@aventara/core 0.1.0-pilot.4 → 1.0.0-rc.1

package/dist/compiler/contract.compiler.js

@@ -1,11 +1,14 @@
-import { PROJECTION_SCOPES, WRITE_SCOPES, } from "../contracts/capability.js";
+import { bindShapedField, jsonShapeOf } from "../avz/json-shape.registry.js";
+import { PROJECTION_SCOPES, WRITE_SCOPES } from "../contracts/capability.js";
 import { validateClientContractStructure } from "../contracts/client-contract-structure.validator.js";
-import { canonicalizeContract } from "../contracts/contract-canonicalizer.js";
-import { computeClientContractHash, } from "../contracts/contract-hash.js";
+import { canonicalizeContract, canonicalizeContractMembers, canonicalizeJson, joinCanonicalContractMembers, recordCanonicalContractText, } from "../contracts/contract-canonicalizer.js";
+import { hashCanonicalContractText, } from "../contracts/contract-hash.js";
 import { DEFAULT_CONTRACT_LIMITS, } from "../contracts/contract-limits.js";
 import { AVENTARA_PROTOCOL_VERSION } from "../contracts/contract-protocol.js";
-import { advertisedDirectives, advertisedDirectivesAt, advertisedReducers, advertisedReducersAt, holdsAt, holdsInAnyScope, } from "../contracts/field.js";
+import { advertisedDirectives, advertisedReducers, holdsInAnyScope, } from "../contracts/field.js";
 import { isOperationVariantAvailable, } from "../contracts/resource-operations.js";
+import { checkCreateRequirements, checkHiddenRequirements, projectCreateRequirements, } from "./create-requirements.projector.js";
+import { applyValidators, bindFieldValidators, checkLayerValidators, compileValidatorTable, } from "./field-validator.compiler.js";
 const UNIQUE_VARIANTS = [
     ["find", "unique"],
     ["update", "unique"],
@@ -99,10 +102,13 @@ function createBaseline(model) {
         ])),
         limits: { ...DEFAULT_CONTRACT_LIMITS },
         transactions: model.transactions,
+        ...(model.referenceWrites === undefined
+            ? {}
+            : { referenceWrites: model.referenceWrites }),
     };
 }
-function scalarFieldPath(scope, resource, field) {
-    return `${scope}.resources.${resource}.fields.${field}`;
+function definitionPath(resource, field) {
+    return `root.resources.${resource}.fields.${field}.definition`;
 }
 function structuralValueMatches(field, config, key) {
     if (config[key] === undefined) {
@@ -110,7 +116,18 @@ function structuralValueMatches(field, config, key) {
     }
     return JSON.stringify(field[key]) === JSON.stringify(config[key]);
 }
+function configuredMember(capabilities, key) {
+    const value = capabilities?.[key];
+    if (value === undefined) {
+        return {};
+    }
+    return { [key]: Array.isArray(value) ? [...value] : cloneValue(value) };
+}
 function addConfiguredScalarField(config, path, diagnostics) {
+    if (config.json !== undefined) {
+        refuseJsonShape(path, "is not a field of the adapter model", diagnostics);
+        return undefined;
+    }
     const missing = ["type", "nullable", "list"].filter((key) => config[key] === undefined);
     if (missing.length > 0) {
         diagnostics.push(diagnostic("COMPILER_INCOMPLETE_FIELD", path, `framework-added scalar field is missing required properties: ${missing.join(", ")}`));
@@ -120,7 +137,7 @@ function addConfiguredScalarField(config, path, diagnostics) {
     if (configuredLifecycle === undefined ||
         !configuredLifecycle.includes("VIRTUAL") ||
         configuredLifecycle.some((trait) => trait !== "VIRTUAL")) {
-        diagnostics.push(diagnostic("COMPILER_INVALID_LIFECYCLE", `${path}.lifecycle`, "framework-added scalar field must declare only VIRTUAL lifecycle; generated lifecycle comes from adapters and computed lifecycle comes from behaviors"));
+        diagnostics.push(diagnostic("COMPILER_INVALID_LIFECYCLE", `${path}.lifecycle`, "framework-added scalar field must declare only VIRTUAL lifecycle; generated lifecycle comes from adapters and computed lifecycle comes from compute"));
         return undefined;
     }
     return {
@@ -132,86 +149,38 @@ function addConfiguredScalarField(config, path, diagnostics) {
         lifecycle: [...(config.lifecycle ?? [])],
         capabilities: {
             select: config.capabilities?.select ?? true,
-            ...(config.capabilities?.filter !== undefined
-                ? { filter: [...config.capabilities.filter] }
-                : {}),
-            ...(config.capabilities?.order !== undefined
-                ? { order: config.capabilities.order }
-                : {}),
-            ...(config.capabilities?.orderNulls !== undefined
-                ? { orderNulls: config.capabilities.orderNulls }
-                : {}),
-            ...(config.capabilities?.create !== undefined
-                ? { create: [...config.capabilities.create] }
-                : {}),
-            ...(config.capabilities?.update !== undefined
-                ? { update: [...config.capabilities.update] }
-                : {}),
+            ...configuredMember(config.capabilities, "filter"),
+            ...configuredMember(config.capabilities, "order"),
+            ...configuredMember(config.capabilities, "orderNulls"),
+            ...configuredMember(config.capabilities, "create"),
+            ...configuredMember(config.capabilities, "update"),
         },
     };
 }
-export function capabilityAddsBaseline(fieldKind, baseline, key, configured) {
-    const axis = capabilityAxisFor(fieldKind, key);
-    if (axis === undefined) {
-        return false;
-    }
-    const baselineValue = baseline[key];
-    switch (axis.kind) {
-        case "flag":
-            return configured === true && baselineValue !== true;
-        case "tokens": {
-            if (!isTokenList(configured)) {
-                return false;
-            }
-            const advertised = isTokenList(baselineValue) ? baselineValue : [];
-            return configured.some((token) => !advertised.includes(token));
-        }
-        case "scopes": {
-            const claimed = configured === true
-                ? axis.axis
-                : isTokenList(configured)
-                    ? configured
-                    : undefined;
-            return (claimed?.some((position) => axis.axis.includes(position) &&
-                !holdsAt(baselineValue, position)) === true);
-        }
-        case "scopedTokens": {
-            const claim = scopedTokenClaim(axis, configured);
-            if (claim === undefined) {
-                return false;
-            }
-            return claim.positions.some((position) => {
-                if (!axis.axis.includes(position)) {
-                    return false;
-                }
-                const advertised = advertisedTokensAt(axis.tokenKey, baselineValue, position);
-                return (advertised === undefined ||
-                    claim.tokens.some((token) => !advertised.includes(token)));
-            });
-        }
-    }
+function fieldLabel(path) {
+    const [, resource, , field] = path.split(".").slice(1);
+    return `${resource}.${field}`;
 }
-function scopedTokenClaim(axis, configured) {
-    if (isTokenList(configured)) {
-        return { tokens: configured, positions: axis.axis };
+function refuseJsonShape(path, reason, diagnostics) {
+    diagnostics.push(diagnostic("COMPILER_INVALID_JSON_SHAPE", `${path}.json`, `field "${fieldLabel(path)}" ${reason}; only a Json field the adapter discovered may declare a "json" shape`));
+}
+function applyJsonShape(field, baselineField, shape, path, diagnostics) {
+    const type = baselineField.type;
+    if (type.scalar !== "json") {
+        refuseJsonShape(path, `is ${type.scalar === undefined ? "an enum" : `${/^[aeiou]/.test(type.scalar) ? "an" : "a"} ${type.scalar}`} field`, diagnostics);
+        return;
     }
-    if (isRecord(configured) &&
-        isTokenList(configured[axis.tokenKey]) &&
-        isTokenList(configured.scopes)) {
-        return {
-            tokens: configured[axis.tokenKey],
-            positions: configured.scopes,
-        };
+    const runtime = jsonShapeOf(shape);
+    if (runtime === undefined) {
+        diagnostics.push(diagnostic("COMPILER_INVALID_JSON_SHAPE", `${path}.json`, `field "${fieldLabel(path)}": "json" must be a shape built with AvZ from "@aventara/core/avz"; a Zod schema or any other value is not accepted`));
+        return;
     }
-    return undefined;
-}
-function advertisedTokensAt(tokenKey, baselineValue, position) {
-    if (!isTokenList(baselineValue) && !isRecord(baselineValue)) {
-        return undefined;
+    if (runtime.validate(null).length === 0 ||
+        runtime.validate(undefined).length === 0) {
+        diagnostics.push(diagnostic("COMPILER_INVALID_JSON_SHAPE", `${path}.json`, `field "${fieldLabel(path)}": a field's shape cannot admit null or absence at its top level; whether the field may be null comes from the adapter model`));
+        return;
     }
-    return tokenKey === "directives"
-        ? advertisedDirectivesAt(baselineValue, position)
-        : advertisedReducersAt(baselineValue, position);
+    field.json = cloneValue(runtime.schema);
 }
 function applyExistingScalarConfig(field, baselineField, config, path, diagnostics) {
     for (const key of ["type", "nullable", "list"]) {
@@ -220,98 +189,48 @@ function applyExistingScalarConfig(field, baselineField, config, path, diagnosti
         }
     }
     if (config.format !== undefined) {
-        field.format = config.format;
+        diagnostics.push(diagnostic("COMPILER_STRUCTURAL_FIELD_OVERRIDE", `${path}.format`, "a discovered field's format is the adapter's and cannot be set; format is for configured (VIRTUAL) fields"));
     }
-    if (config.lifecycle !== undefined) {
-        diagnostics.push(diagnostic("COMPILER_INVALID_LIFECYCLE", `${path}.lifecycle`, "existing adapter field lifecycle cannot be redefined by framework field configuration"));
-    }
-    if (config.capabilities !== undefined) {
-        const current = field.capabilities;
-        const baseline = baselineField.capabilities;
-        for (const [key, value] of Object.entries(config.capabilities)) {
-            if (capabilityAddsBaseline(baselineField.kind, baseline, key, value)) {
-                diagnostics.push(diagnostic("COMPILER_UNAVAILABLE_CAPABILITY", `${path}.capabilities.${key}`, `capability "${key}" is not available in the canonical baseline`));
-                continue;
-            }
-            current[key] = cloneValue(value);
-        }
-    }
-}
-function applyFrameworkOwnedScalarConfig(field, config, path, diagnostics) {
-    for (const key of ["type", "nullable", "list"]) {
-        if (config[key] !== undefined) {
-            field[key] = cloneValue(config[key]);
-        }
-    }
-    if (config.format !== undefined) {
-        field.format = config.format;
+    if (config.json !== undefined) {
+        applyJsonShape(field, baselineField, config.json, path, diagnostics);
     }
     if (config.lifecycle !== undefined) {
-        const configuredLifecycle = config.lifecycle;
-        if (!configuredLifecycle.includes("VIRTUAL") ||
-            configuredLifecycle.some((trait) => trait !== "VIRTUAL")) {
-            diagnostics.push(diagnostic("COMPILER_INVALID_LIFECYCLE", `${path}.lifecycle`, "framework-owned scalar field may declare only VIRTUAL lifecycle; computed lifecycle comes from behaviors"));
-        }
-        else {
-            field.lifecycle = [...configuredLifecycle];
-        }
+        diagnostics.push(diagnostic("COMPILER_INVALID_LIFECYCLE", `${path}.lifecycle`, "existing adapter field lifecycle cannot be redefined by framework field configuration"));
     }
     if (config.capabilities !== undefined) {
-        const current = field.capabilities;
-        for (const [key, value] of Object.entries(config.capabilities)) {
-            current[key] = cloneValue(value);
-        }
+        diagnostics.push(diagnostic("COMPILER_STRUCTURAL_FIELD_OVERRIDE", `${path}.capabilities`, "a discovered field's capabilities are the adapter's and cannot be set; narrow what it exposes with exemptions"));
     }
 }
-function applyFieldConfig(model, projection, scope, config, diagnostics, allowRestrictedMissing = false) {
-    if (config === undefined) {
-        return;
-    }
+function applyFieldDefinitions(model, projection, definitions, diagnostics) {
     const providerBaseline = createBaseline(model);
-    for (const [resourceName, resourceConfig] of Object.entries(config)) {
-        if (resourceConfig === undefined) {
-            continue;
-        }
+    for (const [resourceName, resourceDefinitions] of Object.entries(definitions)) {
         const resource = projection.resources[resourceName];
         const providerResource = providerBaseline.resources[resourceName];
         if (resource === undefined || providerResource === undefined) {
-            if (allowRestrictedMissing && providerResource !== undefined) {
-                continue;
-            }
-            diagnostics.push(diagnostic("COMPILER_UNKNOWN_RESOURCE", `${scope}.resources.${resourceName}`, `resource "${resourceName}" is not present in the canonical adapter model`));
             continue;
         }
-        for (const [fieldName, rawConfig] of Object.entries(resourceConfig)) {
-            const fieldConfig = rawConfig;
-            const path = scalarFieldPath(scope, resourceName, fieldName);
+        for (const [fieldName, definition] of Object.entries(resourceDefinitions)) {
+            const path = definitionPath(resourceName, fieldName);
             const existing = resource.fields[fieldName];
             const providerField = providerResource.fields[fieldName];
             if (existing === undefined) {
-                if (allowRestrictedMissing && providerField !== undefined) {
-                    continue;
-                }
-                const added = addConfiguredScalarField(fieldConfig, path, diagnostics);
+                const added = addConfiguredScalarField(definition, path, diagnostics);
                 if (added !== undefined) {
                     resource.fields[fieldName] = added;
                 }
                 continue;
             }
             if (existing.kind === "relation") {
-                diagnostics.push(diagnostic("COMPILER_RELATION_FIELD_CONFIG_UNSUPPORTED", path, "framework field augmentation applies only to scalar fields"));
+                diagnostics.push(diagnostic("COMPILER_RELATION_FIELD_CONFIG_UNSUPPORTED", path, "a relation field takes no definition"));
                 continue;
             }
             if (providerField?.kind === "scalar") {
-                applyExistingScalarConfig(existing, providerField, fieldConfig, path, diagnostics);
-                continue;
+                applyExistingScalarConfig(existing, providerField, definition, path, diagnostics);
             }
-            applyFrameworkOwnedScalarConfig(existing, fieldConfig, path, diagnostics);
         }
     }
 }
-function isActiveBehaviorStage(value) {
-    return value !== undefined && value !== false;
-}
-function readBehaviorDependencies(value) {
+function readComputeDependencies(value) {
     if (!isRecord(value) || typeof value.compute !== "function") {
         return undefined;
     }
@@ -319,54 +238,114 @@ function readBehaviorDependencies(value) {
         ? value.dependsOn.filter((entry) => typeof entry === "string")
         : undefined;
 }
-function applyFieldBehavior(resource, fieldName, behavior, path, diagnostics, allowRestrictedMissing = false) {
-    const field = resource.fields[fieldName];
-    if (field === undefined || field.kind !== "scalar") {
-        if (allowRestrictedMissing && field === undefined) {
-            return;
+function applyCompute(projection, compute) {
+    for (const [resourceName, fields] of Object.entries(compute)) {
+        const resource = projection.resources[resourceName];
+        if (resource === undefined) {
+            continue;
+        }
+        for (const [fieldName, fieldCompute] of Object.entries(fields)) {
+            const field = resource.fields[fieldName];
+            if (field?.kind !== "scalar") {
+                continue;
+            }
+            const lifecycle = field.lifecycle.filter((trait) => !COMPUTED_TRAITS.has(trait));
+            if (fieldCompute.create !== undefined) {
+                lifecycle.push("COMPUTED_ON_CREATE");
+            }
+            if (fieldCompute.update !== undefined) {
+                lifecycle.push("COMPUTED_ON_UPDATE");
+            }
+            if (fieldCompute.read !== undefined) {
+                lifecycle.push("COMPUTED_ON_READ");
+            }
+            field.lifecycle = lifecycle;
         }
-        diagnostics.push(diagnostic("COMPILER_UNKNOWN_FIELD", path, `behavior field "${fieldName}" must resolve to a scalar field`));
-        return;
-    }
-    const lifecycle = field.lifecycle.filter((trait) => !COMPUTED_TRAITS.has(trait));
-    if (isActiveBehaviorStage(behavior.create)) {
-        lifecycle.push("COMPUTED_ON_CREATE");
     }
-    if (isActiveBehaviorStage(behavior.update)) {
-        lifecycle.push("COMPUTED_ON_UPDATE");
+}
+function storedScalar(model, resource, field) {
+    const fields = Object.hasOwn(model.resources, resource)
+        ? model.resources[resource]?.fields
+        : undefined;
+    return (fields !== undefined &&
+        Object.hasOwn(fields, field) &&
+        fields[field]?.kind === "scalar");
+}
+function checkFieldCompute(model, resourceName, fieldName, field, compute, path, diagnostics) {
+    if (!isRecord(compute)) {
+        return;
     }
-    if (isActiveBehaviorStage(behavior.read)) {
-        lifecycle.push("COMPUTED_ON_READ");
+    if (field?.kind === "relation") {
+        diagnostics.push(diagnostic("COMPILER_RELATION_FIELD_CONFIG_UNSUPPORTED", path, `relation field "${fieldName}" takes write guards only; compute derives a scalar field's value`));
+        return;
     }
-    field.lifecycle = lifecycle;
-    for (const dependency of readBehaviorDependencies(behavior.read) ?? []) {
-        const dependencyField = resource.fields[dependency];
-        if (dependencyField === undefined || dependencyField.kind !== "scalar") {
-            diagnostics.push(diagnostic("COMPILER_INVALID_BEHAVIOR_DEPENDENCY", `${path}.read.dependsOn`, `read behavior dependency "${dependency}" must reference a scalar field in the same Resource`));
+    for (const dependency of readComputeDependencies(compute.read) ?? []) {
+        if (!storedScalar(model, resourceName, dependency)) {
+            diagnostics.push(diagnostic("COMPILER_INVALID_COMPUTE_DEPENDENCY", `${path}.read.dependsOn`, `compute.read dependency "${dependency}" must name a scalar field the adapter stores on resource "${resourceName}"`));
         }
     }
 }
-function applyBehaviors(projection, scope, config, diagnostics, allowRestrictedMissing = false) {
-    if (config === undefined) {
+function checkResourceTree(model, baseline, scope, tree, definitions, diagnostics) {
+    if (!isRecord(tree)) {
         return;
     }
-    for (const [resourceName, rawResourceConfig] of Object.entries(config)) {
-        if (rawResourceConfig === undefined) {
+    for (const [resourceName, entry] of Object.entries(tree)) {
+        const resourcePath = `${scope}.resources.${resourceName}`;
+        const resource = baseline.resources[resourceName];
+        if (resource === undefined) {
+            diagnostics.push(diagnostic("COMPILER_UNKNOWN_RESOURCE", resourcePath, `resource "${resourceName}" is not present in the canonical adapter model`));
             continue;
         }
-        const resource = projection.resources[resourceName];
-        if (resource === undefined) {
-            if (allowRestrictedMissing) {
-                continue;
+        if (!isRecord(entry)) {
+            continue;
+        }
+        if (isRecord(entry.operations)) {
+            for (const [family, level] of Object.entries(entry.operations)) {
+                const familyPath = `${resourcePath}.operations.${family}`;
+                const variants = resource.operations[family];
+                if (!isRecord(variants)) {
+                    diagnostics.push(diagnostic("COMPILER_UNAVAILABLE_OPERATION", familyPath, `operation family "${family}" is not available for resource "${resourceName}"`));
+                    continue;
+                }
+                if (!isRecord(level)) {
+                    continue;
+                }
+                for (const variant of Object.keys(level)) {
+                    if (variant === "pipelines" || variant === "forceTransaction") {
+                        continue;
+                    }
+                    if (!isOperationVariantAvailable(variants[variant])) {
+                        diagnostics.push(diagnostic("COMPILER_UNAVAILABLE_OPERATION", `${familyPath}.${variant}`, `operation "${family}.${variant}" is not available for resource "${resourceName}"`));
+                    }
+                }
             }
-            diagnostics.push(diagnostic("COMPILER_UNKNOWN_RESOURCE", `${scope}.resources.${resourceName}`, `resource "${resourceName}" is not present in the canonical adapter model`));
+        }
+        if (!isRecord(entry.fields)) {
             continue;
         }
-        for (const [fieldName, behavior] of Object.entries(rawResourceConfig.fields)) {
-            if (behavior === undefined) {
+        for (const [fieldName, fieldEntry] of Object.entries(entry.fields)) {
+            const field = resource.fields[fieldName];
+            if (field === undefined &&
+                definitions[resourceName]?.[fieldName] === undefined) {
+                diagnostics.push(diagnostic("COMPILER_UNKNOWN_FIELD", `${resourcePath}.fields.${fieldName}`, `field "${fieldName}" is neither discovered by the adapter nor defined at the root`));
                 continue;
             }
-            applyFieldBehavior(resource, fieldName, behavior, `${scope}.resources.${resourceName}.fields.${fieldName}.behaviors`, diagnostics, allowRestrictedMissing);
+            if (!isRecord(fieldEntry) || !isRecord(fieldEntry.pipelines)) {
+                continue;
+            }
+            const pipelinesPath = `${resourcePath}.fields.${fieldName}.pipelines`;
+            if (field?.kind === "relation" &&
+                fieldEntry.pipelines.pipes !== undefined) {
+                diagnostics.push(diagnostic("COMPILER_RELATION_FIELD_CONFIG_UNSUPPORTED", `${pipelinesPath}.pipes`, `relation field "${fieldName}" takes write guards only; a field pipe transforms a scalar field's value`));
+            }
+            checkFieldCompute(model, resourceName, fieldName, field, fieldEntry.pipelines.compute, `${pipelinesPath}.compute`, diagnostics);
+        }
+    }
+}
+function checkReservedResourceNames(model, diagnostics) {
+    for (const resourceName of Object.keys(model.resources)) {
+        if (resourceName.startsWith("$")) {
+            diagnostics.push(diagnostic("COMPILER_RESERVED_RESOURCE_NAME", `adapter.model.resources.${resourceName}`, `resource "${resourceName}" starts with "$", which is reserved for the framework's own names`));
         }
     }
 }
@@ -391,6 +370,7 @@ const RELATION_CAPABILITY_AXES = {
     },
     create: { kind: "scopedTokens", tokenKey: "directives", axis: WRITE_SCOPES },
     update: { kind: "scopedTokens", tokenKey: "directives", axis: WRITE_SCOPES },
+    nestedWriteFilter: { kind: "limit", values: ["scalar"] },
 };
 function capabilityAxisFor(kind, key) {
     const axes = kind === "scalar" ? SCALAR_CAPABILITY_AXES : RELATION_CAPABILITY_AXES;
@@ -399,222 +379,366 @@ function capabilityAxisFor(kind, key) {
 function unavailableCapability(path, message, diagnostics) {
     diagnostics.push(diagnostic("COMPILER_UNAVAILABLE_CAPABILITY", path, message));
 }
-function narrowedTokens(baselineTokens, requested, key, path, diagnostics) {
-    const unavailable = requested.filter((entry) => !baselineTokens.includes(entry));
-    if (unavailable.length > 0) {
-        unavailableCapability(path, `capability "${key}" requested unavailable values: ${unavailable.join(", ")}`, diagnostics);
-        return undefined;
-    }
-    return [...requested];
+function otherOverlay(layer) {
+    return layer === "client" ? "application" : "client";
 }
-function narrowedScopes(axis, holdsAtScope, requested, key, path, diagnostics) {
-    if (requested.length === 0) {
-        return { outcome: "denied" };
-    }
-    const unavailable = requested.filter((scope) => !axis.includes(scope) || !holdsAtScope(scope));
-    if (unavailable.length > 0) {
-        unavailableCapability(path, `capability "${key}" requested unavailable scopes: ${unavailable.join(", ")}`, diagnostics);
-        return { outcome: "refused" };
+function widening(walk, code, path, what) {
+    walk.diagnostics.push(diagnostic(code, path, walk.layer === "agent"
+        ? `${what} is hidden by ${walk.parent ?? "client"}, the layer agent extends, and the agent layer only narrows that view; expose it in ${walk.parent ?? "client"}, or extend a layer that exposes it`
+        : `${what} is hidden by the root, and an overlay only narrows the root's view; expose it at the root and hide it in ${otherOverlay(walk.layer)} instead`));
+}
+function exemptsWhole(entry) {
+    return entry === true;
+}
+function exemptsAnything(entry) {
+    return (entry === true ||
+        (Array.isArray(entry) && entry.length > 0) ||
+        isRecord(entry));
+}
+function listedNames(entry, path) {
+    if (!Array.isArray(entry)) {
+        return [];
     }
-    return { outcome: "narrowed", scopes: [...requested] };
+    return entry.flatMap((name, index) => typeof name === "string"
+        ? [[name, `${path}[${index}]`]]
+        : []);
 }
-function applyScopeRestriction(axis, baselineValue, current, key, requested, path, diagnostics) {
-    const baseline = baselineValue;
-    const narrowing = narrowedScopes(axis, (scope) => holdsAt(baseline, scope), requested, key, path, diagnostics);
-    if (narrowing.outcome === "refused") {
-        return;
+function memberOffered(axis, value) {
+    if (value === undefined || value === false) {
+        return false;
     }
-    if (narrowing.outcome === "denied") {
-        delete current[key];
-        return;
+    switch (axis.kind) {
+        case "tokens":
+            return Array.isArray(value);
+        case "scopedTokens":
+            return memberTokens(axis, value) !== undefined;
+        case "scopes":
+            return holdsInAnyScope(value);
+        default:
+            return true;
     }
-    current[key] = narrowing.scopes;
 }
-function applyScopedTokenRestriction(tokenKey, axis, baselineValue, current, key, value, path, diagnostics) {
-    const requestedTokens = Array.isArray(value)
-        ? value
-        : isRecord(value)
-            ? value[tokenKey]
-            : undefined;
-    const requestedScopes = isRecord(value) ? value.scopes : undefined;
-    if ((requestedTokens !== undefined && !Array.isArray(requestedTokens)) ||
-        (requestedScopes !== undefined && !Array.isArray(requestedScopes))) {
-        return false;
+function memberTokens(axis, value) {
+    if (axis.kind === "tokens") {
+        return Array.isArray(value) ? value : undefined;
     }
-    const baselineTokens = tokenKey === "directives"
-        ? advertisedDirectives(baselineValue)
-        : advertisedReducers(baselineValue);
-    if (baselineTokens === undefined) {
-        unavailableCapability(path, `capability "${key}" is not available in the canonical baseline`, diagnostics);
-        return true;
+    if (axis.kind === "scopedTokens") {
+        return axis.tokenKey === "directives"
+            ? advertisedDirectives(value)
+            : advertisedReducers(value);
     }
-    const tokens = requestedTokens === undefined
-        ? [...baselineTokens]
-        : narrowedTokens(baselineTokens, requestedTokens, key, path, diagnostics);
-    if (tokens === undefined) {
-        return true;
+    return undefined;
+}
+function withTokens(axis, parentValue, tokens) {
+    if (axis.kind === "scopedTokens" &&
+        isRecord(parentValue) &&
+        Array.isArray(parentValue.scopes)) {
+        return {
+            [axis.tokenKey]: [...tokens],
+            scopes: [...parentValue.scopes],
+        };
     }
-    if (requestedScopes === undefined) {
-        const baselineScopes = isRecord(baselineValue) && Array.isArray(baselineValue.scopes)
-            ? [...baselineValue.scopes]
-            : undefined;
-        current[key] =
-            baselineScopes === undefined
-                ? tokens
-                : { [tokenKey]: tokens, scopes: baselineScopes };
-        return true;
+    return [...tokens];
+}
+function fieldName(resource, field) {
+    return `"${resource}.${field}"`;
+}
+function exemptableAxis(walk, universeField, capability, label, path) {
+    const axis = capabilityAxisFor(universeField.kind, capability);
+    if (axis === undefined || axis.kind === "limit") {
+        const names = Object.entries(universeField.kind === "scalar"
+            ? SCALAR_CAPABILITY_AXES
+            : RELATION_CAPABILITY_AXES)
+            .filter(([, entry]) => entry.kind !== "limit")
+            .map(([name]) => name);
+        unavailableCapability(path, `"${capability}" is not a capability a ${universeField.kind} field's exemption can name; it takes ${names.join(", ")}`, walk.diagnostics);
+        return undefined;
     }
-    const narrowing = narrowedScopes(axis, (scope) => (tokenKey === "directives"
-        ? advertisedDirectivesAt(baselineValue, scope)
-        : advertisedReducersAt(baselineValue, scope)) !== undefined, requestedScopes, key, path, diagnostics);
-    if (narrowing.outcome === "refused") {
-        return true;
+    const capabilities = universeField.capabilities;
+    if (!memberOffered(axis, capabilities[capability])) {
+        unavailableCapability(path, `capability "${capability}" is not available for field ${label}: the adapter does not offer it`, walk.diagnostics);
+        return undefined;
     }
-    if (narrowing.outcome === "denied") {
-        delete current[key];
-        return true;
+    return axis;
+}
+function offeredTokens(walk, axis, universeValue, listed, capability, label) {
+    const offered = memberTokens(axis, universeValue) ?? [];
+    const tokens = [];
+    for (const [token, tokenPath] of listed) {
+        if (!offered.includes(token)) {
+            unavailableCapability(tokenPath, `capability "${capability}" of field ${label} does not offer "${token}": the adapter does not offer it`, walk.diagnostics);
+            continue;
+        }
+        tokens.push(token);
     }
-    current[key] = { [tokenKey]: tokens, scopes: narrowing.scopes };
-    return true;
+    return tokens;
 }
-function applyCapabilityRestriction(fieldKind, inherited, restoration, current, key, value, path, diagnostics) {
-    if (value === false) {
-        delete current[key];
+function exemptCapability(walk, universeField, parentCapabilities, result, capability, entry, label, path) {
+    if (entry === undefined) {
         return;
     }
-    const axis = capabilityAxisFor(fieldKind, key);
-    const baselineValue = inherited?.[key] ?? restoration[key];
-    if (axis === undefined ||
-        baselineValue === undefined ||
-        baselineValue === false) {
-        unavailableCapability(path, `capability "${key}" is not available in the canonical baseline`, diagnostics);
+    const axis = exemptableAxis(walk, universeField, capability, label, path);
+    if (axis === undefined || entry === false) {
         return;
     }
-    if (value === true) {
-        current[key] = cloneValue(baselineValue);
+    const isTokenAxis = axis.kind === "tokens" || axis.kind === "scopedTokens";
+    if (entry !== true && !(isTokenAxis && Array.isArray(entry))) {
+        unavailableCapability(path, isTokenAxis
+            ? `capability "${capability}" takes true, false or a list of its tokens`
+            : `capability "${capability}" takes true or false`, walk.diagnostics);
         return;
     }
-    if (axis.kind === "tokens" &&
-        Array.isArray(value) &&
-        Array.isArray(baselineValue)) {
-        const tokens = narrowedTokens(baselineValue, value, key, path, diagnostics);
-        if (tokens !== undefined) {
-            current[key] = tokens;
+    const universeValue = universeField.capabilities[capability];
+    const tokens = entry === true
+        ? undefined
+        : offeredTokens(walk, axis, universeValue, listedNames(entry, path), capability, label);
+    if (tokens !== undefined && tokens.length !== entry.length) {
+        return;
+    }
+    const parentValue = parentCapabilities[capability];
+    const parentHas = memberOffered(axis, parentValue);
+    if (walk.style === "omit") {
+        if (!parentHas) {
+            return;
+        }
+        if (tokens === undefined) {
+            delete result[capability];
+            return;
         }
+        const kept = (memberTokens(axis, parentValue) ?? []).filter((token) => !tokens.includes(token));
+        result[capability] = withTokens(axis, parentValue, kept);
         return;
     }
-    if (axis.kind === "scopes" && Array.isArray(value)) {
-        applyScopeRestriction(axis.axis, baselineValue, current, key, value, path, diagnostics);
+    if (tokens !== undefined && tokens.length === 0) {
         return;
     }
-    if (axis.kind === "scopedTokens") {
-        if (applyScopedTokenRestriction(axis.tokenKey, axis.axis, baselineValue, current, key, value, path, diagnostics)) {
-            return;
-        }
+    if (!parentHas) {
+        widening(walk, "COMPILER_UNAVAILABLE_CAPABILITY", path, `capability "${capability}" of field ${label}`);
+        return;
     }
-    unavailableCapability(path, `capability "${key}" does not admit this restriction shape`, diagnostics);
-}
-function applyCapabilityRestrictions(inheritedField, restorationField, field, restrictions, path, diagnostics) {
-    const capabilityRestrictions = restrictions.capabilities;
-    if (capabilityRestrictions === undefined) {
+    if (tokens === undefined) {
+        result[capability] = cloneValue(parentValue);
         return;
     }
-    const inherited = inheritedField?.capabilities;
-    const restoration = restorationField.capabilities;
-    const current = field.capabilities;
-    for (const [key, value] of Object.entries(capabilityRestrictions)) {
-        if (value === undefined) {
-            continue;
+    const parentTokens = memberTokens(axis, parentValue) ?? [];
+    const hidden = tokens.filter((token) => !parentTokens.includes(token));
+    if (hidden.length > 0) {
+        widening(walk, "COMPILER_UNAVAILABLE_CAPABILITY", path, `${hidden.map((token) => `"${token}"`).join(", ")} of capability "${capability}" of field ${label}`);
+        return;
+    }
+    result[capability] = withTokens(axis, parentValue, parentTokens.filter((token) => tokens.includes(token)));
+}
+function exemptField(walk, universeField, parentField, entry, label, path) {
+    const parentCapabilities = (parentField?.capabilities ?? {});
+    const result = walk.style === "omit" ? cloneValue(parentCapabilities) : {};
+    if (walk.style === "pick") {
+        for (const [key, value] of Object.entries(parentCapabilities)) {
+            if (capabilityAxisFor(universeField.kind, key)?.kind === "limit") {
+                result[key] = cloneValue(value);
+            }
+        }
+    }
+    if (Array.isArray(entry)) {
+        for (const [capability, capabilityPath] of listedNames(entry, path)) {
+            exemptCapability(walk, universeField, parentCapabilities, result, capability, true, label, capabilityPath);
         }
-        applyCapabilityRestriction(restorationField.kind, inherited, restoration, current, key, value, `${path}.capabilities.${key}`, diagnostics);
     }
+    else if (isRecord(entry)) {
+        for (const [capability, value] of Object.entries(entry)) {
+            exemptCapability(walk, universeField, parentCapabilities, result, capability, value, label, `${path}.${capability}`);
+        }
+    }
+    if (parentField === undefined) {
+        return undefined;
+    }
+    if (walk.style === "pick" &&
+        !Object.keys(result).some((key) => capabilityAxisFor(universeField.kind, key)?.kind !== "limit")) {
+        return undefined;
+    }
+    return { ...cloneValue(parentField), capabilities: result };
 }
-function applyOperationRestrictions(restoration, current, restrictions, path, diagnostics) {
-    if (restrictions === undefined) {
-        return;
+function exemptFields(walk, resourceName, universe, parent, entries, path) {
+    const named = isRecord(entries) ? entries : {};
+    for (const fieldName of Object.keys(named)) {
+        if (universe.fields[fieldName] === undefined) {
+            walk.diagnostics.push(diagnostic("COMPILER_UNKNOWN_FIELD", `${path}.${fieldName}`, `field "${fieldName}" is neither discovered by the adapter nor defined at the root`));
+        }
     }
-    for (const [family, variants] of Object.entries(restrictions)) {
-        if (!isRecord(variants)) {
+    const result = {};
+    for (const [name, entry] of Object.entries(named)) {
+        const universeField = universe.fields[name];
+        if (universeField === undefined) {
             continue;
         }
-        const baselineFamily = restoration[family];
-        let currentFamily = current[family];
-        if (!isRecord(currentFamily)) {
-            currentFamily = {};
-            current[family] = currentFamily;
+        const parentField = parent.fields[name];
+        const label = fieldName(resourceName, name);
+        const fieldPath = `${path}.${name}`;
+        if (walk.style === "pick" &&
+            exemptsAnything(entry) &&
+            parentField === undefined) {
+            widening(walk, "COMPILER_UNAVAILABLE_CAPABILITY", fieldPath, `field ${label}`);
+            continue;
         }
-        for (const [variant, enabled] of Object.entries(variants)) {
-            if (typeof enabled !== "boolean") {
-                continue;
-            }
-            if (!enabled) {
-                delete currentFamily[variant];
-                continue;
+        if (exemptsWhole(entry) || !exemptsAnything(entry)) {
+            continue;
+        }
+        const exempted = exemptField(walk, universeField, parentField, entry, label, fieldPath);
+        if (exempted !== undefined) {
+            result[name] = exempted;
+        }
+    }
+    for (const [name, parentField] of Object.entries(parent.fields)) {
+        if (Object.hasOwn(result, name)) {
+            continue;
+        }
+        const entry = Object.hasOwn(named, name) ? named[name] : undefined;
+        if (walk.style === "omit" ? !exemptsWhole(entry) : exemptsWhole(entry)) {
+            result[name] = cloneValue(parentField);
+        }
+    }
+    return result;
+}
+function exemptVariants(walk, resourceName, family, universeFamily, parentFamily, entry, path) {
+    if (entry === true) {
+        return "all";
+    }
+    const named = Array.isArray(entry)
+        ? [...listedNames(entry, path)]
+        : isRecord(entry)
+            ? Object.keys(entry).map((variant) => [variant, `${path}.${variant}`])
+            : [];
+    const variants = [];
+    for (const [variant, variantPath] of named) {
+        if (!isOperationVariantAvailable(universeFamily[variant])) {
+            walk.diagnostics.push(diagnostic("COMPILER_UNAVAILABLE_OPERATION", variantPath, `operation "${family}.${variant}" is not available for resource "${resourceName}"`));
+            continue;
+        }
+        if (isRecord(entry)) {
+            const value = entry[variant];
+            if (value !== true && value !== false) {
+                walk.diagnostics.push(diagnostic("COMPILER_UNAVAILABLE_OPERATION", variantPath, "an operation variant takes true or false"));
             }
-            const baselineAvailability = isRecord(baselineFamily)
-                ? baselineFamily[variant]
-                : undefined;
-            if (!isOperationVariantAvailable(baselineAvailability)) {
-                diagnostics.push(diagnostic("COMPILER_UNAVAILABLE_OPERATION", `${path}.${family}.${variant}`, `operation "${family}.${variant}" is not available in the canonical baseline`));
+            if (value !== true) {
                 continue;
             }
-            const target = currentFamily;
-            if (!isOperationVariantAvailable(target[variant])) {
-                target[variant] = cloneValue(baselineAvailability);
-            }
         }
+        if (walk.style === "pick" &&
+            !isOperationVariantAvailable(parentFamily?.[variant])) {
+            widening(walk, "COMPILER_UNAVAILABLE_OPERATION", variantPath, `operation "${resourceName}.${family}.${variant}"`);
+            continue;
+        }
+        variants.push(variant);
     }
+    return variants;
 }
-function applyRestrictions(baselines, projection, scope, config, diagnostics) {
-    if (config === undefined) {
-        return;
-    }
-    for (const [resourceName, rawRestrictions] of Object.entries(config)) {
-        if (rawRestrictions === undefined) {
+function exemptOperations(walk, resourceName, universe, parent, entry, path) {
+    const omit = walk.style === "omit";
+    if (entry === true) {
+        return omit ? {} : cloneValue(parent);
+    }
+    const families = Array.isArray(entry)
+        ? listedNames(entry, path).map(([family, familyPath]) => [family, familyPath, true])
+        : isRecord(entry)
+            ? Object.entries(entry).map(([family, value]) => [family, `${path}.${family}`, value])
+            : [];
+    const result = omit ? cloneValue(parent) : {};
+    for (const [family, familyPath, value] of families) {
+        const universeFamily = universe[family];
+        if (!isRecord(universeFamily)) {
+            walk.diagnostics.push(diagnostic("COMPILER_UNAVAILABLE_OPERATION", familyPath, `operation family "${family}" is not available for resource "${resourceName}"`));
             continue;
         }
-        const restrictions = rawRestrictions;
-        const baselineResource = baselines.restoration.resources[resourceName];
-        if (baselineResource === undefined) {
-            diagnostics.push(diagnostic("COMPILER_UNKNOWN_RESOURCE", `${scope}.resources.${resourceName}`, `resource "${resourceName}" is not present in the canonical compilation baseline`));
+        if (value === false || value === undefined) {
             continue;
         }
-        if (restrictions.hidden === true) {
-            delete projection.resources[resourceName];
+        if (value !== true && !Array.isArray(value) && !isRecord(value)) {
+            walk.diagnostics.push(diagnostic("COMPILER_UNAVAILABLE_OPERATION", familyPath, "an operation family takes true, false, a list of its variants or an object of them"));
             continue;
         }
-        if (restrictions.hidden === false &&
-            projection.resources[resourceName] === undefined) {
-            projection.resources[resourceName] = cloneValue(baselineResource);
+        const parentFamily = isRecord(parent[family])
+            ? parent[family]
+            : undefined;
+        if (value === true && !omit && parentFamily === undefined) {
+            widening(walk, "COMPILER_UNAVAILABLE_OPERATION", familyPath, `operation family "${resourceName}.${family}"`);
+            continue;
         }
-        const resource = projection.resources[resourceName];
-        if (resource === undefined) {
+        const variants = exemptVariants(walk, resourceName, family, universeFamily, parentFamily, value, familyPath);
+        if (parentFamily === undefined) {
             continue;
         }
-        for (const [fieldName, rawFieldRestrictions] of Object.entries(restrictions.fields ?? {})) {
-            const fieldRestrictions = rawFieldRestrictions;
-            const baselineField = baselineResource.fields[fieldName];
-            const path = `${scope}.resources.${resourceName}.fields.${fieldName}`;
-            if (baselineField === undefined) {
-                diagnostics.push(diagnostic("COMPILER_UNKNOWN_FIELD", path, `field "${fieldName}" is not present in the canonical compilation baseline`));
-                continue;
-            }
-            if (fieldRestrictions.hidden === true) {
-                delete resource.fields[fieldName];
-                continue;
-            }
-            if (fieldRestrictions.hidden === false &&
-                resource.fields[fieldName] === undefined) {
-                resource.fields[fieldName] = cloneValue(baselineField);
+        const named = variants === "all" ? Object.keys(parentFamily) : variants;
+        if (omit) {
+            const target = result[family];
+            for (const variant of named) {
+                if (target !== undefined) {
+                    delete target[variant];
+                }
             }
-            const field = resource.fields[fieldName];
-            if (field === undefined) {
-                continue;
+            continue;
+        }
+        const target = (isRecord(result[family]) ? result[family] : {});
+        for (const variant of named) {
+            if (isOperationVariantAvailable(parentFamily[variant])) {
+                target[variant] = cloneValue(parentFamily[variant]);
             }
-            applyCapabilityRestrictions(baselines.narrowing.resources[resourceName]?.fields[fieldName], baselineField, field, fieldRestrictions, path, diagnostics);
         }
-        applyOperationRestrictions(baselineResource.operations, resource.operations, restrictions.operations, `${scope}.resources.${resourceName}.operations`, diagnostics);
+        result[family] = target;
+    }
+    pruneEmptyOperationFamilies(result);
+    return result;
+}
+function exemptResource(walk, resourceName, universe, parent, entry, path) {
+    const resource = {
+        fields: exemptFields(walk, resourceName, universe, parent, entry.fields, `${path}.fields`),
+        identifiers: [],
+        operations: exemptOperations(walk, resourceName, universe.operations, parent.operations, entry.operations, `${path}.operations`),
+    };
+    reconcileIdentifiers(walk, resource, parent, path);
+    return resource;
+}
+function projectExposure(walk, universe, parent, exemptions) {
+    const path = `${walk.layer}.exemptions.resources`;
+    const entries = isRecord(exemptions) && isRecord(exemptions.resources)
+        ? exemptions.resources
+        : {};
+    const resources = {};
+    for (const [resourceName, entry] of Object.entries(entries)) {
+        const resourcePath = `${path}.${resourceName}`;
+        const universeResource = universe.resources[resourceName];
+        if (universeResource === undefined) {
+            walk.diagnostics.push(diagnostic("COMPILER_UNKNOWN_RESOURCE", resourcePath, `resource "${resourceName}" is not present in the canonical adapter model`));
+            continue;
+        }
+        const parentResource = parent.resources[resourceName];
+        if (walk.style === "pick" &&
+            exemptsAnything(entry) &&
+            parentResource === undefined) {
+            widening(walk, "COMPILER_UNAVAILABLE_CAPABILITY", resourcePath, `resource "${resourceName}"`);
+            continue;
+        }
+        if (!isRecord(entry)) {
+            continue;
+        }
+        const exempted = exemptResource(walk, resourceName, universeResource, parentResource ?? { fields: {}, identifiers: [], operations: {} }, entry, resourcePath);
+        if (parentResource !== undefined &&
+            (walk.style === "omit" ||
+                Object.keys(exempted.fields).length > 0 ||
+                Object.keys(exempted.operations).length > 0)) {
+            resources[resourceName] = exempted;
+        }
+    }
+    for (const [resourceName, parentResource] of Object.entries(parent.resources)) {
+        if (Object.hasOwn(resources, resourceName)) {
+            continue;
+        }
+        const entry = Object.hasOwn(entries, resourceName)
+            ? entries[resourceName]
+            : undefined;
+        if (walk.style === "omit" ? !exemptsWhole(entry) : exemptsWhole(entry)) {
+            resources[resourceName] = cloneValue(parentResource);
+        }
     }
+    return { ...cloneValue({ ...parent, resources: {} }), resources };
 }
 function pruneEmptyOperationFamilies(operations) {
     for (const [family, variants] of Object.entries(operations)) {
@@ -623,45 +747,28 @@ function pruneEmptyOperationFamilies(operations) {
         }
     }
 }
-function operationIsExplicitlyDisabled(restrictions, family, variant) {
-    if (restrictions === undefined || !isRecord(restrictions.operations)) {
-        return false;
-    }
-    const familyRestrictions = restrictions.operations[family];
-    return isRecord(familyRestrictions) && familyRestrictions[variant] === false;
+function identifierLabel(identifier) {
+    return identifier.map((name) => `\`${name}\``).join(" and ");
 }
-function reconcileIdentifiers(resource, baseline, restrictions) {
-    resource.identifiers = baseline.identifiers.filter((identifier) => identifier.every((fieldName) => {
-        const field = resource.fields[fieldName];
-        return field !== undefined && field.kind === "scalar";
-    }));
+function reconcileIdentifiers(walk, resource, parent, path) {
+    resource.identifiers = parent.identifiers
+        .filter((identifier) => identifier.every((name) => resource.fields[name]?.kind === "scalar"))
+        .map((identifier) => [...identifier]);
+    const first = parent.identifiers[0];
+    if (resource.identifiers.length > 0 || first === undefined) {
+        return;
+    }
     for (const [family, variant] of UNIQUE_VARIANTS) {
         const currentFamily = resource.operations[family];
-        if (resource.identifiers.length === 0) {
-            if (isRecord(currentFamily)) {
-                delete currentFamily[variant];
-            }
+        if (!isRecord(currentFamily) ||
+            !isOperationVariantAvailable(currentFamily[variant])) {
             continue;
         }
-        if (operationIsExplicitlyDisabled(restrictions, family, variant)) {
-            if (isRecord(currentFamily)) {
-                delete currentFamily[variant];
-            }
-            continue;
-        }
-        const baselineFamily = baseline.operations[family];
-        const baselineAvailability = isRecord(baselineFamily)
-            ? baselineFamily[variant]
-            : undefined;
-        if (isOperationVariantAvailable(baselineAvailability)) {
-            const targetFamily = isRecord(currentFamily) ? currentFamily : {};
-            if (!isOperationVariantAvailable(targetFamily[variant])) {
-                targetFamily[variant] = cloneValue(baselineAvailability);
-            }
-            resource.operations[family] = targetFamily;
-        }
+        const variantPath = `${path}.operations.${family}.${variant}`;
+        walk.diagnostics.push(diagnostic("COMPILER_MISSING_IDENTIFIER", variantPath, walk.style === "pick"
+            ? `${variantPath} needs an identifier field; pick ${identifierLabel(first)} (or another complete identifier) too`
+            : `${variantPath} needs an identifier field, and the exemptions hide every complete identifier; keep ${identifierLabel(first)} (or another complete identifier) exposed, or exempt the operation too`));
     }
-    pruneEmptyOperationFamilies(resource.operations);
 }
 function validateScalarReference(projection, field, path, diagnostics) {
     const type = field.type;
@@ -711,7 +818,7 @@ function validateFieldLifecycle(field, path, diagnostics) {
     if (lifecycle.includes("VIRTUAL") &&
         holdsInAnyScope(capabilities.select) &&
         !lifecycle.includes("COMPUTED_ON_READ")) {
-        diagnostics.push(diagnostic("COMPILER_MISSING_READ_BEHAVIOR", path, "selectable VIRTUAL field requires an effective read behavior"));
+        diagnostics.push(diagnostic("COMPILER_MISSING_READ_COMPUTE", path, "selectable VIRTUAL field requires a compute.read stage (pipelines.compute.read)"));
     }
 }
 function isTokenList(value) {
@@ -728,6 +835,10 @@ function positionListFault(axis, positions) {
 }
 function representationFault(axis, value) {
     switch (axis.kind) {
+        case "limit":
+            return typeof value === "string" && axis.values.includes(value)
+                ? undefined
+                : `one of ${axis.values.join(", ")} is expected`;
         case "flag":
             return typeof value === "boolean" ? undefined : "a boolean is expected";
         case "tokens":
@@ -765,12 +876,8 @@ function validateCapabilityRepresentation(field, path, diagnostics) {
         }
     }
 }
-function validateProjection(projection, restoration, scope, restrictions, diagnostics) {
+function validateProjection(projection, scope, diagnostics) {
     for (const [resourceName, resource] of Object.entries(projection.resources)) {
-        const baselineResource = restoration.resources[resourceName];
-        if (baselineResource !== undefined) {
-            reconcileIdentifiers(resource, baselineResource, restrictions?.[resourceName]);
-        }
         for (const [fieldName, field] of Object.entries(resource.fields)) {
             const fieldPath = `${scope}.resources.${resourceName}.fields.${fieldName}`;
             validateCapabilityRepresentation(field, fieldPath, diagnostics);
@@ -791,73 +898,140 @@ function resolveLimits(scope) {
     return { ...DEFAULT_CONTRACT_LIMITS, ...(scope.limits ?? {}) };
 }
 function resolveTransactions(model, scopeName, scope, diagnostics) {
-    const requested = scope.transactions ?? model.transactions;
+    const requested = scope.transactionsStyle ?? model.transactions;
     if (requested === "interactive" && model.transactions === "none") {
-        diagnostics.push(diagnostic("COMPILER_UNAVAILABLE_CAPABILITY", `${scopeName}.transactions`, 'transaction capability "interactive" is not available in the canonical adapter model'));
+        diagnostics.push(diagnostic("COMPILER_UNAVAILABLE_CAPABILITY", `${scopeName}.transactionsStyle`, 'transaction capability "interactive" is not available in the canonical adapter model'));
     }
     return requested;
 }
 function semanticObject(contract) {
     return JSON.parse(canonicalizeContract(contract));
 }
-function projectCore(model, scope, diagnostics) {
+function exposureStyle(layer) {
+    return layer.exposed === false ? "pick" : "omit";
+}
+function projectCore(model, config, diagnostics) {
+    const scope = config.root;
     const providerBaseline = createBaseline(model);
     const baseline = cloneValue(providerBaseline);
     baseline.limits = resolveLimits(scope);
     baseline.transactions = resolveTransactions(model, "root", scope, diagnostics);
-    applyFieldConfig(model, baseline, "root", scope.fields, diagnostics);
-    applyBehaviors(baseline, "root", scope.behaviors, diagnostics);
-    const projection = cloneValue(baseline);
-    applyRestrictions({ narrowing: baseline, restoration: baseline }, projection, "root", scope.restrictions, diagnostics);
-    validateProjection(projection, baseline, "root", scope.restrictions, diagnostics);
-    return { baseline, projection };
-}
-function projectDerivedScope(model, scopeName, core, scope, diagnostics) {
+    checkResourceTree(model, baseline, "root", config.trees.root, config.definitions, diagnostics);
+    applyFieldDefinitions(model, baseline, config.definitions, diagnostics);
+    applyCompute(baseline, scope.compute);
+    checkLayerValidators(baseline.resources, "root", config.trees.root, diagnostics);
+    const validators = compileValidatorTable(baseline.resources, scope.pipelines);
+    const projection = projectExposure({ layer: "root", style: exposureStyle(scope), diagnostics }, baseline, baseline, scope.exemptions);
+    projectCreateRequirements(model, projection.resources);
+    checkHiddenRequirements(model, "root", baseline.resources, baseline.resources, projection.resources, diagnostics);
+    applyValidators(projection.resources, validators);
+    validateProjection(projection, "root", diagnostics);
+    return { baseline, projection, validators };
+}
+function projectDerivedScope(model, scopeName, core, parentView, config, diagnostics) {
+    const scope = config[scopeName];
     const baseline = cloneValue(core.baseline);
     baseline.limits = resolveLimits(scope);
-    baseline.transactions = resolveTransactions(model, scopeName, scope, diagnostics);
-    applyFieldConfig(model, baseline, scopeName, scope.fields, diagnostics);
-    applyBehaviors(baseline, scopeName, scope.behaviors, diagnostics);
-    const projection = cloneValue(core.projection);
-    projection.limits = resolveLimits(scope);
-    projection.transactions = baseline.transactions;
-    applyFieldConfig(model, projection, scopeName, scope.fields, diagnostics, true);
-    applyBehaviors(projection, scopeName, scope.behaviors, diagnostics, true);
-    applyRestrictions({ narrowing: cloneValue(projection), restoration: baseline }, projection, scopeName, scope.restrictions, diagnostics);
-    validateProjection(projection, baseline, scopeName, scope.restrictions, diagnostics);
-    return projection;
+    baseline.transactions = resolveTransactions(model, scopeName, scope, scopeName === "agent" &&
+        scope.transactionsStyle === config[config.agent.parent].transactionsStyle
+        ? []
+        : diagnostics);
+    checkResourceTree(model, baseline, scopeName, config.trees[scopeName], config.definitions, diagnostics);
+    applyCompute(baseline, scope.compute);
+    checkLayerValidators(baseline.resources, scopeName, config.trees[scopeName], diagnostics);
+    const validators = compileValidatorTable(baseline.resources, scope.pipelines);
+    const parent = cloneValue(parentView);
+    parent.limits = resolveLimits(scope);
+    parent.transactions = baseline.transactions;
+    applyCompute(parent, scope.compute);
+    const projection = projectExposure({
+        layer: scopeName,
+        style: exposureStyle(scope),
+        diagnostics,
+        ...(scopeName === "agent" ? { parent: config.agent.parent } : {}),
+    }, baseline, parent, scope.exemptions);
+    projectCreateRequirements(model, projection.resources);
+    checkHiddenRequirements(model, scopeName, baseline.resources, parent.resources, projection.resources, diagnostics);
+    applyValidators(projection.resources, validators);
+    validateProjection(projection, scopeName, diagnostics);
+    return { projection, validators };
+}
+function bindShapedFields(contract, definitions) {
+    for (const [resourceName, resource] of Object.entries(contract.resources)) {
+        for (const [fieldName, field] of Object.entries(resource.fields)) {
+            if (field.kind !== "scalar" || field.json === undefined) {
+                continue;
+            }
+            const shape = jsonShapeOf(definitions[resourceName]?.[fieldName]?.json);
+            if (shape === undefined) {
+                throw new Error(`the Contract compiler found no shape for shaped field "${resourceName}.${fieldName}"`);
+            }
+            bindShapedField(field, shape);
+        }
+    }
 }
 export async function compileContracts(model, config) {
     const compilerConfig = config;
     const diagnostics = [];
-    const coreCompilation = projectCore(model, compilerConfig.root, diagnostics);
-    const applicationProjection = projectDerivedScope(model, "application", coreCompilation, compilerConfig.application, diagnostics);
-    const clientProjection = projectDerivedScope(model, "client", coreCompilation, compilerConfig.client, diagnostics);
+    checkReservedResourceNames(model, diagnostics);
+    checkCreateRequirements(model, diagnostics);
+    const coreCompilation = projectCore(model, compilerConfig, diagnostics);
+    const applicationProjection = projectDerivedScope(model, "application", coreCompilation, coreCompilation.projection, compilerConfig, diagnostics);
+    const clientProjection = projectDerivedScope(model, "client", coreCompilation, coreCompilation.projection, compilerConfig, diagnostics);
+    const agentParent = compilerConfig.agent.parent;
+    const agentProjection = projectDerivedScope(model, "agent", coreCompilation, agentParent === "root"
+        ? coreCompilation.projection
+        : agentParent === "application"
+            ? applicationProjection.projection
+            : clientProjection.projection, compilerConfig, diagnostics);
     if (diagnostics.length > 0) {
         return { ok: false, diagnostics };
     }
     const core = semanticObject(coreCompilation.projection);
-    const application = semanticObject(applicationProjection);
-    const clientHashInput = semanticObject({
-        ...clientProjection,
-        protocol: { version: AVENTARA_PROTOCOL_VERSION },
-    });
-    const hash = await computeClientContractHash(clientHashInput);
-    const client = semanticObject({
-        ...clientHashInput,
-        protocol: { version: AVENTARA_PROTOCOL_VERSION, hash },
-    });
-    const structure = validateClientContractStructure(client);
-    if (!structure.valid) {
-        return {
-            ok: false,
-            diagnostics: [
-                diagnostic("COMPILER_INVALID_CLIENT_CONTRACT", structure.path, structure.message),
-            ],
-        };
+    const application = semanticObject(applicationProjection.projection);
+    const client = await identifiedContract(clientProjection.projection);
+    const agent = await identifiedContract(agentProjection.projection);
+    for (const [layer, contract] of [
+        ["client", client],
+        ["agent", agent],
+    ]) {
+        const structure = validateClientContractStructure(contract);
+        if (!structure.valid) {
+            return {
+                ok: false,
+                diagnostics: [
+                    diagnostic("COMPILER_INVALID_CLIENT_CONTRACT", structure.path, layer === "client"
+                        ? structure.message
+                        : `Agent Contract: ${structure.message}`),
+                ],
+            };
+        }
     }
+    bindShapedFields(core, compilerConfig.definitions);
+    bindShapedFields(application, compilerConfig.definitions);
+    bindShapedFields(client, compilerConfig.definitions);
+    bindShapedFields(agent, compilerConfig.definitions);
+    bindFieldValidators(core, coreCompilation.validators);
+    bindFieldValidators(application, applicationProjection.validators);
+    bindFieldValidators(client, clientProjection.validators);
+    bindFieldValidators(agent, agentProjection.validators);
     return {
         ok: true,
-        contracts: { core, application, client },
+        contracts: { core, application, client, agent },
     };
 }
+async function identifiedContract(projection) {
+    const members = canonicalizeContractMembers({
+        ...projection,
+        protocol: { version: AVENTARA_PROTOCOL_VERSION },
+    });
+    const hash = await hashCanonicalContractText(joinCanonicalContractMembers(members));
+    const protocol = canonicalizeJson({
+        version: AVENTARA_PROTOCOL_VERSION,
+        hash,
+    });
+    const text = joinCanonicalContractMembers(members.map((member) => member.key === "protocol" ? { key: "protocol", text: protocol } : member));
+    const contract = JSON.parse(text);
+    recordCanonicalContractText(contract, text);
+    return contract;
+}