@aventara/core 1.0.0-rc.13 → 1.0.0-rc.14

package/CHANGELOG.md

@@ -1,5 +1,13 @@
 # @aventara/core
 
+## 1.0.0-rc.14
+
+### Patch Changes
+
+- 1c5eaa3: The agent skill's stage order in `reference/stages.md` now lists every stage `SKILL.md` and the pipelines docs list: policy admission before the guards, the policy write check after the re-check, and output validation before the response. It says where a nested write's targets run their guards, field pipes, validators and write compute (after the top-level operation's stages of the same kind), lists the check of a value compute set in a field the caller's layer hides (`A3000`), and gives the `forceTransaction` order in full: framework validation and policy admission before `BEGIN`, the policy write check and output validation inside the transaction.
+
+  The error catalog's `A4000` and `A4001` entries now state the whole rule for a `state` that rejects with an authentication library's refusal: the envelope it answers, that nothing of the library's error is sent and nothing goes to `diagnostics`, which shapes are not a refusal (`500 A3000`), and every route, MCP tool call and in-process call it applies to.
+
 ## 1.0.0-rc.13
 
 ### Minor Changes

package/ERRORS.md

@@ -1,6 +1,6 @@
 # Aventara error codes
 
-Every code `@aventara/core` 1.0.0-rc.13 answers, reports in a validation issue, or refuses to start with. Generated from `AvErrorCatalog` (exported by `@aventara/core`); do not edit.
+Every code `@aventara/core` 1.0.0-rc.14 answers, reports in a validation issue, or refuses to start with. Generated from `AvErrorCatalog` (exported by `@aventara/core`); do not edit.
 
 Branch on the code, never on the message. In code, `AvErrorCatalog[code]` gives the same entry: `{ code, kind, message, cause, fix, docs }`.
 
@@ -61,8 +61,8 @@ Produced by your guards; the framework never authenticates by itself.
 
 | Code | Meaning | Cause | Fix |
 |---|---|---|---|
-| [`A4000`](https://aventara.razor34.dev/framework/docs/error-codes#a4000) | Unauthenticated. | A guard threw new AvError("A4000", ...), or the host's or access provider's state rejected with an object whose status or statusCode is 401 (an authentication library's refusal, answered with this message only): authentication is required or failed. The framework never authenticates by itself. | Send the credentials your guards expect, such as the Authorization header. |
-| [`A4001`](https://aventara.razor34.dev/framework/docs/error-codes#a4001) | Forbidden. | A guard returned false ("Operation denied by a framework guard."), a field write guard or a nested write's target guard included, a stage threw A4001, or the host's or access provider's state rejected with an object whose status or statusCode is 403 (answered with this message only). | Call as a caller the guard admits, or stop sending the guarded field. To answer another code, throw an AvError from the guard. |
+| [`A4000`](https://aventara.razor34.dev/framework/docs/error-codes#a4000) | Unauthenticated. | A guard threw new AvError("A4000", ...), or the host's or access provider's state rejected with an object whose status or statusCode is the number 401 (an authentication library's refusal, such as Better Auth's statusCode 401): authentication is required or failed. Such a refusal answers {"data":null,"code":"A4000","cause":{"message":"Unauthenticated."}}, nothing of the library's error, and is not sent to diagnostics. A string status ("401"), another number, or a status and statusCode that are two different numbers is no refusal and answers 500 A3000; a number beside a string is read by the number. The rule holds on every protocol route (operations, cached reads, /_transactions, /_all, /_access/can), on MCP tool calls and in Next.js; in process (avClient in a Server Component or Server Action, serverClient.$access.can given headers) the call rejects with an AvAuthError. The framework never authenticates by itself. | Send the credentials your guards expect, such as the Authorization header. |
+| [`A4001`](https://aventara.razor34.dev/framework/docs/error-codes#a4001) | Forbidden. | A guard returned false ("Operation denied by a framework guard."), a field write guard or a nested write's target guard included, a stage threw A4001, or the host's or access provider's state rejected with an object whose status or statusCode is the number 403, read by the same rule as A4000's 401 (answered with this message only, not sent to diagnostics). | Call as a caller the guard admits, or stop sending the guarded field. To answer another code, throw an AvError from the guard. |
 | [`A4002`](https://aventara.razor34.dev/framework/docs/error-codes#a4002) | Policy denied. | The configuration's policy refused the request: its engine does not allow the operation, a field the request names, writes or returns, a row it reaches, a row it creates, or the row a change leaves (moved out of what the caller reads, or failing its grant's after condition, which rolls the write back); on a database without interactive transactions, a write the policy can only check after it runs; or a stage threw new AvError("A4002", ...). | Read cause.message, which names what the policy refused. Call as a principal the policy allows, leave the refused field or relation out (a governed one is named only where every row grants it), or change only rows the caller may change and still read afterwards. |
 
 ## Validation issues (V1xxx)

package/dist/prebuilt/core-version.generated.d.ts

@@ -1,2 +1,2 @@
 /** The version of this `@aventara/core`. */
-export declare const CORE_VERSION = "1.0.0-rc.13";
+export declare const CORE_VERSION = "1.0.0-rc.14";

package/dist/prebuilt/core-version.generated.js

@@ -1 +1 @@
-export const CORE_VERSION = "1.0.0-rc.13";
+export const CORE_VERSION = "1.0.0-rc.14";

package/dist/runtime/operation-code.guidance.js

@@ -151,12 +151,12 @@ export const OPERATION_CODE_GUIDANCE = {
     },
     A4000: {
         message: "Unauthenticated.",
-        cause: "A guard threw new AvError(\"A4000\", ...), or the host's or access provider's state rejected with an object whose status or statusCode is 401 (an authentication library's refusal, answered with this message only): authentication is required or failed. The framework never authenticates by itself.",
+        cause: 'A guard threw new AvError("A4000", ...), or the host\'s or access provider\'s state rejected with an object whose status or statusCode is the number 401 (an authentication library\'s refusal, such as Better Auth\'s statusCode 401): authentication is required or failed. Such a refusal answers {"data":null,"code":"A4000","cause":{"message":"Unauthenticated."}}, nothing of the library\'s error, and is not sent to diagnostics. A string status ("401"), another number, or a status and statusCode that are two different numbers is no refusal and answers 500 A3000; a number beside a string is read by the number. The rule holds on every protocol route (operations, cached reads, /_transactions, /_all, /_access/can), on MCP tool calls and in Next.js; in process (avClient in a Server Component or Server Action, serverClient.$access.can given headers) the call rejects with an AvAuthError. The framework never authenticates by itself.',
         fix: "Send the credentials your guards expect, such as the Authorization header.",
     },
     A4001: {
         message: "Forbidden.",
-        cause: "A guard returned false (\"Operation denied by a framework guard.\"), a field write guard or a nested write's target guard included, a stage threw A4001, or the host's or access provider's state rejected with an object whose status or statusCode is 403 (answered with this message only).",
+        cause: "A guard returned false (\"Operation denied by a framework guard.\"), a field write guard or a nested write's target guard included, a stage threw A4001, or the host's or access provider's state rejected with an object whose status or statusCode is the number 403, read by the same rule as A4000's 401 (answered with this message only, not sent to diagnostics).",
         fix: "Call as a caller the guard admits, or stop sending the guarded field. To answer another code, throw an AvError from the guard.",
     },
     A4002: {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@aventara/core",
-  "version": "1.0.0-rc.13",
+  "version": "1.0.0-rc.14",
   "license": "SEE LICENSE IN LICENSE",
   "description": "Core runtime, contract compiler, and extension APIs for Aventara.",
   "type": "module",