@aventara/core 1.0.0-rc.2 → 1.0.0-rc.3

package/CHANGELOG.md

@@ -1,5 +1,51 @@
 # @aventara/core
 
+## 1.0.0-rc.3
+
+### Patch Changes
+
+- b38034d: An issue inside one entry of a to-many relation directive's array names that entry's index:
+  `["arguments", "data", "posts", "$update", 1, "data", "category"]`, where it read `[…, "$update", "data", "category"]`.
+  This holds for `$create`, `$connect`, `$connectOrCreate`, `$update`, `$delete`, `$upsert`, `$set` and `$disconnect`,
+  as the runtime's own nested-write paths already did. A directive given one object, not an array, keeps its issue at the
+  directive.
+- b38034d: An empty boolean node in the `where` of a write is refused, as an `undefined` there is, and nothing runs. In
+  `update.many`, `update.count`, `update.first`, `delete.many`, `delete.count`, `delete.first` and a to-many `$update`
+  or `$delete`, an empty `NOT: {}`, `AND: {}` or `[]`, `OR: []` or `AND`/`OR` entry `{}`, at any depth, answers
+  `422 A2004` with a `V1001` issue at the node:
+  `A boolean node must hold a condition here: an empty one matches every row, and the write would reach more rows.`
+  The ORM reads these as no condition, so `delete.count({ where: { NOT: {} } })` deleted every row, and `delete.first`
+  with one deleted an arbitrary row. A `where` that is `{}` itself still means every row, and reads pass empty nodes through as before. Field filters are unchanged: a scalar's `{}` and a
+  to-many relation's `{}` were already refused, and a to-one relation's `{}` matches the rows that have a related row.
+- b38034d: The error catalog (`AvErrorCatalog`, `ERRORS.md`) catches up with the code: `A2004` says a value the database refused
+  may stand at the value itself where the adapter can place it (a bigint its driver cannot bind) and may be too long for
+  its index; `V1001` lists an `undefined` in a filter, selector or cursor and an empty boolean node in a bulk write's
+  `where`; `V1004` lists a value the database refused as too long or out of range, a bigint a driver cannot bind among
+  them.
+- b38034d: A value write compute writes to a field the caller's layer hides is judged by that field's validators and Json shape
+  (the Core Contract's), and a value they refuse is the server's error: `500 A3000`, the issues to the `diagnostics` sink
+  on an `AvComputedValueError`, with nothing of the hidden field in the answer. Before, a shaped Json field hidden from
+  the layer was not judged at all, and a hidden field's own validators answered the caller `A2004` with an issue at the
+  hidden field's path. A layer that shows the field still answers `A2004` at it.
+- b38034d: On PostgreSQL, a `@unique` value too long for its index (an index row past the B-tree's 8191 bytes, SQLSTATE
+  `54000`) is answered `422 A2004`, not `500 A3001`: one `V1004` issue at `["arguments"]`, as a value too long for its
+  column already was. The adapter reads the SQLSTATE, never the message. The issue's message for a value too long now
+  reads `The database refused this value: it is longer than the database can hold for its column.`
+  (it said `longer than its column can hold`, which an index refusal is not).
+- b38034d: A Pick layer's list entry that names what its parent hid is refused with the sentence written inline too. Inline in
+  `createFramework` or `AventaraModule.forRoot`, the error is at the key and reads:
+
+  ```text
+  Type '["select"]' is not assignable to type '…'.
+    …
+      Property '"Error: client cannot expose 'Post.internalNote': hidden by root"' is missing in type '["select"]' but required in type '{ readonly "Error: client cannot expose 'Post.internalNote': hidden by root": true; }'.
+  ```
+
+  where it ended at `Type 'string' is not assignable to type 'never'.` at the list's element. A list entry is now typed as
+  an object keyed by the sentence, which no list has, so a configuration that is not inline (an `aventaraConfig()` handed
+  to `AventaraModule.forRootAsync`) ends at the same `Property '"Error: …"' is missing` line, where it ended at
+  `Type '"select"' is not assignable to type '"Error: …"'`. An entry written `true` or as an object is unchanged.
+
 ## 1.0.0-rc.2
 
 ### Patch Changes

package/ERRORS.md

@@ -1,6 +1,6 @@
 # Aventara error codes
 
-Every code `@aventara/core` 1.0.0-rc.2 answers, reports in a validation issue, or refuses to start with. Generated from `AvErrorCatalog` (exported by `@aventara/core`); do not edit.
+Every code `@aventara/core` 1.0.0-rc.3 answers, reports in a validation issue, or refuses to start with. Generated from `AvErrorCatalog` (exported by `@aventara/core`); do not edit.
 
 Branch on the code, never on the message. In code, `AvErrorCatalog[code]` gives the same entry: `{ code, kind, message, cause, fix, docs }`.
 
@@ -31,7 +31,7 @@ The caller can fix these. The generated client and server-side calls throw the c
 | [`A2001`](https://aventara-framework.vercel.app/docs/error-codes#a2001) | Unknown Resource. | The Resource is not in the caller's contract: misspelt, hidden by exposure, or added to the schema after aventara:prepare last ran. cause.message is "The requested Resource is not available." and the issue is V1005 at `["resource"]`. | Use the model's exact name. After a schema change run the adapter's generate step (`npm run aventara:prepare` in a scaffolded project), restart, and regenerate the client. A Resource hidden on purpose is reached from server code (framework.application). |
 | [`A2002`](https://aventara-framework.vercel.app/docs/error-codes#a2002) | Unknown operation. | The operation is not available on that Resource: a typo, removed by exposure, an operation the adapter does not offer (such as delete.many), or a ctx.$sql, appTx.$sql or ctx.$transaction the adapter or the layer cannot run. The issue is V1006 at `["family"]` or `["variant"]`. | Call an operation the contract lists (`GET <api>/_contract`), regenerate a stale client, and check the layer's exemptions and transactionsStyle. |
 | [`A2003`](https://aventara-framework.vercel.app/docs/error-codes#a2003) | Not found. | A unique operation (find.unique, update.unique, delete.unique) matched no row, or a $connect names a record that does not exist. The operation fails, so no after hook runs. | Catch AvNotFoundError, or use a first-style operation, which answers A1001 with null. Check the $connect identifier. |
-| [`A2004`](https://aventara-framework.vercel.app/docs/error-codes#a2004) | Validation failed. | The arguments break a contract rule or a field validator. cause.issues lists each problem by V-code and path; a validator's issue also has check and params. The validators judge the values after the pipes and write compute, so a computed value they refuse is here too, at its field. A required create field left out is here (V1000). So is a value the database itself refused: too long for its column or out of its range (V1004), or holding a character it cannot store or a pattern it cannot read (V1001), with the issue at `["arguments"]` and its message saying what the database refused. So is a record written through a relation that writes that relation, or a field holding its reference, back (V1012, at that field), where the adapter admits no such write. | Fix the argument each issue's path points at, as its V-code says. A field the server must fill takes a compute.create stage. For a value the database refused, send one its column holds. For a nested write that writes its relation back, leave that field out: the parent supplies it. |
+| [`A2004`](https://aventara-framework.vercel.app/docs/error-codes#a2004) | Validation failed. | The arguments break a contract rule or a field validator. cause.issues lists each problem by V-code and path; a validator's issue also has check and params. The validators judge the values after the pipes and write compute, so a computed value they refuse is here too, at its field. A required create field left out is here (V1000). So is a value the database itself refused: too long for its column or its index, or out of its range (V1004), or holding a character it cannot store or a pattern it cannot read (V1001), with the issue at `["arguments"]`, or at the value where the adapter can place it (a bigint its driver cannot bind), and its message saying what the database refused. So is a record written through a relation that writes that relation, or a field holding its reference, back (V1012, at that field), where the adapter admits no such write. | Fix the argument each issue's path points at, as its V-code says. A field the server must fill takes a compute.create stage. For a value the database refused, send one its column holds. For a nested write that writes its relation back, leave that field out: the parent supplies it. |
 | [`A2005`](https://aventara-framework.vercel.app/docs/error-codes#a2005) | Contract mismatch. | The caller's Aventara-Contract-Hash is not the server's current one: the schema, the configuration, the limits or the exposure changed, or the client targets another deployment. | Regenerate the client against the running server: `npm run avclient:generate`. |
 | [`A2006`](https://aventara-framework.vercel.app/docs/error-codes#a2006) | Protocol mismatch. | Aventara-Protocol-Version is not 1. | Send `Aventara-Protocol-Version: 1`, or upgrade the client. |
 | [`A2007`](https://aventara-framework.vercel.app/docs/error-codes#a2007) | Invalid transaction reference. | A transaction $ref or fingerprint is invalid: the issues are V1010, V1011, V1016, V1017 or V1018, and cause.operation is the step. A $ref with no fingerprint is A2004 / V1000. | Let the generated client or framework.appTx build plans; check the $ref path and that the referenced step comes earlier. |
@@ -72,10 +72,10 @@ Each entry of `cause.issues[]` under `A2001`, `A2002`, `A2004`, `A2007` or `A200
 | Code | Meaning | Cause | Fix |
 |---|---|---|---|
 | [`V1000`](https://aventara-framework.vercel.app/docs/error-codes#v1000) | Required value missing. | A required value is absent: a create leaves out a required field that has no database default and no compute.create (the path names the field), a required relation and its reference field are both missing, a typed Json field lacks a required key, or a $ref has no fingerprint. | Send the value at the issue's path. When the server must fill it, give the field a compute.create stage or a database default; a pipe cannot fill it. |
-| [`V1001`](https://aventara-framework.vercel.app/docs/error-codes#v1001) | Invalid runtime/wire type. | A value of the wrong type: a string where a number is expected, a negative limit, a non-integer id, null given to an operator with no null meaning (gt, contains, in), two directives in one scalar action object (`{ $increment: 1, $decrement: 2 }`), or a server-side value that is not plain data. | Send the type the contract states at that path (the generated client's types say it). |
+| [`V1001`](https://aventara-framework.vercel.app/docs/error-codes#v1001) | Invalid runtime/wire type. | A value of the wrong type: a string where a number is expected, a negative limit, a non-integer id, null given to an operator with no null meaning (gt, contains, in), two directives in one scalar action object (`{ $increment: 1, $decrement: 2 }`), or a server-side value that is not plain data. Also a value that would make the call reach more rows: `undefined` in a filter, a unique selector or a cursor, an empty boolean node (`NOT: {}`, `AND: []`, `OR: []`) in the where of a write (update or delete many, count or first, a to-many $update or $delete). | Send the type the contract states at that path (the generated client's types say it). |
 | [`V1002`](https://aventara-framework.vercel.app/docs/error-codes#v1002) | Invalid enum value. | A value that is not a member of the enum, or outside a typed Json field's AvZ.enum or AvZ.literal. | Send one of the enum's members. |
 | [`V1003`](https://aventara-framework.vercel.app/docs/error-codes#v1003) | Invalid format (for example UUID/DateTime/base64). | A malformed datetime, decimal, base64 or UUID string, or a failed pattern or format validator (`check: "string_format"`). | Send the canonical encoding (ISO-8601 UTC datetime, decimal string, base64 bytes) and satisfy the validator that check and params name. |
-| [`V1004`](https://aventara-framework.vercel.app/docs/error-codes#v1004) | Value outside accepted range. | A number, length or size outside its range: a failed bound, length or size validator, a BigInt outside signed 64 bits, an AvZ.int() outside the safe integer range, or a transaction with no operations. | Send a value inside the range; check and params name the validator that failed. |
+| [`V1004`](https://aventara-framework.vercel.app/docs/error-codes#v1004) | Value outside accepted range. | A number, length or size outside its range: a failed bound, length or size validator, a BigInt outside signed 64 bits, an AvZ.int() outside the safe integer range, or a transaction with no operations. Under A2004 it is also a value the database refused as too long or out of its range, a BigInt beyond what the data source's driver can bind among them (some bind at most ±(2^53 − 1)). | Send a value inside the range; check and params name the validator that failed. |
 | [`V1005`](https://aventara-framework.vercel.app/docs/error-codes#v1005) | Unknown or inaccessible field. | A field that does not exist or is hidden in the caller's layer, an unknown Resource (under A2001), or a key a typed Json field's shape does not declare. | Use a field the caller's contract exposes, expose it through exemptions, or make the call from server code. |
 | [`V1006`](https://aventara-framework.vercel.app/docs/error-codes#v1006) | Unsupported filter/order/mutation directive. | An operator, directive or nested write the field does not offer (at any depth, inside not too; a to-many $update's data takes only what a bulk write takes), a mode it does not offer, or an operation that is not available (under A2002). | Use what the contract lists for that field or Resource, or expose it through exemptions. |
 | [`V1007`](https://aventara-framework.vercel.app/docs/error-codes#v1007) | Invalid unique identifier shape. | The where of a unique operation is not exactly one complete identifier. | Pass exactly one identifier: the id, or every field of one @unique or @@unique. |

package/dist/config/exact-framework-config.d.ts

@@ -147,7 +147,9 @@ type RefusalOf<Info, K, Value> = [Value] extends [false] ? never : Info extends
     readonly layer: infer Layer extends string;
     readonly parent: infer Parent extends string;
     readonly at: infer At extends string;
-} ? readonly [
+} ? Value extends readonly unknown[] ? {
+    readonly [S in `Error: ${Layer} cannot expose '${At}${K & string}': hidden by ${Parent}`]: true;
+} : readonly [
     `Error: ${Layer} cannot expose '${At}${K & string}': hidden by ${Parent}`
 ] : never;
 /** A Pick layer's operations exemption, a family or variant its parent hid refused by name. */

package/dist/operations/database-refusal.d.ts

@@ -6,7 +6,7 @@ import type { AvValidationCode } from "./validation-code.js";
 export declare const DATABASE_REFUSALS: {
     readonly tooLong: {
         readonly code: "V1004";
-        readonly message: "The database refused this value: it is longer than its column can hold.";
+        readonly message: "The database refused this value: it is longer than the database can hold for its column.";
     };
     readonly outOfRange: {
         readonly code: "V1004";

package/dist/operations/database-refusal.js

@@ -1,7 +1,7 @@
 export const DATABASE_REFUSALS = {
     tooLong: {
         code: "V1004",
-        message: "The database refused this value: it is longer than its column can hold.",
+        message: "The database refused this value: it is longer than the database can hold for its column.",
     },
     outOfRange: {
         code: "V1004",

package/dist/operations/operation-validator-core.js

@@ -304,6 +304,12 @@ const UNDEFINED_ARGUMENT_MESSAGES = {
     offset: "offset must not be undefined: leave the key out to mean no offset.",
     cursor: "cursor must not be undefined: leave the key out to mean no cursor.",
 };
+const EMPTY_BOOLEAN_NODE_MESSAGE = "A boolean node must hold a condition here: an empty one matches every row, and the write would reach more rows.";
+function isEmptyBooleanNode(value) {
+    return Array.isArray(value)
+        ? value.length === 0
+        : isRecord(value) && Object.keys(value).length === 0;
+}
 function validateWhere(contract, resourceName, where, path, state, depth) {
     if (!checkDepth(contract, state, depth)) {
         return;
@@ -322,6 +328,13 @@ function validateWhere(contract, resourceName, where, path, state, depth) {
         return;
     }
     for (const [key, value] of Object.entries(where)) {
+        if (state.refuseEmptyNodes === true &&
+            (key === "AND" || key === "OR" || key === "NOT") &&
+            isEmptyBooleanNode(value)) {
+            countFilterNode(contract, state);
+            addIssue(state.issues, "V1001", [...path, key], EMPTY_BOOLEAN_NODE_MESSAGE);
+            continue;
+        }
         if (key === "AND" || key === "OR") {
             countFilterNode(contract, state);
             if (!Array.isArray(value)) {
@@ -329,6 +342,10 @@ function validateWhere(contract, resourceName, where, path, state, depth) {
                 continue;
             }
             value.forEach((entry, index) => {
+                if (state.refuseEmptyNodes === true && isEmptyBooleanNode(entry)) {
+                    addIssue(state.issues, "V1001", [...path, key, index], EMPTY_BOOLEAN_NODE_MESSAGE);
+                    return;
+                }
                 validateWhere(contract, resourceName, entry, [...path, key, index], state, depth + 1);
             });
             continue;
@@ -687,8 +704,8 @@ function validateRelationMutationEntry(contract, edge, directive, value, path, i
             addIssue(issues, "V1012", path, "To-many $disconnect requires one or more unique identifiers.");
             return;
         }
-        for (const selector of selectors) {
-            validateUniqueSelector(contract, target, selector, path, issues);
+        for (const { entry: selector, at } of entriesOf(edge, value, path)) {
+            validateUniqueSelector(contract, target, selector, at, issues);
         }
         return;
     }
@@ -703,84 +720,81 @@ function validateRelationMutationEntry(contract, edge, directive, value, path, i
             addIssue(issues, "V1012", path, "To-many $set requires an identifier array.");
             return;
         }
-        for (const selector of value) {
-            validateUniqueSelector(contract, target, selector, path, issues);
+        for (const { entry: selector, at } of entriesOf(edge, value, path)) {
+            validateUniqueSelector(contract, target, selector, at, issues);
         }
         return;
     }
     if (directive === "$connect") {
-        const selectors = edge.cardinality === "many" && Array.isArray(value) ? value : [value];
-        for (const selector of selectors) {
-            validateUniqueSelector(contract, target, selector, path, issues);
+        for (const { entry: selector, at } of entriesOf(edge, value, path)) {
+            validateUniqueSelector(contract, target, selector, at, issues);
         }
         return;
     }
     if (directive === "$create") {
-        const entries = edge.cardinality === "many" && Array.isArray(value) ? value : [value];
-        for (const entry of entries) {
-            validateMutationData(contract, target, entry, "create", NESTED_WRITE_SCOPE, path, issues, transactionReferences);
+        for (const { entry, at } of entriesOf(edge, value, path)) {
+            validateMutationData(contract, target, entry, "create", NESTED_WRITE_SCOPE, at, issues, transactionReferences);
         }
         return;
     }
     if (directive === "$connectOrCreate") {
-        const entries = edge.cardinality === "many" && Array.isArray(value) ? value : [value];
-        for (const entry of entries) {
+        for (const { entry, at } of entriesOf(edge, value, path)) {
             if (!isRecord(entry) || !("where" in entry) || !("create" in entry)) {
-                addIssue(issues, "V1012", path, "$connectOrCreate requires where and create.");
+                addIssue(issues, "V1012", at, "$connectOrCreate requires where and create.");
                 continue;
             }
-            validateUniqueSelector(contract, target, entry.where, [...path, "where"], issues);
-            validateMutationData(contract, target, entry.create, "create", NESTED_WRITE_SCOPE, [...path, "create"], issues, transactionReferences);
+            validateUniqueSelector(contract, target, entry.where, [...at, "where"], issues);
+            validateMutationData(contract, target, entry.create, "create", NESTED_WRITE_SCOPE, [...at, "create"], issues, transactionReferences);
         }
         return;
     }
     if (directive === "$update") {
-        const entries = edge.cardinality === "many" && Array.isArray(value) ? value : [value];
-        for (const entry of entries) {
+        for (const { entry, at } of entriesOf(edge, value, path)) {
             if (!isRecord(entry) || !("data" in entry)) {
-                addIssue(issues, "V1012", path, "$update requires a data object.");
+                addIssue(issues, "V1012", at, "$update requires a data object.");
                 continue;
             }
             if (edge.cardinality === "many" && !("where" in entry)) {
-                addIssue(issues, "V1012", path, "To-many $update requires where.");
+                addIssue(issues, "V1012", at, "To-many $update requires where.");
                 continue;
             }
             if ("where" in entry) {
                 const state = {
                     issues,
-                    structuralRoot: [...path, "where"],
+                    structuralRoot: [...at, "where"],
                     transactionReferences,
                     scalarOnly: edge.capabilities.nestedWriteFilter === "scalar",
+                    ...(edge.cardinality === "many" ? { refuseEmptyNodes: true } : {}),
                     booleanFilterNodes: 0,
                     nestingExceeded: false,
                     booleanNodesExceeded: false,
                 };
-                validateWhere(contract, target, entry.where, [...path, "where"], state, 1);
+                validateWhere(contract, target, entry.where, [...at, "where"], state, 1);
             }
             validateMutationData(contract, target, entry.data, "update", edge.cardinality === "many"
                 ? TO_MANY_UPDATE_WRITE_SCOPE
-                : NESTED_WRITE_SCOPE, [...path, "data"], issues, transactionReferences);
+                : NESTED_WRITE_SCOPE, [...at, "data"], issues, transactionReferences);
         }
         return;
     }
     if (directive === "$delete") {
-        const entries = edge.cardinality === "many" && Array.isArray(value) ? value : [value];
-        for (const entry of entries) {
+        for (const { entry, at } of entriesOf(edge, value, path)) {
             if (edge.cardinality === "many") {
                 if (!isRecord(entry) || !("where" in entry)) {
-                    addIssue(issues, "V1012", path, "To-many $delete requires where.");
+                    addIssue(issues, "V1012", at, "To-many $delete requires where.");
                     continue;
                 }
                 const state = {
                     issues,
-                    structuralRoot: [...path, "where"],
+                    structuralRoot: [...at, "where"],
                     transactionReferences,
                     scalarOnly: edge.capabilities.nestedWriteFilter === "scalar",
+                    refuseEmptyNodes: true,
                     booleanFilterNodes: 0,
                     nestingExceeded: false,
                     booleanNodesExceeded: false,
                 };
-                validateWhere(contract, target, entry.where, [...path, "where"], state, 1);
+                validateWhere(contract, target, entry.where, [...at, "where"], state, 1);
             }
             else if (entry !== true &&
                 (!isRecord(entry) || Object.keys(entry).some((key) => key !== "where"))) {
@@ -802,23 +816,27 @@ function validateRelationMutationEntry(contract, edge, directive, value, path, i
         return;
     }
     if (directive === "$upsert") {
-        const entries = edge.cardinality === "many" && Array.isArray(value) ? value : [value];
-        for (const entry of entries) {
+        for (const { entry, at } of entriesOf(edge, value, path)) {
             if (!isRecord(entry) ||
                 !("create" in entry) ||
                 !("update" in entry) ||
                 (edge.cardinality === "many" && !("where" in entry))) {
-                addIssue(issues, "V1012", path, "$upsert requires create/update and requires where on to-many relations.");
+                addIssue(issues, "V1012", at, "$upsert requires create/update and requires where on to-many relations.");
                 continue;
             }
             if ("where" in entry) {
-                validateUniqueSelector(contract, target, entry.where, [...path, "where"], issues);
+                validateUniqueSelector(contract, target, entry.where, [...at, "where"], issues);
             }
-            validateMutationData(contract, target, entry.create, "create", NESTED_WRITE_SCOPE, [...path, "create"], issues, transactionReferences);
-            validateMutationData(contract, target, entry.update, "update", NESTED_WRITE_SCOPE, [...path, "update"], issues, transactionReferences);
+            validateMutationData(contract, target, entry.create, "create", NESTED_WRITE_SCOPE, [...at, "create"], issues, transactionReferences);
+            validateMutationData(contract, target, entry.update, "update", NESTED_WRITE_SCOPE, [...at, "update"], issues, transactionReferences);
         }
     }
 }
+function entriesOf(edge, value, path) {
+    return edge.cardinality === "many" && Array.isArray(value)
+        ? value.map((entry, index) => ({ entry, at: [...path, index] }))
+        : [{ entry: value, at: path }];
+}
 function validateRelationMutation(contract, fieldName, field, value, stage, scope, path, issues, transactionReferences) {
     const directives = advertisedDirectivesAt(field.capabilities[stage], scope);
     if (directives === undefined) {
@@ -896,6 +914,14 @@ function validateMutationArguments(contract, resourceName, request, args, issues
         }
     }
 }
+function emptyNodeRefusalOf(request) {
+    return (request.family === "update" || request.family === "delete") &&
+        (request.variant === "many" ||
+            request.variant === "count" ||
+            request.variant === "first")
+        ? { refuseEmptyNodes: true }
+        : {};
+}
 function isUniqueOperation(request) {
     return (request.variant === "unique" &&
         (request.family === "find" ||
@@ -941,6 +967,7 @@ export function validateOperationArguments(contract, request, options) {
                 issues,
                 structuralRoot: ["arguments", "where"],
                 transactionReferences: options?.transactionReferences === true,
+                ...emptyNodeRefusalOf(request),
                 booleanFilterNodes: 0,
                 nestingExceeded: false,
                 booleanNodesExceeded: false,

package/dist/operations/validation-code.guidance.js

@@ -4,7 +4,7 @@ export const VALIDATION_CODE_GUIDANCE = {
         fix: "Send the value at the issue's path. When the server must fill it, give the field a compute.create stage or a database default; a pipe cannot fill it.",
     },
     V1001: {
-        cause: "A value of the wrong type: a string where a number is expected, a negative limit, a non-integer id, null given to an operator with no null meaning (gt, contains, in), two directives in one scalar action object (`{ $increment: 1, $decrement: 2 }`), or a server-side value that is not plain data.",
+        cause: "A value of the wrong type: a string where a number is expected, a negative limit, a non-integer id, null given to an operator with no null meaning (gt, contains, in), two directives in one scalar action object (`{ $increment: 1, $decrement: 2 }`), or a server-side value that is not plain data. Also a value that would make the call reach more rows: `undefined` in a filter, a unique selector or a cursor, an empty boolean node (`NOT: {}`, `AND: []`, `OR: []`) in the where of a write (update or delete many, count or first, a to-many $update or $delete).",
         fix: "Send the type the contract states at that path (the generated client's types say it).",
     },
     V1002: {
@@ -16,7 +16,7 @@ export const VALIDATION_CODE_GUIDANCE = {
         fix: "Send the canonical encoding (ISO-8601 UTC datetime, decimal string, base64 bytes) and satisfy the validator that check and params name.",
     },
     V1004: {
-        cause: "A number, length or size outside its range: a failed bound, length or size validator, a BigInt outside signed 64 bits, an AvZ.int() outside the safe integer range, or a transaction with no operations.",
+        cause: "A number, length or size outside its range: a failed bound, length or size validator, a BigInt outside signed 64 bits, an AvZ.int() outside the safe integer range, or a transaction with no operations. Under A2004 it is also a value the database refused as too long or out of its range, a BigInt beyond what the data source's driver can bind among them (some bind at most ±(2^53 − 1)).",
         fix: "Send a value inside the range; check and params name the validator that failed.",
     },
     V1005: {

package/dist/runtime/field-validator.runtime.d.ts

@@ -1,5 +1,6 @@
 import type { AvContract } from "../contracts/contract.js";
 import type { AvValidationIssue } from "../operations/validation-code.js";
+import { AvComputedValueError } from "./computed-value.error.js";
 import { type Path } from "./field-stage.runtime.js";
 import type { OperationExecutionRequest } from "./operation-request.js";
 import type { ReferentialActionTable } from "./referential-action.js";
@@ -17,3 +18,11 @@ export type DeferredField = (resource: string, stage: WriteStage, field: string)
  * request's: `argumentsPath` and then the value's place in the arguments.
  */
 export declare function fieldValidatorIssues(contract: AvContract, references: ReferentialActionTable, request: OperationExecutionRequest, args: unknown, argumentsPath: Path, select: (path: Path) => boolean, deferred?: DeferredField): readonly AvValidationIssue[];
+/**
+ * The server's defect when a value written to a field the active layer hides
+ * breaks its validators or its Json shape, or `undefined`.
+ */
+export declare function hiddenFieldRefusal(contracts: {
+    readonly core: AvContract;
+    readonly active: AvContract;
+}, references: ReferentialActionTable, request: OperationExecutionRequest, args: unknown, argumentsPath: Path): AvComputedValueError | undefined;

package/dist/runtime/field-validator.runtime.js

@@ -1,4 +1,5 @@
-import { validatedFieldsOf, } from "../compiler/field-validator.compiler.js";
+import { hasFieldValidators, validatedFieldsOf, } from "../compiler/field-validator.compiler.js";
+import { AvComputedValueError } from "./computed-value.error.js";
 import { entryCheckIssues, fieldCheckIssues } from "./field-check.evaluator.js";
 import { isPlainRecord, valueAt, writeRecordPathsOf, } from "./field-stage.runtime.js";
 import { nestedWriteTargetsOf } from "./nested-write.walker.js";
@@ -14,7 +15,10 @@ function rulesOf(contract, compiled, resource, name) {
     const field = fields !== undefined && Object.hasOwn(fields, name)
         ? fields[name]
         : undefined;
-    if (field?.kind === "scalar" && field.json !== undefined) {
+    if (field === undefined) {
+        return undefined;
+    }
+    if (field.kind === "scalar" && field.json !== undefined) {
         return { kind: "shape", field };
     }
     const checks = Object.hasOwn(compiled, name) ? compiled[name] : undefined;
@@ -90,3 +94,33 @@ export function fieldValidatorIssues(contract, references, request, args, argume
     }
     return issues;
 }
+function holdsField(contract, resource, field) {
+    const fields = Object.hasOwn(contract.resources, resource)
+        ? contract.resources[resource]?.fields
+        : undefined;
+    return fields !== undefined && Object.hasOwn(fields, field);
+}
+export function hiddenFieldRefusal(contracts, references, request, args, argumentsPath) {
+    const { core, active } = contracts;
+    if (core === active || !hasFieldValidators(core)) {
+        return undefined;
+    }
+    const judged = [];
+    const issues = fieldValidatorIssues(core, references, request, args, argumentsPath, () => true, (resource, stage, field) => {
+        if (holdsField(active, resource, field)) {
+            return true;
+        }
+        judged.push({ resource, stage, field });
+        return false;
+    });
+    const [first] = issues;
+    if (first === undefined) {
+        return undefined;
+    }
+    const path = first.path ?? [];
+    const at = judged.find(({ field }) => path.includes(field)) ?? judged[0];
+    if (at === undefined) {
+        return undefined;
+    }
+    return new AvComputedValueError(at.resource, at.field, at.stage, issues, `compute.${at.stage} on ${at.resource}.${at.field}, a field the ${request.origin} layer hides, returned a value its validators refuse (${first.code}: ${first.message})`);
+}

package/dist/runtime/operation-code.guidance.js

@@ -71,7 +71,7 @@ export const OPERATION_CODE_GUIDANCE = {
     },
     A2004: {
         message: "Validation failed.",
-        cause: 'The arguments break a contract rule or a field validator. cause.issues lists each problem by V-code and path; a validator\'s issue also has check and params. The validators judge the values after the pipes and write compute, so a computed value they refuse is here too, at its field. A required create field left out is here (V1000). So is a value the database itself refused: too long for its column or out of its range (V1004), or holding a character it cannot store or a pattern it cannot read (V1001), with the issue at `["arguments"]` and its message saying what the database refused. So is a record written through a relation that writes that relation, or a field holding its reference, back (V1012, at that field), where the adapter admits no such write.',
+        cause: 'The arguments break a contract rule or a field validator. cause.issues lists each problem by V-code and path; a validator\'s issue also has check and params. The validators judge the values after the pipes and write compute, so a computed value they refuse is here too, at its field. A required create field left out is here (V1000). So is a value the database itself refused: too long for its column or its index, or out of its range (V1004), or holding a character it cannot store or a pattern it cannot read (V1001), with the issue at `["arguments"]`, or at the value where the adapter can place it (a bigint its driver cannot bind), and its message saying what the database refused. So is a record written through a relation that writes that relation, or a field holding its reference, back (V1012, at that field), where the adapter admits no such write.',
         fix: "Fix the argument each issue's path points at, as its V-code says. A field the server must fill takes a compute.create stage. For a value the database refused, send one its column holds. For a nested write that writes its relation back, leave that field out: the parent supplies it.",
     },
     A2005: {

package/dist/runtime/operation-runtime.js

@@ -15,7 +15,7 @@ import { createDiagnosticsReporter, } from "./diagnostics-reporter.js";
 import { AdapterBoundary, OPERATION_ARGUMENTS_PATH, resolveOperationFailure, sanitizeOperationFailure, } from "./error-boundary.js";
 import { planFieldStages } from "./field-stage.plan.js";
 import { guardSentFields, pipeSentFields, valueAt, writeRecordPathsOf, } from "./field-stage.runtime.js";
-import { fieldValidatorIssues } from "./field-validator.runtime.js";
+import { fieldValidatorIssues, hiddenFieldRefusal, } from "./field-validator.runtime.js";
 import { thrownFailure } from "./framework-error.factory.js";
 import { AvInterceptorNextError } from "./interceptor-next.error.js";
 import { runLevelLifecycle, } from "./level-lifecycle.runtime.js";
@@ -539,6 +539,10 @@ export async function executeAdmittedOperation(dependencies, request, contract,
                 return mapValidationOutcome(refused);
             }
         }
+        const hiddenRefusal = hiddenFieldRefusal({ core: dependencies.contracts.core, active: contract }, dependencies.recordWrites.references, request, computed, argumentsPath);
+        if (hiddenRefusal !== undefined) {
+            throw hiddenRefusal;
+        }
         args = deepFreeze(computed);
         let readMaterialized = false;
         let executedReadPlan;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@aventara/core",
-  "version": "1.0.0-rc.2",
+  "version": "1.0.0-rc.3",
   "license": "SEE LICENSE IN LICENSE",
   "description": "Core runtime, contract compiler, and extension APIs for Aventara.",
   "type": "module",