/mutation-planner.js

@@ -1,7 +1,6 @@
 import { lookupField, lookupResource } from "../contracts/contract-lookup.js";
-import { FrameworkError } from "./framework-error.js";
-import { INTERNAL_FAILURE_MESSAGE } from "./operation-response.js";
-import { normalizeScalarFieldValue } from "./scalar-runtime.js";
+import { ComputedValueError } from "./computed-value.error.js";
+import { jsonShapeIssues, normalizeScalarFieldValue, } from "./scalar-runtime.js";
 function writeScalarField(contracts, resourceName, fieldName) {
     const field = lookupField(lookupResource(contracts.core, resourceName), fieldName) ??
         lookupField(lookupResource(contracts.active, resourceName), fieldName);
@@ -34,12 +33,6 @@ function cloneRecord(value) {
 function relationEntries(value) {
     return Array.isArray(value) ? value : [value];
 }
-function behaviorFailure(issues) {
-    throw new FrameworkError("A3000", {
-        message: INTERNAL_FAILURE_MESSAGE,
-        issues,
-    });
-}
 async function computeRecord(contracts, behaviors, request, resourceName, stage, data, contextFactory) {
     if (!isRecord(data)) {
         return data;
@@ -64,7 +57,7 @@ async function computeRecord(contracts, behaviors, request, resourceName, stage,
                 continue;
             }
             const computed = await callback({
-                scope: request.scope,
+                origin: request.origin,
                 resource: resourceName,
                 field: fieldName,
                 value: logicalData[fieldName],
@@ -76,7 +69,16 @@ async function computeRecord(contracts, behaviors, request, resourceName, stage,
             }
             const validation = normalizeScalarFieldValue(contracts.core, field, computed, "runtime", ["behaviors", resourceName, fieldName, stage]);
             if (!validation.ok) {
-                behaviorFailure(validation.issues);
+                throw new ComputedValueError(resourceName, fieldName, stage, validation.issues);
+            }
+            const shapeIssues = jsonShapeIssues(field, validation.value, [
+                "behaviors",
+                resourceName,
+                fieldName,
+                stage,
+            ]);
+            if (shapeIssues.length > 0) {
+                throw new ComputedValueError(resourceName, fieldName, stage, shapeIssues);
             }
             logicalData[fieldName] = validation.value;
         }

package/dist/runtime/operation-request.d.ts

@@ -1,12 +1,5 @@
-import type { RequestOrigin } from "../config/config-layer.js";
 import type { OperationIdentity } from "../operations/operation-identity.js";
 import type { PipelineTransportContext } from "./pipeline.js";
-/**
- * @deprecated Use {@link RequestOrigin}. The set it names is not a property of
- * an operation but the origin layer a request belongs to, derived from
- * `ConfigLayer`; kept as an alias so existing consumers keep compiling.
- */
-export type OperationScope = RequestOrigin;
 /** The protocol version and ClientContract hash a client says it was built for. */
 export type ClientProtocolIdentity = {
     readonly version: number;
@@ -19,7 +12,7 @@ type RuntimeOperationBase = OperationIdentity & {
 };
 /** An in-process request, run under the Application Contract. */
 export type ApplicationOperationRequest = RuntimeOperationBase & {
-    readonly scope: "application";
+    readonly origin: "application";
     readonly protocol?: never;
     readonly transport?: never;
 };
@@ -28,7 +21,7 @@ export type ApplicationOperationRequest = RuntimeOperationBase & {
  * the client sent.
  */
 export type ClientOperationRequest = RuntimeOperationBase & {
-    readonly scope: "client";
+    readonly origin: "client";
     readonly protocol: ClientProtocolIdentity;
     readonly transport?: PipelineTransportContext;
 };
@@ -37,10 +30,10 @@ export type FrameworkOperationRequest = ApplicationOperationRequest | ClientOper
 type WithoutArguments<Request> = Request extends unknown ? Omit<Request, "arguments"> : never;
 /**
  * A request as every stage after the Framework Validation Layer sees it:
- * identity, scope, request id and transport, but never `arguments`. Those
+ * identity, origin, request id and transport, but never `arguments`. Those
  * stages act on the validated arguments passed beside it; the unvalidated
  * view — inside a transaction plan still carrying `$ref` placeholders — is
- * unreachable by type. Distributive, so the scope and family/variant
+ * unreachable by type. Distributive, so the origin and family/variant
  * correlations survive the omission.
  */
 export type OperationExecutionRequest = WithoutArguments<FrameworkOperationRequest>;

package/dist/runtime/operation-runtime.d.ts

@@ -6,10 +6,12 @@ import type { ResolvedFrameworkConfig } from "../config/config.resolver.js";
 import type { Contract } from "../contracts/contract.js";
 import type { OperationValidationOptions, SemanticOperationArguments } from "../operations/operation-validator.js";
 import type { FrameworkTransactionRequest } from "../transactions/transaction-request.js";
-import { type CreateRequirementTable } from "./create-requirement.js";
+import { type ArgumentsSource } from "./caller-data.door.js";
+import { type RecordWriteFacts } from "./create-requirement.js";
 import type { DiagnosticsReporter } from "./diagnostics-reporter.js";
 import type { ClientProtocolIdentity, FrameworkOperationRequest, OperationExecutionRequest } from "./operation-request.js";
 import type { OperationFailureResponse, OperationResponse } from "./operation-response.js";
+import { type NormalizationWrite } from "./scalar-runtime.js";
 export type OperationRuntimeDependencies<M extends AdapterModel> = {
     readonly adapter: Adapter<M>;
     readonly contracts: FrameworkContracts;
@@ -21,17 +23,22 @@ export type OperationRuntimeDependencies<M extends AdapterModel> = {
  * transaction plan the root Adapter is unreachable by type.
  */
 export type OperationPipelineDependencies<M extends AdapterModel> = Omit<OperationRuntimeDependencies<M>, "adapter"> & {
-    /** The Adapter's create requirements, read once at construction. */
-    readonly createRequirements: CreateRequirementTable;
+    /**
+     * The Adapter's create requirements and referential edges, read once at
+     * construction.
+     */
+    readonly recordWrites: RecordWriteFacts;
 };
 /**
  * The executor core owns no diagnostics channel: the framework factory owns
  * it and hands in one reporter already bound to this request, so every
  * boundary — including the outermost totality guard, which runs outside this
- * function — reports through the same channel.
+ * function — reports through the same channel. `source` says whether the
+ * request's arguments are the caller's own objects, copied at the door, or data
+ * no caller holds (see {@link ArgumentsSource}).
  */
-export type FrameworkOperationExecutor = (request: FrameworkOperationRequest, report: DiagnosticsReporter) => Promise<OperationResponse>;
-/** Selects the Contract of the request's execution scope. */
+export type FrameworkOperationExecutor = (request: FrameworkOperationRequest, report: DiagnosticsReporter, source: ArgumentsSource) => Promise<OperationResponse>;
+/** Selects the Contract of the request's origin. */
 export declare function activeContract(contracts: FrameworkContracts, request: FrameworkOperationRequest | FrameworkTransactionRequest): Contract;
 /** Creates the transport-independent operation executor owned by core. */
 export declare function createOperationRuntime<M extends AdapterModel>(dependencies: OperationRuntimeDependencies<M>): FrameworkOperationExecutor;
@@ -53,7 +60,7 @@ export type ValidatedOperationArguments = {
     readonly response: OperationFailureResponse;
 };
 /** Validates one operation's arguments through the Framework Validation Layer. */
-export declare function validateOperationRequest(contract: Contract, request: FrameworkOperationRequest, options?: OperationValidationOptions): ValidatedOperationArguments;
+export declare function validateOperationRequest(contract: Contract, request: FrameworkOperationRequest, options?: OperationValidationOptions, write?: NormalizationWrite): ValidatedOperationArguments;
 /**
  * Everything after the Framework Validation Layer: the developer/runtime path
  * wrapped in the post-validation error boundary. Validation failures never

package/dist/runtime/operation-runtime.js

@@ -1,32 +1,34 @@
 import { AVENTARA_PROTOCOL_VERSION } from "../contracts/contract-protocol.js";
-import { validateOperationArguments } from "../operations/operation-validator.js";
+import { findOperationAvailabilityIssue, validateOperationArguments, } from "../operations/operation-validator.js";
+import { copyAtDoor, misuseIdentityOf, refuseCallerData, } from "./caller-data.door.js";
 import { materializeReadOperation, planReadOperation, } from "./computed-read-runtime.js";
-import { missingCreateValues, } from "./create-requirement.js";
+import { createRequirementIssues, recordWriteFactsOf, } from "./create-requirement.js";
 import { AdapterBoundary, OPERATION_ARGUMENTS_PATH, resolveOperationFailure, sanitizeOperationFailure, } from "./error-boundary.js";
+import { createMisuseReporter, } from "./misuse-reporter.js";
 import { applyWriteFieldBehaviors, stripVirtualMutationInput, } from "./mutation-planner.js";
 import { internalFailure, operationFailure } from "./operation-response.js";
 import { mapOperationOutcome, mapValidationOutcome } from "./outcome-mapper.js";
-import { validateOperationOutput } from "./output-validator.js";
+import { OutputValidationError, validateOperationOutput, } from "./output-validator.js";
 import { refusePipeOutput } from "./pipe-output.validator.js";
-import { normalizeOperationScalarValues } from "./scalar-runtime.js";
+import { normalizeOperationScalarValues, } from "./scalar-runtime.js";
 export function activeContract(contracts, request) {
-    return request.scope === "application"
+    return request.origin === "application"
         ? contracts.application
         : contracts.client;
 }
 function activeScopeConfig(config, request) {
-    return request.scope === "application" ? config.application : config.client;
+    return request.origin === "application" ? config.application : config.client;
 }
 function pipelineContext(contract, request, args) {
     return {
         contract,
-        scope: request.scope,
+        origin: request.origin,
         resource: request.resource,
         family: request.family,
         variant: request.variant,
         args,
         requestId: request.requestId,
-        ...(request.scope === "client" && request.transport !== undefined
+        ...(request.origin === "client" && request.transport !== undefined
             ? { transport: request.transport }
             : {}),
     };
@@ -37,24 +39,30 @@ function forbidden() {
     });
 }
 function outputAccepted(contract, request, projection, data, report) {
+    let validation;
     try {
-        return validateOperationOutput(contract, request, projection, data).ok;
+        validation = validateOperationOutput(contract, request, projection, data);
     }
     catch (error) {
         report(error, "A3000");
         return false;
     }
+    if (!validation.ok) {
+        report(new OutputValidationError(request, validation.issues), "A3000");
+    }
+    return validation.ok;
 }
 export function createOperationRuntime(dependencies) {
     const pipelineDependencies = {
         contracts: dependencies.contracts,
         config: dependencies.config,
-        createRequirements: dependencies.adapter.createRequirements ?? {},
+        recordWrites: recordWriteFactsOf(dependencies.adapter),
     };
-    return async (request, report) => {
+    const misuse = createMisuseReporter(dependencies.config.misuse);
+    return async (request, report, source) => {
         let validated;
         try {
-            validated = validateOperation(dependencies, request);
+            validated = validateOperation(dependencies, request, source, misuse);
         }
         catch (error) {
             return sanitizeOperationFailure(error, "runtime", report, {
@@ -68,20 +76,31 @@ export function createOperationRuntime(dependencies) {
         return executeValidatedOperation(pipelineDependencies, request, validated.contract, validated.arguments, OPERATION_ARGUMENTS_PATH, dependencies.adapter, report);
     };
 }
-function validateOperation(dependencies, request) {
+function validateOperation(dependencies, request, source, misuse) {
     const protocolFailure = validateProtocolIdentity(dependencies.contracts, request);
     if (protocolFailure !== undefined) {
         return rejected(protocolFailure);
     }
     const contract = activeContract(dependencies.contracts, request);
-    const validation = validateOperationRequest(contract, request);
+    let owned = request;
+    if (source === "caller" &&
+        findOperationAvailabilityIssue(contract, request) === undefined) {
+        const copy = copyAtDoor(request.arguments);
+        if (!copy.ok) {
+            return rejected(mapValidationOutcome([
+                refuseCallerData(copy.error, OPERATION_ARGUMENTS_PATH, misuseIdentityOf(request), misuse),
+            ]));
+        }
+        owned = { ...request, arguments: copy.value };
+    }
+    const validation = validateOperationRequest(contract, owned, undefined, "in-place");
     if (!validation.ok) {
         return rejected(validation.response);
     }
     return { ok: true, contract, arguments: validation.arguments };
 }
 export function validateProtocolIdentity(contracts, request) {
-    return request.scope === "client"
+    return request.origin === "client"
         ? protocolIdentityFailure(contracts, request.protocol)
         : undefined;
 }
@@ -98,12 +117,12 @@ export function protocolIdentityFailure(contracts, protocol) {
     }
     return undefined;
 }
-export function validateOperationRequest(contract, request, options) {
+export function validateOperationRequest(contract, request, options, write = "copy") {
     const validation = validateOperationArguments(contract, request, options);
     if (!validation.ok) {
         return { ok: false, response: mapValidationOutcome(validation.issues) };
     }
-    const scalarNormalization = normalizeOperationScalarValues(contract, { ...request, arguments: validation.arguments }, request.scope, options);
+    const scalarNormalization = normalizeOperationScalarValues(contract, { ...request, arguments: validation.arguments }, request.origin, options, write);
     return scalarNormalization.ok
         ? { ok: true, arguments: scalarNormalization.arguments }
         : {
@@ -144,7 +163,7 @@ export async function executeValidatedOperation(dependencies, request, contract,
             }
         }
         args = await applyWriteFieldBehaviors({ core: dependencies.contracts.core, active: contract }, scopeConfig.behaviors, request, args, () => pipelineContext(contract, request, args));
-        const missing = missingCreateValues(contract, dependencies.createRequirements, request, args, argumentsPath);
+        const missing = createRequirementIssues(contract, dependencies.recordWrites, request, args, argumentsPath);
         if (missing.length > 0) {
             return mapValidationOutcome(missing);
         }

package/dist/runtime/outcome-mapper.js

@@ -42,11 +42,21 @@ export function mapOperationOutcome(operation, data) {
         ? absenceOutcome(rule.absence)
         : operationSuccess(data, rule.success);
 }
+function stepRelativeHead(issue) {
+    const path = issue.path;
+    return path?.[0] === "operations" && typeof path[1] === "number"
+        ? path[2]
+        : path?.[0];
+}
+function namesUnavailableOperation(issue) {
+    const head = stepRelativeHead(issue);
+    return issue.code === "V1006" && (head === "family" || head === "variant");
+}
 function validationCode(issues) {
-    if (issues.some((issue) => issue.path?.[0] === "resource")) {
+    if (issues.some((issue) => issue.code !== "V1019" && stepRelativeHead(issue) === "resource")) {
         return "A2001";
     }
-    if (issues.some((issue) => issue.path?.[0] === "operation")) {
+    if (issues.some(namesUnavailableOperation)) {
         return "A2002";
     }
     if (issues.some((issue) => issue.code === "V1010" ||

package/dist/runtime/output-validator.d.ts

@@ -11,6 +11,16 @@ export type OutputValidationResult = {
 type OutputOperation = OperationIdentity & {
     readonly resource: string;
 };
+/**
+ * The error the diagnostics channel receives when a result fails output
+ * validation: whose result it was and what the validator found. The caller
+ * receives the generic `A3000` and never this.
+ */
+export declare class OutputValidationError extends Error {
+    readonly issues: readonly ValidationIssue[];
+    readonly name = "OutputValidationError";
+    constructor(operation: OutputOperation, issues: readonly ValidationIssue[]);
+}
 /** Validate final operation output against fixed cardinality and executed projection. */
 export declare function validateOperationOutput(contract: Contract, operation: OutputOperation, projection: ReadProjectionPlan | undefined, value: unknown): OutputValidationResult;
 export {};

package/dist/runtime/output-validator.js

@@ -168,6 +168,17 @@ function validateProjection(contract, operation, projection, value) {
         ? validateExactRecord(contract, value, projection, ["data"])
         : { ok: true };
 }
+export class OutputValidationError extends Error {
+    issues;
+    name = "OutputValidationError";
+    constructor(operation, issues) {
+        const [first] = issues;
+        super(`The result of ${operation.resource}.${operation.family}.${operation.variant} does not satisfy its Contract${first === undefined
+            ? "."
+            : ` at "${(first.path ?? []).join(".")}" (${first.code}: ${first.message})`}`);
+        this.issues = issues;
+    }
+}
 export function validateOperationOutput(contract, operation, projection, value) {
     const cardinality = validateOperationOutputCardinality(operation, value);
     return cardinality.ok

package/dist/runtime/owned-execution.registry.d.ts

@@ -0,0 +1,13 @@
+import type { ClientTransactionRequest } from "../transactions/transaction-request.js";
+import type { TransactionResponse } from "../transactions/transaction-response.js";
+import type { ClientOperationRequest } from "./operation-request.js";
+import type { OperationResponse } from "./operation-response.js";
+/** The two entries that run a request the protocol decoded itself, uncopied. */
+export type OwnedExecution = {
+    readonly execute: (request: ClientOperationRequest) => Promise<OperationResponse>;
+    readonly executeTransaction: (request: ClientTransactionRequest) => Promise<TransactionResponse>;
+};
+/** Records `framework`'s owned entries; called once, at construction. */
+export declare function recordOwnedExecution(framework: object, execution: OwnedExecution): void;
+/** `framework`'s owned entries, or `undefined` for anything `createFramework` did not return. */
+export declare function ownedExecutionOf(framework: object): OwnedExecution | undefined;