@aventara/core 1.0.0-rc.12 → 1.0.0-rc.14

package/dist/compiler/create-requirements.projector.d.ts

@@ -12,11 +12,18 @@ type ProjectedResource = {
     readonly fields: Readonly<Record<string, ProjectedField>>;
     createRequirements?: AvCreateRequirements;
 };
+/**
+ * The Adapter's statement with the layer's non-null added fields required too.
+ * The runtime reads it over the Core Contract (`recordWriteFactsOf`): what write
+ * compute must not leave missing.
+ */
+export declare function withVirtualRequirements(stated: AvCreateRequirements | undefined, resource: ProjectedResource): AvCreateRequirements | undefined;
 /**
  * Sets every Resource's `createRequirements` in one layer's projection to the
- * Adapter's statement as that layer sees it, and removes it where nothing is
- * left. Reads the projection's final fields: its exposure, and the lifecycle
- * its compute stages gave them.
+ * Adapter's statement as that layer sees it, its non-null added (`VIRTUAL`)
+ * fields required too, and removes it where nothing is left. Reads the
+ * projection's final fields: its exposure, and the lifecycle its compute stages
+ * gave them.
  */
 export declare function projectCreateRequirements(model: AvAdapterModel, resources: Readonly<Record<string, ProjectedResource>>): void;
 /** A Resource's operations, as far as this check reads them. */
@@ -38,6 +45,41 @@ type ResourceWithOperations = ProjectedResource & {
  * its final view.
  */
 export declare function checkHiddenRequirements(model: AvAdapterModel, layer: AvConfigLayerName, universe: Readonly<Record<string, ProjectedResource>>, parent: Readonly<Record<string, ProjectedResource>>, projection: Readonly<Record<string, ResourceWithOperations>>, diagnostics: AvContractCompilerDiagnostic[]): void;
+/**
+ * Refuses, for one layer, every relation that writes rows of a Resource the
+ * layer keeps read-only: a nested `$create`, `$connectOrCreate` or `$upsert`
+ * into a Resource with no create or upsert variant and no field writable on
+ * create, a nested `$update` or `$upsert` into one with no update or upsert
+ * variant and no field writable on update, or a nested `$delete` into one with
+ * no delete variant. Reported once, by the layer that makes it so: an overlay
+ * is not refused for a relation its parent was already refused for. `parent` is
+ * what the layer starts from; the root's is none, so an Adapter that offers such
+ * a write is refused at the root. An Omit layer has none left to refuse:
+ * {@link withholdReadOnlyNestedWrites} dropped them first.
+ */
+export declare function checkReadOnlyNestedWrites(layer: AvConfigLayerName, parent: Readonly<Record<string, ResourceWithOperations>> | undefined, projection: Readonly<Record<string, ResourceWithOperations>>, diagnostics: AvContractCompilerDiagnostic[]): void;
+/** Why the narrowing dropped a directive: its target deletes, updates or creates nothing in the layer. */
+export type WithheldReason = "delete" | "update" | "create";
+/**
+ * The directives an Omit layer's narrowing dropped, by relation, stage and
+ * directive (`"posts.comments.update.$delete"`), each with why.
+ */
+export type WithheldWrites = ReadonlyMap<string, WithheldReason>;
+/** The key of one dropped directive in {@link WithheldWrites}. */
+export declare function withheldKey(relation: string, stage: string, directive: string): string;
+/**
+ * Narrows an Omit layer's view so no relation writes rows of a Resource the
+ * view cannot write: `$create`, `$connectOrCreate` and `$upsert` into one that
+ * creates nothing (no create or upsert variant, no field writable on create),
+ * `$update` and `$upsert` into one that updates nothing (no update or upsert
+ * variant, no field writable on update), `$delete` into one that deletes
+ * nothing (no delete variant). A member emptied goes with its last directive.
+ * Dropping a directive can leave another Resource writing nothing (its only
+ * write capability was it), so the pass repeats to a fixed point. Returns
+ * every directive it dropped, with why. A Pick layer's view is not narrowed:
+ * {@link checkReadOnlyNestedWrites} refuses what it grants.
+ */
+export declare function withholdReadOnlyNestedWrites(resources: Readonly<Record<string, ResourceWithOperations>>): WithheldWrites;
 /**
  * Every name in the Adapter's create requirements that is not what its member
  * says: a `required` name that is no field of the Resource, a group whose first

package/dist/compiler/create-requirements.projector.js

@@ -1,6 +1,7 @@
 import { advertisedDirectives, advertisedDirectivesAt, } from "../contracts/field.js";
 import { isOperationVariantAvailable, writeScopeOf, } from "../contracts/resource-operations.js";
 import { isRecord } from "../runtime/record.guard.js";
+import { keptDirectives } from "./managed-elsewhere.projector.js";
 function own(record, key) {
     return Object.hasOwn(record, key) ? record[key] : undefined;
 }
@@ -32,6 +33,23 @@ function computedOnCreate(resource, name) {
         Array.isArray(field.lifecycle) &&
         field.lifecycle.includes("COMPUTED_ON_CREATE"));
 }
+function virtualRequirements(resource) {
+    return Object.entries(resource.fields)
+        .filter(([, field]) => field.kind === "scalar" &&
+        field.nullable === false &&
+        Array.isArray(field.lifecycle) &&
+        field.lifecycle.includes("VIRTUAL"))
+        .map(([name]) => name);
+}
+export function withVirtualRequirements(stated, resource) {
+    const [first, ...rest] = [
+        ...(stated?.required ?? []),
+        ...virtualRequirements(resource),
+    ];
+    return first === undefined
+        ? stated
+        : { ...stated, required: [first, ...rest] };
+}
 function projectOne(stated, resource, resources) {
     const required = [];
     const requireOnce = (name) => {
@@ -99,7 +117,7 @@ function projectOne(stated, resource, resources) {
 export function projectCreateRequirements(model, resources) {
     for (const [name, resource] of Object.entries(resources)) {
         delete resource.createRequirements;
-        const stated = own(model.resources, name)?.createRequirements;
+        const stated = withVirtualRequirements(own(model.resources, name)?.createRequirements, resource);
         if (stated === undefined) {
             continue;
         }
@@ -118,6 +136,7 @@ const UPDATING_DIRECTIVES = [
     "$update",
     "$upsert",
 ];
+const DELETING_DIRECTIVES = ["$delete"];
 function variantsOf(resource, families) {
     const variants = [];
     for (const family of families) {
@@ -159,6 +178,36 @@ function createVariantsOf(resource) {
     return variants;
 }
 function createPaths(resources) {
+    const { created, updated } = writtenResources(resources);
+    const paths = new Map();
+    const add = (name, path) => {
+        const list = paths.get(name) ?? [];
+        list.push(path);
+        paths.set(name, list);
+    };
+    for (const [name, resource] of Object.entries(resources)) {
+        const variants = createVariantsOf(resource);
+        if (variants.length > 0) {
+            add(name, { kind: "operation", variants });
+        }
+    }
+    for (const [parent, resource] of Object.entries(resources)) {
+        for (const [relation, field] of Object.entries(resource.fields)) {
+            const target = field.target;
+            if (field.kind !== "relation" || typeof target !== "string") {
+                continue;
+            }
+            if ((created.has(parent) &&
+                advertises(field, "create", CREATING_DIRECTIVES)) ||
+                (updated.has(parent) &&
+                    advertises(field, "update", CREATING_DIRECTIVES))) {
+                add(target, { kind: "nested", parent, relation });
+            }
+        }
+    }
+    return paths;
+}
+function writtenResources(resources) {
     const created = new Set();
     const updated = new Set();
     for (const [name, resource] of Object.entries(resources)) {
@@ -197,33 +246,7 @@ function createPaths(resources) {
             }
         }
     }
-    const paths = new Map();
-    const add = (name, path) => {
-        const list = paths.get(name) ?? [];
-        list.push(path);
-        paths.set(name, list);
-    };
-    for (const [name, resource] of Object.entries(resources)) {
-        const variants = createVariantsOf(resource);
-        if (variants.length > 0) {
-            add(name, { kind: "operation", variants });
-        }
-    }
-    for (const [parent, resource] of Object.entries(resources)) {
-        for (const [relation, field] of Object.entries(resource.fields)) {
-            const target = field.target;
-            if (field.kind !== "relation" || typeof target !== "string") {
-                continue;
-            }
-            if ((created.has(parent) &&
-                advertises(field, "create", CREATING_DIRECTIVES)) ||
-                (updated.has(parent) &&
-                    advertises(field, "update", CREATING_DIRECTIVES))) {
-                add(target, { kind: "nested", parent, relation });
-            }
-        }
-    }
-    return paths;
+    return { created, updated };
 }
 function pathLabel(path) {
     return path.kind === "operation"
@@ -320,6 +343,7 @@ export function checkHiddenRequirements(model, layer, universe, parent, projecti
         const parentResource = own(parent, name);
         if (stated === undefined ||
             routes.length === 0 ||
+            createsNothing(resource) ||
             universeResource === undefined ||
             parentResource === undefined) {
             continue;
@@ -367,6 +391,193 @@ export function checkHiddenRequirements(model, layer, universe, parent, projecti
         }
     }
 }
+function createsNothing(resource) {
+    return (variantsOf(resource, ["create", "upsert"]).length === 0 &&
+        !Object.keys(resource.fields).some((name) => creatable(resource, name)));
+}
+function updatesNothing(resource) {
+    return (variantsOf(resource, ["update", "upsert"]).length === 0 &&
+        !Object.values(resource.fields).some((field) => {
+            const capabilities = isRecord(field.capabilities)
+                ? field.capabilities
+                : undefined;
+            return field.kind === "scalar"
+                ? capabilities?.update !== undefined
+                : advertisedDirectives(capabilities?.update) !== undefined;
+        }));
+}
+function deletesNothing(resource) {
+    return variantsOf(resource, ["delete"]).length === 0;
+}
+function advertisedOf(field, stage, directives) {
+    const capabilities = isRecord(field.capabilities)
+        ? field.capabilities
+        : undefined;
+    const advertised = advertisedDirectives(capabilities?.[stage]) ?? [];
+    return directives.filter((name) => advertised.includes(name));
+}
+function readOnlyNestedWrites(resources) {
+    const { created, updated } = writtenResources(resources);
+    const writes = [];
+    for (const [parent, resource] of Object.entries(resources)) {
+        for (const [relation, field] of Object.entries(resource.fields)) {
+            const target = field.target;
+            const targetResource = field.kind === "relation" && typeof target === "string"
+                ? own(resources, target)
+                : undefined;
+            if (typeof target !== "string" || targetResource === undefined) {
+                continue;
+            }
+            const reached = (directives) => [
+                ...new Set([
+                    ...(created.has(parent)
+                        ? advertisedOf(field, "create", directives)
+                        : []),
+                    ...(updated.has(parent)
+                        ? advertisedOf(field, "update", directives)
+                        : []),
+                ]),
+            ];
+            const creating = createsNothing(targetResource)
+                ? reached(CREATING_DIRECTIVES)
+                : [];
+            const updating = updatesNothing(targetResource)
+                ? reached(UPDATING_DIRECTIVES)
+                : [];
+            const deleting = deletesNothing(targetResource)
+                ? reached(DELETING_DIRECTIVES)
+                : [];
+            if (creating.length > 0 || updating.length > 0 || deleting.length > 0) {
+                writes.push({
+                    parent,
+                    relation,
+                    target,
+                    creating,
+                    updating,
+                    deleting,
+                });
+            }
+        }
+    }
+    return writes;
+}
+export function checkReadOnlyNestedWrites(layer, parent, projection, diagnostics) {
+    const inherited = new Map((parent === undefined ? [] : readOnlyNestedWrites(parent)).map((write) => [
+        `${write.parent}.${write.relation}`,
+        write,
+    ]));
+    for (const found of readOnlyNestedWrites(projection)) {
+        const at = `${found.parent}.${found.relation}`;
+        const above = inherited.get(at);
+        const write = {
+            ...found,
+            creating: (above?.creating.length ?? 0) > 0 ? [] : found.creating,
+            updating: (above?.updating.length ?? 0) > 0 ? [] : found.updating,
+            deleting: (above?.deleting.length ?? 0) > 0 ? [] : found.deleting,
+        };
+        if (write.creating.length === 0 &&
+            write.updating.length === 0 &&
+            write.deleting.length === 0) {
+            continue;
+        }
+        const directives = [
+            ...new Set([...write.creating, ...write.updating, ...write.deleting]),
+        ];
+        const lacks = [
+            ...(write.creating.length === 0
+                ? []
+                : ["no create operation and no field writable on create"]),
+            ...(write.updating.length === 0
+                ? []
+                : ["no update operation and no field writable on update"]),
+            ...(write.deleting.length === 0 ? [] : ["no delete operation"]),
+        ];
+        const gives = [
+            ...(write.creating.length === 0
+                ? []
+                : ["a create operation or a field writable on create"]),
+            ...(write.updating.length === 0
+                ? []
+                : ["an update operation or a field writable on update"]),
+            ...(write.deleting.length === 0 ? [] : ["a delete operation"]),
+        ];
+        const keep = `take ${listed(directives)} off "${at}" (keep only the directives it may use, such as $connect)`;
+        diagnostics.push({
+            code: "COMPILER_READ_ONLY_NESTED_WRITE",
+            path: `${layer}.exemptions.resources.${write.parent}.fields.${write.relation}`,
+            message: write.creating.length === 0 && write.updating.length === 0
+                ? `the ${layer} layer lets relation "${at}" delete rows of resource "${write.target}" ($delete), but "${write.target}" has no delete operation in that layer; ${keep}, or give "${write.target}" a delete operation`
+                : `the ${layer} layer lets relation "${at}" write rows of resource "${write.target}" (${listed(directives)}), but "${write.target}" is read-only in that layer: it has ${lacks.join(", and ")}; ${keep}, or give "${write.target}" ${gives.join(", and ")}`,
+        });
+    }
+}
+function dropDirectives(field, stage, dropped) {
+    if (!isRecord(field.capabilities)) {
+        return [];
+    }
+    const capabilities = field.capabilities;
+    const advertised = advertisedDirectives(capabilities[stage]) ?? [];
+    const removed = advertised.filter((name) => dropped.includes(name));
+    if (removed.length === 0) {
+        return [];
+    }
+    const narrowed = keptDirectives(capabilities[stage], advertised.filter((name) => !dropped.includes(name)));
+    if (narrowed === undefined) {
+        delete capabilities[stage];
+    }
+    else {
+        capabilities[stage] = narrowed;
+    }
+    return removed;
+}
+function* relationsOf(resources) {
+    for (const [parent, resource] of Object.entries(resources)) {
+        for (const [relation, field] of Object.entries(resource.fields)) {
+            const target = field.target;
+            const targetResource = field.kind === "relation" && typeof target === "string"
+                ? own(resources, target)
+                : undefined;
+            if (typeof target === "string" && targetResource !== undefined) {
+                yield [parent, relation, field, target, targetResource];
+            }
+        }
+    }
+}
+export function withheldKey(relation, stage, directive) {
+    return `${relation}.${stage}.${directive}`;
+}
+export function withholdReadOnlyNestedWrites(resources) {
+    const withheld = new Map();
+    const drop = (at, field, stage, directives, reason) => {
+        const removed = dropDirectives(field, stage, directives);
+        for (const directive of removed) {
+            withheld.set(withheldKey(at, stage, directive), reason);
+        }
+        return removed.length > 0;
+    };
+    let changed = true;
+    while (changed) {
+        changed = false;
+        for (const [parent, relation, field, , target] of relationsOf(resources)) {
+            const at = `${parent}.${relation}`;
+            for (const stage of ["create", "update"]) {
+                if (deletesNothing(target)) {
+                    changed =
+                        drop(at, field, stage, DELETING_DIRECTIVES, "delete") || changed;
+                }
+                if (createsNothing(target)) {
+                    changed =
+                        drop(at, field, stage, CREATING_DIRECTIVES, "create") || changed;
+                }
+            }
+            if (updatesNothing(target)) {
+                changed =
+                    drop(at, field, "update", UPDATING_DIRECTIVES, "update") || changed;
+            }
+        }
+    }
+    return withheld;
+}
 function misnamed(path, message) {
     return { code: "COMPILER_UNKNOWN_FIELD", path, message };
 }

package/dist/compiler/managed-elsewhere.projector.d.ts

@@ -1,4 +1,5 @@
 import type { AvAdapterModel } from "../adapters/adapter-model.js";
+import type { AvRelationMutationDirective } from "../contracts/capability.js";
 import type { AvContractCompilerDiagnostic } from "./contract-compiler-diagnostic.js";
 type ProjectedField = Record<string, unknown> & {
     kind: "scalar" | "relation";
@@ -14,6 +15,8 @@ type ProjectedContract = {
 };
 /** The Resources the root's `resources` tree marks `managedElsewhere: true`. */
 export declare function managedElsewhereOf(rootTree: unknown): ReadonlySet<string>;
+/** A relation mutation capability with only `kept` of its directives (its scopes kept), or `undefined` when none is left. */
+export declare function keptDirectives(capability: unknown, kept: readonly AvRelationMutationDirective[]): unknown;
 /**
  * Takes every write of a managed Resource away from `baseline`: its write
  * families, its fields' `create`/`update`, and the directives of every relation

package/dist/compiler/managed-elsewhere.projector.js

@@ -22,7 +22,7 @@ export function managedElsewhereOf(rootTree) {
     }
     return managed;
 }
-function keptDirectives(capability, kept) {
+export function keptDirectives(capability, kept) {
     if (Array.isArray(capability)) {
         const left = capability.filter((directive) => kept.includes(directive));
         return left.length > 0 ? left : undefined;

package/dist/config/computed-fields.d.ts

@@ -38,6 +38,14 @@ type CreateComputedOf<Layer> = Layer extends object ? {
 export type AvPreComputeLift<M, L extends AvConfigLayerName> = M extends {
     readonly "~computedFields"?: infer Facts;
 } ? Exclude<Facts, undefined> extends infer Stated extends AvConfigComputedFields ? string extends keyof Stated["root"] ? string : CreateComputedOf<Stated[ComputingLayers<Stated, L>]> : string : string;
+/**
+ * The create fields a ctx call need not write, as `"<Resource>.<field>"`: those
+ * the root's or the application's `compute.create` fills. `never` when the
+ * model's type carries no statement of them.
+ */
+export type AvContextComputeLift<M> = M extends {
+    readonly "~computedFields"?: infer Facts;
+} ? Exclude<Facts, undefined> extends infer Stated extends AvConfigComputedFields ? string extends keyof Stated["root"] ? never : CreateComputedOf<Stated["root" | "application"]> : never : never;
 /** The configuration's layers' `resources` trees and the agent's parent. */
 type ComputedFieldsSource = {
     readonly trees: Readonly<Record<AvConfigLayerName, unknown>>;

package/dist/config/computed-fields.js

@@ -66,7 +66,7 @@ export function warnOnStaleComputedFields(generated, configured) {
     if (drift.length === 0) {
         return;
     }
-    const message = `generated types are stale: run aventara:prepare. The computed fields the pre-compute stages are typed with differ from the configuration's:\n${drift
+    const message = `generated types are stale: run aventara:prepare. The computed fields the pre-compute stages and ctx creates are typed with differ from the configuration's:\n${drift
         .map((line) => `  - ${line}`)
         .join("\n")}`;
     emitFrameworkWarning(message, STALE_GENERATED_TYPES_WARNING);

package/dist/config/config-diagnostic.guidance.js

@@ -26,7 +26,7 @@ export const CONFIG_DIAGNOSTIC_GUIDANCE = {
     },
     CONFIG_FORBIDDEN_IN_OVERLAY: {
         message: "A root-only key is written in an overlay.",
-        cause: "A field definition in application, client or agent.",
-        fix: "Define the field once at the root (`resources.<R>.fields.<f>.definition`); an overlay only chooses its visibility.",
+        cause: "A field definition, or a Resource's managedElsewhere, in application, client or agent.",
+        fix: "State it once at the root (`resources.<R>.fields.<f>.definition`, `resources.<R>.managedElsewhere`); an overlay only chooses visibility.",
     },
 };

package/dist/config/config.resolver.d.ts

@@ -1,7 +1,7 @@
 import type { AvAdapter } from "../adapters/adapter.interface.js";
 import type { AvAdapterModel } from "../adapters/adapter-model.js";
 import type { AvContractClientAccess } from "../contracts/contract-access.js";
-import type { AvTransactionCapability } from "../contracts/transaction-capability.js";
+import type { TransactionsStyle } from "../contracts/transaction-capability.js";
 import type { AvPolicyEngine } from "../policy/policy-engine.js";
 import type { AvDiagnosticsSink } from "../runtime/diagnostics-reporter.js";
 import type { AvMisuseSink } from "../runtime/misuse-reporter.js";
@@ -45,7 +45,7 @@ export type ResolvedFrameworkLayerConfig = {
      * registrations, then the overlay's, at each level.
      */
     readonly pipelines: ResolvedPipelineTree;
-    readonly transactionsStyle: AvTransactionCapability | undefined;
+    readonly transactionsStyle: TransactionsStyle | undefined;
 };
 /**
  * The MCP endpoint a Framework serves (`mcp` resolved): its mount path in

package/dist/config/config.validator.js

@@ -1,5 +1,5 @@
 import { isAccessPath, isAccessUrl } from "../contracts/access-route.rules.js";
-import { TRANSACTION_CAPABILITIES } from "../contracts/transaction-capability.js";
+import { TRANSACTIONS_STYLES } from "../contracts/transaction-capability.js";
 import { ACCESS_VERB_NAMES, isAccessVerbName, providerVerb, } from "../policy/access-verb.table.js";
 import { isPlainRecord } from "../runtime/record.guard.js";
 import { normalizeEntrypoint } from "./entrypoint.normalizer.js";
@@ -69,13 +69,14 @@ const OPERATION_FAMILIES = new Set([
     "upsert",
 ]);
 const OPERATION_VARIANTS = new Set(["first", "unique", "many", "count", "one"]);
-const TRANSACTION_CAPABILITY_SET = new Set(TRANSACTION_CAPABILITIES);
+const TRANSACTIONS_STYLE_SET = new Set(TRANSACTIONS_STYLES);
 const AVZ_FORMAT_SET = new Set(AVZ_FORMATS);
 const LIMIT_PROPERTIES = new Set([
     "maxRequestBytes",
     "maxNestingDepth",
     "maxListLimit",
     "maxTransactionOperations",
+    "maxTransactionWrites",
     "maxBooleanNodes",
     "maxJsonDepth",
     "maxAll",
@@ -436,6 +437,7 @@ function validateResources(value, path, isRoot, diagnostics) {
 const EXEMPTIONS_PROPERTIES = new Set(["resources"]);
 const RESOURCE_EXEMPTION_PROPERTIES = new Set(["operations", "fields"]);
 const FLAG_CAPABILITIES = new Set(["select", "include", "order", "orderNulls"]);
+const READ_EXEMPTION = "read";
 function movedHidden(path) {
     return diagnostic("CONFIG_MOVED_PROPERTY", path, `${path} moved in rc.1: an entry is hidden with \`true\` under exposed: true`);
 }
@@ -492,9 +494,12 @@ function validateOperationsExemption(value, path, diagnostics) {
     }
 }
 function validateFieldExemption(value, path, diagnostics) {
+    if (value === READ_EXEMPTION) {
+        return;
+    }
     const kind = validateExemptionValue(value, path, "a capability name", diagnostics);
     if (kind === undefined) {
-        diagnostics.push(diagnostic("CONFIG_INVALID_TYPE", path, `${path} must be true, false, a list of capability names, or an object of them`));
+        diagnostics.push(diagnostic("CONFIG_INVALID_TYPE", path, `${path} must be true, false, "read", a list of capability names, or an object of them`));
         return;
     }
     if (kind !== "object") {
@@ -543,7 +548,11 @@ function validateResourceExemption(value, path, diagnostics) {
             validateOperationsExemption(entry, keyPath, diagnostics);
             continue;
         }
-        if (!requireRecord(entry, keyPath, diagnostics)) {
+        if (entry === READ_EXEMPTION) {
+            continue;
+        }
+        if (!isPlainRecord(entry)) {
+            diagnostics.push(diagnostic("CONFIG_INVALID_TYPE", keyPath, `${keyPath} must be "read" or an object of field exemptions`));
             continue;
         }
         for (const [field, fieldEntry] of Object.entries(entry)) {
@@ -616,9 +625,9 @@ function validateLayer(value, path, kind, diagnostics) {
         validateExemptions(value.exemptions, exemptionsPath, diagnostics);
     }
     if (Object.hasOwn(value, "transactionsStyle") &&
-        !TRANSACTION_CAPABILITY_SET.has(value.transactionsStyle)) {
+        !TRANSACTIONS_STYLE_SET.has(value.transactionsStyle)) {
         const stylePath = childPath(path, "transactionsStyle");
-        diagnostics.push(diagnostic("CONFIG_INVALID_VALUE", stylePath, `${stylePath} must be "none" or "interactive"`));
+        diagnostics.push(diagnostic("CONFIG_INVALID_VALUE", stylePath, `${stylePath} must be "none", "server" or "interactive"`));
     }
     if (Object.hasOwn(value, "limits")) {
         validateLimits(value.limits, childPath(path, "limits"), diagnostics);

package/dist/config/exact-framework-config.d.ts

@@ -26,6 +26,7 @@ type LimitsSchema = {
     readonly maxNestingDepth: Leaf;
     readonly maxListLimit: Leaf;
     readonly maxTransactionOperations: Leaf;
+    readonly maxTransactionWrites: Leaf;
     readonly maxBooleanNodes: Leaf;
     readonly maxJsonDepth: Leaf;
     readonly maxAll: Leaf;

package/dist/config/field-pipeline-config.d.ts

@@ -20,9 +20,9 @@ export type AvFieldCompute<M extends AvAdapterModel = AvAdapterModel, Cfg = AvCo
 /**
  * A scalar field's stages: validators, field pipes, compute and write guards.
  * `Check` is the checks the field takes (any, when the field's type is not
- * known here).
+ * known here), or the sentence a type that takes none refuses them with.
  */
-export type AvScalarFieldPipeline<M extends AvAdapterModel = AvAdapterModel, Cfg = AvConfigAny, R extends AvConfigResourceKey<M> = AvConfigResourceKey<M>, Check extends AvZCheck = AvZCheck> = {
+export type AvScalarFieldPipeline<M extends AvAdapterModel = AvAdapterModel, Cfg = AvConfigAny, R extends AvConfigResourceKey<M> = AvConfigResourceKey<M>, Check extends AvZCheck | `Error: ${string}` = AvZCheck> = {
     /**
      * Declarative checks on the value, built with `AvZ` and carried in the Contract;
      * root's, then the overlay's. On a list field `AvZ.minItems` and `AvZ.maxItems`

package/dist/config/forced-operation.validator.js

@@ -1,4 +1,5 @@
 import { isOperationVariantAvailable } from "../contracts/resource-operations.js";
+import { opensServerTransactions } from "../contracts/transaction-capability.js";
 import { forcedOperationsOf } from "./pipeline-tree.resolver.js";
 function reachable(contract, resource, family, variant) {
     if (!Object.hasOwn(contract.resources, resource)) {
@@ -45,7 +46,7 @@ export function validateForcedOperations(config, contracts) {
         : ["application", "client"];
     for (const origin of origins) {
         const contract = contracts[origin];
-        if (contract.transactions !== "none") {
+        if (opensServerTransactions(contract.transactions)) {
             continue;
         }
         const forced = [
@@ -61,6 +62,6 @@ export function validateForcedOperations(config, contracts) {
     return [...refused].map(([path, layers]) => ({
         code: "CONFIG_INVALID_VALUE",
         path,
-        message: `${path}: forceTransaction runs a plain call as a one-step transaction, and the effective transactionsStyle of the ${layers.join(" and ")} ${layers.length === 1 ? "layer is" : "layers are"} "none"; set transactionsStyle: "interactive" there (the adapter must offer interactive transactions) or remove forceTransaction`,
+        message: `${path}: forceTransaction runs a plain call as a one-step transaction, and the effective transactionsStyle of the ${layers.join(" and ")} ${layers.length === 1 ? "layer is" : "layers are"} "none"; set transactionsStyle: "server" (no plans from callers) or "interactive" there (the adapter must offer interactive transactions) or remove forceTransaction`,
     }));
 }

package/dist/config/framework-config.d.ts

@@ -1,7 +1,6 @@
 import type { AvAdapter } from "../adapters/adapter.interface.js";
 import type { AvAdapterModel } from "../adapters/adapter-model.js";
 import type { AvContractLimits } from "../contracts/contract-limits.js";
-import type { AvTransactionCapability } from "../contracts/transaction-capability.js";
 import type { AvAccessProvider } from "../policy/access-provider.interface.js";
 import type { AvPolicyEngine } from "../policy/policy-engine.js";
 import type { AvPrebuiltContracts } from "../prebuilt/prebuilt-contracts.js";
@@ -38,8 +37,14 @@ export type AvConfigLayer<M extends AvAdapterModel = AvAdapterModel, Cfg = AvCon
      * the adapter's model, an overlay the root's view.
      */
     readonly exposed?: boolean;
-    /** `"none"` turns transactions off; `"interactive"` needs adapter support. */
-    readonly transactionsStyle?: AvTransactionCapability;
+    /**
+     * `"interactive"`: the server opens transactions and callers send plans
+     * (`/_transactions`, a generated client's `tx`). `"server"`: only the server
+     * opens them (`forceTransaction`, a policy-checked write, `ctx.$transaction`);
+     * a plan answers as an absent route. `"none"`: no transactions. Both
+     * `"server"` and `"interactive"` need adapter support.
+     */
+    readonly transactionsStyle?: "none" | "server" | "interactive";
     /** Request limits; see {@link AvConfigLimits}. */
     readonly limits?: AvConfigLimits;
     /** Guards, pipes, hooks, interceptors and filters run around every operation of the layer. */