@aventara/core 1.0.0-rc.1 → 1.0.0-rc.11

package/dist/protocol/protocol.handler.d.ts

@@ -1,8 +1,10 @@
 import type { AvContracts } from "../compiler/contract.compiler.js";
 import type { RemoteRequestOrigin } from "../config/config-layer.js";
 import type { AvFramework } from "../framework/framework.js";
-import { type AvDiagnosticsSink } from "../runtime/diagnostics-reporter.js";
+import type { AccessQuestionsAnswerer } from "../policy/access-question.runtime.js";
+import { type AvDiagnosticsSink, createReporter } from "../runtime/diagnostics-reporter.js";
 import type { RemoteOperationRequest } from "../runtime/operation-request.js";
+import { type AvOperationFailureResponse, type AvOperationResponse } from "../runtime/operation-response.js";
 import type { OwnedExecution } from "../runtime/owned-execution.registry.js";
 import type { AvState } from "../runtime/request-state.js";
 import { type AvProtocolRequest } from "./http-request.decoder.js";
@@ -21,12 +23,46 @@ export type HandlerContext = {
     readonly executeTransaction: AvFramework["executeTransaction"];
     readonly owned: OwnedExecution | undefined;
     readonly sink: AvDiagnosticsSink | undefined;
+    /** The Framework's `can` answerer: absent for one without `access`, or anything `createFramework` did not return. */
+    readonly can: AccessQuestionsAnswerer | undefined;
 };
+/** A decoded operation as the shortcut runs it: the arguments it reads, and its entry. */
+export type AdmittedOperation = {
+    readonly request: RemoteOperationRequest;
+    /**
+     * `member` is an Operation Set entry's (its principal, derived once for the
+     * set, and its key), which only a constructed Framework's owned entry reads.
+     */
+    readonly run: (request: RemoteOperationRequest, member?: OperationSetMember) => Promise<AvOperationResponse>;
+};
+/**
+ * The entry a decoded operation runs through, with the arguments it reads, settled
+ * at the call, before the shortcut's first await. A body parsed here from raw
+ * content is fresh and runs uncopied. A host's `{ kind: "parsed" }` body is the
+ * host's object, so it is copied here, as `framework.execute` copies a server-side
+ * caller's arguments when called: a change the host makes after the call changes
+ * nothing, and a body that cannot be copied is answered as that door answers it
+ * (`A2004`/`V1001` at its path), never read again.
+ */
+export declare function admitOperation(context: HandlerContext, request: RemoteOperationRequest): AdmittedOperation;
+/** What an Operation Set entry runs under besides its request: the set's principal, and its key. */
+type OperationSetMember = NonNullable<Parameters<OwnedExecution["execute"]>[2]>;
 /** What a host passes beside one protocol request. */
 export type ProtocolCallOptions = {
     /** Seeds the request's `ctx.$state`; called once, after decoding. Omitted, the state is `{}`. */
     readonly state?: () => AvState | Promise<AvState>;
 };
+/** The request's seeded state, or the failure the seed's throw answers. */
+export declare function seededState(options: ProtocolCallOptions | undefined, report: ReturnType<typeof createReporter>, view: {
+    readonly path: readonly (string | number)[];
+    readonly arguments: unknown;
+}): Promise<{
+    readonly ok: true;
+    readonly state: AvState | undefined;
+} | {
+    readonly ok: false;
+    readonly response: AvOperationFailureResponse;
+}>;
 /**
  * Where a plan's `A3003` goes: the Framework's diagnostics sink, as a `"transaction"`
  * diagnostic — client origin, the request id the plan ran under, and the step the
@@ -62,3 +98,11 @@ export declare function handleOperationRequest(context: HandlerContext, request:
  * planUnencodableReport}.
  */
 export declare function handleTransactionRequest(context: HandlerContext, request: AvProtocolRequest, options?: ProtocolCallOptions): Promise<AvProtocolResponse>;
+/**
+ * `protocol.handleCan(request)`: the `/_access/can` request decoded, its state
+ * seeded, its questions answered by the bound Framework, and the answer encoded —
+ * `200 A1000` with one boolean per question, in order, or the refusal. Total over
+ * any value, as {@link handleOperationRequest} is.
+ */
+export declare function handleCanRequest(context: HandlerContext, request: AvProtocolRequest, options?: ProtocolCallOptions): Promise<AvProtocolResponse>;
+export {};

package/dist/protocol/protocol.handler.js

@@ -1,18 +1,67 @@
+import { copyAtDoor } from "../runtime/caller-data.door.js";
 import { createDiagnosticsReporter, createReporter, } from "../runtime/diagnostics-reporter.js";
 import { sanitizeOperationFailure } from "../runtime/error-boundary.js";
-import { decodeOperationRequest, decodeTransactionRequest, isParsedByDecoder, } from "./http-request.decoder.js";
+import { internalFailure, } from "../runtime/operation-response.js";
+import { capturePlanAtCall } from "../transactions/transaction-plan-validator.js";
+import { checkOperationRoute } from "./absent-route.responder.js";
+import { adoptParsedBody, decodeCanRequest, decodeOperationRead, decodeTransactionRequest, isParsedByDecoder, transportOf, } from "./http-request.decoder.js";
+import { readRequest } from "./http-request.reader.js";
 import { encodeOperationResponse, encodeTransactionResponse, } from "./http-response.encoder.js";
-function operationEntry(context, request) {
-    return context.owned !== undefined && isParsedByDecoder(request.arguments)
-        ? context.owned.execute
-        : context.execute;
+import { transportFailure } from "./protocol-failure.js";
+import { headerValue } from "./protocol-headers.js";
+import { cachedReadAnswer, uncachedAnswer } from "./read-cache.responder.js";
+import { readArgumentsOf } from "./read-query.codec.js";
+export function admitOperation(context, request) {
+    const owned = context.owned;
+    if (isParsedByDecoder(request.arguments)) {
+        return {
+            request,
+            run: owned === undefined
+                ? (admitted) => context.execute(admitted)
+                : (admitted, member) => owned.execute(admitted, undefined, member),
+        };
+    }
+    const copy = copyAtDoor(request.arguments);
+    if (owned === undefined) {
+        return {
+            request: copy.ok ? { ...request, arguments: copy.value } : request,
+            run: (admitted) => context.execute(admitted),
+        };
+    }
+    if (copy.ok) {
+        return {
+            request: { ...request, arguments: copy.value },
+            run: (admitted, member) => owned.execute(admitted, undefined, member),
+        };
+    }
+    return {
+        request: { ...request, arguments: {} },
+        run: (admitted, member) => owned.execute(admitted, copy.error, member),
+    };
 }
-function transactionEntry(context, request) {
-    return context.owned !== undefined && isParsedByDecoder(request.plan)
-        ? context.owned.executeTransaction
-        : context.executeTransaction;
+function admitTransaction(context, request) {
+    const owned = context.owned;
+    if (isParsedByDecoder(request.plan)) {
+        return {
+            request,
+            run: owned?.executeTransaction ?? context.executeTransaction,
+        };
+    }
+    const captured = capturePlanAtCall(request.plan);
+    if (owned === undefined) {
+        return {
+            request: captured.refused.size === 0
+                ? { ...request, plan: captured.plan }
+                : request,
+            run: context.executeTransaction,
+        };
+    }
+    return {
+        request: { ...request, plan: captured.plan },
+        run: (admitted) => owned.executeTransaction(admitted, captured.refused.size === 0 ? undefined : captured.refused),
+    };
 }
-async function seededState(options, report, view) {
+export async function seededState(options, report, view) {
     if (options?.state === undefined) {
         return { ok: true, state: undefined };
     }
@@ -44,32 +93,128 @@ export function operationUnencodableReport(sink, request) {
     return (error) => createDiagnosticsReporter(sink, request)(error, "A3003");
 }
 export async function handleOperationRequest(context, request, options) {
-    const decoded = decodeOperationRequest(context.contracts, request, context.origin);
+    const read = readRequest(request);
+    if (!read.ok) {
+        return read.response;
+    }
+    if (read.request.method === "GET") {
+        return handleCachedRead(context, read, options);
+    }
+    const decoded = decodeOperationRead(context.contracts, read, context.origin);
     if (!decoded.ok) {
         return decoded.response;
     }
-    const seeded = await seededState(options, createDiagnosticsReporter(context.sink, decoded.request), { path: ["arguments"], arguments: decoded.request.arguments });
+    return runOperation(context, decoded, options);
+}
+async function runOperation(context, decoded, options) {
+    const admitted = admitOperation(context, decoded.request);
+    const seeded = await seededState(options, createDiagnosticsReporter(context.sink, admitted.request), { path: ["arguments"], arguments: admitted.request.arguments });
     const response = seeded.ok
-        ? await operationEntry(context, decoded.request)(seeded.state === undefined
-            ? decoded.request
-            : { ...decoded.request, state: seeded.state })
+        ? await admitted.run(seeded.state === undefined
+            ? admitted.request
+            : { ...admitted.request, state: seeded.state })
         : seeded.response;
     return encodeOperationResponse(response, decoded.requestId, operationUnencodableReport(context.sink, decoded.request));
 }
+async function handleCachedRead(context, read, options) {
+    const route = checkOperationRoute(context.contracts, read, context.origin);
+    if (!route.ok) {
+        return uncachedAnswer(route.response);
+    }
+    const { cache, query } = route;
+    if (cache === undefined || query === undefined) {
+        return uncachedAnswer(transportFailure("A2000", read.requestId));
+    }
+    const args = await readArgumentsOf(query.q, context.contracts[context.origin].limits.maxRequestBytes);
+    if (!args.ok) {
+        return uncachedAnswer(transportFailure(args.code, read.requestId));
+    }
+    adoptParsedBody(args.value);
+    const request = {
+        origin: context.origin,
+        requestId: read.requestId,
+        resource: route.resource,
+        ...route.operation,
+        protocol: route.protocol,
+        transport: transportOf(read),
+        arguments: args.value,
+    };
+    const ifNoneMatch = headerValue(read.headers, "if-none-match");
+    const owned = context.owned;
+    if (cache.for !== "anonymous" || owned === undefined) {
+        const answer = await runOperation(context, { ok: true, request, requestId: read.requestId }, options);
+        return cachedReadAnswer(answer, cache, ifNoneMatch, false);
+    }
+    const report = createDiagnosticsReporter(context.sink, request);
+    const seeded = await seededState(options, report, {
+        path: ["arguments"],
+        arguments: request.arguments,
+    });
+    if (!seeded.ok) {
+        return uncachedAnswer(encodeOperationResponse(seeded.response, read.requestId));
+    }
+    const state = seeded.state ?? {};
+    let caller;
+    try {
+        caller = await owned.caller({ origin: context.origin, state });
+    }
+    catch (error) {
+        report(error, "A3000");
+        return uncachedAnswer(encodeOperationResponse(internalFailure(), read.requestId));
+    }
+    const response = await owned.execute({ ...request, state }, undefined, caller === undefined ? undefined : { caller });
+    return cachedReadAnswer(encodeOperationResponse(response, read.requestId, operationUnencodableReport(context.sink, request)), cache, ifNoneMatch, isAnonymous(caller, read.headers));
+}
+function isAnonymous(caller, headers) {
+    return caller === undefined
+        ? headerValue(headers, "cookie") === undefined &&
+            headerValue(headers, "authorization") === undefined
+        : caller.principal === null || caller.principal === undefined;
+}
 export async function handleTransactionRequest(context, request, options) {
     const decoded = decodeTransactionRequest(context.contracts, request, context.origin);
     if (!decoded.ok) {
         return decoded.response;
     }
+    const admitted = admitTransaction(context, decoded.request);
     const seeded = await seededState(options, createReporter(context.sink, {
         kind: "transaction",
         origin: context.origin,
         requestId: decoded.requestId,
-    }), { path: ["plan"], arguments: decoded.request.plan });
+    }), { path: ["plan"], arguments: admitted.request.plan });
     const response = seeded.ok
-        ? await transactionEntry(context, decoded.request)(seeded.state === undefined
-            ? decoded.request
-            : { ...decoded.request, state: seeded.state })
+        ? await admitted.run(seeded.state === undefined
+            ? admitted.request
+            : { ...admitted.request, state: seeded.state })
         : seeded.response;
     return encodeTransactionResponse(response, decoded.requestId, planUnencodableReport(context.sink, decoded.requestId, context.origin));
 }
+export async function handleCanRequest(context, request, options) {
+    const decoded = decodeCanRequest(context.contracts, request, context.origin);
+    if (!decoded.ok) {
+        return decoded.response;
+    }
+    const { requestId, body } = decoded.request;
+    const report = createReporter(context.sink, {
+        kind: "can",
+        origin: "client",
+        requestId,
+    });
+    if (context.can === undefined) {
+        report(new Error("The bound Framework has no answerer for /_access/can."), "A3000");
+        return encodeOperationResponse(internalFailure(), requestId);
+    }
+    const seeded = await seededState(options, report, {
+        path: ["questions"],
+        arguments: body,
+    });
+    const response = seeded.ok
+        ? await context.can({
+            origin: context.origin,
+            requestId,
+            ...(seeded.state === undefined ? {} : { state: seeded.state }),
+            body,
+        })
+        : seeded.response;
+    return encodeOperationResponse(response, requestId);
+}

package/dist/protocol/read-cache.responder.d.ts

@@ -0,0 +1,26 @@
+import type { AvContractClient } from "../contracts/contract.js";
+import type { AvProtocolResponse } from "./http-response.encoder.js";
+/** A cached read's mark, as the Client Contract states it. */
+type ReadCacheMark = NonNullable<NonNullable<AvContractClient["resources"][string]["cache"]>["first" | "unique" | "many" | "count"]>;
+/**
+ * A `GET`'s answer that must not be kept: `Cache-Control: no-store` (with
+ * `Referrer-Policy: no-referrer` and `X-Content-Type-Options: nosniff`). Every
+ * refusal, a stale client's `A2005` included, and every answer but `200`.
+ */
+export declare function uncachedAnswer(response: AvProtocolResponse): AvProtocolResponse;
+/**
+ * A cached read's answer. A `200` gets, by the mark's `for`:
+ *
+ * - `"everyone"`: `Cache-Control: public, max-age=<n>`;
+ * - `"anonymous"`: `public` to an `anonymous` caller, `private` otherwise, both
+ *   with `Vary: Authorization, Cookie`;
+ * - `"user"`: `Cache-Control: private, max-age=<n>`, `Vary: Authorization,
+ *   Cookie`;
+ *
+ * and `Referrer-Policy: no-referrer`, `X-Content-Type-Options: nosniff` and an
+ * `ETag` over its body; it is `304` with no body when `ifNoneMatch` names that
+ * tag. A public answer echoes no `Aventara-Request-Id`. Any other status is
+ * {@link uncachedAnswer}.
+ */
+export declare function cachedReadAnswer(response: AvProtocolResponse, cache: ReadCacheMark, ifNoneMatch: string | undefined, anonymous: boolean): Promise<AvProtocolResponse>;
+export {};

package/dist/protocol/read-cache.responder.js

@@ -0,0 +1,47 @@
+import { noneMatchHolds } from "./contract-document.responder.js";
+import { headers, NO_SNIFF } from "./protocol-headers.js";
+const CALLER_VARY = "Authorization, Cookie";
+export function uncachedAnswer(response) {
+    return {
+        ...response,
+        headers: {
+            ...response.headers,
+            "Cache-Control": "no-store",
+            "Referrer-Policy": "no-referrer",
+            ...NO_SNIFF,
+        },
+    };
+}
+export async function cachedReadAnswer(response, cache, ifNoneMatch, anonymous) {
+    if (response.status !== 200) {
+        return uncachedAnswer(response);
+    }
+    const shared = cache.for === "everyone" || (cache.for === "anonymous" && anonymous);
+    const validators = {
+        "Cache-Control": `${shared ? "public" : "private"}, max-age=${cache.maxAge}`,
+        ...(cache.for === "everyone" ? {} : { Vary: CALLER_VARY }),
+        "Referrer-Policy": "no-referrer",
+        ...NO_SNIFF,
+        ETag: `"${await bodyDigest(response.body)}"`,
+    };
+    const kept = { ...response.headers };
+    if (shared) {
+        delete kept[headers.requestId];
+    }
+    if (noneMatchHolds(ifNoneMatch, validators.ETag)) {
+        delete kept["Content-Type"];
+        return { status: 304, headers: { ...kept, ...validators }, body: "" };
+    }
+    return { ...response, headers: { ...kept, ...validators } };
+}
+async function bodyDigest(body) {
+    const digest = new Uint8Array(await globalThis.crypto.subtle.digest("SHA-256", new TextEncoder().encode(body)));
+    let binary = "";
+    for (const byte of digest) {
+        binary += String.fromCharCode(byte);
+    }
+    return btoa(binary)
+        .replace(/\+/g, "-")
+        .replace(/\//g, "_")
+        .replace(/=+$/, "");
+}

package/dist/protocol/read-query.codec.d.ts

@@ -0,0 +1,34 @@
+/** A cached read's query: its two parameters, each percent-decoded once. */
+export type ReadQuery = {
+    /** The arguments, in either form. */
+    readonly q: string;
+    /** The Client Contract hash the client was generated against. */
+    readonly v: string;
+};
+/**
+ * The query's `q` and `v`, or `undefined` when it is anything else: absent,
+ * either parameter missing or repeated, another parameter, or a percent-escape
+ * that does not decode.
+ */
+export declare function readQueryOf(query: string | undefined): ReadQuery | undefined;
+/** What reading `q` answers: the arguments object, or the transport code refusing it. */
+type ReadArguments = {
+    readonly ok: true;
+    readonly value: object;
+} | {
+    readonly ok: false;
+    readonly code: "A2000" | "A2010";
+};
+/**
+ * `q` as the arguments object: plain JSON when it starts with `{`, otherwise
+ * base64url(deflate-raw(JSON)). More than `maxBytes` bytes of JSON, or of
+ * compressed input, is `A2010`; anything that is not base64url, deflate-raw,
+ * UTF-8 or a JSON object is `A2000`.
+ */
+export declare function readArgumentsOf(q: string, maxBytes: number): Promise<ReadArguments>;
+/**
+ * A read's `q`: its arguments' canonical JSON, percent-encoded, or that JSON
+ * deflate-raw'd and base64url'd when that is shorter.
+ */
+export declare function readQueryArgumentOf(args: object): Promise<string>;
+export {};

package/dist/protocol/read-query.codec.js

@@ -0,0 +1,125 @@
+import { canonicalJson } from "../contracts/canonical-json.writer.js";
+const BASE64URL = /^[A-Za-z0-9_-]*$/;
+export function readQueryOf(query) {
+    if (query === undefined || query === "") {
+        return undefined;
+    }
+    const found = new Map();
+    for (const pair of query.split("&")) {
+        const equals = pair.indexOf("=");
+        const name = equals === -1 ? pair : pair.slice(0, equals);
+        if ((name !== "q" && name !== "v") || found.has(name) || equals === -1) {
+            return undefined;
+        }
+        const value = percentDecoded(pair.slice(equals + 1));
+        if (value === undefined) {
+            return undefined;
+        }
+        found.set(name, value);
+    }
+    const q = found.get("q");
+    const v = found.get("v");
+    return q === undefined || v === undefined ? undefined : { q, v };
+}
+function percentDecoded(text) {
+    try {
+        return decodeURIComponent(text);
+    }
+    catch {
+        return undefined;
+    }
+}
+export async function readArgumentsOf(q, maxBytes) {
+    if (q.startsWith("{")) {
+        const bytes = new TextEncoder().encode(q);
+        return bytes.byteLength > maxBytes
+            ? { ok: false, code: "A2010" }
+            : parsedObject(q);
+    }
+    if (!BASE64URL.test(q) || q.length % 4 === 1) {
+        return { ok: false, code: "A2000" };
+    }
+    if (Math.floor((q.length * 3) / 4) > maxBytes) {
+        return { ok: false, code: "A2010" };
+    }
+    const compressed = base64urlBytes(q);
+    const inflated = await inflatedWithin(compressed, maxBytes);
+    if (inflated.ok === false) {
+        return inflated;
+    }
+    let text;
+    try {
+        text = new TextDecoder("utf-8", { fatal: true }).decode(inflated.bytes);
+    }
+    catch {
+        return { ok: false, code: "A2000" };
+    }
+    return parsedObject(text);
+}
+function parsedObject(text) {
+    let value;
+    try {
+        value = JSON.parse(text);
+    }
+    catch {
+        return { ok: false, code: "A2000" };
+    }
+    return typeof value === "object" && value !== null && !Array.isArray(value)
+        ? { ok: true, value }
+        : { ok: false, code: "A2000" };
+}
+function base64urlBytes(text) {
+    const binary = atob(text.replace(/-/g, "+").replace(/_/g, "/") +
+        "=".repeat((4 - (text.length % 4)) % 4));
+    const bytes = new Uint8Array(binary.length);
+    for (let index = 0; index < binary.length; index += 1) {
+        bytes[index] = binary.charCodeAt(index);
+    }
+    return bytes;
+}
+async function inflatedWithin(compressed, maxBytes) {
+    const stream = new Blob([compressed])
+        .stream()
+        .pipeThrough(new DecompressionStream("deflate-raw"));
+    const reader = stream.getReader();
+    const chunks = [];
+    let total = 0;
+    try {
+        for (;;) {
+            const { done, value } = await reader.read();
+            if (done) {
+                break;
+            }
+            total += value.byteLength;
+            if (total > maxBytes) {
+                await reader.cancel().catch(() => undefined);
+                return { ok: false, code: "A2010" };
+            }
+            chunks.push(value);
+        }
+    }
+    catch {
+        return { ok: false, code: "A2000" };
+    }
+    const bytes = new Uint8Array(total);
+    let offset = 0;
+    for (const chunk of chunks) {
+        bytes.set(chunk, offset);
+        offset += chunk.byteLength;
+    }
+    return { ok: true, bytes };
+}
+export async function readQueryArgumentOf(args) {
+    const json = canonicalJson(args);
+    const plain = encodeURIComponent(json);
+    const deflated = await new Response(new Blob([json]).stream().pipeThrough(new CompressionStream("deflate-raw"))).arrayBuffer();
+    let binary = "";
+    for (const byte of new Uint8Array(deflated)) {
+        binary += String.fromCharCode(byte);
+    }
+    const compressed = btoa(binary)
+        .replace(/\+/g, "-")
+        .replace(/\//g, "_")
+        .replace(/=+$/, "");
+    return compressed.length < plain.length ? compressed : plain;
+}

package/dist/runtime/caller-data.copier.d.ts

@@ -1,5 +1,5 @@
 /** Why a caller value could not be copied. */
-export type CallerDataFailureKind = "unreadable-value" | "non-plain-value";
+type CallerDataFailureKind = "unreadable-value" | "non-plain-value";
 /** A data location inside the copied value, from its root. */
 export type CallerDataPath = readonly (string | number)[];
 /**
@@ -41,6 +41,22 @@ export type CallerDataPolicy = {
     readonly keep?: CallerDataKeep;
     readonly mirror?: CallerDataMirror;
 };
+/** The members a structural mirror copies by value rather than mirroring. */
+type MirrorMembers = {
+    /** The policy a member at `path` (from the mirror's root) is copied by, or `undefined`. */
+    readonly copyAt: (path: CallerDataPath) => CallerDataPolicy | undefined;
+    /** Receives a member whose copy failed; the mirror holds `undefined` for it. */
+    readonly refused: (path: CallerDataPath, error: AvCallerDataError) => void;
+};
+/**
+ * Mirrors `value` by its descriptors, as a `$ref` control object is mirrored (no
+ * getter runs, an accessor stays a tripwire), except the members `members.copyAt`
+ * names by their path: each is copied by value under the policy it returns, and one
+ * whose copy fails is reported to `members.refused` and held as `undefined`.
+ *
+ * @throws {@link AvCallerDataError} at `[]` when `value` itself cannot be reflected.
+ */
+export declare function mirrorCallerData(value: object, members: MirrorMembers): unknown;
 /**
  * Places a mirror tripwire's failure in the value the door copied: its path from the
  * copy's root, where `error.path` started from the mirror. A failure that is not a
@@ -55,5 +71,4 @@ export declare function locateCallerDataError(error: AvCallerDataError, copy: un
  *   naming its path from `value`.
  */
 export declare function copyCallerData(value: unknown, policy?: CallerDataPolicy): unknown;
-/** The `V1001` message a door answers a {@link AvCallerDataError} with. */
-export declare function callerDataFailureMessage(kind: CallerDataFailureKind): string;
+export {};

package/dist/runtime/caller-data.copier.js

@@ -1,4 +1,4 @@
-import { AvDecimal } from "./decimal.js";
+import { AvDecimal, decimalDigitsOf, isAvDecimal } from "./decimal.js";
 const FAILURE_MESSAGES = {
     "unreadable-value": "Value could not be read.",
     "non-plain-value": "Value must be plain data.",
@@ -19,7 +19,6 @@ const NO_POLICY = {};
 const OBJECT_PROTOTYPE = Object.prototype;
 const DATE_PROTOTYPE = Date.prototype;
 const dateValueOf = Date.prototype.getTime;
-const decimalValueOf = AvDecimal.prototype.toString;
 const FAST_WALK_DEPTH = 256;
 const SLOW_WALK = Symbol("slow walk");
 class FastWalkFailure {
@@ -33,8 +32,8 @@ function copyValueType(value, prototype) {
     if (prototype === DATE_PROTOTYPE || value instanceof Date) {
         return new Date(dateValueOf.call(value));
     }
-    if (value instanceof AvDecimal) {
-        return new AvDecimal(decimalValueOf.call(value));
+    if (isAvDecimal(value)) {
+        return new AvDecimal(decimalDigitsOf(value));
     }
     if (value instanceof Uint8Array) {
         return new Uint8Array(value);
@@ -268,7 +267,7 @@ function pathSegment(array, key) {
     }
     return key;
 }
-function mirrorControlData(value) {
+function mirrorControlData(value, members) {
     const shape = reflectNode(value);
     if (shape === undefined) {
         throw new AvCallerDataError("unreadable-value", []);
@@ -375,6 +374,20 @@ function mirrorControlData(value) {
                 continue;
             }
             const memberLink = childLink(link, pathSegment(shape.array, key));
+            const byValue = members?.copyAt(pathOf(memberLink));
+            if (byValue !== undefined) {
+                try {
+                    store(copyCallerData(member, byValue));
+                }
+                catch (error) {
+                    if (!(error instanceof AvCallerDataError)) {
+                        throw error;
+                    }
+                    members?.refused(pathOf(memberLink), error);
+                    store(undefined);
+                }
+                continue;
+            }
             const memberShape = reflectNode(member);
             if (memberShape === undefined) {
                 store(UNREADABLE);
@@ -408,6 +421,9 @@ function mirrorControlData(value) {
     }
     return root;
 }
+export function mirrorCallerData(value, members) {
+    return mirrorControlData(value, members);
+}
 export function locateCallerDataError(error, copy) {
     const within = error.within;
     if (within === undefined) {
@@ -465,6 +481,3 @@ export function copyCallerData(value, policy = NO_POLICY) {
     }
     return guardNative(() => copyFast(value, 0, policy), (failure) => copySlow(value, policy, failure instanceof FastWalkFailure ? failure.at : undefined));
 }
-export function callerDataFailureMessage(kind) {
-    return FAILURE_MESSAGES[kind];
-}

package/dist/runtime/caller-data.door.d.ts

@@ -6,15 +6,21 @@ import type { AvMisuseEvent, MisuseReporter } from "./misuse-reporter.js";
  *
  * - `"caller"`: a server-side caller's own objects — copied at the door.
  * - `"owned"`: data no caller holds a reference to — a body the protocol decoder
- *   parsed with `JSON.parse` for this request alone, or a plan the typed runner
- *   assembled from copies its builders took. It is never copied again.
+ *   parsed with `JSON.parse` for this request alone, a host's parsed body the
+ *   protocol's shortcut copied at the call, or a plan the typed runner assembled
+ *   from copies its builders took. It is never copied again.
  *
- * Only core's own modules choose `"owned"`: the public `framework.execute` and
- * `executeTransaction` always pass `"caller"`.
+ * - `{ refused }`: a body the protocol's shortcut copied at the call, whose copy
+ *   failed — answered at the door as `"caller"` would answer it, never read again.
+ *
+ * Only core's own modules choose anything but `"caller"`: the public
+ * `framework.execute` and `executeTransaction` always pass `"caller"`.
  */
-export type ArgumentsSource = "caller" | "owned";
+export type ArgumentsSource = "caller" | "owned" | {
+    readonly refused: AvCallerDataError;
+};
 /** The operation identity a misuse event may name, as far as it could be read. */
-export type MisuseIdentity = Omit<AvMisuseEvent, "kind" | "path">;
+type MisuseIdentity = Omit<AvMisuseEvent, "kind" | "path">;
 /**
  * The identity of a request the framework holds a copy of, keeping only what is
  * identity: an origin, a Resource name and a standard operation, each present only
@@ -54,3 +60,4 @@ export declare function copyAtDoor(value: unknown, policy?: CallerDataPolicy): C
  * plan validator inspects and copies step by step.
  */
 export declare function copyEnvelopeAtDoor(request: unknown, members: readonly string[]): CallerDataCopy;
+export {};