@aventara/core 1.0.0-rc.1 → 1.0.0-rc.10

package/dist/runtime/operation-runtime.d.ts

@@ -7,14 +7,15 @@ import type { ResolvedFrameworkConfig } from "../config/config.resolver.js";
 import type { AvRequestOrigin, RemoteRequestOrigin } from "../config/config-layer.js";
 import type { AvContract } from "../contracts/contract.js";
 import type { OperationValidationOptions, SemanticOperationArguments } from "../operations/operation-validator.js";
-import type { FrameworkTransactionRequest } from "../transactions/transaction-request.js";
+import { type PolicyCaller } from "../policy/policy-request.js";
+import type { AvTransactionRequest } from "../transactions/transaction-request.js";
 import { type ArgumentsSource } from "./caller-data.door.js";
 import { type ContextExecutor, type ExecutorScope } from "./context-executor.runtime.js";
 import { type RecordWriteFacts } from "./create-requirement.js";
 import { type DiagnosticsReporter } from "./diagnostics-reporter.js";
 import { type OuterFailureLayer } from "./error-boundary.js";
 import { type FieldStagePlan } from "./field-stage.plan.js";
-import type { ClientProtocolIdentity, FrameworkOperationRequest, StatefulOperationRequest } from "./operation-request.js";
+import type { AvOperationRequest, AvRequestProtocol, StatefulOperationRequest } from "./operation-request.js";
 import type { AvOperationFailureResponse, AvOperationResponse } from "./operation-response.js";
 import type { AvState } from "./request-state.js";
 import { type NormalizationWrite } from "./scalar-runtime.js";
@@ -45,7 +46,7 @@ export type OperationPipelineDependencies<M extends AvAdapterModel> = Omit<Opera
  * Where one operation's Adapter call runs: standalone, through the Adapter, or
  * inside an open transaction, through its executor.
  */
-export type OperationBinding<M extends AvAdapterModel> = {
+type OperationBinding<M extends AvAdapterModel> = {
     readonly kind: "standalone";
     readonly executor: AvAdapterOperationExecutor<M>;
 } | {
@@ -79,13 +80,15 @@ export declare function createPipelineDependencies<M extends AvAdapterModel>(dep
  * request's arguments are the caller's own objects, copied at the door, or data
  * no caller holds (see {@link ArgumentsSource}).
  */
-export type FrameworkOperationExecutor = (request: FrameworkOperationRequest, report: DiagnosticsReporter, source: ArgumentsSource) => Promise<AvOperationResponse>;
+export type FrameworkOperationExecutor = (request: AvOperationRequest, report: DiagnosticsReporter, source: ArgumentsSource, 
+/** The principal an application call runs as (`{ as }`), when it names one. */
+caller?: PolicyCaller) => Promise<AvOperationResponse>;
 /** Selects the Contract of the request's origin. */
-export declare function activeContract(contracts: AvContracts, request: FrameworkOperationRequest | FrameworkTransactionRequest): AvContract;
+export declare function activeContract(contracts: AvContracts, request: AvOperationRequest | AvTransactionRequest): AvContract;
 /** Creates the transport-independent operation executor owned by core. */
 export declare function createOperationRuntime<M extends AvAdapterModel>(dependencies: OperationRuntimeDependencies<M>, pipelineDependencies: OperationPipelineDependencies<M>): FrameworkOperationExecutor;
 /** Validates the request-level protocol identity. */
-export declare function validateProtocolIdentity(contracts: AvContracts, request: FrameworkOperationRequest | FrameworkTransactionRequest): AvOperationFailureResponse | undefined;
+export declare function validateProtocolIdentity(contracts: AvContracts, request: AvOperationRequest | AvTransactionRequest): AvOperationFailureResponse | undefined;
 /**
  * The stale-client check on one remote protocol identity: the protocol version first
  * (`A2006`), then the hash of the origin's Contract (`A2005`): the ClientContract's
@@ -94,8 +97,8 @@ export declare function validateProtocolIdentity(contracts: AvContracts, request
  * (`@aventara/core/protocol`) call it too, so a stale client hears the same envelope
  * whichever layer answers.
  */
-export declare function protocolIdentityFailure(contracts: AvContracts, protocol: ClientProtocolIdentity, origin: RemoteRequestOrigin): AvOperationFailureResponse | undefined;
-export type ValidatedOperationArguments = {
+export declare function protocolIdentityFailure(contracts: AvContracts, protocol: AvRequestProtocol, origin: RemoteRequestOrigin): AvOperationFailureResponse | undefined;
+type ValidatedOperationArguments = {
     readonly ok: true;
     readonly arguments: SemanticOperationArguments;
 } | {
@@ -103,8 +106,14 @@ export type ValidatedOperationArguments = {
     readonly response: AvOperationFailureResponse;
 };
 /** Validates one operation's arguments through the Framework Validation Layer. */
-export declare function validateOperationRequest(contract: AvContract, request: FrameworkOperationRequest, options?: OperationValidationOptions, write?: NormalizationWrite): ValidatedOperationArguments;
-/** Every sent field's path: a single call's arguments hold no `$ref`. */
+export declare function validateOperationRequest(contract: AvContract, request: AvOperationRequest, options?: OperationValidationOptions, write?: NormalizationWrite): ValidatedOperationArguments;
+/** The subject a refused output of an operation's pipes is reported under at a plan step. */
+export declare const STEP_PIPES = "Pipes";
+/**
+ * Every sent field's path. A `$ref` is an object of `$`-keys, which no field
+ * pipe or validator takes, so a plan step's literal values before BEGIN are
+ * every field too, wherever a pipe left a reference or a literal.
+ */
 export declare const EVERY_FIELD: () => boolean;
 /**
  * What admission leaves: the deep-frozen arguments every later stage reads, and
@@ -120,23 +129,31 @@ export type AdmittedOperation = {
     readonly response: AvOperationFailureResponse;
 };
 /** Which sent values an operation's field stages and validators take, and how its pipe output is checked. */
-export type AdmissionScope = {
+type AdmissionScope = {
     /**
      * The sent values the field pipes and validators take: every one for a single
-     * call, a plan step's literal values before BEGIN, its resolved `$ref` values
-     * at the step.
+     * call and for a plan step before BEGIN (an unresolved `$ref` is an object of
+     * `$`-keys, which they never take), its resolved `$ref` values at the step.
      */
     readonly select: (path: readonly (string | number)[]) => boolean;
     /** Before BEGIN a plan step's `$ref` slots are unresolved: these admit them. */
     readonly validation?: OperationValidationOptions;
+    /**
+     * A plan step or a forced call, admitted before BEGIN: the validators judge
+     * there the sent values no later stage can change (a field with no write
+     * compute stage of its record's phase), so a caller's refusal opens no
+     * transaction. Everything is judged again after write compute.
+     */
+    readonly beforeBegin?: boolean;
 };
 /**
- * Runs an operation's admission — its guards, pipes and validators — and answers
- * the deep-frozen arguments the rest of the operation reads, or the refusal.
+ * Runs an operation's admission — its guards and pipes, and before BEGIN the
+ * validators of the values nothing after it changes — and answers the
+ * deep-frozen arguments the rest of the operation reads, or the refusal.
  */
 export declare function admitOperation<M extends AvAdapterModel>(dependencies: OperationPipelineDependencies<M>, request: StatefulOperationRequest, contract: AvContract, args: unknown, argumentsPath: readonly (string | number)[], report: DiagnosticsReporter, scope: ExecutorScope<M>, admission?: AdmissionScope): Promise<AdmittedOperation>;
 /** How a plan step's arguments were changed between their admission and the step. */
-export type StepChanges = {
+type StepChanges = {
     /** The sent `$ref` values written at this step: their field stages run now. */
     readonly written: (path: readonly (string | number)[]) => boolean;
     /** A transaction pipe changed the step: every value is judged again. */
@@ -146,7 +163,7 @@ export type StepChanges = {
 };
 /**
  * A plan step's (or a forced call's) arguments at the step: resolved values
- * through their field stages, and re-checked when a stage changed them.
+ * through their field pipes, and re-checked when a stage changed them.
  */
 export declare function prepareStep<M extends AvAdapterModel>(dependencies: OperationPipelineDependencies<M>, request: StatefulOperationRequest, contract: AvContract, args: unknown, argumentsPath: readonly (string | number)[], report: DiagnosticsReporter, executor: AvAdapterTransactionExecutor<M>, changes: StepChanges, outer: OuterFailureLayer): Promise<AdmittedOperation>;
 /**
@@ -155,3 +172,4 @@ export declare function prepareStep<M extends AvAdapterModel>(dependencies: Oper
  * failures never reach this function, so developer filters never see them.
  */
 export declare function executeAdmittedOperation<M extends AvAdapterModel>(dependencies: OperationPipelineDependencies<M>, request: StatefulOperationRequest, contract: AvContract, admittedArguments: unknown, argumentsPath: readonly (string | number)[], binding: OperationBinding<M>, report: DiagnosticsReporter): Promise<AvOperationResponse>;
+export {};

package/dist/runtime/operation-runtime.js

@@ -1,19 +1,24 @@
 import { hasFieldValidators } from "../compiler/field-validator.compiler.js";
+import { createComputedFields } from "../config/field-compute.resolver.js";
 import { fieldStagesOf, isForcedOperation, nestedTargetLevels, operationLevels, rawPipelineTree, transactionLevelsOf, } from "../config/pipeline-tree.resolver.js";
 import { AVENTARA_PROTOCOL_VERSION } from "../contracts/contract-protocol.js";
 import { findOperationAvailabilityIssue, validateOperationArguments, } from "../operations/operation-validator.js";
+import { enforceReadPolicy, } from "../policy/policy-read.runtime.js";
+import { admitRequestPolicy, openRequestPolicy, } from "../policy/policy-request.js";
+import { enforceWritePolicy, writeNeedsTransaction, } from "../policy/policy-write.runtime.js";
 import { transactionInfrastructureFailure } from "../transactions/transaction-response.js";
 import { settleTransaction } from "../transactions/transaction-settlement.runtime.js";
 import { TRANSACTION_PIPES, transactionFacts, } from "../transactions/transaction-stage.runtime.js";
 import { copyAtDoor, misuseIdentityOf, refuseCallerData, } from "./caller-data.door.js";
 import { materializeReadOperation, planReadOperation, } from "./computed-read-runtime.js";
+import { AvComputedValueError } from "./computed-value.error.js";
 import { createContextExecutor, } from "./context-executor.runtime.js";
-import { createRequirementIssues, recordWriteFactsOf, } from "./create-requirement.js";
+import { computedRequirementGapsOf, createRequirementIssues, recordWriteFactsOf, } from "./create-requirement.js";
 import { createDiagnosticsReporter, } from "./diagnostics-reporter.js";
 import { AdapterBoundary, OPERATION_ARGUMENTS_PATH, resolveOperationFailure, sanitizeOperationFailure, } from "./error-boundary.js";
 import { planFieldStages } from "./field-stage.plan.js";
 import { guardSentFields, pipeSentFields, valueAt, writeRecordPathsOf, } from "./field-stage.runtime.js";
-import { fieldValidatorIssues } from "./field-validator.runtime.js";
+import { fieldValidatorIssues, hiddenFieldRefusal, } from "./field-validator.runtime.js";
 import { thrownFailure } from "./framework-error.factory.js";
 import { AvInterceptorNextError } from "./interceptor-next.error.js";
 import { runLevelLifecycle, } from "./level-lifecycle.runtime.js";
@@ -23,10 +28,11 @@ import { nestedWriteTargetsOf, } from "./nested-write.walker.js";
 import { internalFailure, operationFailure } from "./operation-response.js";
 import { mapOperationOutcome, mapValidationOutcome, uniqueMissFailure, } from "./outcome-mapper.js";
 import { AvOutputValidationError, validateOperationOutput, } from "./output-validator.js";
-import { refusePipeOutput, refuseStageOutput, } from "./pipe-output.validator.js";
+import { AvPipeOutputError, PIPE_OUTPUT_FAILURE_MESSAGE, refusePipeOutput, refuseStageOutput, } from "./pipe-output.validator.js";
 import { deepFreeze, frozenCopy } from "./readonly-value.js";
 import { requestStateOf } from "./request-state.resolver.js";
 import { normalizeOperationScalarValues, } from "./scalar-runtime.js";
+import { withoutUnsentWriteValues } from "./unsent-value.normalizer.js";
 function scopeOf(request, binding) {
     return {
         requestId: request.requestId,
@@ -37,9 +43,30 @@ function scopeOf(request, binding) {
 export function withRequestState(request) {
     return { ...request, state: requestStateOf(request.state) };
 }
+function withRequestPolicy(dependencies, request, caller, report) {
+    const failed = (error) => {
+        report(error, "A3000");
+        return internalFailure();
+    };
+    const withPolicy = (policy) => policy === undefined ? request : { ...request, policy };
+    try {
+        const policy = openRequestPolicy(dependencies.config.policy, dependencies.contracts.core, request, caller, dependencies.adapter);
+        return policy instanceof Promise
+            ? policy.then(withPolicy, failed)
+            : withPolicy(policy);
+    }
+    catch (error) {
+        return failed(error);
+    }
+}
 export function createPipelineDependencies(dependencies, model) {
     const misuse = createMisuseReporter(dependencies.config.misuse);
-    const recordWrites = recordWriteFactsOf(dependencies.adapter);
+    const recordWrites = recordWriteFactsOf({
+        ...(dependencies.adapter.referentialActions === undefined
+            ? {}
+            : { referentialActions: dependencies.adapter.referentialActions }),
+        model,
+    });
     const contexts = createContextExecutor({
         model,
         adapter: dependencies.adapter,
@@ -121,7 +148,7 @@ function operationFacts(contract, request, args) {
             family: request.family,
             variant: request.variant,
         },
-        $args: args,
+        $args: frozenCopy(args),
         $origin: request.origin,
         $requestId: request.requestId,
         $contract: contract,
@@ -162,7 +189,7 @@ function outputAccepted(contract, request, projection, data, report) {
 }
 export function createOperationRuntime(dependencies, pipelineDependencies) {
     const misuse = createMisuseReporter(dependencies.config.misuse);
-    return async (request, report, source) => {
+    return async (request, report, source, caller) => {
         let validated;
         try {
             validated = validateOperation(dependencies, request, source, misuse);
@@ -176,17 +203,34 @@ export function createOperationRuntime(dependencies, pipelineDependencies) {
         if (!validated.ok) {
             return validated.response;
         }
-        const stateful = withRequestState(request);
+        const opened = withRequestPolicy(dependencies, withRequestState(request), caller, report);
+        const stateful = opened instanceof Promise ? await opened : opened;
+        if (!("state" in stateful)) {
+            return stateful;
+        }
+        const forced = isForcedOperation(activeScopeConfig(dependencies.config, request).pipelines, request);
         const admitted = await admitOperation(pipelineDependencies, stateful, validated.contract, validated.arguments, OPERATION_ARGUMENTS_PATH, report, {
             requestId: request.requestId,
             transaction: undefined,
             state: stateful.state,
-        });
+        }, forced ? FORCED_CALL : SINGLE_CALL);
         if (!admitted.ok) {
             return admitted.response;
         }
-        if (isForcedOperation(activeScopeConfig(dependencies.config, request).pipelines, request)) {
-            return executeForcedOperation(pipelineDependencies, dependencies.adapter, stateful, validated.contract, admitted.args, report);
+        let checkedWrite = false;
+        if (stateful.policy !== undefined &&
+            request.family !== "find" &&
+            validated.contract.transactions === "interactive" &&
+            !forced) {
+            try {
+                checkedWrite = await writeNeedsTransaction(stateful.policy, dependencies.contracts.core, stateful, () => planReadOperation(dependencies.contracts.core, dependencies.config.adapter.model, validated.contract, activeScopeConfig(dependencies.config, request).compute, stateful, admitted.args), admitted.args);
+            }
+            catch (error) {
+                return sanitizeOperationFailure(error, stateful.policy.execution.boundary.originOf(error), report, { path: OPERATION_ARGUMENTS_PATH, arguments: admitted.args });
+            }
+        }
+        if (forced || checkedWrite) {
+            return executeForcedOperation(pipelineDependencies, dependencies.adapter, stateful, validated.contract, admitted.args, report, forced);
         }
         return executeAdmittedOperation(pipelineDependencies, stateful, validated.contract, admitted.args, OPERATION_ARGUMENTS_PATH, { kind: "standalone", executor: dependencies.adapter }, report);
     };
@@ -198,9 +242,11 @@ function validateOperation(dependencies, request, source, misuse) {
     }
     const contract = activeContract(dependencies.contracts, request);
     let owned = request;
-    if (source === "caller" &&
+    if (source !== "owned" &&
         findOperationAvailabilityIssue(contract, request) === undefined) {
-        const copy = copyAtDoor(request.arguments);
+        const copy = source === "caller"
+            ? copyAtDoor(request.arguments)
+            : { ok: false, error: source.refused };
         if (!copy.ok) {
             return rejected(mapValidationOutcome([
                 refuseCallerData(copy.error, OPERATION_ARGUMENTS_PATH, misuseIdentityOf(request), misuse),
@@ -235,6 +281,12 @@ export function protocolIdentityFailure(contracts, protocol, origin) {
     return undefined;
 }
 export function validateOperationRequest(contract, request, options, write = "copy") {
+    if (findOperationAvailabilityIssue(contract, request) === undefined) {
+        const sent = withoutUnsentWriteValues(contract, request, request.arguments);
+        if (sent !== request.arguments) {
+            request = { ...request, arguments: sent };
+        }
+    }
     const validation = validateOperationArguments(contract, request, options);
     if (!validation.ok) {
         return { ok: false, response: mapValidationOutcome(validation.issues) };
@@ -251,12 +303,13 @@ function rejected(response) {
     return { ok: false, response };
 }
 const FIELD_PIPES = "Field pipes";
-const STEP_PIPES = "Pipes";
+export const STEP_PIPES = "Pipes";
 export const EVERY_FIELD = () => true;
 function filtersOf(levels) {
     return levels.flatMap((level) => level.filters);
 }
 const SINGLE_CALL = { select: EVERY_FIELD };
+const FORCED_CALL = { select: EVERY_FIELD, beforeBegin: true };
 export async function admitOperation(dependencies, request, contract, args, argumentsPath, report, scope, admission = SINGLE_CALL) {
     const contexts = dependencies.contexts;
     const tree = activeScopeConfig(dependencies.config, request).pipelines;
@@ -299,8 +352,10 @@ export async function admitOperation(dependencies, request, contract, args, argu
         let pipeIndex = 0;
         for (const level of levels) {
             for (const pipe of level.pipes) {
-                const returned = await pipe(current, context());
-                if (returned !== undefined && returned !== current) {
+                const told = frozenCopy(current);
+                const output = await pipe(told, context());
+                if (output !== undefined && output !== told && output !== current) {
+                    const returned = withoutUnsentWriteValues(dependencies.contracts.core, request, output);
                     const refused = refusePipeOutput(contracts, request, returned, pipe, pipeIndex, admission.validation);
                     if (refused !== undefined) {
                         report(refused.error, "A3004");
@@ -322,6 +377,16 @@ export async function admitOperation(dependencies, request, contract, args, argu
             piped: piped || fields.piped,
         };
     };
+    const absent = createRequirementIssues(contract, dependencies.recordWrites, request, current, argumentsPath);
+    if (absent.length > 0) {
+        return { ok: false, response: mapValidationOutcome(absent) };
+    }
+    if (request.policy !== undefined) {
+        const refused = await admitRequestPolicy(request.policy, dependencies.contracts.core, contract, request, current, report, { path: argumentsPath, arguments: current });
+        if (refused !== undefined) {
+            return { ok: false, response: refused };
+        }
+    }
     try {
         return await admit();
     }
@@ -333,10 +398,12 @@ export async function admitOperation(dependencies, request, contract, args, argu
     }
 }
 async function runFieldInputStages(dependencies, request, contract, args, argumentsPath, report, admission) {
-    const tree = activeScopeConfig(dependencies.config, request).pipelines;
+    const scopeConfig = activeScopeConfig(dependencies.config, request);
+    const tree = scopeConfig.pipelines;
     const planned = dependencies.fieldStages[request.origin];
     const pipes = planned.anyPipes;
-    if (!pipes && !hasFieldValidators(contract)) {
+    const judge = admission.beforeBegin === true && hasFieldValidators(contract);
+    if (!pipes && !judge) {
         return { ok: true, args, piped: false };
     }
     let current = args;
@@ -364,14 +431,25 @@ async function runFieldInputStages(dependencies, request, contract, args, argume
             }
         }
     }
-    const broken = fieldValidatorIssues(contract, dependencies.recordWrites.references, request, current, argumentsPath, admission.select);
-    if (broken.length > 0) {
-        return { ok: false, response: mapValidationOutcome(broken) };
+    if (judge) {
+        const compute = scopeConfig.compute;
+        const broken = fieldValidatorIssues(contract, dependencies.recordWrites.references, request, current, argumentsPath, admission.select, (resource, stage, field) => {
+            const fields = compute !== undefined && Object.hasOwn(compute, resource)
+                ? compute[resource]
+                : undefined;
+            const phases = fields !== undefined && Object.hasOwn(fields, field)
+                ? fields[field]
+                : undefined;
+            return phases?.[stage] !== undefined;
+        });
+        if (broken.length > 0) {
+            return { ok: false, response: mapValidationOutcome(broken) };
+        }
     }
     return { ok: true, args: current, piped: changed };
 }
 export async function prepareStep(dependencies, request, contract, args, argumentsPath, report, executor, changes, outer) {
-    let current = deepFreeze(args);
+    let current = deepFreeze(withoutUnsentWriteValues(dependencies.contracts.core, request, args));
     const scope = {
         requestId: request.requestId,
         transaction: executor,
@@ -395,12 +473,6 @@ export async function prepareStep(dependencies, request, contract, args, argumen
                 return { ok: false, response: refused.response };
             }
         }
-        if (changes.transactionPiped) {
-            const broken = fieldValidatorIssues(contract, dependencies.recordWrites.references, request, current, argumentsPath, EVERY_FIELD);
-            if (broken.length > 0) {
-                return { ok: false, response: mapValidationOutcome(broken) };
-            }
-        }
         return { ok: true, args: deepFreeze(current), piped: resolved.piped };
     }
     catch (error) {
@@ -410,7 +482,7 @@ export async function prepareStep(dependencies, request, contract, args, argumen
         };
     }
 }
-async function executeForcedOperation(dependencies, adapter, request, contract, args, report) {
+async function executeForcedOperation(dependencies, adapter, request, contract, args, report, forced) {
     const plan = [
         {
             resource: request.resource,
@@ -421,7 +493,9 @@ async function executeForcedOperation(dependencies, adapter, request, contract,
     ];
     const settled = await settleTransaction({
         adapter,
-        levels: transactionLevelsOf(activeScopeConfig(dependencies.config, request).pipelines, request.resource),
+        levels: forced
+            ? transactionLevelsOf(activeScopeConfig(dependencies.config, request).pipelines, request.resource)
+            : [],
         plan,
         contextOf: (current, executor) => dependencies.contexts.transaction({
             requestId: request.requestId,
@@ -465,15 +539,8 @@ export async function executeAdmittedOperation(dependencies, request, contract,
     const adapterBoundary = new AdapterBoundary();
     const contracts = { core: dependencies.contracts.core, active: contract };
     let args = deepFreeze(admittedArguments);
-    let told;
-    const view = () => {
-        if (told === undefined || told.of !== args) {
-            told = { of: args, view: frozenCopy(args) };
-        }
-        return told.view;
-    };
-    const context = () => contexts.operation(scope, operationFacts(contract, request, view()));
-    const computeContext = () => contexts.compute(scope, operationFacts(contract, request, view()));
+    const context = () => contexts.operation(scope, operationFacts(contract, request, args));
+    const computeContext = () => contexts.compute(scope, operationFacts(contract, request, args));
     const reuse = { refusal: undefined };
     const refusedReuse = (refusal) => {
         report(refusal, "A3000");
@@ -493,11 +560,52 @@ export async function executeAdmittedOperation(dependencies, request, contract,
     async function runLifecycle() {
         let computed = await applyWriteCompute(contracts, scopeConfig.compute, request, args, computeContext);
         computed = await applyNestedWriteCompute(contracts, scopeConfig.compute, computed, nestedWriteTargetsOf(contract, dependencies.recordWrites.references, request, computed), (target, payload) => contexts.compute(scope, nestedFacts(contract, request, target, payload)));
-        const missing = createRequirementIssues(contract, dependencies.recordWrites, request, computed, argumentsPath);
-        if (missing.length > 0) {
-            return mapValidationOutcome(missing);
+        const broken = createRequirementIssues(contract, dependencies.recordWrites, request, computed, argumentsPath);
+        const [firstBroken] = broken;
+        if (firstBroken !== undefined) {
+            const what = firstBroken.code === "V1000"
+                ? "dropped a required field"
+                : "wrote a reference twice";
+            report(new AvPipeOutputError(`Pipes or write compute ${what} of ${request.resource}.${request.family}.${request.variant} at "${(firstBroken.path ?? []).join(".")}" (${firstBroken.code}: ${firstBroken.message})`, broken), "A3004");
+            return operationFailure("A3004", {
+                message: PIPE_OUTPUT_FAILURE_MESSAGE,
+            });
+        }
+        const unfilled = computedRequirementGapsOf(contract, dependencies.recordWrites, request, computed, argumentsPath, (resource) => createComputedFields(scopeConfig.compute, resource));
+        const [firstUnfilled] = unfilled;
+        if (firstUnfilled !== undefined) {
+            throw new AvComputedValueError(firstUnfilled.resource, firstUnfilled.field, "create", unfilled.map((gap) => gap.issue), `compute.create on ${firstUnfilled.resource}.${firstUnfilled.field} returned undefined for a required field`);
+        }
+        if (hasFieldValidators(contract)) {
+            const refused = fieldValidatorIssues(contract, dependencies.recordWrites.references, request, computed, argumentsPath, EVERY_FIELD);
+            if (refused.length > 0) {
+                return mapValidationOutcome(refused);
+            }
+        }
+        const hiddenRefusal = hiddenFieldRefusal({ core: dependencies.contracts.core, active: contract }, dependencies.recordWrites.references, request, computed, argumentsPath);
+        if (hiddenRefusal !== undefined) {
+            throw hiddenRefusal;
         }
         args = deepFreeze(computed);
+        let policyWrite;
+        if (request.policy !== undefined && request.family !== "find") {
+            const planned = planReadOperation(dependencies.contracts.core, dependencies.config.adapter.model, contract, scopeConfig.compute, request, args);
+            const plannedArguments = await stripVirtualMutationInput(contracts, request, planned.arguments);
+            try {
+                policyWrite = await enforceWritePolicy(request.policy.on({ executor, boundary: adapterBoundary }), dependencies.contracts.core, dependencies.config.adapter.model, request, planned, plannedArguments, binding.kind === "transaction");
+            }
+            catch (error) {
+                return sanitizeOperationFailure(error, adapterBoundary.originOf(error), report, { path: argumentsPath, arguments: args });
+            }
+            if (policyWrite.kind === "refused") {
+                return policyWrite.response;
+            }
+        }
+        let policyFailure;
+        const refuseWrite = (response) => {
+            policyFailure = response;
+            throw thrownFailure(response);
+        };
         let readMaterialized = false;
         let executedReadPlan;
         const materialize = async (data, plan) => {
@@ -506,24 +614,87 @@ export async function executeAdmittedOperation(dependencies, request, contract,
             return materializeReadOperation(contract, scopeConfig.compute, request, plan, data, computeContext);
         };
         const invoke = async () => {
-            const readPlan = planReadOperation(dependencies.contracts.core, dependencies.config.adapter.model, contract, scopeConfig.compute, request, args);
-            const adapterArguments = await stripVirtualMutationInput(contracts, request, readPlan.arguments);
-            const identity = request;
-            const adapterData = await adapterBoundary.execute(() => executor.execute({
-                ...identity,
-                resource: request.resource,
-                arguments: adapterArguments,
-            }));
+            let readPlan = planReadOperation(dependencies.contracts.core, dependencies.config.adapter.model, contract, scopeConfig.compute, request, args);
+            let adapterArguments = await stripVirtualMutationInput(contracts, request, readPlan.arguments);
+            let operation = request;
+            let settle;
+            let writeMiss;
+            let failedWrite;
+            if (policyWrite !== undefined && policyWrite.kind !== "refused") {
+                writeMiss = policyWrite.miss;
+                failedWrite = policyWrite.failed;
+                if (policyWrite.kind === "empty") {
+                    if (writeMiss !== undefined && policyWrite.data === null) {
+                        refuseWrite(await writeMiss());
+                    }
+                    return materialize(policyWrite.data, readPlan);
+                }
+                operation = policyWrite.identity;
+                adapterArguments = policyWrite.arguments;
+                readPlan = policyWrite.plan;
+                settle = policyWrite.settle;
+            }
+            else if (request.policy !== undefined && request.family === "find") {
+                const read = await enforceReadPolicy(request.policy.on({ executor, boundary: adapterBoundary }), dependencies.contracts.core, dependencies.config.adapter.model, request, readPlan, adapterArguments);
+                if (read.kind === "refused") {
+                    throw thrownFailure(read.response);
+                }
+                if (read.kind === "empty") {
+                    const miss = uniqueMissFailure(request, read.data);
+                    if (miss !== undefined) {
+                        throw thrownFailure(miss);
+                    }
+                    return materialize(read.data, readPlan);
+                }
+                operation = read.identity;
+                adapterArguments = read.arguments;
+                readPlan = read.plan;
+                settle = read.settle;
+            }
+            const { policy: _session, ...identity } = operation;
+            let adapterData;
+            try {
+                adapterData = await adapterBoundary.execute(() => executor.execute({
+                    ...identity,
+                    resource: request.resource,
+                    arguments: adapterArguments,
+                }));
+            }
+            catch (error) {
+                const missed = failedWrite === undefined
+                    ? undefined
+                    : await failedWrite(error).catch(() => undefined);
+                if (missed !== undefined) {
+                    refuseWrite(missed);
+                }
+                throw error;
+            }
+            if (writeMiss !== undefined && adapterData === null) {
+                refuseWrite(await writeMiss());
+            }
             const miss = uniqueMissFailure(request, adapterData);
             if (miss !== undefined) {
                 throw thrownFailure(miss);
             }
+            if (settle !== undefined) {
+                const settled = await settle(adapterData);
+                if (!settled.ok) {
+                    if (policyWrite !== undefined) {
+                        refuseWrite(settled.response);
+                    }
+                    throw thrownFailure(settled.response);
+                }
+                adapterData = settled.data;
+            }
             return materialize(adapterData, readPlan);
         };
         const materialized = async (data) => readMaterialized
             ? data
             : materialize(data, planReadOperation(dependencies.contracts.core, dependencies.config.adapter.model, contract, scopeConfig.compute, request, args));
         const data = await materialized(await runLevelLifecycle(levels, context, invoke, materialized, reuse, () => new AvInterceptorNextError()));
+        if (policyFailure !== undefined) {
+            return policyFailure;
+        }
         if (!outputAccepted(contract, request, executedReadPlan?.projection, data, report)) {
             return internalFailure();
         }

package/dist/runtime/outcome-mapper.d.ts

@@ -13,10 +13,11 @@ export declare function uniqueMissFailure(operation: AvOperationIdentity, data:
  */
 export declare function mapOperationOutcome(operation: AvOperationIdentity, data: unknown): AvOperationResponse;
 /** The A-codes a set of Framework Validation Layer issues can roll up to. */
-export type ValidationOutcomeCode = "A2001" | "A2002" | "A2004" | "A2007" | "A2009";
+type ValidationOutcomeCode = "A2001" | "A2002" | "A2004" | "A2007" | "A2009";
 /** The framework's top-level `cause.message` for each validation outcome code. */
 export declare const VALIDATION_OUTCOME_MESSAGES: {
     readonly [K in ValidationOutcomeCode]: string;
 };
 /** Maps framework validation issues to their stable failure envelope. */
 export declare function mapValidationOutcome(issues: readonly AvValidationIssue[]): AvOperationFailureResponse;
+export {};

package/dist/runtime/output-validator.d.ts

@@ -2,7 +2,7 @@ import type { AvContract } from "../contracts/contract.js";
 import type { AvOperationIdentity } from "../operations/operation-identity.js";
 import type { AvValidationIssue } from "../operations/validation-code.js";
 import type { ReadProjectionPlan } from "./computed-read-runtime.js";
-export type OutputValidationResult = {
+type OutputValidationResult = {
     readonly ok: true;
 } | {
     readonly ok: false;

package/dist/runtime/owned-execution.registry.d.ts

@@ -1,11 +1,21 @@
-import type { AgentTransactionRequest, ClientTransactionRequest } from "../transactions/transaction-request.js";
+import type { AvAgentTransactionRequest, AvClientTransactionRequest } from "../transactions/transaction-request.js";
 import type { AvTransactionResponse } from "../transactions/transaction-response.js";
+import type { AvCallerDataError } from "./caller-data.copier.js";
 import type { RemoteOperationRequest } from "./operation-request.js";
 import type { AvOperationResponse } from "./operation-response.js";
 /** The two entries that run a request the protocol decoded itself, uncopied. */
 export type OwnedExecution = {
-    readonly execute: (request: RemoteOperationRequest) => Promise<AvOperationResponse>;
-    readonly executeTransaction: (request: ClientTransactionRequest | AgentTransactionRequest) => Promise<AvTransactionResponse>;
+    /**
+     * Runs `request` uncopied; with `refused`, its arguments are a host's parsed body
+     * whose copy at the call failed, answered as the door answers that failure.
+     */
+    readonly execute: (request: RemoteOperationRequest, refused?: AvCallerDataError) => Promise<AvOperationResponse>;
+    /**
+     * Runs `request` uncopied; with `refused`, its plan is a host's parsed plan taken
+     * at the call, and these steps' arguments could not be copied there: each is
+     * answered at its turn as the door answers that failure.
+     */
+    readonly executeTransaction: (request: AvClientTransactionRequest | AvAgentTransactionRequest, refused?: ReadonlyMap<number, AvCallerDataError>) => Promise<AvTransactionResponse>;
 };
 /** Records `framework`'s owned entries; called once, at construction. */
 export declare function recordOwnedExecution(framework: object, execution: OwnedExecution): void;

package/dist/runtime/pipe-output.validator.d.ts

@@ -24,6 +24,8 @@ import type { AvOperationFailureResponse } from "./operation-response.js";
  */
 /** The one text every `A3004` carries on the wire. */
 export declare const PIPE_OUTPUT_FAILURE_MESSAGE = "A server pipeline produced invalid arguments.";
+/** The Contract a stage's output is held to: Core's Resources plus what `active` adds. */
+export declare function serverContractFor(core: AvContractCore, active: AvContract): AvContract;
 /** The error the diagnostics channel receives for a refused pipe output. */
 export declare class AvPipeOutputError extends Error {
     readonly issues: readonly AvValidationIssue[];
@@ -61,3 +63,11 @@ export declare function refuseStageOutput(contracts: {
 }, request: AvOperationIdentity & {
     readonly resource: string;
 }, args: unknown, subject: string, options?: OperationValidationOptions): RefusedStageOutput | undefined;
+/**
+ * The `A3004` for a stage output the server's rules raised `issues` against
+ * (paths under `["arguments", …]`), the first named in the diagnostic;
+ * `undefined` when there are none.
+ */
+export declare function refusedStageOutput(request: AvOperationIdentity & {
+    readonly resource: string;
+}, issues: readonly AvValidationIssue[], subject: string): RefusedStageOutput | undefined;