@aventara/core 1.0.0-rc.0 → 1.0.0-rc.10

package/dist/compiler/contract.compiler.js

@@ -1,12 +1,15 @@
-import { PROJECTION_SCOPES, WRITE_SCOPES, } from "../contracts/capability.js";
+import { bindShapedField, jsonShapeOf } from "../avz/json-shape.registry.js";
+import { FILTER_MODES, PROJECTION_SCOPES, WRITE_SCOPES, } from "../contracts/capability.js";
 import { validateClientContractStructure } from "../contracts/client-contract-structure.validator.js";
-import { canonicalizeContract } from "../contracts/contract-canonicalizer.js";
-import { computeClientContractHash, } from "../contracts/contract-hash.js";
+import { canonicalizeContract, canonicalizeContractMembers, canonicalizeJson, joinCanonicalContractMembers, recordCanonicalContractText, } from "../contracts/contract-canonicalizer.js";
+import { hashCanonicalContractText, } from "../contracts/contract-hash.js";
 import { DEFAULT_CONTRACT_LIMITS, } from "../contracts/contract-limits.js";
 import { AVENTARA_PROTOCOL_VERSION } from "../contracts/contract-protocol.js";
-import { advertisedDirectives, advertisedDirectivesAt, advertisedReducers, advertisedReducersAt, holdsAt, holdsInAnyScope, } from "../contracts/field.js";
+import { advertisedDirectives, advertisedReducers, holdsInAnyScope, } from "../contracts/field.js";
 import { isOperationVariantAvailable, } from "../contracts/resource-operations.js";
-import { bindShapedField, jsonShapeOf } from "../json/json-shape.registry.js";
+import { checkCreateRequirements, checkHiddenRequirements, projectCreateRequirements, } from "./create-requirements.projector.js";
+import { applyValidators, bindFieldValidators, checkLayerValidators, compileValidatorTable, } from "./field-validator.compiler.js";
+import { explainManagedRefusals, hideManagedElsewhere, managedElsewhereOf, managedWriteReason, markCoreResources, pruneManagedEnums, withholdManagedWrites, } from "./managed-elsewhere.projector.js";
 const UNIQUE_VARIANTS = [
     ["find", "unique"],
     ["update", "unique"],
@@ -39,6 +42,12 @@ function normalizeAdapterScalarCapabilities(capabilities) {
         ...(capabilities.filter !== undefined
             ? { filter: [...capabilities.filter] }
             : {}),
+        ...(capabilities.filterModes !== undefined
+            ? { filterModes: [...capabilities.filterModes] }
+            : {}),
+        ...(capabilities.pathFilterModes !== undefined
+            ? { pathFilterModes: [...capabilities.pathFilterModes] }
+            : {}),
         ...(capabilities.order !== undefined ? { order: capabilities.order } : {}),
         ...(capabilities.orderNulls !== undefined
             ? { orderNulls: capabilities.orderNulls }
@@ -69,8 +78,65 @@ function cloneAdapterField(field) {
         cardinality: field.cardinality,
         nullable: field.nullable,
         capabilities: cloneValue(field.capabilities),
+        ...(typeof field.inverse === "string" ? { inverse: field.inverse } : {}),
+        ...(Array.isArray(field.referenceFields) && field.referenceFields.length > 0
+            ? { referenceFields: [...field.referenceFields] }
+            : {}),
+        ...(Array.isArray(field.referenceFields) &&
+            Array.isArray(field.references) &&
+            field.references.length > 0 &&
+            field.references.length === field.referenceFields.length
+            ? { references: [...field.references] }
+            : {}),
     };
 }
+function pruneHiddenPairings(projection, references) {
+    const resources = projection.resources;
+    for (const [name, resource] of Object.entries(resources)) {
+        for (const field of Object.values(resource.fields)) {
+            if (field.kind !== "relation") {
+                continue;
+            }
+            if (Array.isArray(field.references) &&
+                (references === "none" ||
+                    !wholePairing(resource.fields, Object.hasOwn(resources, String(field.target))
+                        ? resources[String(field.target)]?.fields
+                        : undefined, field.referenceFields, field.references))) {
+                delete field.references;
+            }
+            if (Array.isArray(field.referenceFields)) {
+                const shown = field.referenceFields.filter((reference) => typeof reference === "string" &&
+                    Object.hasOwn(resource.fields, reference) &&
+                    resource.fields[reference]?.kind === "scalar");
+                if (shown.length > 0) {
+                    field.referenceFields = shown;
+                }
+                else {
+                    delete field.referenceFields;
+                }
+            }
+            if (typeof field.inverse !== "string") {
+                continue;
+            }
+            const other = Object.hasOwn(resources, String(field.target))
+                ? resources[String(field.target)]?.fields[field.inverse]
+                : undefined;
+            if (other?.kind !== "relation" || other.target !== name) {
+                delete field.inverse;
+            }
+        }
+    }
+}
+function wholePairing(fields, targetFields, referenceFields, references) {
+    const shownIn = (within, name) => typeof name === "string" &&
+        within !== undefined &&
+        Object.hasOwn(within, name) &&
+        within[name]?.kind === "scalar";
+    return (Array.isArray(referenceFields) &&
+        referenceFields.length === references.length &&
+        referenceFields.every((name) => shownIn(fields, name)) &&
+        references.every((name) => shownIn(targetFields, name)));
+}
 function cloneOperations(operations) {
     return cloneValue(operations);
 }
@@ -84,8 +150,40 @@ function cloneAdapterResource(resource) {
         operations: cloneOperations(resource.operations),
     };
 }
+function canonicalModes(modes) {
+    const stated = Array.isArray(modes) ? modes : [];
+    const known = FILTER_MODES.filter((mode) => mode === "default" || stated.includes(mode));
+    const unknown = stated.filter((mode) => !FILTER_MODES.includes(mode));
+    return [...known, ...unknown];
+}
+function qualifyFilterModes(projection) {
+    for (const resource of Object.values(projection.resources)) {
+        for (const field of Object.values(resource.fields)) {
+            if (field.kind !== "scalar") {
+                continue;
+            }
+            const capabilities = field.capabilities;
+            const filter = Array.isArray(capabilities.filter)
+                ? capabilities.filter
+                : [];
+            if (!filter.includes("mode")) {
+                delete capabilities.filterModes;
+                delete capabilities.pathFilterModes;
+                continue;
+            }
+            const stated = capabilities.filterModes;
+            capabilities.filterModes = canonicalModes(stated);
+            if (filter.includes("path")) {
+                capabilities.pathFilterModes = canonicalModes(capabilities.pathFilterModes ?? stated);
+            }
+            else {
+                delete capabilities.pathFilterModes;
+            }
+        }
+    }
+}
 function createBaseline(model) {
-    return {
+    const baseline = {
         scalars: Object.fromEntries(Object.entries(model.scalars).map(([key, value]) => [
             key,
             cloneValue(value),
@@ -104,9 +202,11 @@ function createBaseline(model) {
             ? {}
             : { referenceWrites: model.referenceWrites }),
     };
+    qualifyFilterModes(baseline);
+    return baseline;
 }
-function scalarFieldPath(scope, resource, field) {
-    return `${scope}.resources.${resource}.fields.${field}`;
+function definitionPath(resource, field) {
+    return `root.resources.${resource}.fields.${field}.definition`;
 }
 function structuralValueMatches(field, config, key) {
     if (config[key] === undefined) {
@@ -114,6 +214,13 @@ function structuralValueMatches(field, config, key) {
     }
     return JSON.stringify(field[key]) === JSON.stringify(config[key]);
 }
+function configuredMember(capabilities, key) {
+    const value = capabilities?.[key];
+    if (value === undefined) {
+        return {};
+    }
+    return { [key]: Array.isArray(value) ? [...value] : cloneValue(value) };
+}
 function addConfiguredScalarField(config, path, diagnostics) {
     if (config.json !== undefined) {
         refuseJsonShape(path, "is not a field of the adapter model", diagnostics);
@@ -128,7 +235,7 @@ function addConfiguredScalarField(config, path, diagnostics) {
     if (configuredLifecycle === undefined ||
         !configuredLifecycle.includes("VIRTUAL") ||
         configuredLifecycle.some((trait) => trait !== "VIRTUAL")) {
-        diagnostics.push(diagnostic("COMPILER_INVALID_LIFECYCLE", `${path}.lifecycle`, "framework-added scalar field must declare only VIRTUAL lifecycle; generated lifecycle comes from adapters and computed lifecycle comes from behaviors"));
+        diagnostics.push(diagnostic("COMPILER_INVALID_LIFECYCLE", `${path}.lifecycle`, "framework-added scalar field must declare only VIRTUAL lifecycle; generated lifecycle comes from adapters and computed lifecycle comes from compute"));
         return undefined;
     }
     return {
@@ -140,89 +247,14 @@ function addConfiguredScalarField(config, path, diagnostics) {
         lifecycle: [...(config.lifecycle ?? [])],
         capabilities: {
             select: config.capabilities?.select ?? true,
-            ...(config.capabilities?.filter !== undefined
-                ? { filter: [...config.capabilities.filter] }
-                : {}),
-            ...(config.capabilities?.order !== undefined
-                ? { order: config.capabilities.order }
-                : {}),
-            ...(config.capabilities?.orderNulls !== undefined
-                ? { orderNulls: config.capabilities.orderNulls }
-                : {}),
-            ...(config.capabilities?.create !== undefined
-                ? { create: [...config.capabilities.create] }
-                : {}),
-            ...(config.capabilities?.update !== undefined
-                ? { update: [...config.capabilities.update] }
-                : {}),
+            ...configuredMember(config.capabilities, "filter"),
+            ...configuredMember(config.capabilities, "order"),
+            ...configuredMember(config.capabilities, "orderNulls"),
+            ...configuredMember(config.capabilities, "create"),
+            ...configuredMember(config.capabilities, "update"),
         },
     };
 }
-export function capabilityAddsBaseline(fieldKind, baseline, key, configured) {
-    const axis = capabilityAxisFor(fieldKind, key);
-    if (axis === undefined) {
-        return false;
-    }
-    const baselineValue = baseline[key];
-    switch (axis.kind) {
-        case "limit":
-            return baselineValue !== undefined && configured !== baselineValue;
-        case "flag":
-            return configured === true && baselineValue !== true;
-        case "tokens": {
-            if (!isTokenList(configured)) {
-                return false;
-            }
-            const advertised = isTokenList(baselineValue) ? baselineValue : [];
-            return configured.some((token) => !advertised.includes(token));
-        }
-        case "scopes": {
-            const claimed = configured === true
-                ? axis.axis
-                : isTokenList(configured)
-                    ? configured
-                    : undefined;
-            return (claimed?.some((position) => axis.axis.includes(position) &&
-                !holdsAt(baselineValue, position)) === true);
-        }
-        case "scopedTokens": {
-            const claim = scopedTokenClaim(axis, configured);
-            if (claim === undefined) {
-                return false;
-            }
-            return claim.positions.some((position) => {
-                if (!axis.axis.includes(position)) {
-                    return false;
-                }
-                const advertised = advertisedTokensAt(axis.tokenKey, baselineValue, position);
-                return (advertised === undefined ||
-                    claim.tokens.some((token) => !advertised.includes(token)));
-            });
-        }
-    }
-}
-function scopedTokenClaim(axis, configured) {
-    if (isTokenList(configured)) {
-        return { tokens: configured, positions: axis.axis };
-    }
-    if (isRecord(configured) &&
-        isTokenList(configured[axis.tokenKey]) &&
-        isTokenList(configured.scopes)) {
-        return {
-            tokens: configured[axis.tokenKey],
-            positions: configured.scopes,
-        };
-    }
-    return undefined;
-}
-function advertisedTokensAt(tokenKey, baselineValue, position) {
-    if (!isTokenList(baselineValue) && !isRecord(baselineValue)) {
-        return undefined;
-    }
-    return tokenKey === "directives"
-        ? advertisedDirectivesAt(baselineValue, position)
-        : advertisedReducersAt(baselineValue, position);
-}
 function fieldLabel(path) {
     const [, resource, , field] = path.split(".").slice(1);
     return `${resource}.${field}`;
@@ -238,7 +270,7 @@ function applyJsonShape(field, baselineField, shape, path, diagnostics) {
     }
     const runtime = jsonShapeOf(shape);
     if (runtime === undefined) {
-        diagnostics.push(diagnostic("COMPILER_INVALID_JSON_SHAPE", `${path}.json`, `field "${fieldLabel(path)}": "json" must be a shape built with AvZ from "@aventara/core/json"; a Zod schema or any other value is not accepted`));
+        diagnostics.push(diagnostic("COMPILER_INVALID_JSON_SHAPE", `${path}.json`, `field "${fieldLabel(path)}": "json" must be a shape built with AvZ from "@aventara/core/avz"; a Zod schema or any other value is not accepted`));
         return;
     }
     if (runtime.validate(null).length === 0 ||
@@ -255,7 +287,7 @@ function applyExistingScalarConfig(field, baselineField, config, path, diagnosti
         }
     }
     if (config.format !== undefined) {
-        field.format = config.format;
+        diagnostics.push(diagnostic("COMPILER_STRUCTURAL_FIELD_OVERRIDE", `${path}.format`, "a discovered field's format is the adapter's and cannot be set; format is for configured (VIRTUAL) fields"));
     }
     if (config.json !== undefined) {
         applyJsonShape(field, baselineField, config.json, path, diagnostics);
@@ -264,95 +296,39 @@ function applyExistingScalarConfig(field, baselineField, config, path, diagnosti
         diagnostics.push(diagnostic("COMPILER_INVALID_LIFECYCLE", `${path}.lifecycle`, "existing adapter field lifecycle cannot be redefined by framework field configuration"));
     }
     if (config.capabilities !== undefined) {
-        const current = field.capabilities;
-        const baseline = baselineField.capabilities;
-        for (const [key, value] of Object.entries(config.capabilities)) {
-            if (capabilityAddsBaseline(baselineField.kind, baseline, key, value)) {
-                diagnostics.push(diagnostic("COMPILER_UNAVAILABLE_CAPABILITY", `${path}.capabilities.${key}`, `capability "${key}" is not available in the canonical baseline`));
-                continue;
-            }
-            current[key] = cloneValue(value);
-        }
-    }
-}
-function applyFrameworkOwnedScalarConfig(field, config, path, diagnostics) {
-    for (const key of ["type", "nullable", "list"]) {
-        if (config[key] !== undefined) {
-            field[key] = cloneValue(config[key]);
-        }
-    }
-    if (config.json !== undefined) {
-        refuseJsonShape(path, "is not a field of the adapter model", diagnostics);
-    }
-    if (config.format !== undefined) {
-        field.format = config.format;
-    }
-    if (config.lifecycle !== undefined) {
-        const configuredLifecycle = config.lifecycle;
-        if (!configuredLifecycle.includes("VIRTUAL") ||
-            configuredLifecycle.some((trait) => trait !== "VIRTUAL")) {
-            diagnostics.push(diagnostic("COMPILER_INVALID_LIFECYCLE", `${path}.lifecycle`, "framework-owned scalar field may declare only VIRTUAL lifecycle; computed lifecycle comes from behaviors"));
-        }
-        else {
-            field.lifecycle = [...configuredLifecycle];
-        }
-    }
-    if (config.capabilities !== undefined) {
-        const current = field.capabilities;
-        for (const [key, value] of Object.entries(config.capabilities)) {
-            current[key] = cloneValue(value);
-        }
+        diagnostics.push(diagnostic("COMPILER_STRUCTURAL_FIELD_OVERRIDE", `${path}.capabilities`, "a discovered field's capabilities are the adapter's and cannot be set; narrow what it exposes with exemptions"));
     }
 }
-function applyFieldConfig(model, projection, scope, config, diagnostics, allowRestrictedMissing = false) {
-    if (config === undefined) {
-        return;
-    }
+function applyFieldDefinitions(model, projection, definitions, diagnostics) {
     const providerBaseline = createBaseline(model);
-    for (const [resourceName, resourceConfig] of Object.entries(config)) {
-        if (resourceConfig === undefined) {
-            continue;
-        }
+    for (const [resourceName, resourceDefinitions] of Object.entries(definitions)) {
         const resource = projection.resources[resourceName];
         const providerResource = providerBaseline.resources[resourceName];
         if (resource === undefined || providerResource === undefined) {
-            if (allowRestrictedMissing && providerResource !== undefined) {
-                continue;
-            }
-            diagnostics.push(diagnostic("COMPILER_UNKNOWN_RESOURCE", `${scope}.resources.${resourceName}`, `resource "${resourceName}" is not present in the canonical adapter model`));
             continue;
         }
-        for (const [fieldName, rawConfig] of Object.entries(resourceConfig)) {
-            const fieldConfig = rawConfig;
-            const path = scalarFieldPath(scope, resourceName, fieldName);
+        for (const [fieldName, definition] of Object.entries(resourceDefinitions)) {
+            const path = definitionPath(resourceName, fieldName);
             const existing = resource.fields[fieldName];
             const providerField = providerResource.fields[fieldName];
             if (existing === undefined) {
-                if (allowRestrictedMissing && providerField !== undefined) {
-                    continue;
-                }
-                const added = addConfiguredScalarField(fieldConfig, path, diagnostics);
+                const added = addConfiguredScalarField(definition, path, diagnostics);
                 if (added !== undefined) {
                     resource.fields[fieldName] = added;
                 }
                 continue;
             }
             if (existing.kind === "relation") {
-                diagnostics.push(diagnostic("COMPILER_RELATION_FIELD_CONFIG_UNSUPPORTED", path, "framework field augmentation applies only to scalar fields"));
+                diagnostics.push(diagnostic("COMPILER_RELATION_FIELD_CONFIG_UNSUPPORTED", path, "a relation field takes no definition"));
                 continue;
             }
             if (providerField?.kind === "scalar") {
-                applyExistingScalarConfig(existing, providerField, fieldConfig, path, diagnostics);
-                continue;
+                applyExistingScalarConfig(existing, providerField, definition, path, diagnostics);
             }
-            applyFrameworkOwnedScalarConfig(existing, fieldConfig, path, diagnostics);
         }
     }
 }
-function isActiveBehaviorStage(value) {
-    return value !== undefined && value !== false;
-}
-function readBehaviorDependencies(value) {
+function readComputeDependencies(value) {
     if (!isRecord(value) || typeof value.compute !== "function") {
         return undefined;
     }
@@ -360,60 +336,135 @@ function readBehaviorDependencies(value) {
         ? value.dependsOn.filter((entry) => typeof entry === "string")
         : undefined;
 }
-function applyFieldBehavior(resource, fieldName, behavior, path, diagnostics, allowRestrictedMissing = false) {
-    const field = resource.fields[fieldName];
-    if (field === undefined || field.kind !== "scalar") {
-        if (allowRestrictedMissing && field === undefined) {
-            return;
+function applyCompute(projection, compute) {
+    for (const [resourceName, fields] of Object.entries(compute)) {
+        const resource = projection.resources[resourceName];
+        if (resource === undefined) {
+            continue;
+        }
+        for (const [fieldName, fieldCompute] of Object.entries(fields)) {
+            const field = resource.fields[fieldName];
+            if (field?.kind !== "scalar") {
+                continue;
+            }
+            const lifecycle = field.lifecycle.filter((trait) => !COMPUTED_TRAITS.has(trait));
+            if (fieldCompute.create !== undefined) {
+                lifecycle.push("COMPUTED_ON_CREATE");
+            }
+            if (fieldCompute.update !== undefined) {
+                lifecycle.push("COMPUTED_ON_UPDATE");
+            }
+            if (fieldCompute.read !== undefined) {
+                lifecycle.push("COMPUTED_ON_READ");
+            }
+            field.lifecycle = lifecycle;
         }
-        diagnostics.push(diagnostic("COMPILER_UNKNOWN_FIELD", path, `behavior field "${fieldName}" must resolve to a scalar field`));
-        return;
-    }
-    const lifecycle = field.lifecycle.filter((trait) => !COMPUTED_TRAITS.has(trait));
-    if (isActiveBehaviorStage(behavior.create)) {
-        lifecycle.push("COMPUTED_ON_CREATE");
     }
-    if (isActiveBehaviorStage(behavior.update)) {
-        lifecycle.push("COMPUTED_ON_UPDATE");
+}
+function storedScalar(model, resource, field) {
+    const fields = Object.hasOwn(model.resources, resource)
+        ? model.resources[resource]?.fields
+        : undefined;
+    return (fields !== undefined &&
+        Object.hasOwn(fields, field) &&
+        fields[field]?.kind === "scalar");
+}
+function checkFieldCompute(model, resourceName, fieldName, field, compute, path, diagnostics) {
+    if (!isRecord(compute)) {
+        return;
     }
-    if (isActiveBehaviorStage(behavior.read)) {
-        lifecycle.push("COMPUTED_ON_READ");
+    if (field?.kind === "relation") {
+        diagnostics.push(diagnostic("COMPILER_RELATION_FIELD_CONFIG_UNSUPPORTED", path, `relation field "${fieldName}" takes write guards only; compute derives a scalar field's value`));
+        return;
     }
-    field.lifecycle = lifecycle;
-    for (const dependency of readBehaviorDependencies(behavior.read) ?? []) {
-        const dependencyField = resource.fields[dependency];
-        if (dependencyField === undefined || dependencyField.kind !== "scalar") {
-            diagnostics.push(diagnostic("COMPILER_INVALID_BEHAVIOR_DEPENDENCY", `${path}.read.dependsOn`, `read behavior dependency "${dependency}" must reference a scalar field in the same Resource`));
+    for (const dependency of readComputeDependencies(compute.read) ?? []) {
+        if (!storedScalar(model, resourceName, dependency)) {
+            diagnostics.push(diagnostic("COMPILER_INVALID_COMPUTE_DEPENDENCY", `${path}.read.dependsOn`, `compute.read dependency "${dependency}" must name a scalar field the adapter stores on resource "${resourceName}"`));
         }
     }
 }
-function applyBehaviors(projection, scope, config, diagnostics, allowRestrictedMissing = false) {
-    if (config === undefined) {
+function checkResourceTree(model, baseline, scope, tree, definitions, managed, diagnostics) {
+    if (!isRecord(tree)) {
         return;
     }
-    for (const [resourceName, rawResourceConfig] of Object.entries(config)) {
-        if (rawResourceConfig === undefined) {
+    for (const [resourceName, entry] of Object.entries(tree)) {
+        const resourcePath = `${scope}.resources.${resourceName}`;
+        const resource = baseline.resources[resourceName];
+        if (resource === undefined) {
+            diagnostics.push(diagnostic("COMPILER_UNKNOWN_RESOURCE", resourcePath, `resource "${resourceName}" is not present in the canonical adapter model`));
             continue;
         }
-        const resource = projection.resources[resourceName];
-        if (resource === undefined) {
-            if (allowRestrictedMissing) {
-                continue;
+        if ((scope === "client" || scope === "agent") &&
+            managed.has(resourceName)) {
+            diagnostics.push(diagnostic("COMPILER_UNKNOWN_RESOURCE", resourcePath, `resource "${resourceName}" is managed elsewhere (resources.${resourceName}.managedElsewhere), so the ${scope} layer never has it: nothing configured for it here runs`));
+            continue;
+        }
+        if (!isRecord(entry)) {
+            continue;
+        }
+        if (isRecord(entry.operations)) {
+            for (const [family, level] of Object.entries(entry.operations)) {
+                const familyPath = `${resourcePath}.operations.${family}`;
+                const managedReason = managedWriteReason(managed, resourceName, family);
+                if (managedReason !== undefined) {
+                    diagnostics.push(diagnostic("COMPILER_UNAVAILABLE_OPERATION", familyPath, managedReason));
+                    continue;
+                }
+                const variants = resource.operations[family];
+                if (!isRecord(variants)) {
+                    diagnostics.push(diagnostic("COMPILER_UNAVAILABLE_OPERATION", familyPath, `operation family "${family}" is not available for resource "${resourceName}"`));
+                    continue;
+                }
+                if (!isRecord(level)) {
+                    continue;
+                }
+                for (const variant of Object.keys(level)) {
+                    if (variant === "pipelines" || variant === "forceTransaction") {
+                        continue;
+                    }
+                    if (!isOperationVariantAvailable(variants[variant])) {
+                        diagnostics.push(diagnostic("COMPILER_UNAVAILABLE_OPERATION", `${familyPath}.${variant}`, `operation "${family}.${variant}" is not available for resource "${resourceName}"`));
+                    }
+                }
             }
-            diagnostics.push(diagnostic("COMPILER_UNKNOWN_RESOURCE", `${scope}.resources.${resourceName}`, `resource "${resourceName}" is not present in the canonical adapter model`));
+        }
+        if (!isRecord(entry.fields)) {
             continue;
         }
-        for (const [fieldName, behavior] of Object.entries(rawResourceConfig.fields)) {
-            if (behavior === undefined) {
+        for (const [fieldName, fieldEntry] of Object.entries(entry.fields)) {
+            const field = resource.fields[fieldName];
+            if (field === undefined &&
+                definitions[resourceName]?.[fieldName] === undefined) {
+                diagnostics.push(diagnostic("COMPILER_UNKNOWN_FIELD", `${resourcePath}.fields.${fieldName}`, `field "${fieldName}" is neither discovered by the adapter nor defined at the root`));
+                continue;
+            }
+            if (!isRecord(fieldEntry) || !isRecord(fieldEntry.pipelines)) {
                 continue;
             }
-            applyFieldBehavior(resource, fieldName, behavior, `${scope}.resources.${resourceName}.fields.${fieldName}.behaviors`, diagnostics, allowRestrictedMissing);
+            const pipelinesPath = `${resourcePath}.fields.${fieldName}.pipelines`;
+            if (field?.kind === "relation" &&
+                fieldEntry.pipelines.pipes !== undefined) {
+                diagnostics.push(diagnostic("COMPILER_RELATION_FIELD_CONFIG_UNSUPPORTED", `${pipelinesPath}.pipes`, `relation field "${fieldName}" takes write guards only; a field pipe transforms a scalar field's value`));
+            }
+            checkFieldCompute(model, resourceName, fieldName, field, fieldEntry.pipelines.compute, `${pipelinesPath}.compute`, diagnostics);
         }
     }
 }
+function checkReservedResourceNames(model, diagnostics) {
+    for (const resourceName of Object.keys(model.resources)) {
+        if (resourceName.startsWith("$")) {
+            diagnostics.push(diagnostic("COMPILER_RESERVED_RESOURCE_NAME", `adapter.model.resources.${resourceName}`, `resource "${resourceName}" starts with "$", which is reserved for the framework's own names`));
+        }
+    }
+}
+function isAdapterStated(axis) {
+    return axis?.kind === "limit" || axis?.kind === "adapterTokens";
+}
 const SCALAR_CAPABILITY_AXES = {
     select: { kind: "flag" },
     filter: { kind: "tokens" },
+    filterModes: { kind: "adapterTokens", values: FILTER_MODES },
+    pathFilterModes: { kind: "adapterTokens", values: FILTER_MODES },
     order: { kind: "flag" },
     orderNulls: { kind: "flag" },
     create: { kind: "tokens" },
@@ -441,226 +492,366 @@ function capabilityAxisFor(kind, key) {
 function unavailableCapability(path, message, diagnostics) {
     diagnostics.push(diagnostic("COMPILER_UNAVAILABLE_CAPABILITY", path, message));
 }
-function narrowedTokens(baselineTokens, requested, key, path, diagnostics) {
-    const unavailable = requested.filter((entry) => !baselineTokens.includes(entry));
-    if (unavailable.length > 0) {
-        unavailableCapability(path, `capability "${key}" requested unavailable values: ${unavailable.join(", ")}`, diagnostics);
-        return undefined;
-    }
-    return [...requested];
+function otherOverlay(layer) {
+    return layer === "client" ? "application" : "client";
 }
-function narrowedScopes(axis, holdsAtScope, requested, key, path, diagnostics) {
-    if (requested.length === 0) {
-        return { outcome: "denied" };
-    }
-    const unavailable = requested.filter((scope) => !axis.includes(scope) || !holdsAtScope(scope));
-    if (unavailable.length > 0) {
-        unavailableCapability(path, `capability "${key}" requested unavailable scopes: ${unavailable.join(", ")}`, diagnostics);
-        return { outcome: "refused" };
+function widening(walk, code, path, what) {
+    walk.diagnostics.push(diagnostic(code, path, walk.layer === "agent"
+        ? `${what} is hidden by ${walk.parent ?? "client"}, the layer agent extends, and the agent layer only narrows that view; expose it in ${walk.parent ?? "client"}, or extend a layer that exposes it`
+        : `${what} is hidden by the root, and an overlay only narrows the root's view; expose it at the root and hide it in ${otherOverlay(walk.layer)} instead`));
+}
+function exemptsWhole(entry) {
+    return entry === true;
+}
+function exemptsAnything(entry) {
+    return (entry === true ||
+        (Array.isArray(entry) && entry.length > 0) ||
+        isRecord(entry));
+}
+function listedNames(entry, path) {
+    if (!Array.isArray(entry)) {
+        return [];
     }
-    return { outcome: "narrowed", scopes: [...requested] };
+    return entry.flatMap((name, index) => typeof name === "string"
+        ? [[name, `${path}[${index}]`]]
+        : []);
 }
-function applyScopeRestriction(axis, baselineValue, current, key, requested, path, diagnostics) {
-    const baseline = baselineValue;
-    const narrowing = narrowedScopes(axis, (scope) => holdsAt(baseline, scope), requested, key, path, diagnostics);
-    if (narrowing.outcome === "refused") {
-        return;
+function memberOffered(axis, value) {
+    if (value === undefined || value === false) {
+        return false;
     }
-    if (narrowing.outcome === "denied") {
-        delete current[key];
-        return;
+    switch (axis.kind) {
+        case "tokens":
+            return Array.isArray(value);
+        case "scopedTokens":
+            return memberTokens(axis, value) !== undefined;
+        case "scopes":
+            return holdsInAnyScope(value);
+        default:
+            return true;
     }
-    current[key] = narrowing.scopes;
 }
-function applyScopedTokenRestriction(tokenKey, axis, baselineValue, current, key, value, path, diagnostics) {
-    const requestedTokens = Array.isArray(value)
-        ? value
-        : isRecord(value)
-            ? value[tokenKey]
-            : undefined;
-    const requestedScopes = isRecord(value) ? value.scopes : undefined;
-    if ((requestedTokens !== undefined && !Array.isArray(requestedTokens)) ||
-        (requestedScopes !== undefined && !Array.isArray(requestedScopes))) {
-        return false;
+function memberTokens(axis, value) {
+    if (axis.kind === "tokens") {
+        return Array.isArray(value) ? value : undefined;
     }
-    const baselineTokens = tokenKey === "directives"
-        ? advertisedDirectives(baselineValue)
-        : advertisedReducers(baselineValue);
-    if (baselineTokens === undefined) {
-        unavailableCapability(path, `capability "${key}" is not available in the canonical baseline`, diagnostics);
-        return true;
+    if (axis.kind === "scopedTokens") {
+        return axis.tokenKey === "directives"
+            ? advertisedDirectives(value)
+            : advertisedReducers(value);
     }
-    const tokens = requestedTokens === undefined
-        ? [...baselineTokens]
-        : narrowedTokens(baselineTokens, requestedTokens, key, path, diagnostics);
-    if (tokens === undefined) {
-        return true;
+    return undefined;
+}
+function withTokens(axis, parentValue, tokens) {
+    if (axis.kind === "scopedTokens" &&
+        isRecord(parentValue) &&
+        Array.isArray(parentValue.scopes)) {
+        return {
+            [axis.tokenKey]: [...tokens],
+            scopes: [...parentValue.scopes],
+        };
     }
-    if (requestedScopes === undefined) {
-        const baselineScopes = isRecord(baselineValue) && Array.isArray(baselineValue.scopes)
-            ? [...baselineValue.scopes]
-            : undefined;
-        current[key] =
-            baselineScopes === undefined
-                ? tokens
-                : { [tokenKey]: tokens, scopes: baselineScopes };
-        return true;
+    return [...tokens];
+}
+function fieldName(resource, field) {
+    return `"${resource}.${field}"`;
+}
+function exemptableAxis(walk, universeField, capability, label, path) {
+    const axis = capabilityAxisFor(universeField.kind, capability);
+    if (axis === undefined || isAdapterStated(axis)) {
+        const names = Object.entries(universeField.kind === "scalar"
+            ? SCALAR_CAPABILITY_AXES
+            : RELATION_CAPABILITY_AXES)
+            .filter(([, entry]) => !isAdapterStated(entry))
+            .map(([name]) => name);
+        unavailableCapability(path, `"${capability}" is not a capability a ${universeField.kind} field's exemption can name; it takes ${names.join(", ")}`, walk.diagnostics);
+        return undefined;
     }
-    const narrowing = narrowedScopes(axis, (scope) => (tokenKey === "directives"
-        ? advertisedDirectivesAt(baselineValue, scope)
-        : advertisedReducersAt(baselineValue, scope)) !== undefined, requestedScopes, key, path, diagnostics);
-    if (narrowing.outcome === "refused") {
-        return true;
+    const capabilities = universeField.capabilities;
+    if (!memberOffered(axis, capabilities[capability])) {
+        unavailableCapability(path, `capability "${capability}" is not available for field ${label}: the adapter does not offer it`, walk.diagnostics);
+        return undefined;
     }
-    if (narrowing.outcome === "denied") {
-        delete current[key];
-        return true;
+    return axis;
+}
+function offeredTokens(walk, axis, universeValue, listed, capability, label) {
+    const offered = memberTokens(axis, universeValue) ?? [];
+    const tokens = [];
+    for (const [token, tokenPath] of listed) {
+        if (!offered.includes(token)) {
+            unavailableCapability(tokenPath, `capability "${capability}" of field ${label} does not offer "${token}": the adapter does not offer it`, walk.diagnostics);
+            continue;
+        }
+        tokens.push(token);
     }
-    current[key] = { [tokenKey]: tokens, scopes: narrowing.scopes };
-    return true;
+    return tokens;
 }
-function applyCapabilityRestriction(fieldKind, inherited, restoration, current, key, value, path, diagnostics) {
-    if (capabilityAxisFor(fieldKind, key)?.kind === "limit") {
-        unavailableCapability(path, `capability "${key}" is an adapter limit and takes no restriction`, diagnostics);
+function exemptCapability(walk, universeField, parentCapabilities, result, capability, entry, label, path) {
+    if (entry === undefined) {
         return;
     }
-    if (value === false) {
-        delete current[key];
+    const axis = exemptableAxis(walk, universeField, capability, label, path);
+    if (axis === undefined || entry === false) {
         return;
     }
-    const axis = capabilityAxisFor(fieldKind, key);
-    const baselineValue = inherited?.[key] ?? restoration[key];
-    if (axis === undefined ||
-        baselineValue === undefined ||
-        baselineValue === false) {
-        unavailableCapability(path, `capability "${key}" is not available in the canonical baseline`, diagnostics);
+    const isTokenAxis = axis.kind === "tokens" || axis.kind === "scopedTokens";
+    if (entry !== true && !(isTokenAxis && Array.isArray(entry))) {
+        unavailableCapability(path, isTokenAxis
+            ? `capability "${capability}" takes true, false or a list of its tokens`
+            : `capability "${capability}" takes true or false`, walk.diagnostics);
         return;
     }
-    if (value === true) {
-        current[key] = cloneValue(baselineValue);
+    const universeValue = universeField.capabilities[capability];
+    const tokens = entry === true
+        ? undefined
+        : offeredTokens(walk, axis, universeValue, listedNames(entry, path), capability, label);
+    if (tokens !== undefined && tokens.length !== entry.length) {
         return;
     }
-    if (axis.kind === "tokens" &&
-        Array.isArray(value) &&
-        Array.isArray(baselineValue)) {
-        const tokens = narrowedTokens(baselineValue, value, key, path, diagnostics);
-        if (tokens !== undefined) {
-            current[key] = tokens;
+    const parentValue = parentCapabilities[capability];
+    const parentHas = memberOffered(axis, parentValue);
+    if (walk.style === "omit") {
+        if (!parentHas) {
+            return;
+        }
+        if (tokens === undefined) {
+            delete result[capability];
+            return;
         }
+        const kept = (memberTokens(axis, parentValue) ?? []).filter((token) => !tokens.includes(token));
+        result[capability] = withTokens(axis, parentValue, kept);
         return;
     }
-    if (axis.kind === "scopes" && Array.isArray(value)) {
-        applyScopeRestriction(axis.axis, baselineValue, current, key, value, path, diagnostics);
+    if (tokens !== undefined && tokens.length === 0) {
         return;
     }
-    if (axis.kind === "scopedTokens") {
-        if (applyScopedTokenRestriction(axis.tokenKey, axis.axis, baselineValue, current, key, value, path, diagnostics)) {
-            return;
-        }
+    if (!parentHas) {
+        widening(walk, "COMPILER_UNAVAILABLE_CAPABILITY", path, `capability "${capability}" of field ${label}`);
+        return;
     }
-    unavailableCapability(path, `capability "${key}" does not admit this restriction shape`, diagnostics);
-}
-function applyCapabilityRestrictions(inheritedField, restorationField, field, restrictions, path, diagnostics) {
-    const capabilityRestrictions = restrictions.capabilities;
-    if (capabilityRestrictions === undefined) {
+    if (tokens === undefined) {
+        result[capability] = cloneValue(parentValue);
         return;
     }
-    const inherited = inheritedField?.capabilities;
-    const restoration = restorationField.capabilities;
-    const current = field.capabilities;
-    for (const [key, value] of Object.entries(capabilityRestrictions)) {
-        if (value === undefined) {
-            continue;
+    const parentTokens = memberTokens(axis, parentValue) ?? [];
+    const hidden = tokens.filter((token) => !parentTokens.includes(token));
+    if (hidden.length > 0) {
+        widening(walk, "COMPILER_UNAVAILABLE_CAPABILITY", path, `${hidden.map((token) => `"${token}"`).join(", ")} of capability "${capability}" of field ${label}`);
+        return;
+    }
+    result[capability] = withTokens(axis, parentValue, parentTokens.filter((token) => tokens.includes(token)));
+}
+function exemptField(walk, universeField, parentField, entry, label, path) {
+    const parentCapabilities = (parentField?.capabilities ?? {});
+    const result = walk.style === "omit" ? cloneValue(parentCapabilities) : {};
+    if (walk.style === "pick") {
+        for (const [key, value] of Object.entries(parentCapabilities)) {
+            if (isAdapterStated(capabilityAxisFor(universeField.kind, key))) {
+                result[key] = cloneValue(value);
+            }
+        }
+    }
+    if (Array.isArray(entry)) {
+        for (const [capability, capabilityPath] of listedNames(entry, path)) {
+            exemptCapability(walk, universeField, parentCapabilities, result, capability, true, label, capabilityPath);
         }
-        applyCapabilityRestriction(restorationField.kind, inherited, restoration, current, key, value, `${path}.capabilities.${key}`, diagnostics);
     }
+    else if (isRecord(entry)) {
+        for (const [capability, value] of Object.entries(entry)) {
+            exemptCapability(walk, universeField, parentCapabilities, result, capability, value, label, `${path}.${capability}`);
+        }
+    }
+    if (parentField === undefined) {
+        return undefined;
+    }
+    if (walk.style === "pick" &&
+        !Object.keys(result).some((key) => !isAdapterStated(capabilityAxisFor(universeField.kind, key)))) {
+        return undefined;
+    }
+    return { ...cloneValue(parentField), capabilities: result };
 }
-function applyOperationRestrictions(restoration, current, restrictions, path, diagnostics) {
-    if (restrictions === undefined) {
-        return;
+function exemptFields(walk, resourceName, universe, parent, entries, path) {
+    const named = isRecord(entries) ? entries : {};
+    for (const fieldName of Object.keys(named)) {
+        if (universe.fields[fieldName] === undefined) {
+            walk.diagnostics.push(diagnostic("COMPILER_UNKNOWN_FIELD", `${path}.${fieldName}`, `field "${fieldName}" is neither discovered by the adapter nor defined at the root`));
+        }
     }
-    for (const [family, variants] of Object.entries(restrictions)) {
-        if (!isRecord(variants)) {
+    const result = {};
+    for (const [name, entry] of Object.entries(named)) {
+        const universeField = universe.fields[name];
+        if (universeField === undefined) {
             continue;
         }
-        const baselineFamily = restoration[family];
-        let currentFamily = current[family];
-        if (!isRecord(currentFamily)) {
-            currentFamily = {};
-            current[family] = currentFamily;
+        const parentField = parent.fields[name];
+        const label = fieldName(resourceName, name);
+        const fieldPath = `${path}.${name}`;
+        if (walk.style === "pick" &&
+            exemptsAnything(entry) &&
+            parentField === undefined) {
+            widening(walk, "COMPILER_UNAVAILABLE_CAPABILITY", fieldPath, `field ${label}`);
+            continue;
         }
-        for (const [variant, enabled] of Object.entries(variants)) {
-            if (typeof enabled !== "boolean") {
-                continue;
-            }
-            if (!enabled) {
-                delete currentFamily[variant];
-                continue;
+        if (exemptsWhole(entry) || !exemptsAnything(entry)) {
+            continue;
+        }
+        const exempted = exemptField(walk, universeField, parentField, entry, label, fieldPath);
+        if (exempted !== undefined) {
+            result[name] = exempted;
+        }
+    }
+    for (const [name, parentField] of Object.entries(parent.fields)) {
+        if (Object.hasOwn(result, name)) {
+            continue;
+        }
+        const entry = Object.hasOwn(named, name) ? named[name] : undefined;
+        if (walk.style === "omit" ? !exemptsWhole(entry) : exemptsWhole(entry)) {
+            result[name] = cloneValue(parentField);
+        }
+    }
+    return result;
+}
+function exemptVariants(walk, resourceName, family, universeFamily, parentFamily, entry, path) {
+    if (entry === true) {
+        return "all";
+    }
+    const named = Array.isArray(entry)
+        ? [...listedNames(entry, path)]
+        : isRecord(entry)
+            ? Object.keys(entry).map((variant) => [variant, `${path}.${variant}`])
+            : [];
+    const variants = [];
+    for (const [variant, variantPath] of named) {
+        if (!isOperationVariantAvailable(universeFamily[variant])) {
+            walk.diagnostics.push(diagnostic("COMPILER_UNAVAILABLE_OPERATION", variantPath, `operation "${family}.${variant}" is not available for resource "${resourceName}"`));
+            continue;
+        }
+        if (isRecord(entry)) {
+            const value = entry[variant];
+            if (value !== true && value !== false) {
+                walk.diagnostics.push(diagnostic("COMPILER_UNAVAILABLE_OPERATION", variantPath, "an operation variant takes true or false"));
             }
-            const baselineAvailability = isRecord(baselineFamily)
-                ? baselineFamily[variant]
-                : undefined;
-            if (!isOperationVariantAvailable(baselineAvailability)) {
-                diagnostics.push(diagnostic("COMPILER_UNAVAILABLE_OPERATION", `${path}.${family}.${variant}`, `operation "${family}.${variant}" is not available in the canonical baseline`));
+            if (value !== true) {
                 continue;
             }
-            const target = currentFamily;
-            if (!isOperationVariantAvailable(target[variant])) {
-                target[variant] = cloneValue(baselineAvailability);
-            }
         }
+        if (walk.style === "pick" &&
+            !isOperationVariantAvailable(parentFamily?.[variant])) {
+            widening(walk, "COMPILER_UNAVAILABLE_OPERATION", variantPath, `operation "${resourceName}.${family}.${variant}"`);
+            continue;
+        }
+        variants.push(variant);
     }
+    return variants;
 }
-function applyRestrictions(baselines, projection, scope, config, diagnostics) {
-    if (config === undefined) {
-        return;
-    }
-    for (const [resourceName, rawRestrictions] of Object.entries(config)) {
-        if (rawRestrictions === undefined) {
+function exemptOperations(walk, resourceName, universe, parent, entry, path) {
+    const omit = walk.style === "omit";
+    if (entry === true) {
+        return omit ? {} : cloneValue(parent);
+    }
+    const families = Array.isArray(entry)
+        ? listedNames(entry, path).map(([family, familyPath]) => [family, familyPath, true])
+        : isRecord(entry)
+            ? Object.entries(entry).map(([family, value]) => [family, `${path}.${family}`, value])
+            : [];
+    const result = omit ? cloneValue(parent) : {};
+    for (const [family, familyPath, value] of families) {
+        const universeFamily = universe[family];
+        if (!isRecord(universeFamily)) {
+            walk.diagnostics.push(diagnostic("COMPILER_UNAVAILABLE_OPERATION", familyPath, `operation family "${family}" is not available for resource "${resourceName}"`));
             continue;
         }
-        const restrictions = rawRestrictions;
-        const baselineResource = baselines.restoration.resources[resourceName];
-        if (baselineResource === undefined) {
-            diagnostics.push(diagnostic("COMPILER_UNKNOWN_RESOURCE", `${scope}.resources.${resourceName}`, `resource "${resourceName}" is not present in the canonical compilation baseline`));
+        if (value === false || value === undefined) {
             continue;
         }
-        if (restrictions.hidden === true) {
-            delete projection.resources[resourceName];
+        if (value !== true && !Array.isArray(value) && !isRecord(value)) {
+            walk.diagnostics.push(diagnostic("COMPILER_UNAVAILABLE_OPERATION", familyPath, "an operation family takes true, false, a list of its variants or an object of them"));
             continue;
         }
-        if (restrictions.hidden === false &&
-            projection.resources[resourceName] === undefined) {
-            projection.resources[resourceName] = cloneValue(baselineResource);
+        const parentFamily = isRecord(parent[family])
+            ? parent[family]
+            : undefined;
+        if (value === true && !omit && parentFamily === undefined) {
+            widening(walk, "COMPILER_UNAVAILABLE_OPERATION", familyPath, `operation family "${resourceName}.${family}"`);
+            continue;
         }
-        const resource = projection.resources[resourceName];
-        if (resource === undefined) {
+        const variants = exemptVariants(walk, resourceName, family, universeFamily, parentFamily, value, familyPath);
+        if (parentFamily === undefined) {
             continue;
         }
-        for (const [fieldName, rawFieldRestrictions] of Object.entries(restrictions.fields ?? {})) {
-            const fieldRestrictions = rawFieldRestrictions;
-            const baselineField = baselineResource.fields[fieldName];
-            const path = `${scope}.resources.${resourceName}.fields.${fieldName}`;
-            if (baselineField === undefined) {
-                diagnostics.push(diagnostic("COMPILER_UNKNOWN_FIELD", path, `field "${fieldName}" is not present in the canonical compilation baseline`));
-                continue;
-            }
-            if (fieldRestrictions.hidden === true) {
-                delete resource.fields[fieldName];
-                continue;
-            }
-            if (fieldRestrictions.hidden === false &&
-                resource.fields[fieldName] === undefined) {
-                resource.fields[fieldName] = cloneValue(baselineField);
+        const named = variants === "all" ? Object.keys(parentFamily) : variants;
+        if (omit) {
+            const target = result[family];
+            for (const variant of named) {
+                if (target !== undefined) {
+                    delete target[variant];
+                }
             }
-            const field = resource.fields[fieldName];
-            if (field === undefined) {
-                continue;
+            continue;
+        }
+        const target = (isRecord(result[family]) ? result[family] : {});
+        for (const variant of named) {
+            if (isOperationVariantAvailable(parentFamily[variant])) {
+                target[variant] = cloneValue(parentFamily[variant]);
             }
-            applyCapabilityRestrictions(baselines.narrowing.resources[resourceName]?.fields[fieldName], baselineField, field, fieldRestrictions, path, diagnostics);
         }
-        applyOperationRestrictions(baselineResource.operations, resource.operations, restrictions.operations, `${scope}.resources.${resourceName}.operations`, diagnostics);
+        result[family] = target;
     }
+    pruneEmptyOperationFamilies(result);
+    return result;
+}
+function exemptResource(walk, resourceName, universe, parent, entry, path) {
+    const resource = {
+        fields: exemptFields(walk, resourceName, universe, parent, entry.fields, `${path}.fields`),
+        identifiers: [],
+        operations: exemptOperations(walk, resourceName, universe.operations, parent.operations, entry.operations, `${path}.operations`),
+    };
+    reconcileIdentifiers(walk, resource, parent, path);
+    return resource;
+}
+function projectExposure(walk, universe, parent, exemptions) {
+    const path = `${walk.layer}.exemptions.resources`;
+    const entries = isRecord(exemptions) && isRecord(exemptions.resources)
+        ? exemptions.resources
+        : {};
+    const resources = {};
+    for (const [resourceName, entry] of Object.entries(entries)) {
+        const resourcePath = `${path}.${resourceName}`;
+        const universeResource = universe.resources[resourceName];
+        if (universeResource === undefined) {
+            walk.diagnostics.push(diagnostic("COMPILER_UNKNOWN_RESOURCE", resourcePath, `resource "${resourceName}" is not present in the canonical adapter model`));
+            continue;
+        }
+        const parentResource = parent.resources[resourceName];
+        if (walk.style === "pick" &&
+            exemptsAnything(entry) &&
+            parentResource === undefined) {
+            widening(walk, "COMPILER_UNAVAILABLE_CAPABILITY", resourcePath, `resource "${resourceName}"`);
+            continue;
+        }
+        if (!isRecord(entry)) {
+            continue;
+        }
+        const exempted = exemptResource(walk, resourceName, universeResource, parentResource ?? { fields: {}, identifiers: [], operations: {} }, entry, resourcePath);
+        if (parentResource !== undefined &&
+            (walk.style === "omit" ||
+                Object.keys(exempted.fields).length > 0 ||
+                Object.keys(exempted.operations).length > 0)) {
+            resources[resourceName] = exempted;
+        }
+    }
+    for (const [resourceName, parentResource] of Object.entries(parent.resources)) {
+        if (Object.hasOwn(resources, resourceName)) {
+            continue;
+        }
+        const entry = Object.hasOwn(entries, resourceName)
+            ? entries[resourceName]
+            : undefined;
+        if (walk.style === "omit" ? !exemptsWhole(entry) : exemptsWhole(entry)) {
+            resources[resourceName] = cloneValue(parentResource);
+        }
+    }
+    return { ...cloneValue({ ...parent, resources: {} }), resources };
 }
 function pruneEmptyOperationFamilies(operations) {
     for (const [family, variants] of Object.entries(operations)) {
@@ -669,45 +860,28 @@ function pruneEmptyOperationFamilies(operations) {
         }
     }
 }
-function operationIsExplicitlyDisabled(restrictions, family, variant) {
-    if (restrictions === undefined || !isRecord(restrictions.operations)) {
-        return false;
-    }
-    const familyRestrictions = restrictions.operations[family];
-    return isRecord(familyRestrictions) && familyRestrictions[variant] === false;
+function identifierLabel(identifier) {
+    return identifier.map((name) => `\`${name}\``).join(" and ");
 }
-function reconcileIdentifiers(resource, baseline, restrictions) {
-    resource.identifiers = baseline.identifiers.filter((identifier) => identifier.every((fieldName) => {
-        const field = resource.fields[fieldName];
-        return field !== undefined && field.kind === "scalar";
-    }));
+function reconcileIdentifiers(walk, resource, parent, path) {
+    resource.identifiers = parent.identifiers
+        .filter((identifier) => identifier.every((name) => resource.fields[name]?.kind === "scalar"))
+        .map((identifier) => [...identifier]);
+    const first = parent.identifiers[0];
+    if (resource.identifiers.length > 0 || first === undefined) {
+        return;
+    }
     for (const [family, variant] of UNIQUE_VARIANTS) {
         const currentFamily = resource.operations[family];
-        if (resource.identifiers.length === 0) {
-            if (isRecord(currentFamily)) {
-                delete currentFamily[variant];
-            }
-            continue;
-        }
-        if (operationIsExplicitlyDisabled(restrictions, family, variant)) {
-            if (isRecord(currentFamily)) {
-                delete currentFamily[variant];
-            }
+        if (!isRecord(currentFamily) ||
+            !isOperationVariantAvailable(currentFamily[variant])) {
             continue;
         }
-        const baselineFamily = baseline.operations[family];
-        const baselineAvailability = isRecord(baselineFamily)
-            ? baselineFamily[variant]
-            : undefined;
-        if (isOperationVariantAvailable(baselineAvailability)) {
-            const targetFamily = isRecord(currentFamily) ? currentFamily : {};
-            if (!isOperationVariantAvailable(targetFamily[variant])) {
-                targetFamily[variant] = cloneValue(baselineAvailability);
-            }
-            resource.operations[family] = targetFamily;
-        }
+        const variantPath = `${path}.operations.${family}.${variant}`;
+        walk.diagnostics.push(diagnostic("COMPILER_MISSING_IDENTIFIER", variantPath, walk.style === "pick"
+            ? `${variantPath} needs an identifier field; pick ${identifierLabel(first)} (or another complete identifier) too`
+            : `${variantPath} needs an identifier field, and the exemptions hide every complete identifier; keep ${identifierLabel(first)} (or another complete identifier) exposed, or exempt the operation too`));
     }
-    pruneEmptyOperationFamilies(resource.operations);
 }
 function validateScalarReference(projection, field, path, diagnostics) {
     const type = field.type;
@@ -757,7 +931,7 @@ function validateFieldLifecycle(field, path, diagnostics) {
     if (lifecycle.includes("VIRTUAL") &&
         holdsInAnyScope(capabilities.select) &&
         !lifecycle.includes("COMPUTED_ON_READ")) {
-        diagnostics.push(diagnostic("COMPILER_MISSING_READ_BEHAVIOR", path, "selectable VIRTUAL field requires an effective read behavior"));
+        diagnostics.push(diagnostic("COMPILER_MISSING_READ_COMPUTE", path, "selectable VIRTUAL field requires a compute.read stage (pipelines.compute.read)"));
     }
 }
 function isTokenList(value) {
@@ -778,6 +952,11 @@ function representationFault(axis, value) {
             return typeof value === "string" && axis.values.includes(value)
                 ? undefined
                 : `one of ${axis.values.join(", ")} is expected`;
+        case "adapterTokens":
+            return isTokenList(value) &&
+                value.every((token) => axis.values.includes(token))
+                ? undefined
+                : `a list of ${axis.values.join(", ")} is expected`;
         case "flag":
             return typeof value === "boolean" ? undefined : "a boolean is expected";
         case "tokens":
@@ -815,12 +994,8 @@ function validateCapabilityRepresentation(field, path, diagnostics) {
         }
     }
 }
-function validateProjection(projection, restoration, scope, restrictions, diagnostics) {
+function validateProjection(projection, scope, diagnostics) {
     for (const [resourceName, resource] of Object.entries(projection.resources)) {
-        const baselineResource = restoration.resources[resourceName];
-        if (baselineResource !== undefined) {
-            reconcileIdentifiers(resource, baselineResource, restrictions?.[resourceName]);
-        }
         for (const [fieldName, field] of Object.entries(resource.fields)) {
             const fieldPath = `${scope}.resources.${resourceName}.fields.${fieldName}`;
             validateCapabilityRepresentation(field, fieldPath, diagnostics);
@@ -841,49 +1016,114 @@ function resolveLimits(scope) {
     return { ...DEFAULT_CONTRACT_LIMITS, ...(scope.limits ?? {}) };
 }
 function resolveTransactions(model, scopeName, scope, diagnostics) {
-    const requested = scope.transactions ?? model.transactions;
+    const requested = scope.transactionsStyle ?? model.transactions;
     if (requested === "interactive" && model.transactions === "none") {
-        diagnostics.push(diagnostic("COMPILER_UNAVAILABLE_CAPABILITY", `${scopeName}.transactions`, 'transaction capability "interactive" is not available in the canonical adapter model'));
+        diagnostics.push(diagnostic("COMPILER_UNAVAILABLE_CAPABILITY", `${scopeName}.transactionsStyle`, 'transaction capability "interactive" is not available in the canonical adapter model'));
     }
     return requested;
 }
 function semanticObject(contract) {
     return JSON.parse(canonicalizeContract(contract));
 }
-function projectCore(model, scope, diagnostics) {
+function exposureStyle(layer) {
+    return layer.exposed === false ? "pick" : "omit";
+}
+function projectCore(model, config, diagnostics) {
+    const scope = config.root;
+    const managed = managedElsewhereOf(config.trees.root);
     const providerBaseline = createBaseline(model);
     const baseline = cloneValue(providerBaseline);
     baseline.limits = resolveLimits(scope);
     baseline.transactions = resolveTransactions(model, "root", scope, diagnostics);
-    applyFieldConfig(model, baseline, "root", scope.fields, diagnostics);
-    applyBehaviors(baseline, "root", scope.behaviors, diagnostics);
-    const projection = cloneValue(baseline);
-    applyRestrictions({ narrowing: baseline, restoration: baseline }, projection, "root", scope.restrictions, diagnostics);
-    validateProjection(projection, baseline, "root", scope.restrictions, diagnostics);
-    return { baseline, projection };
-}
-function projectDerivedScope(model, scopeName, core, scope, diagnostics) {
+    checkResourceTree(model, baseline, "root", config.trees.root, config.definitions, managed, diagnostics);
+    applyFieldDefinitions(model, baseline, config.definitions, diagnostics);
+    const unwithheld = managed.size === 0 ? baseline : cloneValue(baseline);
+    withholdManagedWrites(baseline, managed);
+    markGovernedFields(baseline, config.policy?.governed);
+    applyCompute(baseline, scope.compute);
+    checkLayerValidators(baseline.resources, "root", config.trees.root, diagnostics);
+    const validators = compileValidatorTable(baseline.resources, scope.pipelines);
+    const projection = projectExposure({ layer: "root", style: exposureStyle(scope), diagnostics }, baseline, baseline, scope.exemptions);
+    qualifyFilterModes(projection);
+    pruneHiddenPairings(projection, "shown");
+    projectCreateRequirements(model, projection.resources);
+    const rootChecked = diagnostics.length;
+    checkHiddenRequirements(model, "root", baseline.resources, unwithheld.resources, projection.resources, diagnostics);
+    explainManagedRefusals(diagnostics, rootChecked, "root", baseline, managed);
+    applyValidators(projection.resources, validators);
+    validateProjection(projection, "root", diagnostics);
+    return { baseline, projection, validators };
+}
+function markGovernedFields(baseline, governed) {
+    if (governed === undefined) {
+        return;
+    }
+    for (const [resourceName, names] of Object.entries(governed)) {
+        const resource = Object.hasOwn(baseline.resources, resourceName)
+            ? baseline.resources[resourceName]
+            : undefined;
+        if (resource === undefined) {
+            continue;
+        }
+        for (const name of names) {
+            const field = Object.hasOwn(resource.fields, name)
+                ? resource.fields[name]
+                : undefined;
+            if (field !== undefined) {
+                field.governed = true;
+            }
+        }
+    }
+}
+function projectDerivedScope(model, scopeName, core, parentView, config, diagnostics) {
+    const scope = config[scopeName];
+    const managed = managedElsewhereOf(config.trees.root);
     const baseline = cloneValue(core.baseline);
     baseline.limits = resolveLimits(scope);
-    baseline.transactions = resolveTransactions(model, scopeName, scope, diagnostics);
-    applyFieldConfig(model, baseline, scopeName, scope.fields, diagnostics);
-    applyBehaviors(baseline, scopeName, scope.behaviors, diagnostics);
-    const projection = cloneValue(core.projection);
-    projection.limits = resolveLimits(scope);
-    projection.transactions = baseline.transactions;
-    applyFieldConfig(model, projection, scopeName, scope.fields, diagnostics, true);
-    applyBehaviors(projection, scopeName, scope.behaviors, diagnostics, true);
-    applyRestrictions({ narrowing: cloneValue(projection), restoration: baseline }, projection, scopeName, scope.restrictions, diagnostics);
-    validateProjection(projection, baseline, scopeName, scope.restrictions, diagnostics);
-    return projection;
-}
-function bindShapedFields(contract, fields) {
+    baseline.transactions = resolveTransactions(model, scopeName, scope, scopeName === "agent" &&
+        scope.transactionsStyle === config[config.agent.parent].transactionsStyle
+        ? []
+        : diagnostics);
+    checkResourceTree(model, baseline, scopeName, config.trees[scopeName], config.definitions, managed, diagnostics);
+    applyCompute(baseline, scope.compute);
+    checkLayerValidators(baseline.resources, scopeName, config.trees[scopeName], diagnostics);
+    const validators = compileValidatorTable(baseline.resources, scope.pipelines);
+    const parent = cloneValue(parentView);
+    const unhidden = (scopeName === "client" || scopeName === "agent") && managed.size > 0
+        ? cloneValue(parent)
+        : parent;
+    if (unhidden !== parent) {
+        hideManagedElsewhere(parent, managed);
+    }
+    parent.limits = resolveLimits(scope);
+    parent.transactions = baseline.transactions;
+    applyCompute(parent, scope.compute);
+    const projection = projectExposure({
+        layer: scopeName,
+        style: exposureStyle(scope),
+        diagnostics,
+        ...(scopeName === "agent" ? { parent: config.agent.parent } : {}),
+    }, baseline, parent, scope.exemptions);
+    qualifyFilterModes(projection);
+    pruneHiddenPairings(projection, "none");
+    if (unhidden !== parent) {
+        pruneManagedEnums(projection, unhidden, managed);
+    }
+    projectCreateRequirements(model, projection.resources);
+    const layerChecked = diagnostics.length;
+    checkHiddenRequirements(model, scopeName, baseline.resources, unhidden.resources, projection.resources, diagnostics);
+    explainManagedRefusals(diagnostics, layerChecked, scopeName, baseline, managed);
+    applyValidators(projection.resources, validators);
+    validateProjection(projection, scopeName, diagnostics);
+    return { projection, validators };
+}
+function bindShapedFields(contract, definitions) {
     for (const [resourceName, resource] of Object.entries(contract.resources)) {
         for (const [fieldName, field] of Object.entries(resource.fields)) {
             if (field.kind !== "scalar" || field.json === undefined) {
                 continue;
             }
-            const shape = jsonShapeOf(fields?.[resourceName]?.[fieldName]?.json);
+            const shape = jsonShapeOf(definitions[resourceName]?.[fieldName]?.json);
             if (shape === undefined) {
                 throw new Error(`the Contract compiler found no shape for shaped field "${resourceName}.${fieldName}"`);
             }
@@ -894,37 +1134,107 @@ function bindShapedFields(contract, fields) {
 export async function compileContracts(model, config) {
     const compilerConfig = config;
     const diagnostics = [];
-    const coreCompilation = projectCore(model, compilerConfig.root, diagnostics);
-    const applicationProjection = projectDerivedScope(model, "application", coreCompilation, compilerConfig.application, diagnostics);
-    const clientProjection = projectDerivedScope(model, "client", coreCompilation, compilerConfig.client, diagnostics);
+    checkReservedResourceNames(model, diagnostics);
+    checkCreateRequirements(model, diagnostics);
+    const coreCompilation = projectCore(model, compilerConfig, diagnostics);
+    const applicationProjection = projectDerivedScope(model, "application", coreCompilation, coreCompilation.projection, compilerConfig, diagnostics);
+    const clientProjection = projectDerivedScope(model, "client", coreCompilation, coreCompilation.projection, compilerConfig, diagnostics);
+    const agentParent = compilerConfig.agent.parent;
+    const agentProjection = projectDerivedScope(model, "agent", coreCompilation, agentParent === "root"
+        ? coreCompilation.projection
+        : agentParent === "application"
+            ? applicationProjection.projection
+            : clientProjection.projection, compilerConfig, diagnostics);
+    markCoreResources(coreCompilation.projection, model, managedElsewhereOf(compilerConfig.trees.root));
     if (diagnostics.length > 0) {
         return { ok: false, diagnostics };
     }
     const core = semanticObject(coreCompilation.projection);
-    const application = semanticObject(applicationProjection);
-    const clientHashInput = semanticObject({
-        ...clientProjection,
-        protocol: { version: AVENTARA_PROTOCOL_VERSION },
+    const application = semanticObject(applicationProjection.projection);
+    const client = await identifiedContract(compilerConfig.access === undefined
+        ? clientProjection.projection
+        : { ...clientProjection.projection, access: compilerConfig.access });
+    const agent = await identifiedContract(agentProjection.projection);
+    for (const [layer, contract] of [
+        ["client", client],
+        ["agent", agent],
+    ]) {
+        const structure = validateClientContractStructure(contract);
+        if (!structure.valid) {
+            return {
+                ok: false,
+                diagnostics: [
+                    diagnostic("COMPILER_INVALID_CLIENT_CONTRACT", structure.path, layer === "client"
+                        ? structure.message
+                        : `Agent Contract: ${structure.message}`),
+                ],
+            };
+        }
+    }
+    const contracts = { core, application, client, agent };
+    bindRuntimePieces(contracts, compilerConfig.definitions, {
+        core: coreCompilation.validators,
+        application: applicationProjection.validators,
+        client: clientProjection.validators,
+        agent: agentProjection.validators,
     });
-    const hash = await computeClientContractHash(clientHashInput);
-    const client = semanticObject({
-        ...clientHashInput,
-        protocol: { version: AVENTARA_PROTOCOL_VERSION, hash },
+    return { ok: true, contracts };
+}
+function bindRuntimePieces(contracts, definitions, validators) {
+    for (const origin of ["core", "application", "client", "agent"]) {
+        bindShapedFields(contracts[origin], definitions);
+        bindFieldValidators(contracts[origin], validators[origin]);
+    }
+}
+export function bindPrebuiltContracts(model, config, contracts) {
+    const compilerConfig = config;
+    const fields = validatedFieldsView(model, compilerConfig.definitions);
+    bindRuntimePieces(contracts, compilerConfig.definitions, {
+        core: compileValidatorTable(fields, compilerConfig.root.pipelines),
+        application: compileValidatorTable(fields, compilerConfig.application.pipelines),
+        client: compileValidatorTable(fields, compilerConfig.client.pipelines),
+        agent: compileValidatorTable(fields, compilerConfig.agent.pipelines),
     });
-    const structure = validateClientContractStructure(client);
-    if (!structure.valid) {
-        return {
-            ok: false,
-            diagnostics: [
-                diagnostic("COMPILER_INVALID_CLIENT_CONTRACT", structure.path, structure.message),
-            ],
-        };
+}
+function validatedFieldsView(model, definitions) {
+    const resources = { ...model.resources };
+    for (const [resourceName, resourceDefinitions] of Object.entries(definitions)) {
+        const resource = Object.hasOwn(model.resources, resourceName)
+            ? model.resources[resourceName]
+            : undefined;
+        if (resource === undefined) {
+            continue;
+        }
+        let added;
+        for (const [fieldName, definition] of Object.entries(resourceDefinitions)) {
+            if (Object.hasOwn(resource.fields, fieldName)) {
+                continue;
+            }
+            added ??= {};
+            added[fieldName] = {
+                kind: "scalar",
+                type: definition.type,
+                list: definition.list,
+            };
+        }
+        if (added !== undefined) {
+            resources[resourceName] = { fields: { ...resource.fields, ...added } };
+        }
     }
-    bindShapedFields(core, compilerConfig.root.fields);
-    bindShapedFields(application, compilerConfig.application.fields);
-    bindShapedFields(client, compilerConfig.client.fields);
-    return {
-        ok: true,
-        contracts: { core, application, client },
-    };
+    return resources;
+}
+async function identifiedContract(projection) {
+    const members = canonicalizeContractMembers({
+        ...projection,
+        protocol: { version: AVENTARA_PROTOCOL_VERSION },
+    });
+    const hash = await hashCanonicalContractText(joinCanonicalContractMembers(members));
+    const protocol = canonicalizeJson({
+        version: AVENTARA_PROTOCOL_VERSION,
+        hash,
+    });
+    const text = joinCanonicalContractMembers(members.map((member) => member.key === "protocol" ? { key: "protocol", text: protocol } : member));
+    const contract = JSON.parse(text);
+    recordCanonicalContractText(contract, text);
+    return contract;
 }