@aventara/core 1.0.0-rc.10 → 1.0.0-rc.11

package/dist/policy/access-question.runtime.js

@@ -8,6 +8,7 @@ import { createReporter, } from "../runtime/diagnostics-reporter.js";
 import { ADAPTER_FAILURE_MESSAGE, deliberateRefusalCode, } from "../runtime/error-boundary.js";
 import { internalFailure, operationFailure, operationSuccess, } from "../runtime/operation-response.js";
 import { VALIDATION_OUTCOME_MESSAGES } from "../runtime/outcome-mapper.js";
+import { isRecord } from "../runtime/record.guard.js";
 import { requestStateOf } from "../runtime/request-state.resolver.js";
 import { normalizeOperationScalarValues } from "../runtime/scalar-runtime.js";
 import { admitByPolicy } from "./policy-admission.js";
@@ -21,9 +22,6 @@ const QUESTION_KEYS = new Set([
     "action",
     "where",
 ]);
-function isRecord(value) {
-    return typeof value === "object" && value !== null && !Array.isArray(value);
-}
 const LIMIT_CODES = new Set([
     "V1013",
     "V1014",

package/dist/policy/policy-admission.js

@@ -3,6 +3,7 @@ import { defaultProjectionFields } from "../runtime/computed-read-runtime.js";
 import { valueAt, writeRecordPathsOf } from "../runtime/field-stage.runtime.js";
 import { isRelationMutationDirective, RELATION_MUTATION_RECORD_SITES, } from "../runtime/mutation-planner.js";
 import { operationFailure } from "../runtime/operation-response.js";
+import { isRecord } from "../runtime/record.guard.js";
 import { everyOf, noneOf, someOf, } from "./policy-condition.js";
 import { fieldAccess, } from "./policy-session.js";
 export function policyRefusal(message) {
@@ -22,9 +23,6 @@ function policyActionsOf(family) {
             return ["create", "update"];
     }
 }
-function isRecord(value) {
-    return value !== null && typeof value === "object" && !Array.isArray(value);
-}
 class FieldWalk {
     active;
     used = new Map();

package/dist/policy/policy-after-update.runtime.js

@@ -1,12 +1,10 @@
 import { adapterPrimaryIdentifier } from "../adapters/adapter-identifier.js";
 import { lookupField, lookupResource } from "../contracts/contract-lookup.js";
 import { frozenCopy } from "../runtime/readonly-value.js";
+import { isRecord } from "../runtime/record.guard.js";
 import { policyRefusal } from "./policy-admission.js";
 import { allOf, everyOf, someOf, whereOf, } from "./policy-condition.js";
 import { identifiedRows } from "./policy-read.runtime.js";
-function isRecord(value) {
-    return value !== null && typeof value === "object" && !Array.isArray(value);
-}
 const fieldLists = new WeakMap();
 function listOf(core, key, make) {
     let lists = fieldLists.get(core);

package/dist/policy/policy-nested-write.runtime.js

@@ -3,6 +3,7 @@ import { toOneRelinkWithRewrite } from "../contracts/capability.js";
 import { lookupField, lookupResource } from "../contracts/contract-lookup.js";
 import { isRelationMutationDirective } from "../runtime/mutation-planner.js";
 import { frozenCopy } from "../runtime/readonly-value.js";
+import { isPlainRecord, isRecord } from "../runtime/record.guard.js";
 import { policyRefusal } from "./policy-admission.js";
 import { afterUpdate, beforeFields, checkChanged, coveredBefore, rowFieldsOf, unchangedSince, } from "./policy-after-update.runtime.js";
 import { allOf, noneOf, someOf, whereOf, } from "./policy-condition.js";
@@ -10,16 +11,6 @@ import { NamedRows } from "./policy-named-rows.js";
 import { identifiedRows } from "./policy-read.runtime.js";
 import { isHeldTarget } from "./policy-reference-write.runtime.js";
 import { fieldAccess } from "./policy-session.js";
-function isRecord(value) {
-    return value !== null && typeof value === "object" && !Array.isArray(value);
-}
-function isPlainObject(value) {
-    if (!isRecord(value)) {
-        return false;
-    }
-    const prototype = Object.getPrototypeOf(value);
-    return prototype === Object.prototype || prototype === null;
-}
 function namesReference(selector, references) {
     if (references === undefined) {
         return false;
@@ -32,7 +23,7 @@ function namesReference(selector, references) {
             return (value !== undefined &&
                 value !== null &&
                 !Array.isArray(value) &&
-                !isPlainObject(value));
+                !isPlainRecord(value));
         }));
 }
 const DROPPED = Symbol("dropped");
@@ -46,7 +37,7 @@ function rewritten(value, replaced) {
             ? value
             : entries.filter((entry) => entry !== DROPPED);
     }
-    if (!isPlainObject(value)) {
+    if (!isPlainRecord(value)) {
         return value;
     }
     let changed = false;

package/dist/policy/policy-read.runtime.js

@@ -1,11 +1,9 @@
 import { adapterPrimaryIdentifier } from "../adapters/adapter-identifier.js";
 import { lookupField, lookupResource } from "../contracts/contract-lookup.js";
+import { isRecord } from "../runtime/record.guard.js";
 import { policyRefusal } from "./policy-admission.js";
 import { allOf, anyOf, everyOf, noneOf, someOf, } from "./policy-condition.js";
 import { fieldAccess } from "./policy-session.js";
-function isRecord(value) {
-    return value !== null && typeof value === "object" && !Array.isArray(value);
-}
 function relationOf(core, resource, name) {
     const field = lookupField(lookupResource(core, resource), name);
     return field?.kind === "relation"

package/dist/policy/policy-reference-write.runtime.js

@@ -2,19 +2,10 @@ import { lookupResource } from "../contracts/contract-lookup.js";
 import { advertisedDirectivesAt, } from "../contracts/field.js";
 import { writeScopeOf } from "../contracts/resource-operations.js";
 import { LOOPBACK_WRITE_SCOPE, NESTED_WRITE_SCOPE, TO_MANY_UPDATE_WRITE_SCOPE, } from "../operations/write-scope.resolver.js";
+import { isPlainRecord, isRecord } from "../runtime/record.guard.js";
 import { policyRefusal } from "./policy-admission.js";
 import { allOf, everyOf, noneOf, someOf, whereOf, } from "./policy-condition.js";
 import { NamedRows } from "./policy-named-rows.js";
-function isRecord(value) {
-    return value !== null && typeof value === "object" && !Array.isArray(value);
-}
-function isPlainObject(value) {
-    if (!isRecord(value)) {
-        return false;
-    }
-    const prototype = Object.getPrototypeOf(value);
-    return prototype === Object.prototype || prototype === null;
-}
 const ownedOf = new WeakMap();
 function resourceOf(model, resource) {
     return Object.hasOwn(model.resources, resource)
@@ -149,7 +140,7 @@ function writtenReferences(model, record, resource) {
                 written.length !== owned.fields.length ||
                     references === undefined ||
                     references.length !== owned.fields.length ||
-                    values.some(isPlainObject)
+                    values.some(isPlainRecord)
                     ? { kind: "unstated" }
                     : { kind: "value", values },
             ],

package/dist/policy/policy-request.d.ts

@@ -30,6 +30,37 @@ export declare function openRequestPolicy(policy: ResolvedPolicyConfig | undefin
 }, caller: PolicyCaller | undefined, adapter: AvAdapterOperationExecutor & {
     readonly model: AvAdapterModel;
 }): PolicySession | undefined | Promise<PolicySession | undefined>;
+/**
+ * The principal a remote request runs as, derived once from its state, or
+ * `undefined` when no policy checks it; a promise of it when the principal
+ * arrives as one. A throw, or a rejection, is the caller's to answer as the
+ * server's defect. Under a held state ({@link holdRequestPrincipal}) it is the
+ * principal derived the first time, however often it is asked.
+ */
+export declare function derivePolicyCaller(policy: ResolvedPolicyConfig | undefined, request: {
+    readonly origin: AvRequestOrigin;
+    readonly state: AvState;
+}): PolicyCaller | undefined | Promise<PolicyCaller>;
+/**
+ * Derives and holds `request`'s origin's principal from a held state that
+ * holds none yet; nothing for a state no host held, or for an origin the
+ * policy derives no principal for. Never throws and never rejects: the
+ * request that names its principal is not answered by it. A throw holds
+ * nothing; a rejection is held, observed here, and answers the requests that
+ * later read it.
+ */
+export declare function holdFirstPrincipal(policy: ResolvedPolicyConfig | undefined, request: {
+    readonly origin: AvRequestOrigin;
+    readonly state: AvState;
+}): void;
+/**
+ * Holds `state` as one request's: every request run under this object reads
+ * its principal once, the first time one is derived from it, until the state
+ * is held again. A host calls it once per request, on the state it seeds once
+ * and shares between that request's calls, before any of them runs. Anything
+ * that is not an object is ignored: no request runs under it.
+ */
+export declare function holdRequestPrincipal(state: unknown): void;
 /**
  * Policy admission inside its own boundary, as the Framework Validation Layer's
  * is: a refusal, a defect of the engine or its answers (`A3000`), or an adapter

package/dist/policy/policy-request.js

@@ -1,4 +1,5 @@
 import { AdapterBoundary, sanitizeOperationFailure, } from "../runtime/error-boundary.js";
+import { isThenable } from "../runtime/thenable.guard.js";
 import { admitByPolicy, admitWriteByPolicy } from "./policy-admission.js";
 import { openPolicySession } from "./policy-session.js";
 export function callerOf(options) {
@@ -14,32 +15,83 @@ export function callerOf(options) {
     }
     return principal === undefined ? undefined : { principal };
 }
-function isThenable(value) {
-    return (value !== null &&
-        (typeof value === "object" || typeof value === "function") &&
-        typeof value.then === "function");
-}
 export function openRequestPolicy(policy, core, request, caller, adapter) {
     if (policy === undefined) {
         return undefined;
     }
-    let principal;
     if (caller !== undefined) {
-        principal = caller.principal;
+        holdFirstPrincipal(policy, request);
     }
-    else if (request.origin === "application") {
+    const settled = caller ?? derivePolicyCaller(policy, request);
+    if (settled === undefined) {
         return undefined;
     }
-    else {
-        principal = policy.principal({
-            $state: request.state,
-            $origin: request.origin,
-        });
-        if (isThenable(principal)) {
-            return Promise.resolve(principal).then((settled) => sessionOf(policy, core, request.origin, adapter, settled));
-        }
+    return settled instanceof Promise
+        ? settled.then(({ principal }) => sessionOf(policy, core, request.origin, adapter, principal))
+        : sessionOf(policy, core, request.origin, adapter, settled.principal);
+}
+export function derivePolicyCaller(policy, request) {
+    if (policy === undefined || request.origin === "application") {
+        return undefined;
+    }
+    const held = heldOf(policy, request.state);
+    if (held === undefined) {
+        return principalOf(policy, request);
+    }
+    const known = held.get(request.origin);
+    if (known !== undefined) {
+        return known;
+    }
+    const derived = principalOf(policy, request);
+    held.set(request.origin, derived);
+    return derived;
+}
+export function holdFirstPrincipal(policy, request) {
+    if (policy === undefined || request.origin === "application") {
+        return;
+    }
+    const held = heldOf(policy, request.state);
+    if (held === undefined || held.has(request.origin)) {
+        return;
+    }
+    let derived;
+    try {
+        derived = principalOf(policy, request);
+    }
+    catch {
+        return;
+    }
+    if (derived instanceof Promise) {
+        derived.catch(() => undefined);
+    }
+    held.set(request.origin, derived);
+}
+function heldOf(policy, state) {
+    const held = HELD_PRINCIPALS.get(state);
+    if (held === undefined) {
+        return undefined;
+    }
+    let byOrigin = held.get(policy);
+    if (byOrigin === undefined) {
+        byOrigin = new Map();
+        held.set(policy, byOrigin);
+    }
+    return byOrigin;
+}
+function principalOf(policy, request) {
+    const principal = policy.principal({
+        $state: request.state,
+        $origin: request.origin,
+    });
+    return isThenable(principal)
+        ? Promise.resolve(principal).then((settled) => ({ principal: settled }))
+        : { principal };
+}
+const HELD_PRINCIPALS = new WeakMap();
+export function holdRequestPrincipal(state) {
+    if (typeof state === "object" && state !== null) {
+        HELD_PRINCIPALS.set(state, new Map());
     }
-    return sessionOf(policy, core, request.origin, adapter, principal);
 }
 function sessionOf(policy, core, origin, adapter, principal) {
     return openPolicySession(policy, core, adapter.model, principal, origin, {

package/dist/policy/policy-session.js

@@ -1,6 +1,7 @@
 import { adapterPrimaryIdentifier } from "../adapters/adapter-identifier.js";
 import { lookupField, lookupResource } from "../contracts/contract-lookup.js";
 import { validateOperationArguments } from "../operations/operation-validator-core.js";
+import { isRecord } from "../runtime/record.guard.js";
 import { normalizeOperationScalarValues } from "../runtime/scalar-runtime.js";
 import { encodeOperationArgumentsForWire } from "../transactions/operation-arguments-encoder.js";
 class PolicyDefectError extends Error {
@@ -12,9 +13,6 @@ function isEmptyRecord(value) {
         !Array.isArray(value) &&
         Object.keys(value).length === 0);
 }
-function isRecord(value) {
-    return value !== null && typeof value === "object" && !Array.isArray(value);
-}
 const FRAGMENT_WIRE_ORIGIN = "client";
 function checkedFragment(core, resource, where, what) {
     if (!isRecord(where)) {

package/dist/policy/policy-write.runtime.js

@@ -2,6 +2,7 @@ import { adapterPrimaryIdentifier } from "../adapters/adapter-identifier.js";
 import { lookupField, lookupResource } from "../contracts/contract-lookup.js";
 import { uniqueMissFailure } from "../runtime/outcome-mapper.js";
 import { frozenCopy } from "../runtime/readonly-value.js";
+import { isRecord } from "../runtime/record.guard.js";
 import { policyRefusal } from "./policy-admission.js";
 import { afterCheckFields, afterUpdate, beforeFields, beforeUnreadable, checkChanged, coveredBefore, rowsBefore, unchangedSince, } from "./policy-after-update.runtime.js";
 import { allOf, everyOf, noneOf, someOf, whereOf, } from "./policy-condition.js";
@@ -38,9 +39,6 @@ function fewerChanged(resource, checks, before, changed) {
         : undefined;
 }
 const UNVERIFIABLE = "cannot be verified on this database: it has no interactive transaction to roll the write back in";
-function isRecord(value) {
-    return value !== null && typeof value === "object" && !Array.isArray(value);
-}
 function refused(message) {
     return { kind: "refused", response: policyRefusal(message) };
 }

package/dist/prebuilt/core-version.generated.d.ts

@@ -1,2 +1,2 @@
 /** The version of this `@aventara/core`. */
-export declare const CORE_VERSION = "1.0.0-rc.10";
+export declare const CORE_VERSION = "1.0.0-rc.11";

package/dist/prebuilt/core-version.generated.js

@@ -1 +1 @@
-export const CORE_VERSION = "1.0.0-rc.10";
+export const CORE_VERSION = "1.0.0-rc.11";

package/dist/prebuilt/prebuilt-changes.js

@@ -1,6 +1,4 @@
-function isRecord(value) {
-    return value !== null && typeof value === "object" && !Array.isArray(value);
-}
+import { isRecord } from "../runtime/record.guard.js";
 export function listedNames(names) {
     return names.length < 2
         ? names.join("")

package/dist/prebuilt/prebuilt-contracts.loader.js

@@ -2,14 +2,12 @@ import { bindPrebuiltContracts, } from "../compiler/contract.compiler.js";
 import { recordCanonicalContractText } from "../contracts/contract-canonicalizer.js";
 import { AVENTARA_PROTOCOL_VERSION } from "../contracts/contract-protocol.js";
 import { emitFrameworkWarning } from "../runtime/framework-warning.emitter.js";
+import { isRecord } from "../runtime/record.guard.js";
 import { CORE_VERSION } from "./core-version.generated.js";
 import { listedNames, prebuiltHeaderChanges, prebuiltInputChanges, } from "./prebuilt-changes.js";
 import { PREBUILT_FORMAT } from "./prebuilt-contracts.js";
 import { prebuiltInputsFingerprint, prebuiltPartFingerprints, } from "./prebuilt-inputs.fingerprint.js";
 const PREBUILT_STALE_WARNING = "AVENTARA_PREBUILT_STALE";
-function isRecord(value) {
-    return value !== null && typeof value === "object" && !Array.isArray(value);
-}
 async function changedInputs(stored, model, config) {
     const changes = prebuiltInputChanges(stored, await prebuiltPartFingerprints(model, config));
     return changes.length === 0

package/dist/prebuilt/prebuilt-inputs.fingerprint.js

@@ -2,14 +2,12 @@ import { avzCheckOf } from "../avz/avz-check.registry.js";
 import { jsonShapeOf } from "../avz/json-shape.registry.js";
 import { hashCanonicalContractText } from "../contracts/contract-hash.js";
 import { AVENTARA_PROTOCOL_VERSION } from "../contracts/contract-protocol.js";
+import { isRecord } from "../runtime/record.guard.js";
 import { CORE_VERSION } from "./core-version.generated.js";
 import { PREBUILT_FORMAT } from "./prebuilt-contracts.js";
 const LAYERS = ["root", "application", "client", "agent"];
 const NOT_INPUTS = new Set(["adapter", "prebuilt"]);
 const PER_RESOURCE = "#resources";
-function isRecord(value) {
-    return value !== null && typeof value === "object" && !Array.isArray(value);
-}
 function sortedRecord(record) {
     const keys = Object.keys(record);
     const prototype = Object.getPrototypeOf(record);

package/dist/protocol/absent-route.responder.d.ts

@@ -1,11 +1,14 @@
 import type { AvContracts } from "../compiler/contract.compiler.js";
 import type { RemoteRequestOrigin } from "../config/config-layer.js";
+import type { AvContractClient } from "../contracts/contract.js";
 import { type AvOperationIdentity } from "../operations/operation-identity.js";
 import { type AvDiagnosticsSink } from "../runtime/diagnostics-reporter.js";
 import type { AvRequestProtocol } from "../runtime/operation-request.js";
+import { type AvOperationFailureResponse } from "../runtime/operation-response.js";
 import type { AvProtocolRequest } from "./http-request.decoder.js";
 import { type ReadRequest } from "./http-request.reader.js";
 import { type AvProtocolResponse } from "./http-response.encoder.js";
+import { type ReadQuery } from "./read-query.codec.js";
 /**
  * The absence answers: the checks a framework route makes before it reads a body, runs
  * a pipeline or reaches an Adapter — the protocol version (`A2006`), the
@@ -20,6 +23,43 @@ export type OperationRouteSegments = {
     readonly family: string;
     readonly variant: string;
 };
+/** What a route check resolves to: the operation it names, or the answer that refuses it. */
+type OperationRouteResolution = {
+    readonly ok: true;
+    readonly operation: AvOperationIdentity;
+} | {
+    readonly ok: false;
+    readonly failure: AvOperationFailureResponse;
+};
+/**
+ * An operation route `/_resources/<resource>/<family>/<variant>` under one client
+ * protocol identity: version → hash → Resource → operation. A Resource key is matched
+ * exactly and only as the ClientContract's own key; a family/variant pair only when it
+ * is a standard operation the Resource advertises, read through
+ * `isOperationVariantAvailable` alone.
+ */
+export declare function resolveOperationRoute(contracts: AvContracts, protocol: AvRequestProtocol, route: OperationRouteSegments, origin?: RemoteRequestOrigin): OperationRouteResolution;
+/**
+ * The `/_transactions` route under one client protocol identity: version → hash → the
+ * ClientContract's transaction capability. The route exists only when that capability
+ * is `"interactive"` — tested against the value itself, as `protocol.surface()` tests
+ * it — and is otherwise absent with core's own refusal of a plan. `undefined` when the
+ * route is there.
+ */
+declare function transactionsRouteFailure(contracts: AvContracts, protocol: AvRequestProtocol, origin?: RemoteRequestOrigin): AvOperationFailureResponse | undefined;
+/**
+ * The `/_access/can` route under one client protocol identity: version → hash →
+ * the Contract's `access` section. The route exists only when the section is
+ * there — tested as `protocol.surface()` tests it — and is otherwise absent.
+ * `undefined` when the route is there.
+ */
+declare function accessCanRouteFailure(contracts: AvContracts, protocol: AvRequestProtocol, origin?: RemoteRequestOrigin): AvOperationFailureResponse | undefined;
+/**
+ * The `/_all` route under one client protocol identity: version → hash → whether
+ * the Contract advertises any operation, tested as `protocol.surface()` tests it.
+ * `undefined` when the route is there.
+ */
+declare function allRouteFailure(contracts: AvContracts, protocol: AvRequestProtocol, origin?: RemoteRequestOrigin): AvOperationFailureResponse | undefined;
 /**
  * What a route's checks before its body resolve to: the route a request
  * reaches, or the framework response that answers it instead.
@@ -31,32 +71,45 @@ type RouteCheck<Route> = ({
     readonly ok: false;
     readonly response: AvProtocolResponse;
 };
+/** A cached read's mark in the Contract a route reads: its `for` and `maxAge`. */
+type ReadCacheMark = NonNullable<NonNullable<AvContractClient["resources"][string]["cache"]>["first" | "unique" | "many" | "count"]>;
 /**
  * An operation route's checks before its body (decoder steps 2–4): the path (`A2000`
  * unless `/_resources/<r>/<f>/<v>`, each segment decodable and none empty), the
- * identity headers' presence (`A2000`), then {@link resolveOperationRoute} — version,
- * hash, Resource, operation — and the method (`A2012`, `Allow: POST`). One sequence
- * for both route styles: `decodeOperation` reads the body only after it passes,
+ * identity — a `GET`'s well-formed `q`/`v` query when it has a query, otherwise
+ * the headers' presence (`A2000`) — then {@link resolveOperationRoute} — version, hash, Resource,
+ * operation — and the method (`A2012`): `POST`, or `GET` for a `find` operation of
+ * read the Contract marks cacheable, whose `Allow` is then `GET, POST`. One sequence for
+ * both route styles: `decodeOperation` reads the body only after it passes,
  * `answerAbsent` never.
  */
-export declare function checkOperationRoute(contracts: AvContracts, read: ReadRequest, origin?: RemoteRequestOrigin): RouteCheck<{
+export declare function checkOperationRoute(contracts: AvContracts, read: ReadRequest, origin?: RemoteRequestOrigin): OperationRouteCheck;
+/** What an operation route's checks resolve to. */
+type OperationRouteCheck = RouteCheck<{
     readonly resource: string;
     readonly operation: AvOperationIdentity;
+    /** The read's cache mark, for a `find` variant the Contract marks. */
+    readonly cache: ReadCacheMark | undefined;
+    /** A `GET`'s query, read; `undefined` without one (`A2000` for a cached read). */
+    readonly query: ReadQuery | undefined;
 }>;
+/** Each fixed `POST` route, by path, and its absence under one protocol identity. */
+declare const POST_ROUTE_FAILURES: {
+    readonly "/_transactions": typeof transactionsRouteFailure;
+    readonly "/_access/can": typeof accessCanRouteFailure;
+    readonly "/_all": typeof allRouteFailure;
+};
+/** `/_transactions`, `/_access/can` or `/_all`. */
+type PostRoute = keyof typeof POST_ROUTE_FAILURES;
 /**
- * `/_transactions`' checks before its body: the path (`A2000` unless exactly
- * `/_transactions`), the identity headers' presence (`A2000`), then
- * {@link transactionsRouteFailure} — version, hash, `"interactive"` — and the
- * method (`A2012`, `Allow: POST`).
- */
-export declare function checkTransactionsRoute(contracts: AvContracts, read: ReadRequest, origin?: RemoteRequestOrigin): RouteCheck<object>;
-/**
- * `/_access/can`'s checks before its body: the path (`A2000` unless exactly
- * `/_access/can`), the identity headers' presence (`A2000`), then
- * {@link accessCanRouteFailure} — version, hash, the `access` section — and the
- * method (`A2012`, `Allow: POST`).
+ * A fixed `POST` route's checks before its body: the path (`A2000` unless
+ * exactly `route`), the identity headers' presence (`A2000`), then the route's
+ * own absence — version, hash, and {@link transactionsRouteFailure}'s
+ * `"interactive"`, {@link accessCanRouteFailure}'s `access` section or
+ * {@link allRouteFailure}'s advertised operation — and the method (`A2012`,
+ * `Allow: POST`).
  */
-export declare function checkAccessCanRoute(contracts: AvContracts, read: ReadRequest, origin?: RemoteRequestOrigin): RouteCheck<object>;
+export declare function checkPostRoute(route: PostRoute, contracts: AvContracts, read: ReadRequest, origin?: RemoteRequestOrigin): RouteCheck<object>;
 /**
  * `protocol.answerAbsent(request)` — the fallback a host that mounts one route per
  * `protocol.surface()` entry mounts for every path it did not. Never a catch-all into