@aventara/core 1.0.0-rc.1 → 1.0.0-rc.11

package/dist/protocol/absent-route.responder.js

@@ -1,17 +1,22 @@
 import { lookupOwn, lookupResource } from "../contracts/contract-lookup.js";
+import { AVENTARA_PROTOCOL_VERSION } from "../contracts/contract-protocol.js";
 import { isOperationVariantAvailable, } from "../contracts/resource-operations.js";
 import { parseOperationIdentity, } from "../operations/operation-identity.js";
 import { operationUnavailableIssue } from "../operations/operation-validator.js";
 import { resourceUnavailableIssue } from "../operations/operation-validator-core.js";
+import { validationIssue } from "../operations/validation-code.js";
 import { createReporter, } from "../runtime/diagnostics-reporter.js";
 import { INTERNAL_FAILURE_MESSAGE, operationFailure, } from "../runtime/operation-response.js";
 import { protocolIdentityFailure } from "../runtime/operation-runtime.js";
 import { mapValidationOutcome } from "../runtime/outcome-mapper.js";
 import { transactionsUnavailableFailure } from "../transactions/transaction-plan-validator.js";
-import { CONTRACT_ROUTE, GET_ONLY, isProtocolPath, operationRouteSegments, POST_ONLY, readRequest, TRANSACTIONS_ROUTE, } from "./http-request.reader.js";
+import { ACCESS_CAN_ROUTE, ALL_ROUTE, CONTRACT_ROUTE, GET_AND_POST, GET_ONLY, isProtocolPath, operationRouteSegments, POST_ONLY, readRequest, TRANSACTIONS_ROUTE, } from "./http-request.reader.js";
 import { encodeOperationResponse, } from "./http-response.encoder.js";
 import { identityHeadersMissing, transportFailure, } from "./protocol-failure.js";
-import { missingIdentityHeaders } from "./protocol-headers.js";
+import { missingIdentityHeaders, NO_SNIFF, protocolVersionOf, } from "./protocol-headers.js";
+import { advertisesAnyOperation } from "./protocol-surface.js";
+import { uncachedAnswer } from "./read-cache.responder.js";
+import { readQueryOf } from "./read-query.codec.js";
 import { AvUnmountedRouteError } from "./unmounted-route.error.js";
 export function resolveOperationRoute(contracts, protocol, route, origin = "client") {
     const identityFailure = protocolIdentityFailure(contracts, protocol, origin);
@@ -38,41 +43,101 @@ export function resolveOperationRoute(contracts, protocol, route, origin = "clie
     }
     return { ok: true, operation };
 }
-export function transactionsRouteFailure(contracts, protocol, origin = "client") {
+function transactionsRouteFailure(contracts, protocol, origin = "client") {
     return (protocolIdentityFailure(contracts, protocol, origin) ??
         (contracts[origin].transactions === "interactive"
             ? undefined
             : transactionsUnavailableFailure()));
 }
+function accessCanUnavailableFailure() {
+    const message = "Access questions are not available on the active Contract.";
+    return operationFailure("A2002", {
+        message,
+        issues: [validationIssue("V1006", ["questions"], message)],
+    });
+}
+function accessCanRouteFailure(contracts, protocol, origin = "client") {
+    return (protocolIdentityFailure(contracts, protocol, origin) ??
+        (contracts[origin].access === undefined
+            ? accessCanUnavailableFailure()
+            : undefined));
+}
+function allRouteFailure(contracts, protocol, origin = "client") {
+    const identityFailure = protocolIdentityFailure(contracts, protocol, origin);
+    if (identityFailure !== undefined) {
+        return identityFailure;
+    }
+    if (advertisesAnyOperation(contracts[origin])) {
+        return undefined;
+    }
+    const message = "Operation Sets are not available on the active Contract.";
+    return operationFailure("A2002", {
+        message,
+        issues: [validationIssue("V1006", ["operations"], message)],
+    });
+}
+function readIdentityOf(read, query) {
+    return {
+        version: protocolVersionOf(read.headers) ?? AVENTARA_PROTOCOL_VERSION,
+        hash: query.v,
+    };
+}
 export function checkOperationRoute(contracts, read, origin = "client") {
+    const check = operationRouteCheck(contracts, read, origin);
+    return check.ok || read.request.method !== "GET"
+        ? check
+        : refusedWith(uncachedAnswer(check.response));
+}
+function operationRouteCheck(contracts, read, origin) {
     const segments = operationRouteSegments(read.request.path);
     if (segments === undefined) {
         return refusedWith(transportFailure("A2000", read.requestId));
     }
-    if (read.protocol === undefined) {
+    const get = read.request.method === "GET";
+    const queried = get && read.request.query !== undefined && read.request.query !== "";
+    const query = queried ? readQueryOf(read.request.query) : undefined;
+    if (queried && query === undefined) {
+        return refusedWith(transportFailure("A2000", read.requestId));
+    }
+    const protocol = query === undefined ? read.protocol : readIdentityOf(read, query);
+    if (protocol === undefined) {
         return refusedWith(identityFailureOf(read));
     }
-    const route = resolveOperationRoute(contracts, read.protocol, segments, origin);
+    const route = resolveOperationRoute(contracts, protocol, segments, origin);
     if (!route.ok) {
         return refusedWith(encodeOperationResponse(route.failure, read.requestId));
     }
-    return read.request.method === "POST"
+    const { family, variant } = route.operation;
+    const marks = family === "find"
+        ? lookupResource(contracts[origin], segments.resource)?.cache
+        : undefined;
+    const cache = family === "find"
+        ? lookupOwn(marks, variant)
+        : undefined;
+    return read.request.method === "POST" || (get && cache !== undefined)
         ? {
             ok: true,
-            protocol: read.protocol,
+            protocol,
             resource: segments.resource,
             operation: route.operation,
+            cache,
+            query,
         }
-        : refusedWith(transportFailure("A2012", read.requestId, POST_ONLY));
+        : refusedWith(transportFailure("A2012", read.requestId, cache === undefined ? POST_ONLY : GET_AND_POST));
 }
-export function checkTransactionsRoute(contracts, read, origin = "client") {
-    if (read.request.path !== TRANSACTIONS_ROUTE) {
+const POST_ROUTE_FAILURES = {
+    [TRANSACTIONS_ROUTE]: transactionsRouteFailure,
+    [ACCESS_CAN_ROUTE]: accessCanRouteFailure,
+    [ALL_ROUTE]: allRouteFailure,
+};
+export function checkPostRoute(route, contracts, read, origin = "client") {
+    if (read.request.path !== route) {
         return refusedWith(transportFailure("A2000", read.requestId));
     }
     if (read.protocol === undefined) {
         return refusedWith(identityFailureOf(read));
     }
-    const absent = transactionsRouteFailure(contracts, read.protocol, origin);
+    const absent = POST_ROUTE_FAILURES[route](contracts, read.protocol, origin);
     if (absent !== undefined) {
         return refusedWith(encodeOperationResponse(absent, read.requestId));
     }
@@ -97,11 +162,19 @@ export function answerAbsentRequest(contracts, received, sink, origin = "client"
     }
     if (path === CONTRACT_ROUTE) {
         return method === "GET"
-            ? unmounted(read.requestId)
+            ? withNoSniff(unmounted(read.requestId))
             : transportFailure("A2012", read.requestId, GET_ONLY);
     }
+    if (path === ALL_ROUTE) {
+        const route = checkPostRoute(ALL_ROUTE, contracts, read, origin);
+        return route.ok ? unmounted(read.requestId) : route.response;
+    }
+    if (path === ACCESS_CAN_ROUTE) {
+        const route = checkPostRoute(ACCESS_CAN_ROUTE, contracts, read, origin);
+        return route.ok ? unmounted(read.requestId) : route.response;
+    }
     if (path === TRANSACTIONS_ROUTE) {
-        const route = checkTransactionsRoute(contracts, read, origin);
+        const route = checkPostRoute(TRANSACTIONS_ROUTE, contracts, read, origin);
         if (!route.ok) {
             return route.response;
         }
@@ -117,6 +190,7 @@ export function answerAbsentRequest(contracts, received, sink, origin = "client"
         return route.response;
     }
     const { family, variant } = route.operation;
+    const answer = unmounted(read.requestId);
     createReporter(sink, {
         kind: "operation",
         origin,
@@ -124,8 +198,11 @@ export function answerAbsentRequest(contracts, received, sink, origin = "client"
         family,
         variant,
         requestId: read.requestId,
-    })(new AvUnmountedRouteError(`${route.resource}.${family}.${variant}`, `POST ${path}`), "A3000");
-    return unmounted(read.requestId);
+    })(new AvUnmountedRouteError(`${route.resource}.${family}.${variant}`, `${method} ${path}`), "A3000");
+    return method === "GET" ? uncachedAnswer(answer) : answer;
+}
+function withNoSniff(response) {
+    return { ...response, headers: { ...response.headers, ...NO_SNIFF } };
 }
 function unmounted(requestId) {
     return encodeOperationResponse(operationFailure("A3000", { message: INTERNAL_FAILURE_MESSAGE }), requestId);

package/dist/protocol/contract-document.responder.d.ts

@@ -6,7 +6,7 @@ import type { AvProtocolResponse } from "./http-response.encoder.js";
  * entity tag, the quoted contract hash. The bytes include `protocol.hash`, although
  * the hash's own input excludes it.
  */
-export type ContractDocument = {
+type ContractDocument = {
     readonly body: string;
     readonly etag: string;
 };
@@ -17,3 +17,11 @@ export declare function contractDocumentOf(client: AvContractClient): ContractDo
  * order:
  */
 export declare function encodeContractRequest(document: ContractDocument, received: AvProtocolRequest): AvProtocolResponse;
+/**
+ * Whether `If-None-Match` names the current representation: `*`, or a list holding an
+ * entity tag whose opaque tag equals `etag`'s — the WEAK comparison, which `If-None-
+ * Match` uses, so a `W/` prefix does not matter. A value that is not a well-formed
+ * list matches nothing; an absent header matches nothing.
+ */
+export declare function noneMatchHolds(value: string | undefined, etag: string): boolean;
+export {};

package/dist/protocol/contract-document.responder.js

@@ -1,7 +1,7 @@
 import { canonicalContractTextOf } from "../contracts/contract-canonicalizer.js";
 import { CONTRACT_ROUTE, GET_ONLY, readRequest, } from "./http-request.reader.js";
 import { transportFailure } from "./protocol-failure.js";
-import { headers, headerValue } from "./protocol-headers.js";
+import { headers, headerValue, NO_SNIFF } from "./protocol-headers.js";
 export function contractDocumentOf(client) {
     return Object.freeze({
         body: canonicalContractTextOf(client),
@@ -23,6 +23,7 @@ export function encodeContractRequest(document, received) {
     const validators = {
         ETag: document.etag,
         "Cache-Control": "no-cache",
+        ...NO_SNIFF,
         [headers.requestId]: requestId,
     };
     return noneMatchHolds(headerValue(read.headers, "if-none-match"), document.etag)
@@ -34,7 +35,7 @@ export function encodeContractRequest(document, received) {
         };
 }
 const IF_NONE_MATCH_MEMBER = /[ \t]*(?:(?:W\/)?("[\x21\x23-\x7e\x80-\xff]*"))?[ \t]*(,|$)/y;
-function noneMatchHolds(value, etag) {
+export function noneMatchHolds(value, etag) {
     if (value === undefined) {
         return false;
     }

package/dist/protocol/http-request.decoder.d.ts

@@ -1,7 +1,9 @@
 import type { AvContracts } from "../compiler/contract.compiler.js";
 import type { RemoteRequestOrigin } from "../config/config-layer.js";
-import type { RemoteOperationRequest } from "../runtime/operation-request.js";
-import type { AgentTransactionRequest, ClientTransactionRequest } from "../transactions/transaction-request.js";
+import type { AvRequestProtocol, RemoteOperationRequest } from "../runtime/operation-request.js";
+import type { AvTransportContext } from "../runtime/pipeline.js";
+import type { AvAgentTransactionRequest, AvClientTransactionRequest } from "../transactions/transaction-request.js";
+import { type ReadRequest } from "./http-request.reader.js";
 import type { AvProtocolResponse } from "./http-response.encoder.js";
 /** One HTTP request as a host hands it to the protocol. */
 export type AvProtocolRequest = {
@@ -13,6 +15,12 @@ export type AvProtocolRequest = {
      * in the same form as the paths `protocol.surface()` returns.
      */
     readonly path: string;
+    /**
+     * The request URL's query, as received (not yet URL-decoded) and without its
+     * `?`: `q=…&v=…`. Read only by a cached read's `GET`; omitted or `""` when
+     * the URL has none.
+     */
+    readonly query?: string;
     /**
      * The request headers as the host received them. Names in any case (they
      * are case-insensitive); a repeated header as its list of values; an entry
@@ -56,12 +64,14 @@ export type DecodedOperationRequest = Extract<DecodedOperation, {
     ok: true;
 }>;
 /** What `protocol.decodeTransaction` answers. */
-export type DecodedTransaction = Decoded<ClientTransactionRequest | AgentTransactionRequest>;
+export type DecodedTransaction = Decoded<AvClientTransactionRequest | AvAgentTransactionRequest>;
 /**
  * `protocol.decodeOperation(request)` — one operation route's HTTP request as
  * the client-origin request `framework.execute` takes, or its answer.
  */
 export declare function decodeOperationRequest(contracts: AvContracts, received: AvProtocolRequest, origin?: RemoteRequestOrigin): DecodedOperation;
+/** {@link decodeOperationRequest} over a request already read. */
+export declare function decodeOperationRead(contracts: AvContracts, read: ReadRequest, origin: RemoteRequestOrigin): DecodedOperation;
 /**
  * `protocol.decodeTransaction(request)` — the `/_transactions` request as the client-
  * origin plan request `framework.executeTransaction` takes, or its answer. The same
@@ -71,10 +81,49 @@ export declare function decodeOperationRequest(contracts: AvContracts, received:
  * say otherwise. The body is the plan verbatim.
  */
 export declare function decodeTransactionRequest(contracts: AvContracts, received: AvProtocolRequest, origin?: RemoteRequestOrigin): DecodedTransaction;
+/** A `/_access/can` request as core answers it: its origin, identity and body. */
+type DecodedCanRequest = {
+    readonly origin: RemoteRequestOrigin;
+    readonly requestId: string;
+    readonly protocol: AvRequestProtocol;
+    /** The body, a JSON object: `{ questions }`, read by core. */
+    readonly body: object;
+};
+/**
+ * The `/_access/can` request as the request core answers, or its answer: the same
+ * steps as {@link decodeTransactionRequest}, with the path exactly `/_access/can`
+ * and its absence being a Contract without its `access` section. The body is read
+ * as a JSON object and handed to core verbatim; its `questions` are core's to
+ * judge.
+ */
+export declare function decodeCanRequest(contracts: AvContracts, received: AvProtocolRequest, origin?: RemoteRequestOrigin): Decoded<DecodedCanRequest>;
+/**
+ * A client request's method — `POST`, or `GET` for a cached read — and its
+ * headers, in one spelling.
+ */
+export declare function transportOf(read: ReadRequest): AvTransportContext;
+/**
+ * Step 5, after the route checks passed: the body as a JSON object, or the answer
+ * refusing it. Only the raw arm is measured, typed and parsed.
+ */
+export declare function readBody(read: ReadRequest, contracts: AvContracts, origin: RemoteRequestOrigin): {
+    readonly ok: true;
+    readonly value: object;
+} | {
+    readonly ok: false;
+    readonly response: AvProtocolResponse;
+};
+/**
+ * Records `value` as a body the protocol parsed itself: a cached read's
+ * arguments, `JSON.parse` output of its `q` that nothing else holds.
+ */
+export declare function adoptParsedBody(value: object): void;
 /**
  * Whether `value` is a body this decoder parsed from raw content. Only the protocol's
  * own shortcuts ask, about a request they have just decoded, before any host code
  * could hold it; it is exported from no entry point.
  */
 export declare function isParsedByDecoder(value: unknown): boolean;
+/** Marks `value`, a part of a body this decoder parsed from raw content, as parsed here. */
+export declare function markParsedByDecoder(value: object): void;
 export {};

package/dist/protocol/http-request.decoder.js

@@ -1,16 +1,23 @@
-import { checkOperationRoute, checkTransactionsRoute, } from "./absent-route.responder.js";
-import { readRequest } from "./http-request.reader.js";
+import { checkOperationRoute, checkPostRoute, } from "./absent-route.responder.js";
+import { ACCESS_CAN_ROUTE, POST_ONLY, readRequest, TRANSACTIONS_ROUTE, } from "./http-request.reader.js";
 import { transportFailure, } from "./protocol-failure.js";
 import { headerValue } from "./protocol-headers.js";
+import { uncachedAnswer } from "./read-cache.responder.js";
 export function decodeOperationRequest(contracts, received, origin = "client") {
     const read = readRequest(received);
     if (!read.ok) {
         return read;
     }
+    return decodeOperationRead(contracts, read, origin);
+}
+export function decodeOperationRead(contracts, read, origin) {
     const route = checkOperationRoute(contracts, read, origin);
     if (!route.ok) {
         return refused(route.response, read.requestId);
     }
+    if (read.request.method !== "POST") {
+        return refused(uncachedAnswer(transportFailure("A2012", read.requestId, POST_ONLY)), read.requestId);
+    }
     const body = readBody(read, contracts, origin);
     return body.ok
         ? {
@@ -33,7 +40,7 @@ export function decodeTransactionRequest(contracts, received, origin = "client")
     if (!read.ok) {
         return read;
     }
-    const route = checkTransactionsRoute(contracts, read, origin);
+    const route = checkPostRoute(TRANSACTIONS_ROUTE, contracts, read, origin);
     if (!route.ok) {
         return refused(route.response, read.requestId);
     }
@@ -52,13 +59,39 @@ export function decodeTransactionRequest(contracts, received, origin = "client")
         }
         : refused(body.response, read.requestId);
 }
+export function decodeCanRequest(contracts, received, origin = "client") {
+    const read = readRequest(received);
+    if (!read.ok) {
+        return read;
+    }
+    const route = checkPostRoute(ACCESS_CAN_ROUTE, contracts, read, origin);
+    if (!route.ok) {
+        return refused(route.response, read.requestId);
+    }
+    const body = readBody(read, contracts, origin);
+    return body.ok
+        ? {
+            ok: true,
+            request: {
+                origin,
+                requestId: read.requestId,
+                protocol: route.protocol,
+                body: body.value,
+            },
+            requestId: read.requestId,
+        }
+        : refused(body.response, read.requestId);
+}
 function refused(response, requestId) {
     return { ok: false, response, requestId };
 }
-function transportOf(read) {
-    return { method: "POST", headers: read.headers };
+export function transportOf(read) {
+    return {
+        method: read.request.method === "GET" ? "GET" : "POST",
+        headers: read.headers,
+    };
 }
-function readBody(read, contracts, origin) {
+export function readBody(read, contracts, origin) {
     const code = bodyValue(read.request.body, headerValue(read.headers, "content-type"), contracts[origin].limits.maxRequestBytes);
     return typeof code === "string"
         ? { ok: false, response: transportFailure(code, read.requestId) }
@@ -92,9 +125,15 @@ function bodyValue(body, contentType, maxRequestBytes) {
     return { value };
 }
 const PARSED_HERE = new WeakSet();
+export function adoptParsedBody(value) {
+    PARSED_HERE.add(value);
+}
 export function isParsedByDecoder(value) {
     return typeof value === "object" && value !== null && PARSED_HERE.has(value);
 }
+export function markParsedByDecoder(value) {
+    PARSED_HERE.add(value);
+}
 function isJsonMediaType(contentType) {
     return (contentType
         ?.split(";")[0]

package/dist/protocol/http-request.reader.d.ts

@@ -1,13 +1,19 @@
-import type { ClientProtocolIdentity } from "../runtime/operation-request.js";
+import type { AvRequestProtocol } from "../runtime/operation-request.js";
 import type { OperationRouteSegments } from "./absent-route.responder.js";
 import type { AvProtocolRequest } from "./http-request.decoder.js";
 import type { AvProtocolResponse } from "./http-response.encoder.js";
 /** `POST <api>/_transactions`. */
 export declare const TRANSACTIONS_ROUTE = "/_transactions";
+/** `POST <api>/_access/can`. */
+export declare const ACCESS_CAN_ROUTE = "/_access/can";
+/** `POST <api>/_all`: one Operation Set. */
+export declare const ALL_ROUTE = "/_all";
 /** `GET <api>/_contract`. */
 export declare const CONTRACT_ROUTE = "/_contract";
 /** The methods an operation or `/_transactions` route accepts: `POST`, only. */
 export declare const POST_ONLY: readonly string[];
+/** The methods a cached read's route accepts: `GET` and `POST`. */
+export declare const GET_AND_POST: readonly string[];
 /** The methods the contract route accepts: `GET`, only. */
 export declare const GET_ONLY: readonly string[];
 /**
@@ -25,10 +31,10 @@ export type ReadRequest = {
     /** Adopted from `Aventara-Request-Id`, else minted. */
     readonly requestId: string;
     /** `undefined` when either identity header is absent (`A2000`). */
-    readonly protocol: ClientProtocolIdentity | undefined;
+    readonly protocol: AvRequestProtocol | undefined;
 };
 /** What a value that is not an `AvProtocolRequest` reads as. */
-export type UnreadableRequest = {
+type UnreadableRequest = {
     readonly ok: false;
     readonly response: AvProtocolResponse;
     readonly requestId: string;
@@ -43,3 +49,4 @@ export declare function readRequest(received: unknown): ReadRequest | Unreadable
  * `undefined` when it is not one.
  */
 export declare function operationRouteSegments(path: string): OperationRouteSegments | undefined;
+export {};

package/dist/protocol/http-request.reader.js

@@ -3,8 +3,11 @@ import { transportFailure } from "./protocol-failure.js";
 import { adoptedRequestId, normalizeHeaders, protocolIdentityOf, } from "./protocol-headers.js";
 const OPERATION_ROUTE = /^\/_resources\/([^/]*)\/([^/]*)\/([^/]*)$/;
 export const TRANSACTIONS_ROUTE = "/_transactions";
+export const ACCESS_CAN_ROUTE = "/_access/can";
+export const ALL_ROUTE = "/_all";
 export const CONTRACT_ROUTE = "/_contract";
 export const POST_ONLY = Object.freeze(["POST"]);
+export const GET_AND_POST = Object.freeze(["GET", "POST"]);
 export const GET_ONLY = Object.freeze(["GET"]);
 export function isProtocolPath(path) {
     return path.startsWith("/_");
@@ -53,14 +56,21 @@ function malformedRequest() {
 }
 function wellFormedRequest(received) {
     try {
-        const { method, path, headers, body } = received;
+        const { method, path, query, headers, body } = received;
         const copied = headerRecord(headers);
         const armed = armedBody(body);
         return typeof method === "string" &&
             typeof path === "string" &&
+            (query === undefined || typeof query === "string") &&
             copied !== undefined &&
             armed !== undefined
-            ? { method, path, headers: copied, body: armed }
+            ? {
+                method,
+                path,
+                ...(query === undefined ? {} : { query }),
+                headers: copied,
+                body: armed,
+            }
             : undefined;
     }
     catch {

package/dist/protocol/http-response.encoder.d.ts

@@ -38,3 +38,15 @@ export declare function encodeOperationResponse(response: AvOperationResponse, r
  * as `cause.operation`, as every internal failure inside a plan does.
  */
 export declare function encodeTransactionResponse(response: AvTransactionResponse, requestId: string, report?: UnencodableReport): AvProtocolResponse;
+/**
+ * An Operation Set's answer: `200 A1000`, `data` holding each entry's envelope
+ * text under its key, in the order given.
+ */
+export declare function encodeOperationSetResponse(entries: readonly {
+    readonly key: string;
+    readonly envelope: string;
+}[], requestId: string): AvProtocolResponse;
+/** One line of a streamed Operation Set answer: the entry's key and its envelope text. */
+export declare function operationSetLine(key: string, envelope: string): string;
+/** The headers of a streamed Operation Set answer. */
+export declare function streamedHeaders(requestId: string): Readonly<Record<string, string>>;

package/dist/protocol/http-response.encoder.js

@@ -1,7 +1,7 @@
 import { encodeBase64, WIRE_SCALAR_PATTERNS, } from "../contracts/wire-scalar-format.js";
-import { AvDecimal } from "../runtime/decimal.js";
+import { isAvDecimal } from "../runtime/decimal.js";
 import { SERIALIZATION_FAILURE_MESSAGE } from "../runtime/error-boundary.js";
-import { operationFailure, } from "../runtime/operation-response.js";
+import { operationFailure, operationSuccess, } from "../runtime/operation-response.js";
 import { httpStatus } from "./http-status.table.js";
 import { headers } from "./protocol-headers.js";
 export function encodeOperationResponse(response, requestId, report) {
@@ -37,6 +37,20 @@ export function encodeTransactionResponse(response, requestId, report) {
         return written(serializationFailure(step), "null", requestId);
     }
 }
+export function encodeOperationSetResponse(entries, requestId) {
+    return written(operationSuccess(null, "A1000"), `{${entries.map(({ key, envelope }) => `${JSON.stringify(key)}:${envelope}`).join(",")}}`, requestId);
+}
+export function operationSetLine(key, envelope) {
+    return `{"key":${JSON.stringify(key)},"envelope":${envelope}}\n`;
+}
+export function streamedHeaders(requestId) {
+    return {
+        "Content-Type": "application/x-ndjson",
+        "Cache-Control": "no-store",
+        "X-Accel-Buffering": "no",
+        [headers.requestId]: requestId,
+    };
+}
 function serializationFailure(operation) {
     return operationFailure("A3003", {
         message: SERIALIZATION_FAILURE_MESSAGE,
@@ -161,7 +175,7 @@ function scalarWireText(value) {
         }
         return JSON.stringify(wire);
     }
-    if (value instanceof AvDecimal) {
+    if (isAvDecimal(value)) {
         return JSON.stringify(value.toString());
     }
     if (value instanceof Uint8Array) {

package/dist/protocol/operation-response.guard.js

@@ -1,5 +1,6 @@
 import { VALIDATION_CODES } from "../operations/validation-code.js";
 import { OPERATION_CODES, } from "../runtime/operation-response.js";
+import { isRecord } from "../runtime/record.guard.js";
 export function isOperationResponse(value) {
     if (!isRecord(value) || !Object.hasOwn(value, "data")) {
         return false;
@@ -13,9 +14,6 @@ export function isOperationResponse(value) {
     }
     return value.data === null && isCause(value.cause);
 }
-function isRecord(value) {
-    return typeof value === "object" && value !== null && !Array.isArray(value);
-}
 function isOperationCode(value) {
     return OPERATION_CODES.some((code) => code === value);
 }

package/dist/protocol/operation-set.decoder.d.ts

@@ -0,0 +1,48 @@
+import type { AvContracts } from "../compiler/contract.compiler.js";
+import type { RemoteRequestOrigin } from "../config/config-layer.js";
+import type { AvRequestProtocol } from "../runtime/operation-request.js";
+import type { AvTransportContext } from "../runtime/pipeline.js";
+import { type AvProtocolRequest } from "./http-request.decoder.js";
+import { type AvProtocolResponse } from "./http-response.encoder.js";
+/** One entry of an Operation Set as the decoder read it: its key, the operation it names, and its arguments. */
+export type OperationSetEntry = {
+    readonly key: string;
+    readonly resource: string;
+    readonly family: string;
+    readonly variant: string;
+    /** A JSON object: the operation's arguments, as its single route's body. */
+    readonly args: object;
+};
+/** A decoded `/_all` request: what every entry shares, and the entries in the request's own key order. */
+export type DecodedOperationSet = {
+    readonly origin: RemoteRequestOrigin;
+    readonly requestId: string;
+    readonly protocol: AvRequestProtocol;
+    readonly transport: AvTransportContext;
+    readonly entries: readonly OperationSetEntry[];
+    /** Whether the request asked for the streamed answer (`Accept: application/x-ndjson`). */
+    readonly streamed: boolean;
+};
+/** What `decodeAllRequest` answers: the set, or the response that answers the whole request. */
+type DecodedAll = {
+    readonly ok: true;
+    readonly request: DecodedOperationSet;
+    readonly requestId: string;
+} | {
+    readonly ok: false;
+    readonly response: AvProtocolResponse;
+    readonly requestId: string;
+};
+/**
+ * `POST /_all` — the request as the Operation Set core runs, or the answer that
+ * refuses it whole. The same steps as `decodeTransaction` up to the body: request
+ * id, path (exactly `/_all`), identity headers, version, hash, the route's
+ * presence, method, then size, content type and JSON. Then the body's shape, in
+ * order: exactly the `operations` member (`A2004`), an object of entries
+ * (`A2004`/`V1001`), at least one (`A2004`/`V1004`), at most `limits.maxAll`
+ * (`422 A2009`/`V1014`), every key an identifier (`A2004`/`V1001` at
+ * `["operations"]`, the key not echoed), and every entry exactly `resource`,
+ * `family` and `variant` strings and an `args` object (`A2004` at its member).
+ */
+export declare function decodeAllRequest(contracts: AvContracts, received: AvProtocolRequest, origin?: RemoteRequestOrigin): DecodedAll;
+export {};