@aventara/core 1.0.0-rc.0 → 1.0.0-rc.10

package/dist/operations/structural-limits.walker.js

@@ -28,6 +28,109 @@ function nestingExceeded(state) {
         message: `Request nesting exceeds maxNestingDepth (${state.nestingLimit}).`,
     };
 }
+function jsonDepthExceeded(state, fieldPath) {
+    state.nestingAtField = true;
+    state.nesting = {
+        path: state.tracking ? fieldPath : ["arguments", state.rootKey],
+        code: "V1021",
+        message: `Json value depth exceeds maxJsonDepth (${state.jsonDepthLimit}).`,
+    };
+}
+function isJsonField(field) {
+    return "scalar" in field.type && field.type.scalar === "json";
+}
+function jsonValueExceeds(state, value) {
+    const deepest = new Map();
+    const ancestors = new Set();
+    const stack = [{ leave: false, value, level: 0 }];
+    while (stack.length > 0) {
+        const task = stack.pop();
+        if (task.leave) {
+            ancestors.delete(task.container);
+            continue;
+        }
+        const current = task.value;
+        if (typeof current !== "object" ||
+            current === null ||
+            ancestors.has(current)) {
+            continue;
+        }
+        const inner = task.level + 1;
+        if (inner > state.jsonDepthLimit) {
+            return true;
+        }
+        const seen = deepest.get(current);
+        if (seen !== undefined && seen >= inner) {
+            continue;
+        }
+        deepest.set(current, inner);
+        ancestors.add(current);
+        stack.push({ leave: true, container: current });
+        const entries = Array.isArray(current)
+            ? current
+            : Object.values(current);
+        for (const entry of entries) {
+            stack.push({ leave: false, value: entry, level: inner });
+        }
+    }
+    return false;
+}
+function walkJsonWrite(state, field, value, path) {
+    const operands = isRecord(value) && Object.keys(value).some((key) => key.startsWith("$"))
+        ? Object.entries(value)
+            .filter(([key]) => key !== "$unset" && key !== "$ref")
+            .map(([, operand]) => operand)
+        : [value];
+    for (const operand of operands) {
+        const values = field.list && Array.isArray(operand) ? operand : [operand];
+        for (const entry of values) {
+            if (jsonValueExceeds(state, entry)) {
+                jsonDepthExceeded(state, path);
+                return;
+            }
+        }
+    }
+}
+const JSON_LIST_OPERATORS = new Set(["in", "notIn", "hasEvery", "hasSome"]);
+const JSON_VALUELESS_OPERATORS = new Set(["mode", "isEmpty", "path"]);
+function walkJsonFilter(state, filter, depth, path) {
+    let level = depth;
+    let current = filter;
+    while (isRecord(current)) {
+        let next;
+        for (const operator of Object.keys(current)) {
+            const operand = current[operator];
+            if (operator === "not" && isRecord(operand)) {
+                next = operand;
+                continue;
+            }
+            if (JSON_VALUELESS_OPERATORS.has(operator)) {
+                continue;
+            }
+            const values = JSON_LIST_OPERATORS.has(operator) && Array.isArray(operand)
+                ? operand
+                : [operand];
+            for (const entry of values) {
+                if (jsonValueExceeds(state, entry)) {
+                    jsonDepthExceeded(state, path);
+                    return;
+                }
+            }
+        }
+        if (next === undefined) {
+            return;
+        }
+        level += 1;
+        if (level > state.nestingLimit) {
+            nestingExceeded(state);
+            return;
+        }
+        current = next;
+    }
+    if (jsonValueExceeds(state, current)) {
+        jsonDepthExceeded(state, path);
+    }
+}
 function countBooleanNode(state, path, key) {
     if (state.booleanExceeded) {
         return;
@@ -74,7 +177,18 @@ function walkWhere(state, resourceName, value, depth, path, counting) {
         }
         else {
             const field = lookupField(resource, key);
+            if (field?.kind === "scalar") {
+                if (isJsonField(field)) {
+                    walkJsonFilter(state, child, depth, extend(state, path, key));
+                }
+                else {
+                    walkScalarNot(state, child, depth);
+                }
+            }
             if (field?.kind !== "relation") {
+                if (state.nesting !== undefined) {
+                    return;
+                }
                 continue;
             }
             if (field.cardinality === "one") {
@@ -97,6 +211,22 @@ function walkWhere(state, resourceName, value, depth, path, counting) {
         }
     }
 }
+function walkScalarNot(state, filter, depth) {
+    let level = depth;
+    let current = filter;
+    while (isRecord(current) && Object.hasOwn(current, "not")) {
+        const operand = current.not;
+        if (!isRecord(operand)) {
+            return;
+        }
+        level += 1;
+        if (level > state.nestingLimit) {
+            nestingExceeded(state);
+            return;
+        }
+        current = operand;
+    }
+}
 function walkOrderBy(state, resourceName, value, depth) {
     const resource = lookupResource(state.contract, resourceName);
     if (resource === undefined) {
@@ -194,6 +324,13 @@ function walkMutationData(state, resourceName, value, depth, path, stage, counti
     for (const fieldName of Object.keys(value)) {
         const edge = lookupField(resource, fieldName);
         const directives = value[fieldName];
+        if (edge?.kind === "scalar" && isJsonField(edge)) {
+            walkJsonWrite(state, edge, directives, extend(state, path, fieldName));
+            if (state.nesting !== undefined) {
+                return;
+            }
+            continue;
+        }
         if (edge?.kind !== "relation" || !isRecord(directives)) {
             continue;
         }
@@ -321,11 +458,13 @@ function walk(contract, request, args, tracking) {
     const state = {
         contract,
         nestingLimit: contract.limits.maxNestingDepth,
+        jsonDepthLimit: contract.limits.maxJsonDepth,
         booleanLimit: contract.limits.maxBooleanNodes,
         tracking,
         rootKey: "",
         booleanCount: 0,
         nesting: undefined,
+        nestingAtField: false,
         booleanNodes: undefined,
         booleanExceeded: false,
     };
@@ -334,6 +473,12 @@ function walk(contract, request, args, tracking) {
 }
 export function findStructuralLimitIssues(contract, request, args) {
     const untracked = walk(contract, request, args, false);
+    if (untracked.nestingAtField) {
+        return {
+            nesting: walk(contract, request, args, true).nesting,
+            booleanNodes: undefined,
+        };
+    }
     if (untracked.nesting !== undefined || !untracked.booleanExceeded) {
         return { nesting: untracked.nesting, booleanNodes: undefined };
     }

package/dist/operations/validation-code.d.ts

@@ -1,14 +1,19 @@
+import type { AvFieldCheck } from "../contracts/field-check.js";
 /** The set of allocated Validation codes, as a runtime array. */
-export declare const VALIDATION_CODES: readonly ["V1000", "V1001", "V1002", "V1003", "V1004", "V1005", "V1006", "V1007", "V1008", "V1009", "V1010", "V1011", "V1012", "V1013", "V1014", "V1015", "V1016", "V1017", "V1018", "V1019"];
+export declare const VALIDATION_CODES: readonly ["V1000", "V1001", "V1002", "V1003", "V1004", "V1005", "V1006", "V1007", "V1008", "V1009", "V1010", "V1011", "V1012", "V1013", "V1014", "V1015", "V1016", "V1017", "V1018", "V1019", "V1020", "V1021"];
 /** A validation code (`V1000` and up), one per kind of argument problem. */
-export type ValidationCode = (typeof VALIDATION_CODES)[number];
+export type AvValidationCode = (typeof VALIDATION_CODES)[number];
 /** The framework's message for each validation code. */
-export declare const VALIDATION_CODE_MESSAGES: Readonly<Record<ValidationCode, string>>;
+export declare const VALIDATION_CODE_MESSAGES: Readonly<Record<AvValidationCode, string>>;
 /** One validation problem: its code, message and the argument path it is at. */
-export type ValidationIssue = {
+export type AvValidationIssue = {
     readonly path?: readonly (string | number)[];
-    readonly code: ValidationCode;
+    readonly code: AvValidationCode;
     readonly message: string;
+    /** The failed field validator's check name (`max_length`, `string_format`, …). */
+    readonly check?: AvFieldCheck["check"];
+    /** That check's parameters, as the Contract stores them (`{ maximum: 80 }`). */
+    readonly params?: Readonly<Record<string, unknown>>;
 };
 /** Builds one validation issue at its path. */
-export declare function validationIssue(code: ValidationCode, path: readonly (string | number)[], message: string): ValidationIssue;
+export declare function validationIssue(code: AvValidationCode, path: readonly (string | number)[], message: string): AvValidationIssue;

package/dist/operations/validation-code.guidance.d.ts

@@ -0,0 +1,6 @@
+import type { ErrorCodeGuidance } from "../runtime/error-guidance.js";
+import type { AvValidationCode } from "./validation-code.js";
+/** Cause and fix of every validation code. */
+export declare const VALIDATION_CODE_GUIDANCE: {
+    readonly [C in AvValidationCode]: ErrorCodeGuidance;
+};

package/dist/operations/validation-code.guidance.js

@@ -0,0 +1,90 @@
+export const VALIDATION_CODE_GUIDANCE = {
+    V1000: {
+        cause: "A required value is absent: a create leaves out a required field that has no database default and no compute.create (the path names the field), a required relation and its reference field are both missing, a typed Json field lacks a required key, or a $ref has no fingerprint.",
+        fix: "Send the value at the issue's path. When the server must fill it, give the field a compute.create stage or a database default; a pipe cannot fill it.",
+    },
+    V1001: {
+        cause: "A value of the wrong type: a string where a number is expected, a negative limit, a non-integer id, null given to an operator with no null meaning (gt, contains, in), two directives in one scalar action object (`{ $increment: 1, $decrement: 2 }`), or a server-side value that is not plain data. Also a value that would make the call reach more rows: `undefined` in a filter, a unique selector or a cursor, an empty boolean node (`NOT: {}`, `AND: []`, `OR: []`) in the where of a write (update or delete many, count or first, a to-many $update or $delete).",
+        fix: "Send the type the contract states at that path (the generated client's types say it).",
+    },
+    V1002: {
+        cause: "A value that is not a member of the enum, or outside a typed Json field's AvZ.enum or AvZ.literal.",
+        fix: "Send one of the enum's members.",
+    },
+    V1003: {
+        cause: 'A malformed datetime, decimal, base64 or UUID string, or a failed pattern or format validator (`check: "string_format"`).',
+        fix: "Send the canonical encoding (ISO-8601 UTC datetime, decimal string, base64 bytes) and satisfy the validator that check and params name.",
+    },
+    V1004: {
+        cause: "A number, length or size outside its range: a failed bound, length or size validator, a BigInt outside signed 64 bits, an AvZ.int() outside the safe integer range, or a transaction with no operations. Under A2004 it is also a value the database refused as too long or out of its range, a BigInt beyond what the data source's driver can bind among them (some bind at most ±(2^53 − 1)).",
+        fix: "Send a value inside the range; check and params name the validator that failed.",
+    },
+    V1005: {
+        cause: "A field that does not exist or is hidden in the caller's layer, an unknown Resource (under A2001), or a key a typed Json field's shape does not declare.",
+        fix: "Use a field the caller's contract exposes, expose it through exemptions, or make the call from server code.",
+    },
+    V1006: {
+        cause: "An operator, directive or nested write the field does not offer (at any depth, inside not too; a to-many $update's data takes only what a bulk write takes), a mode it does not offer, or an operation that is not available (under A2002).",
+        fix: "Use what the contract lists for that field or Resource, or expose it through exemptions.",
+    },
+    V1007: {
+        cause: "The where of a unique operation is not exactly one complete identifier.",
+        fix: "Pass exactly one identifier: the id, or every field of one @unique or @@unique.",
+    },
+    V1008: {
+        cause: "Both select and include, a write-only field selected, or a relation that is not selectable there.",
+        fix: "Use select or include, not both, and select only readable fields.",
+    },
+    V1009: {
+        cause: "A cursor without an explicit orderBy, or cursor keys that do not match the ordered fields.",
+        fix: "Give an orderBy and a cursor holding exactly its ordered fields.",
+    },
+    V1010: {
+        cause: "A $ref path the earlier step does not return, a $ref to a step that is not in the transaction, or to a step with no single row (a many or count step).",
+        fix: "Select the referenced field in the earlier step, and reference a single-row step.",
+    },
+    V1011: {
+        cause: "The referenced value's type does not fit its target, a nullable source where only a non-null value is accepted included.",
+        fix: "Reference a field of the target's type, non-null where the target needs it.",
+    },
+    V1012: {
+        cause: "A nested write that does not fit the relation (a list where one record is expected), a reference field set together with its own relation, one record mixing reference fields and relation writes where the adapter cannot run both, or a record written through a relation that writes that relation (or a field holding its reference) back, where the adapter admits no such write. Also a to-one $update or $upsert beside $connect, $connectOrCreate, $create, $set or $disconnect on the same relation: the row it would update is the newly linked one.",
+        fix: "Write either the relation or its reference field, in the relation's cardinality. Relink a to-one relation in one write and update the linked row in another.",
+    },
+    V1013: {
+        cause: "Nested projections, filters or writes deeper than maxNestingDepth.",
+        fix: "Nest less, or raise limits.maxNestingDepth.",
+    },
+    V1014: {
+        cause: "A limit above maxListLimit, or more steps than maxTransactionOperations.",
+        fix: "Paginate or split the plan, or raise the limit.",
+    },
+    V1015: {
+        cause: "A where tree with more nodes than maxBooleanNodes.",
+        fix: "Simplify the filter (in instead of many OR clauses), or raise limits.maxBooleanNodes.",
+    },
+    V1016: {
+        cause: "A $ref to the referencing step itself or a later one, or to an index no step has.",
+        fix: "Reference an earlier step only.",
+    },
+    V1017: {
+        cause: "A hand-written plan whose fingerprint does not match its step.",
+        fix: "Let the generated client, framework.appTx or framework.clientTx build the plan.",
+    },
+    V1018: {
+        cause: "The referenced step returned no value at that path, such as a first step that matched no row.",
+        fix: "Make sure the earlier step returns a row, or use a unique step, which fails with A2003.",
+    },
+    V1019: {
+        cause: "A later step uses a row that an earlier step's delete removed through a database cascade.",
+        fix: "Reorder or drop the dependent step.",
+    },
+    V1020: {
+        cause: "One framework.transaction([...]) list mixes appTx and clientTx steps.",
+        fix: "Build every step of a plan from one origin.",
+    },
+    V1021: {
+        cause: "A Json field's value nests deeper than maxJsonDepth.",
+        fix: "Flatten the value, or raise limits.maxJsonDepth.",
+    },
+};

package/dist/operations/validation-code.js

@@ -19,6 +19,8 @@ export const VALIDATION_CODES = [
     "V1017",
     "V1018",
     "V1019",
+    "V1020",
+    "V1021",
 ];
 export const VALIDATION_CODE_MESSAGES = {
     V1000: "Required value missing.",
@@ -41,6 +43,8 @@ export const VALIDATION_CODE_MESSAGES = {
     V1017: "Transaction fingerprint mismatch.",
     V1018: "Transaction reference resolved to no value.",
     V1019: "Transaction step depends on a row removed by an earlier step's cascade",
+    V1020: "Transaction mixes application and client steps.",
+    V1021: "Json value depth limit exceeded.",
 };
 export function validationIssue(code, path, message) {
     return { code, path, message };

package/dist/operations/write-scope.resolver.d.ts

@@ -1,15 +1,19 @@
-import type { WriteScope } from "../contracts/capability.js";
-import type { Contract } from "../contracts/contract.js";
-import type { Resource } from "../contracts/resource.js";
-import type { OperationIdentity } from "./operation-identity.js";
+import type { AvWriteScope } from "../contracts/capability.js";
+import type { AvContract } from "../contracts/contract.js";
+import type { AvResource } from "../contracts/resource.js";
+import type { AvOperationIdentity } from "./operation-identity.js";
 /**
  * Which write position one request's top-level `data` (or `create`/`update`)
  * argument sits in, read off the variant the Resource advertises. `"nested"`
  * wherever nothing narrower is stated.
  */
-export declare function resolveWriteScope(resource: Resource<Contract> | undefined, request: OperationIdentity): WriteScope;
+export declare function resolveWriteScope(resource: AvResource<AvContract> | undefined, request: AvOperationIdentity): AvWriteScope;
 /**
  * The position a write NESTED beneath an admitted relation directive sits in: the
  * unrestricted one, at every depth, under every top-level scope.
  */
-export declare const NESTED_WRITE_SCOPE: WriteScope;
+export declare const NESTED_WRITE_SCOPE: AvWriteScope;
+/** The position a to-many `$update`'s `data` sits in: the flat-bulk write position. */
+export declare const TO_MANY_UPDATE_WRITE_SCOPE: AvWriteScope;
+/** The position of a relation's other end inside a record written through it. */
+export declare const LOOPBACK_WRITE_SCOPE: AvWriteScope;

package/dist/operations/write-scope.resolver.js

@@ -5,3 +5,5 @@ export function resolveWriteScope(resource, request) {
     return writeScopeOf(lookupOwn(advertised, request.variant));
 }
 export const NESTED_WRITE_SCOPE = "nested";
+export const TO_MANY_UPDATE_WRITE_SCOPE = "bulkWrite";
+export const LOOPBACK_WRITE_SCOPE = "loopback";

package/dist/policy/access-provider.interface.d.ts

@@ -0,0 +1,91 @@
+import type { AvState } from "../runtime/request-state.js";
+import type { AvPolicyEngine } from "./policy-engine.js";
+/**
+ * What the framework's `access` option takes: the policy engine every client
+ * and agent request is checked against, and how a request's state is seeded.
+ * Aventara Access provides one; one written by hand works the same way.
+ *
+ * The request's principal is `ctx.$state.me` (`null` when it is absent), so
+ * `state` names it as `me`. With `access`, the configuration states no
+ * `policy`, and the host no `state` of its own.
+ */
+export interface AvAccessProvider {
+    /** The policy engine (`AvPolicyEngine`), asked about every client and agent request. */
+    readonly policy: AvPolicyEngine;
+    /**
+     * Seeds a request's `ctx.$state` from its headers (a Web `Headers`): `me`, the principal the
+     * policy is asked about (`null` for an anonymous caller), and anything else
+     * the stages read. Called once per request by the host. `request` is the
+     * host's own request when it has one: Express's `req`, Fastify's
+     * `request`, or the Next.js route handler's `Request`. A throw is answered
+     * like any developer failure: a thrown `AvError` as its own outcome,
+     * anything else as an internal failure.
+     */
+    state(input: {
+        readonly headers: {
+            get(name: string): string | null;
+            has(name: string): boolean;
+            forEach(callback: (value: string, name: string) => void): void;
+        };
+        readonly request?: unknown;
+    }): (AvState & {
+        readonly me: unknown;
+    }) | Promise<AvState & {
+        readonly me: unknown;
+    }>;
+    /**
+     * What the clients' `$access` needs beyond `can`: where the app mounted
+     * Aventara Access (`url`), and each verb's route under it, the JSON Schema
+     * of its arguments and result, and its server-side `call`. Compiled into
+     * the ClientContract's `access` section (its `call`s dropped). Left out,
+     * `$access` offers `can` only.
+     */
+    readonly client?: {
+        /** Where the app mounted Access: an absolute `http(s)` URL, or root-relative (`"/api/auth"`). */
+        readonly url: string;
+        /**
+         * The verbs Access offers, each its route, its schemas and its
+         * server-side call. A verb left out is no verb of `$access`: a
+         * `service` profile, with no cookie sign-in, offers no `signIn` or
+         * `signUp`, and only the `kiosk` profile offers `switchUser`, `lock`,
+         * `setPin`, `enrollDevice` and `revokeDevice`. Any other name is
+         * refused.
+         */
+        readonly verbs: {
+            readonly [Verb in "signIn" | "signUp" | "signOut" | "resetPassword" | "me" | "switchUser" | "lock" | "setPin" | "enrollDevice" | "revokeDevice"]?: {
+                /** The route's method. */
+                readonly method: "GET" | "POST";
+                /** Under `url`: `"/sign-in/email"`. */
+                readonly path: string;
+                /**
+                 * The arguments' JSON Schema, in the subset a `json` field's shape
+                 * uses (absent: the verb takes none).
+                 */
+                readonly args?: {
+                    readonly [key: string]: unknown;
+                };
+                /** The result's JSON Schema, in the same subset (`me`: the value when someone is signed in). */
+                readonly result: {
+                    readonly [key: string]: unknown;
+                };
+                /**
+                 * The verb run in process, for a server-side client
+                 * (`framework.serverClient.$access`, Next's `avClient.$access`):
+                 * Access runs it with the request's headers, and the host's own
+                 * request and response when the caller hands them (Express's
+                 * `req`/`res`, Fastify's `request`/`reply`), so a sign-in (or a
+                 * kiosk's switch, lock or enrollment) sets its cookies as Access
+                 * sets them: on the response it is handed, or, in a Server Action,
+                 * through Next's `cookies()`. `me` resolves the token identity, or
+                 * `null` when no one is signed in.
+                 */
+                call(input: {
+                    readonly args: unknown;
+                    readonly headers: Parameters<AvAccessProvider["state"]>[0]["headers"];
+                    readonly request?: unknown;
+                    readonly response?: unknown;
+                }): Promise<unknown>;
+            };
+        };
+    };
+}

package/dist/policy/access-provider.interface.js

@@ -0,0 +1 @@
+export {};

package/dist/policy/access-provider.registry.d.ts

@@ -0,0 +1,17 @@
+import type { AvAccessProvider } from "./access-provider.interface.js";
+/** Records the provider `framework` was configured with; called once, at construction. */
+export declare function recordAccessProvider(framework: object, access: AvAccessProvider | undefined): void;
+/** What a host reads of the provider a Framework was configured with. */
+type AccessProviderView = {
+    /** The provider's `state`, called on the provider. */
+    readonly state: AvAccessProvider["state"];
+    /** The provider's `client`, when it has one. */
+    readonly client: AvAccessProvider["client"];
+};
+/**
+ * The provider `framework` was configured with (`access`), as a view;
+ * `undefined` for a Framework without `access`, or a value that is no
+ * constructed Framework.
+ */
+export declare function accessProviderOf(framework: object): AccessProviderView | undefined;
+export {};

package/dist/policy/access-provider.registry.js

@@ -0,0 +1,15 @@
+const ACCESS_PROVIDERS = new WeakMap();
+export function recordAccessProvider(framework, access) {
+    if (access !== undefined) {
+        ACCESS_PROVIDERS.set(framework, access);
+    }
+}
+export function accessProviderOf(framework) {
+    const access = ACCESS_PROVIDERS.get(framework);
+    return access === undefined
+        ? undefined
+        : Object.freeze({
+            state: (input) => access.state(input),
+            client: access.client,
+        });
+}

package/dist/policy/access-question.d.ts

@@ -0,0 +1,20 @@
+import type { AvPolicyWhere } from "./policy-engine.js";
+/**
+ * One question to the policy, as a client asks it: may the signed-in principal
+ * run `action` on `resource`, or on the one row `where` names. The answer is
+ * what the real call would do before any data is sent, decided by the same
+ * engine on the server; a row the principal cannot reach answers `false`
+ * exactly as a missing one does. It only shapes the UI, and the real call is
+ * still checked.
+ *
+ * The answer is about the row and the action, not about what a page reads of
+ * the row: it is the call selecting the Resource's identifier only. A field the
+ * principal reads on some rows only is checked by the page's own call that
+ * selects it, so `true` here and a refusal of that call can both hold.
+ */
+export type AvAccessQuestion<R extends string = string, UniqueWhere = AvPolicyWhere> = {
+    readonly resource: R;
+    readonly action: "read" | "create" | "update" | "delete";
+    /** One row, by its unique where. Omitted: may the principal run `action` on `resource` at all. */
+    readonly where?: UniqueWhere;
+};

package/dist/policy/access-question.js

@@ -0,0 +1 @@
+export {};

package/dist/policy/access-question.registry.d.ts

@@ -0,0 +1,5 @@
+import type { AccessQuestionsAnswerer } from "./access-question.runtime.js";
+/** Records `framework`'s `can` answerer; called once, at construction. */
+export declare function recordAccessQuestions(framework: object, answer: AccessQuestionsAnswerer): void;
+/** `framework`'s `can` answerer, or `undefined` for anything `createFramework` did not return. */
+export declare function accessQuestionsOf(framework: object): AccessQuestionsAnswerer | undefined;

package/dist/policy/access-question.registry.js

@@ -0,0 +1,19 @@
+import { coreBrandOf } from "../runtime/core-class.brand.js";
+const ANSWERERS = sharedAnswererRegistry();
+function sharedAnswererRegistry() {
+    const key = coreBrandOf("access-questions");
+    const holder = globalThis;
+    const existing = holder[key];
+    if (existing instanceof WeakMap) {
+        return existing;
+    }
+    const registry = new WeakMap();
+    Object.defineProperty(holder, key, { value: registry });
+    return registry;
+}
+export function recordAccessQuestions(framework, answer) {
+    ANSWERERS.set(framework, answer);
+}
+export function accessQuestionsOf(framework) {
+    return ANSWERERS.get(framework);
+}

package/dist/policy/access-question.runtime.d.ts

@@ -0,0 +1,36 @@
+import type { AvAdapterModel } from "../adapters/adapter-model.js";
+import type { AvAdapterOperationExecutor } from "../adapters/adapter-operation-executor.interface.js";
+import type { AvContracts } from "../compiler/contract.compiler.js";
+import type { ResolvedPolicyConfig } from "../config/config.resolver.js";
+import type { RemoteRequestOrigin } from "../config/config-layer.js";
+import { type AvDiagnosticsSink } from "../runtime/diagnostics-reporter.js";
+import type { MisuseReporter } from "../runtime/misuse-reporter.js";
+import { type AvOperationResponse } from "../runtime/operation-response.js";
+import type { AvState } from "../runtime/request-state.js";
+/** A `can` request as core answers it: the body the protocol read, under the request's origin, id and state. */
+export type AccessQuestionsRequest = {
+    readonly origin: RemoteRequestOrigin;
+    readonly requestId: string;
+    /** The request's `ctx.$state` as its host seeded it; absent, `{}`. */
+    readonly state?: AvState;
+    /** The JSON object the request carried: `{ questions }`. */
+    readonly body: unknown;
+};
+/** Answers one `can` request: `A1000` with one boolean per question, or the refusal. */
+export type AccessQuestionsAnswerer = (request: AccessQuestionsRequest) => Promise<AvOperationResponse<readonly boolean[]>>;
+/** What answering reads off the Framework. */
+type AccessQuestionsDependencies = {
+    readonly contracts: AvContracts;
+    readonly policy: ResolvedPolicyConfig | undefined;
+    readonly adapter: AvAdapterOperationExecutor & {
+        readonly model: AvAdapterModel;
+    };
+    readonly diagnostics: AvDiagnosticsSink | undefined;
+    readonly misuse: MisuseReporter;
+};
+/**
+ * Builds the `can` answerer of one Framework. Total: every request resolves to
+ * an answer, and no throw of the engine or the adapter escapes it.
+ */
+export declare function createAccessQuestionAnswerer(dependencies: AccessQuestionsDependencies): AccessQuestionsAnswerer;
+export {};