@aventara/core 1.0.0-rc.1 → 1.0.0-rc.11

package/dist/framework/framework.factory.js

@@ -1,9 +1,18 @@
-import { compileContracts } from "../compiler/contract.compiler.js";
-import { resolveFrameworkConfig } from "../config/config.resolver.js";
+import { compileContracts, } from "../compiler/contract.compiler.js";
+import { validateManagedDeletes } from "../compiler/managed-elsewhere.validator.js";
+import { computedFieldsOf, warnOnStaleComputedFields, } from "../config/computed-fields.js";
+import { resolveFrameworkConfig, } from "../config/config.resolver.js";
 import { validateFrameworkConfig } from "../config/config.validator.js";
 import { validateForcedOperations } from "../config/forced-operation.validator.js";
 import { AVENTARA_PROTOCOL_VERSION } from "../contracts/contract-protocol.js";
-import { copyEnvelopeAtDoor, refuseCallerData, } from "../runtime/caller-data.door.js";
+import { recordAccessProvider } from "../policy/access-provider.registry.js";
+import { recordAccessQuestions } from "../policy/access-question.registry.js";
+import { createAccessQuestionAnswerer } from "../policy/access-question.runtime.js";
+import { heldTargetsOf } from "../policy/policy-reference-write.runtime.js";
+import { callerOf, derivePolicyCaller, } from "../policy/policy-request.js";
+import { policyStartupDiagnostics } from "../policy/policy-startup.validator.js";
+import { loadPrebuiltContracts, warnStalePrebuilt, } from "../prebuilt/prebuilt-contracts.loader.js";
+import { copyAtDoor, copyEnvelopeAtDoor, refuseCallerData, } from "../runtime/caller-data.door.js";
 import { createDiagnosticsReporter, createTransactionDiagnosticsChannel, recordDiagnosticsSink, } from "../runtime/diagnostics-reporter.js";
 import { createMisuseReporter, } from "../runtime/misuse-reporter.js";
 import { internalFailure, operationFailure, } from "../runtime/operation-response.js";
@@ -12,10 +21,13 @@ import { recordOwnedExecution } from "../runtime/owned-execution.registry.js";
 import { validateOperationEnvelope, validateTransactionEnvelope, } from "../runtime/request-envelope.validator.js";
 import { requestIdOf } from "../runtime/request-id.js";
 import { stateOptionOf } from "../runtime/request-state.resolver.js";
+import { encodeOperationArgumentsForWire } from "../transactions/operation-arguments-encoder.js";
 import { createTransactionPlanAssembler } from "../transactions/transaction-plan-assembler.js";
 import { createTransactionRuntime } from "../transactions/transaction-runtime.js";
+import { createServerClientAccess } from "./access-facade.js";
 import { AvConstructionError } from "./framework-construction.error.js";
-import { createOperationFacade, createOperationTree, settleOperation, } from "./operation-facade.js";
+import { createAbortableOperationFacade, createOperationFacade, createOperationTree, settleOperation, } from "./operation-facade.js";
+import { runOperationSet } from "./operation-set.runner.js";
 const APPLICATION_SQL_BUILDER = "$sql";
 export async function createFramework(config) {
     const configDiagnostics = validateFrameworkConfig(config);
@@ -34,14 +46,34 @@ export async function createFramework(config) {
         ]);
     }
     const resolvedConfig = resolveFrameworkConfig(config);
-    const compilation = await compileContracts(model, resolvedConfig);
+    warnOnStaleComputedFields(config.adapter.computedFields, computedFieldsOf({
+        trees: resolvedConfig.trees,
+        agentExtends: resolvedConfig.agent.parent,
+    }));
+    const compilation = (config.prebuilt === undefined
+        ? undefined
+        : await prebuiltCompilation(config.prebuilt, model, config, resolvedConfig)) ?? (await compileContracts(model, resolvedConfig));
     if (!compilation.ok) {
         throw new AvConstructionError("contract-compilation", compilation.diagnostics);
     }
+    const clashes = serverClientClashes(compilation.contracts);
+    if (clashes.length > 0) {
+        throw new AvConstructionError("contract-compilation", clashes);
+    }
     const forcing = validateForcedOperations(config, compilation.contracts);
     if (forcing.length > 0) {
         throw new AvConstructionError("configuration", forcing);
     }
+    const managedDeletes = validateManagedDeletes(compilation.contracts, config.adapter.referentialActions);
+    if (managedDeletes.length > 0) {
+        throw new AvConstructionError("configuration", managedDeletes);
+    }
+    if (resolvedConfig.policy !== undefined) {
+        const policy = policyStartupDiagnostics(compilation.contracts.core, resolvedConfig.policy, model);
+        if (policy.length > 0) {
+            throw new AvConstructionError("configuration", policy);
+        }
+    }
     const runtimeDependencies = {
         adapter: config.adapter,
         contracts: compilation.contracts,
@@ -51,12 +83,31 @@ export async function createFramework(config) {
     const execute = createOperationRuntime(runtimeDependencies, pipelineDependencies);
     const executeTransaction = createTransactionRuntime(runtimeDependencies, pipelineDependencies);
     const misuse = createMisuseReporter(resolvedConfig.misuse);
-    const executeOperation = (request) => executeTotally(execute, request, resolvedConfig.diagnostics, "caller");
+    const executeOperation = (request, caller) => executeTotally(execute, request, resolvedConfig.diagnostics, "caller", caller);
+    const prepareApplicationValues = (request, caller) => ((copy) => () => executeTotally(encodingApplicationValues(execute, compilation.contracts.client, copy), request, resolvedConfig.diagnostics, "caller", caller))(copyArgumentsNow(request.arguments));
     const protocol = {
         version: AVENTARA_PROTOCOL_VERSION,
         hash: compilation.contracts.client.protocol.hash,
     };
     const assembler = createTransactionPlanAssembler(compilation.contracts, protocol, misuse);
+    const clientRequest = (resource, identity, args, requestId, state) => ({
+        ...identity,
+        origin: "client",
+        protocol,
+        requestId,
+        ...(state === undefined ? {} : { state }),
+        resource,
+        arguments: args,
+    });
+    const accessAnswerer = compilation.contracts.client.access === undefined
+        ? undefined
+        : createAccessQuestionAnswerer({
+            contracts: compilation.contracts,
+            policy: resolvedConfig.policy,
+            adapter: config.adapter,
+            diagnostics: resolvedConfig.diagnostics,
+            misuse,
+        });
     const framework = {
         api: resolvedConfig.api,
         mcp: resolvedConfig.mcp,
@@ -69,35 +120,87 @@ export async function createFramework(config) {
             resource,
             arguments: args,
         }), executeOperation),
-        client: createOperationFacade(model, (resource, identity, args, requestId, state) => ({
-            ...identity,
-            origin: "client",
-            protocol,
-            requestId,
-            ...(state === undefined ? {} : { state }),
-            resource,
-            arguments: args,
-        }), executeOperation),
+        client: createOperationFacade(model, clientRequest, executeOperation),
+        serverClient: withServerClientMembers(createAbortableOperationFacade(model, clientRequest, prepareApplicationValues), (entries, options) => runOperationSet(entries, options, compilation.contracts.client.limits), accessAnswerer === undefined
+            ? undefined
+            : createServerClientAccess({
+                contract: compilation.contracts.client,
+                answer: accessAnswerer,
+                client: config.access?.client,
+                state: (input) => config.access.state(input),
+            })),
         appTx: Object.freeze({
             ...createOperationTree(model, (resource, identity) => (args) => assembler.defer("application", resource, identity, args === undefined ? {} : args)),
             [APPLICATION_SQL_BUILDER]: (strings, ...values) => assembler.deferSql(strings, values),
         }),
         clientTx: createOperationTree(model, (resource, identity) => (args) => assembler.defer("client", resource, identity, args === undefined ? {} : args)),
+        serverClientTx: createOperationTree(model, (resource, identity) => (args) => assembler.defer("client", resource, identity, args === undefined ? {} : args, "application")),
         execute: (request) => executeRequestTotally(execute, request, resolvedConfig.diagnostics, misuse),
         executeTransaction: (request) => executeTransactionRequestTotally(executeTransaction, request, resolvedConfig.diagnostics, misuse),
-        transaction: (async (operations, options) => settleOperation(await runTransactionTotally(executeTransaction, assembler, operations, requestIdOf(options), stateOptionOf(options), resolvedConfig.diagnostics))),
+        transaction: (async (operations, options) => settleOperation(await runTransactionTotally(executeTransaction, assembler, operations, requestIdOf(options), stateOptionOf(options), resolvedConfig.diagnostics, callerOf(options)))),
     };
     recordDiagnosticsSink(framework, resolvedConfig.diagnostics);
+    recordAccessProvider(framework, config.access);
+    if (accessAnswerer !== undefined) {
+        recordAccessQuestions(framework, accessAnswerer);
+    }
     recordOwnedExecution(framework, {
-        execute: (request) => executeTotally(execute, request, resolvedConfig.diagnostics, "owned"),
-        executeTransaction: (request) => executeTransactionTotally(executeTransaction, request, resolvedConfig.diagnostics, undefined, { source: "owned" }),
+        execute: (request, refused, member) => executeTotally(execute, request, resolvedConfig.diagnostics, refused === undefined ? "owned" : { refused }, member?.caller, member?.key),
+        caller: (request) => derivePolicyCaller(resolvedConfig.policy, request),
+        executeTransaction: (request, refused) => executeTransactionTotally(executeTransaction, request, resolvedConfig.diagnostics, undefined, refused === undefined
+            ? { source: "owned" }
+            : { source: "owned", refused }),
     });
+    if (resolvedConfig.policy !== undefined) {
+        await resolvedConfig.policy.engine.hosted?.({
+            held: heldTargetsOf(compilation.contracts.core, resolvedConfig.policy.unheld),
+        });
+    }
     return framework;
 }
-async function executeTotally(execute, request, diagnostics, source) {
-    const report = createDiagnosticsReporter(diagnostics, request);
+async function prebuiltCompilation(prebuilt, model, config, resolved) {
+    let loaded;
+    try {
+        loaded = await loadPrebuiltContracts(prebuilt, model, config, resolved);
+    }
+    catch (error) {
+        loaded = {
+            ok: false,
+            reason: `it could not be read (${error instanceof Error ? error.message : String(error)})`,
+        };
+    }
+    if (!loaded.ok) {
+        warnStalePrebuilt(loaded.reason);
+        return undefined;
+    }
+    return { ok: true, contracts: loaded.contracts };
+}
+function copyArgumentsNow(args) {
     try {
-        return await execute(request, report, source);
+        return copyAtDoor(args);
+    }
+    catch (thrown) {
+        return { thrown };
+    }
+}
+function encodingApplicationValues(execute, contract, copy) {
+    return (request, report, _source, caller) => {
+        if ("thrown" in copy) {
+            throw copy.thrown;
+        }
+        if (!copy.ok) {
+            return execute(request, report, { refused: copy.error }, caller);
+        }
+        return execute({
+            ...request,
+            arguments: encodeOperationArgumentsForWire(contract, request, copy.value),
+        }, report, "owned", caller);
+    };
+}
+async function executeTotally(execute, request, diagnostics, source, caller, key) {
+    const report = createDiagnosticsReporter(diagnostics, request, undefined, key);
+    try {
+        return await execute(request, report, source, caller);
     }
     catch (error) {
         report(error, "A3000");
@@ -138,18 +241,18 @@ function executeTransactionRequestTotally(execute, request, diagnostics, misuse)
     }
     return executeTransactionTotally(execute, envelope.value, diagnostics, undefined, { source: "caller" });
 }
-async function executeTransactionTotally(execute, request, diagnostics, origins, planArguments) {
+async function executeTransactionTotally(execute, request, diagnostics, origins, planArguments, caller) {
     const channel = createTransactionDiagnosticsChannel(diagnostics, request);
     const report = channel.transaction();
     try {
-        return await execute(request, channel, origins, planArguments);
+        return await execute(request, channel, origins, planArguments, caller);
     }
     catch (error) {
         report(error, "A3000");
         return internalFailure();
     }
 }
-async function runTransactionTotally(execute, assembler, operations, requestId, state, diagnostics) {
+async function runTransactionTotally(execute, assembler, operations, requestId, state, diagnostics, caller) {
     let assembled;
     try {
         assembled = await assembler.assemble(operations);
@@ -174,5 +277,23 @@ async function runTransactionTotally(execute, assembler, operations, requestId,
         source: "owned",
         refused: assembled.refused,
         statements: assembled.statements,
+    }, caller);
+}
+function withServerClientMembers(facade, all, access) {
+    return Object.freeze({
+        ...facade,
+        all,
+        ...(access === undefined ? {} : { $access: access }),
     });
 }
+function serverClientClashes(contracts) {
+    return Object.hasOwn(contracts.client.resources, "all")
+        ? [
+            {
+                code: "COMPILER_RESERVED_RESOURCE_NAME",
+                path: "adapter.model.resources.all",
+                message: 'resource "all" clashes with serverClient.all; rename the Resource or expose it under another name',
+            },
+        ]
+        : [];
+}

package/dist/framework/operation-facade.d.ts

@@ -1,15 +1,17 @@
 import type { AvAdapterModel } from "../adapters/adapter-model.js";
 import type { AvContract } from "../contracts/contract.js";
 import type { AvApplicationScalarForms, AvWireScalarForms } from "../contracts/scalar-value-type.js";
-import type { AvResourceKey } from "../operations/operation-arguments.js";
-import type { AvDeferredOperationCall, AvOperationCall, AvOperationGrammar } from "../operations/operation-call.js";
+import type { AvOperationArgumentsFor, AvResourceKey } from "../operations/operation-arguments.js";
+import type { AvOperationCall, AvOperationGrammar, DeferredArguments, DeferredPlainCall, DeferredProjectingCall, PlainCall, ProjectingCall } from "../operations/operation-call.js";
 import type { AvOperationIdentity } from "../operations/operation-identity.js";
+import { type PolicyCaller } from "../policy/policy-request.js";
 import type { AvExecutionOptions } from "../runtime/execution-options.js";
-import type { FrameworkOperationRequest } from "../runtime/operation-request.js";
+import type { AvOperationRequest } from "../runtime/operation-request.js";
 import type { AvOperationResponse } from "../runtime/operation-response.js";
 import type { AvState } from "../runtime/request-state.js";
-import type { SqlStatementBuilder } from "../transactions/sql-statement.js";
+import type { AvSqlStatementBuilder } from "../transactions/sql-statement.js";
 import type { AvTransactionResponse } from "../transactions/transaction-response.js";
+import type { AccessProviderOf, ServerClientAccess } from "./access-facade.js";
 import type { AvContractApplicationView, ClientContractView } from "./contract-view.js";
 /**
  * A model whose Resource names are not literal — the abstract `AvAdapterModel` behind
@@ -19,13 +21,62 @@ import type { AvContractApplicationView, ClientContractView } from "./contract-v
 type OpaqueSurface = {
     readonly [resource: string]: unknown;
 };
-/** The four typed surfaces of an `AvFramework`, named by the member that holds each. */
-type FacadeSurface = "application" | "client" | "appTx" | "clientTx";
+/** The typed surfaces of an `AvFramework`, named by the member that holds each. */
+type FacadeSurface = "application" | "client" | "serverClient" | "appTx" | "clientTx" | "serverClientTx";
+/** `framework.application.<Resource>.<family>.<variant>` when the variant takes a `select` or `include`. */
+export type AvApplicationProjectingCall<in out C extends AvContract, in out R extends AvResourceKey<C>, in out I extends AvOperationIdentity> = ProjectingCall<C, R, I, AvOperationArgumentsFor<C, R, I, AvApplicationScalarForms>, AvApplicationScalarForms, AvExecutionOptions>;
+/** `framework.application.<Resource>.<family>.<variant>` when it does not (the `count` variants). */
+export type AvApplicationPlainCall<in out C extends AvContract, in out R extends AvResourceKey<C>, in out I extends AvOperationIdentity> = PlainCall<C, R, I, AvOperationArgumentsFor<C, R, I, AvApplicationScalarForms>, AvApplicationScalarForms, AvExecutionOptions>;
+/** `framework.client.<Resource>.<family>.<variant>` when the variant takes a `select` or `include`: wire forms in. */
+export type AvClientProjectingCall<in out C extends AvContract, in out R extends AvResourceKey<C>, in out I extends AvOperationIdentity> = ProjectingCall<C, R, I, AvOperationArgumentsFor<C, R, I, AvWireScalarForms>, AvApplicationScalarForms, AvExecutionOptions>;
+/** `framework.client.<Resource>.<family>.<variant>` when it does not. */
+export type AvClientPlainCall<in out C extends AvContract, in out R extends AvResourceKey<C>, in out I extends AvOperationIdentity> = PlainCall<C, R, I, AvOperationArgumentsFor<C, R, I, AvWireScalarForms>, AvApplicationScalarForms, AvExecutionOptions>;
+/** `framework.appTx.<Resource>.<family>.<variant>` when the variant takes a `select` or `include`. */
+export type AvAppTxProjectingCall<in out C extends AvContract, in out R extends AvResourceKey<C>, in out I extends AvOperationIdentity> = DeferredProjectingCall<C, R, I, DeferredArguments<C, R, I, AvApplicationScalarForms, AvApplicationScalarForms>, AvApplicationScalarForms, "application">;
+/** `framework.appTx.<Resource>.<family>.<variant>` when it does not. */
+export type AvAppTxPlainCall<in out C extends AvContract, in out R extends AvResourceKey<C>, in out I extends AvOperationIdentity> = DeferredPlainCall<C, R, I, DeferredArguments<C, R, I, AvApplicationScalarForms, AvApplicationScalarForms>, AvApplicationScalarForms, "application">;
+/** `framework.clientTx.<Resource>.<family>.<variant>` when the variant takes a `select` or `include`: wire forms in. */
+export type AvClientTxProjectingCall<in out C extends AvContract, in out R extends AvResourceKey<C>, in out I extends AvOperationIdentity> = DeferredProjectingCall<C, R, I, DeferredArguments<C, R, I, AvWireScalarForms, AvApplicationScalarForms>, AvApplicationScalarForms, "client">;
+/** `framework.clientTx.<Resource>.<family>.<variant>` when it does not. */
+export type AvClientTxPlainCall<in out C extends AvContract, in out R extends AvResourceKey<C>, in out I extends AvOperationIdentity> = DeferredPlainCall<C, R, I, DeferredArguments<C, R, I, AvWireScalarForms, AvApplicationScalarForms>, AvApplicationScalarForms, "client">;
+/** A `serverClient` call's options: {@link AvExecutionOptions}, and the call's own abort signal. */
+type AvServerClientCallOptions = AvExecutionOptions & {
+    /**
+     * Aborts this call only. Aborted before the call runs, it never runs;
+     * while it runs, it rejects with the signal's reason at once, and the
+     * database finishes what it started. Any platform's `AbortSignal` is one.
+     */
+    readonly signal?: {
+        readonly aborted: boolean;
+        readonly reason: unknown;
+        addEventListener(type: "abort", listener: () => void, options?: {
+            readonly once?: boolean;
+        }): void;
+        removeEventListener(type: "abort", listener: () => void): void;
+    };
+};
+/**
+ * `framework.serverClient.<Resource>.<family>.<variant>` when the variant takes a `select` or `include`:
+ * the Client Contract's view, application forms in.
+ */
+export type AvServerClientProjectingCall<in out C extends AvContract, in out R extends AvResourceKey<C>, in out I extends AvOperationIdentity> = ProjectingCall<C, R, I, AvOperationArgumentsFor<C, R, I, AvApplicationScalarForms>, AvApplicationScalarForms, AvServerClientCallOptions>;
+/** `framework.serverClient.<Resource>.<family>.<variant>` when it does not. */
+export type AvServerClientPlainCall<in out C extends AvContract, in out R extends AvResourceKey<C>, in out I extends AvOperationIdentity> = PlainCall<C, R, I, AvOperationArgumentsFor<C, R, I, AvApplicationScalarForms>, AvApplicationScalarForms, AvServerClientCallOptions>;
+/**
+ * `framework.serverClientTx.<Resource>.<family>.<variant>` when the variant takes a `select` or `include`:
+ * the Client Contract's view, application forms in, a client-origin handle out.
+ */
+export type AvServerClientTxProjectingCall<in out C extends AvContract, in out R extends AvResourceKey<C>, in out I extends AvOperationIdentity> = DeferredProjectingCall<C, R, I, DeferredArguments<C, R, I, AvApplicationScalarForms, AvApplicationScalarForms>, AvApplicationScalarForms, "client">;
+/** `framework.serverClientTx.<Resource>.<family>.<variant>` when it does not. */
+export type AvServerClientTxPlainCall<in out C extends AvContract, in out R extends AvResourceKey<C>, in out I extends AvOperationIdentity> = DeferredPlainCall<C, R, I, DeferredArguments<C, R, I, AvApplicationScalarForms, AvApplicationScalarForms>, AvApplicationScalarForms, "client">;
 /**
  * One variant on a surface: a direct call (application or wire forms), or a
- * deferred one for a transaction (`appTx`, `clientTx`).
+ * deferred one for a transaction (`appTx`, `clientTx`, `serverClientTx`),
+ * projecting when its arguments carry a `select` (as `AvOperationCall` and
+ * `AvDeferredOperationCall` decide it). `serverClient` and `serverClientTx` take
+ * the application forms over the Client Contract's view.
  */
-type SurfaceCall<C extends AvContract, R extends AvResourceKey<C>, I extends AvOperationIdentity, S extends FacadeSurface> = S extends "application" ? AvOperationCall<C, R, I, AvApplicationScalarForms, AvApplicationScalarForms, AvExecutionOptions> : S extends "client" ? AvOperationCall<C, R, I, AvWireScalarForms, AvApplicationScalarForms, AvExecutionOptions> : S extends "appTx" ? AvDeferredOperationCall<C, R, I, AvApplicationScalarForms, AvApplicationScalarForms, "application"> : AvDeferredOperationCall<C, R, I, AvWireScalarForms, AvApplicationScalarForms, "client">;
+type SurfaceCall<C extends AvContract, R extends AvResourceKey<C>, I extends AvOperationIdentity, S extends FacadeSurface> = S extends "application" ? "select" extends keyof AvOperationArgumentsFor<C, R, I, AvApplicationScalarForms> ? AvApplicationProjectingCall<C, R, I> : AvApplicationPlainCall<C, R, I> : S extends "client" ? "select" extends keyof AvOperationArgumentsFor<C, R, I, AvWireScalarForms> ? AvClientProjectingCall<C, R, I> : AvClientPlainCall<C, R, I> : S extends "serverClient" ? "select" extends keyof AvOperationArgumentsFor<C, R, I, AvApplicationScalarForms> ? AvServerClientProjectingCall<C, R, I> : AvServerClientPlainCall<C, R, I> : S extends "appTx" ? "select" extends keyof DeferredArguments<C, R, I, AvApplicationScalarForms, AvApplicationScalarForms> ? AvAppTxProjectingCall<C, R, I> : AvAppTxPlainCall<C, R, I> : S extends "clientTx" ? "select" extends keyof DeferredArguments<C, R, I, AvWireScalarForms, AvApplicationScalarForms> ? AvClientTxProjectingCall<C, R, I> : AvClientTxPlainCall<C, R, I> : "select" extends keyof DeferredArguments<C, R, I, AvApplicationScalarForms, AvApplicationScalarForms> ? AvServerClientTxProjectingCall<C, R, I> : AvServerClientTxPlainCall<C, R, I>;
 /** The families view `C` advertises on Resource `R`. */
 type FamilyKey<C extends AvContract, R extends AvResourceKey<C>> = keyof AvOperationGrammar<C>[R];
 /** One family node of surface `S`; the public names below are its four instances. */
@@ -36,10 +87,14 @@ type FamilyNode<C extends AvContract, S extends FacadeSurface, R extends AvResou
 export type AvApplicationFamilyFacade<in out C extends AvContract, in out R extends AvResourceKey<C>, in out F extends FamilyKey<C, R>> = FamilyNode<C, "application", R, F>;
 /** `framework.client.<Resource>.<family>`: one direct call per variant, wire forms. */
 export type AvClientFamilyFacade<in out C extends AvContract, in out R extends AvResourceKey<C>, in out F extends FamilyKey<C, R>> = FamilyNode<C, "client", R, F>;
+/** `framework.serverClient.<Resource>.<family>`: one direct call per variant, application forms. */
+export type AvServerClientFamilyFacade<in out C extends AvContract, in out R extends AvResourceKey<C>, in out F extends FamilyKey<C, R>> = FamilyNode<C, "serverClient", R, F>;
 /** `framework.appTx.<Resource>.<family>`: one deferred operation per variant. */
 export type AvAppTxFamilyFacade<in out C extends AvContract, in out R extends AvResourceKey<C>, in out F extends FamilyKey<C, R>> = FamilyNode<C, "appTx", R, F>;
 /** `framework.clientTx.<Resource>.<family>`: one deferred operation per variant. */
 export type AvClientTxFamilyFacade<in out C extends AvContract, in out R extends AvResourceKey<C>, in out F extends FamilyKey<C, R>> = FamilyNode<C, "clientTx", R, F>;
+/** `framework.serverClientTx.<Resource>.<family>`: one deferred operation per variant, application forms. */
+export type AvServerClientTxFamilyFacade<in out C extends AvContract, in out R extends AvResourceKey<C>, in out F extends FamilyKey<C, R>> = FamilyNode<C, "serverClientTx", R, F>;
 /** `framework.application.<Resource>`: one {@link AvApplicationFamilyFacade} per family. */
 export type AvApplicationResourceFacade<in out C extends AvContract, in out R extends AvResourceKey<C>> = {
     readonly [F in FamilyKey<C, R>]: AvApplicationFamilyFacade<C, R, F>;
@@ -48,6 +103,10 @@ export type AvApplicationResourceFacade<in out C extends AvContract, in out R ex
 export type AvClientResourceFacade<in out C extends AvContract, in out R extends AvResourceKey<C>> = {
     readonly [F in FamilyKey<C, R>]: AvClientFamilyFacade<C, R, F>;
 };
+/** `framework.serverClient.<Resource>`: one {@link AvServerClientFamilyFacade} per family. */
+export type AvServerClientResourceFacade<in out C extends AvContract, in out R extends AvResourceKey<C>> = {
+    readonly [F in FamilyKey<C, R>]: AvServerClientFamilyFacade<C, R, F>;
+};
 /** `framework.appTx.<Resource>`: one {@link AvAppTxFamilyFacade} per family. */
 export type AvAppTxResourceFacade<in out C extends AvContract, in out R extends AvResourceKey<C>> = {
     readonly [F in FamilyKey<C, R>]: AvAppTxFamilyFacade<C, R, F>;
@@ -56,6 +115,10 @@ export type AvAppTxResourceFacade<in out C extends AvContract, in out R extends
 export type AvClientTxResourceFacade<in out C extends AvContract, in out R extends AvResourceKey<C>> = {
     readonly [F in FamilyKey<C, R>]: AvClientTxFamilyFacade<C, R, F>;
 };
+/** `framework.serverClientTx.<Resource>`: one {@link AvServerClientTxFamilyFacade} per family. */
+export type AvServerClientTxResourceFacade<in out C extends AvContract, in out R extends AvResourceKey<C>> = {
+    readonly [F in FamilyKey<C, R>]: AvServerClientTxFamilyFacade<C, R, F>;
+};
 /**
  * `framework.application`: one {@link AvApplicationResourceFacade} per Resource
  * of `C`, the Application Contract's view.
@@ -70,14 +133,58 @@ export type AvApplicationFacade<C extends AvContract> = {
 export type AvClientFacade<C extends AvContract> = {
     readonly [R in AvResourceKey<C>]: AvClientResourceFacade<C, R>;
 };
+/** `framework.serverClient.all`: its own member beside the Resources. */
+type ServerClientAll = {
+    /**
+     * Awaits an object of calls together, in process (any number of them:
+     * `limits.maxAll` guards the HTTP door only), and resolves one value per key. A call already runs when it is made;
+     * an `avLazy(() => call)` entry is started by `all`, at most
+     * `limits.maxAllConcurrency` at once. Strict: the first failure rejects it
+     * and its `avLazy` entries not yet started never start (fail-fast, not
+     * atomic: what already ran stays done). With `settle: true` every key settles as `{ status, value }`
+     * or `{ status, reason }`. Its `signal` aborts each of its calls and no other.
+     */
+    readonly all: <E extends {
+        readonly [key: string]: PromiseLike<unknown>;
+    }, S extends boolean = false>(entries: E, options?: {
+        /** Aborts every call of this `all`, and no other. Any platform's `AbortSignal` is one. */
+        readonly signal?: {
+            readonly aborted: boolean;
+            readonly reason: unknown;
+            addEventListener(type: "abort", listener: () => void, options?: {
+                readonly once?: boolean;
+            }): void;
+            removeEventListener(type: "abort", listener: () => void): void;
+        };
+        /** true settles every key on its own and never rejects for one; strict otherwise. */
+        readonly settle?: S;
+    }) => Promise<S extends true ? {
+        -readonly [K in keyof E]: {
+            readonly status: "fulfilled";
+            readonly value: Awaited<E[K]>;
+        } | {
+            readonly status: "rejected";
+            readonly reason: unknown;
+        };
+    } : {
+        -readonly [K in keyof E]: Awaited<E[K]>;
+    }>;
+};
+/**
+ * `framework.serverClient`: one {@link AvServerClientResourceFacade} per Resource
+ * of `C`, the Client Contract's view, taking application forms, and `all`.
+ */
+export type AvServerClientFacade<C extends AvContract> = {
+    readonly [R in AvResourceKey<C>]: AvServerClientResourceFacade<C, R>;
+} & ServerClientAll;
 /** `framework.appTx.$sql`: the developer SQL step only an application transaction has. */
 type ApplicationSqlStep = {
     /**
      * A developer SQL step, written only as a tagged template:
      * ``framework.appTx.$sql<Row>`select … ${value}` ``. Every interpolated value
-     * is bound as a parameter. See {@link SqlStatementBuilder}.
+     * is bound as a parameter. See {@link AvSqlStatementBuilder}.
      */
-    readonly $sql: SqlStatementBuilder;
+    readonly $sql: AvSqlStatementBuilder;
 };
 /**
  * `framework.appTx`: one {@link AvAppTxResourceFacade} per Resource of `C`, the
@@ -93,18 +200,31 @@ export type AvAppTxFacade<C extends AvContract> = {
 export type AvClientTxFacade<C extends AvContract> = {
     readonly [R in AvResourceKey<C>]: AvClientTxResourceFacade<C, R>;
 };
+/**
+ * `framework.serverClientTx`: one {@link AvServerClientTxResourceFacade} per
+ * Resource of `C`, the Client Contract's view, taking application forms.
+ */
+export type AvServerClientTxFacade<C extends AvContract> = {
+    readonly [R in AvResourceKey<C>]: AvServerClientTxResourceFacade<C, R>;
+};
 type ApplicationSurface<C> = C extends AvContract ? string extends AvResourceKey<C> ? OpaqueSurface : AvApplicationFacade<C> : never;
 type ClientSurface<C> = C extends AvContract ? string extends AvResourceKey<C> ? OpaqueSurface : AvClientFacade<C> : never;
+type ServerClientSurface<C> = C extends AvContract ? string extends AvResourceKey<C> ? OpaqueSurface & ServerClientAll : AvServerClientFacade<C> : never;
 type ApplicationDeferredSurface<C> = C extends AvContract ? string extends AvResourceKey<C> ? OpaqueSurface & ApplicationSqlStep : AvAppTxFacade<C> : never;
 type ClientDeferredSurface<C> = C extends AvContract ? string extends AvResourceKey<C> ? OpaqueSurface : AvClientTxFacade<C> : never;
+type ServerClientDeferredSurface<C> = C extends AvContract ? string extends AvResourceKey<C> ? OpaqueSurface : AvServerClientTxFacade<C> : never;
 /** `framework.application`'s type: {@link AvApplicationFacade}, or opaque. */
 export type ApplicationOperations<M extends AvAdapterModel, Cfg> = ApplicationSurface<AvContractApplicationView<M, Cfg>>;
 /** `framework.client`'s type: {@link AvClientFacade}, or opaque. */
 export type ClientOperations<M extends AvAdapterModel, Cfg> = ClientSurface<ClientContractView<M, Cfg>>;
+/** `framework.serverClient`'s type: {@link AvServerClientFacade}, or opaque with `all`, and `$access`. */
+export type ServerClientOperations<M extends AvAdapterModel, Cfg> = ServerClientSurface<ClientContractView<M, Cfg>> & ServerClientAccess<ClientContractView<M, Cfg>, AccessProviderOf<Cfg>>;
 /** `framework.appTx`'s type: {@link AvAppTxFacade}, or opaque with `$sql`. */
 export type ApplicationTransactionBuilders<M extends AvAdapterModel, Cfg> = ApplicationDeferredSurface<AvContractApplicationView<M, Cfg>>;
 /** `framework.clientTx`'s type: {@link AvClientTxFacade}, or opaque. */
 export type ClientTransactionBuilders<M extends AvAdapterModel, Cfg> = ClientDeferredSurface<ClientContractView<M, Cfg>>;
+/** `framework.serverClientTx`'s type: {@link AvServerClientTxFacade}, or opaque. */
+export type ServerClientTransactionBuilders<M extends AvAdapterModel, Cfg> = ServerClientDeferredSurface<ClientContractView<M, Cfg>>;
 /**
  * The Resources of a pipeline ctx: `ctx.<Resource>.<family>.<variant>(args)`,
  * application-origin, resolving the operation's data.
@@ -130,8 +250,8 @@ type ComputeReadFacade<C> = C extends AvContract ? string extends AvResourceKey<
     };
 } : never;
 /** Builds the request one façade call hands to `execute`, under its request id and state. */
-export type FacadeRequest = (resource: string, identity: AvOperationIdentity, args: unknown, requestId: string, state: AvState | undefined) => FrameworkOperationRequest;
-type FacadeExecutor = (request: FrameworkOperationRequest) => Promise<AvOperationResponse>;
+export type FacadeRequest = (resource: string, identity: AvOperationIdentity, args: unknown, requestId: string, state: AvState | undefined) => AvOperationRequest;
+type FacadeExecutor = (request: AvOperationRequest, caller: PolicyCaller | undefined) => Promise<AvOperationResponse>;
 /**
  * Builds a façade over `model`, the same object its types are read from, so a
  * call that type-checks always reaches `execute`: a Resource, variant or field
@@ -150,11 +270,19 @@ export declare function createOperationFacade<Facade>(model: AvAdapterModel, req
  * the response's data, or its failure thrown.
  */
 export declare function settleOperation(response: AvOperationResponse | AvTransactionResponse): unknown;
+/** Prepares one call's run: its arguments are read when the call is made. */
+type FacadePreparer = (request: AvOperationRequest, caller: PolicyCaller | undefined) => () => Promise<AvOperationResponse>;
+/**
+ * {@link createOperationFacade}'s twin for `framework.serverClient`: a call
+ * builds its request and runs at once, and the caller's `signal` aborts it
+ * (already aborted, it never runs; aborted while it runs, it rejects at once).
+ */
+export declare function createAbortableOperationFacade<Facade>(model: AvAdapterModel, request: FacadeRequest, prepare: FacadePreparer): Facade;
 /**
  * One leaf of an operation tree: the callable for one advertised variant. The
  * second parameter is a façade call's options; a builder leaf ignores it.
  */
-export type OperationLeaf = (resource: string, identity: AvOperationIdentity) => (args?: unknown, options?: unknown) => unknown;
+type OperationLeaf = (resource: string, identity: AvOperationIdentity) => (args?: unknown, options?: unknown) => unknown;
 /**
  * The runtime shape every façade and builder shares: one frozen property per
  * Resource of `model`, one per family under it, one leaf per variant the model

package/dist/framework/operation-facade.js

@@ -1,10 +1,12 @@
 import { isOperationVariantAvailable } from "../contracts/resource-operations.js";
 import { parseOperationIdentity } from "../operations/operation-identity.js";
+import { callerOf } from "../policy/policy-request.js";
 import { thrownFailure } from "../runtime/framework-error.factory.js";
 import { requestIdOf } from "../runtime/request-id.js";
 import { stateOptionOf } from "../runtime/request-state.resolver.js";
+import { runAbortable, signalOptionOf } from "./operation-set.runner.js";
 export function createOperationFacade(model, request, execute) {
-    return createOperationTree(model, (resource, identity) => async (args, options) => settleOperation(await execute(request(resource, identity, args === undefined ? {} : args, requestIdOf(options), stateOptionOf(options)))));
+    return createOperationTree(model, (resource, identity) => async (args, options) => settleOperation(await execute(request(resource, identity, args === undefined ? {} : args, requestIdOf(options), stateOptionOf(options)), callerOf(options))));
 }
 export function settleOperation(response) {
     if (response.cause !== null) {
@@ -12,6 +14,12 @@ export function settleOperation(response) {
     }
     return response.data;
 }
+export function createAbortableOperationFacade(model, request, prepare) {
+    return createOperationTree(model, (resource, identity) => (args, options) => {
+        const run = prepare(request(resource, identity, args === undefined ? {} : args, requestIdOf(options), stateOptionOf(options)), callerOf(options));
+        return runAbortable(async () => settleOperation(await run()), signalOptionOf(options));
+    });
+}
 export function createOperationTree(model, leaf) {
     const resources = Object.entries(model.resources).map(([resource, { operations }]) => {
         const families = Object.entries(operations).map(([family, variants]) => [family, variantLeaves(leaf, resource, family, variants)]);

package/dist/framework/operation-set.runner.d.ts

@@ -0,0 +1,47 @@
+import type { AvContractLimits } from "../contracts/contract-limits.js";
+/**
+ * What core reads of an abort signal: the platform's `AbortSignal` (DOM's,
+ * Node's, any runtime's) is one, structurally. Core runs in any JS runtime, so
+ * its declarations name no platform global (rc.11): a consumer with neither
+ * DOM's lib nor Node's types type-checks them. The public signatures spell this
+ * shape inline (`serverClient` calls, `serverClient.all`, the protocol's
+ * `handleAll`): no new public name.
+ */
+export type AbortSignalShape = {
+    readonly aborted: boolean;
+    readonly reason: unknown;
+    addEventListener(type: "abort", listener: () => void, options?: {
+        readonly once?: boolean;
+    }): void;
+    removeEventListener(type: "abort", listener: () => void): void;
+};
+/** `options.signal` when it is an abort signal; anything else is ignored. */
+export declare function signalOptionOf(options: unknown): AbortSignalShape | undefined;
+/**
+ * Runs `run` now under `signal`: an eager call's own abort. Already aborted, it
+ * never runs; aborted while it runs, it rejects at once with the signal's reason.
+ */
+export declare function runAbortable(run: () => Promise<unknown>, signal: AbortSignalShape | undefined): Promise<unknown>;
+/**
+ * A call made later: `avLazy(() => avClient.Post.find.many(args))` makes the
+ * call on each `then`, `catch` or `finally`, never before the first, and
+ * answers what that call answers. It keeps no answer: awaited again (by another
+ * request, say), it makes the call again, in the context awaiting it. Given to
+ * `all`, it is started by `all`, at most `limits.maxAllConcurrency` at once,
+ * and never when `all` has already failed (strict) or been aborted.
+ */
+export declare function avLazy<T>(make: () => PromiseLike<T>): Promise<T>;
+/**
+ * The Contract's `limits.maxAllConcurrency`, for `all` here and for `POST /_all`
+ * (`protocol/operation-set.handler.ts`). A compiled Contract always holds a
+ * whole number of at least 1; a hand-built one that does not runs its entries
+ * one at a time, never none.
+ */
+export declare function maxAllConcurrencyOf(limits: AvContractLimits): number;
+/**
+ * `all(entries, options?)` over `limits` (the Client Contract's): see the module
+ * comment. Rejects with a `TypeError`, before anything runs, when `entries` is not
+ * an object whose every value is a promise. Any number of entries is accepted:
+ * `limits.maxAll` guards the HTTP door only.
+ */
+export declare function runOperationSet(entries: unknown, options: unknown, limits: AvContractLimits): Promise<unknown>;