@aventara/testing 0.1.0-pilot.0 → 0.1.0-pilot.2

package/dist/adapters/fake-adapter.js

@@ -1,8 +1,3 @@
-/**
- * Takes the caller's snapshot at the moment the boundary opens and returns the
- * single restore action that undoes everything written after it. Returning a
- * closure keeps the snapshot value's type local to the hook that owns it.
- */
 function beginRollback(rollback) {
     if (rollback === undefined) {
         return undefined;
@@ -12,7 +7,6 @@ function beginRollback(rollback) {
         rollback.restore(snapshot);
     };
 }
-/** Reusable provider-free Adapter implementation for framework/conformance tests. */
 export function createFakeAdapter(options) {
     const operations = [];
     const transactions = [];
@@ -54,8 +48,6 @@ export function createFakeAdapter(options) {
         catch (error) {
             restore?.();
             settle(scoped, "rolled-back");
-            // By identity: the transaction runtime recognises its own abort
-            // sentinel by reference, never by shape.
             throw error;
         }
         settle(scoped, "committed");

package/dist/protocol/corpus-contract.fixture.d.ts

@@ -3,16 +3,14 @@ import { Decimal } from "@aventara/core";
 /**
  * The corpus's adapter model:
  *
- * - `authors` — every standard operation (family 2); its `secret` field is
- *   hidden at client scope (R1's client-hidden field);
+ * - `authors` — every standard operation (family 2); its `secret` field is hidden
+ *   at client scope;
  * - `books` — references `authors`, and deleting an author cascades into it
- *   ({@link CORPUS_REFERENTIAL_ACTIONS}; a plan's `V1019`); the client scope
- *   adds a computed `label` to it ({@link CORPUS_CLIENT_CONFIG}, F-828);
- * - `secrets` — its one operation restricted away at client scope (R1's
- *   client-restricted variant; M6's `operations: {}`);
- * - `hiddenRes` — hidden at client scope (R1's client-hidden Resource, M7);
- * - `samples` — one field of each scalar whose wire form is not its runtime
- *   form (`bigint`, `datetime`, `decimal`, `bytes`; family 13, P1, C1).
+ *   ({@link CORPUS_REFERENTIAL_ACTIONS}; a plan's `V1019`); the client scope adds
+ *   a computed `label` to it;
+ * - `secrets` — its one operation restricted away at client scope;
+ * - `hiddenRes` — hidden at client scope;
+ * - `samples` — one field of each scalar whose wire form is not its runtime form.
  */
 export declare const CORPUS_MODEL: {
     readonly transactions: "interactive";
@@ -290,7 +288,9 @@ export declare const CORPUS_REFERENTIAL_ACTIONS: {
  *   conflict code; `A3001` — it throws a plain `Error`;
  * - `A3002` — a plan step carrying it runs, and the Adapter's transaction then
  *   fails to commit;
- * - `A3003` — `samples.find.unique` answers a datetime the wire cannot spell.
+ * - `A3003` — `samples.find.unique` answers a datetime the wire cannot spell;
+ * - `A3004` — the client pipe rewrites the arguments into ones the server
+ *   contract refuses (a filter on a field `authors` does not have).
  */
 export declare const CORPUS_TRIGGER: {
     readonly unauthenticated: "A4000";
@@ -303,13 +303,19 @@ export declare const CORPUS_TRIGGER: {
     readonly adapterThrows: "A3001";
     readonly commitFails: "A3002";
     readonly unencodable: "A3003";
+    readonly pipeOutputInvalid: "A3004";
 };
 /** The corpus's one client guard: it decides nothing unless a row names a trigger. */
 declare function corpusGuard(context: PipelineContext): boolean;
+/**
+ * The corpus's one client pipe: it rewrites nothing unless a row names the
+ * `A3004` trigger, and then adds a filter on a field the server does not have.
+ */
+declare function corpusPipe(args: unknown): unknown;
 /**
  * The corpus's client-scope configuration: what the ClientContract hides or
  * restricts, and `books.label` — a VIRTUAL field added at client scope and
- * computed on read from `id` (F-828, plan S12).
+ * computed on read from `id`.
  */
 export declare const CORPUS_CLIENT_CONFIG: {
     readonly fields: {
@@ -340,6 +346,7 @@ export declare const CORPUS_CLIENT_CONFIG: {
     };
     readonly pipelines: {
         readonly guards: readonly [typeof corpusGuard];
+        readonly pipes: readonly [typeof corpusPipe];
     };
     readonly restrictions: {
         readonly authors: {
@@ -372,18 +379,17 @@ export declare const CORPUS_ENTRYPOINT = "/api";
 export declare const CORPUS_CLIENT_CONTRACT_HASH = "sha256:07b1a75a6e8e88e30115ae81bcf7e3a12fa493bddce995a01867e2381bd158d0";
 /**
  * The corpus ClientContract as `GET /_contract` serves it: its JCS-canonical
- * bytes (Q8), `protocol.hash` included (M22). A literal, as a host must
- * serve it byte for byte; `corpus-contract.spec.ts` fails, naming this
- * constant, when the compiled contract moves.
+ * bytes, `protocol.hash` included. A literal, as a host must serve it byte for
+ * byte; `corpus-contract.spec.ts` fails, naming this constant, when the compiled
+ * contract moves.
  */
 export declare const CORPUS_CLIENT_CONTRACT_DOCUMENT = "{\"enums\":{},\"limits\":{\"maxBooleanNodes\":50,\"maxListLimit\":250,\"maxNestingDepth\":12,\"maxRequestBytes\":1048576,\"maxTransactionOperations\":20},\"protocol\":{\"hash\":\"sha256:07b1a75a6e8e88e30115ae81bcf7e3a12fa493bddce995a01867e2381bd158d0\",\"version\":1},\"resources\":{\"authors\":{\"fields\":{\"id\":{\"capabilities\":{\"filter\":[\"equals\"],\"select\":true},\"kind\":\"scalar\",\"lifecycle\":[],\"list\":false,\"nullable\":false,\"type\":{\"scalar\":\"string\"}},\"name\":{\"capabilities\":{\"create\":[],\"filter\":[\"equals\"],\"select\":true,\"update\":[]},\"kind\":\"scalar\",\"lifecycle\":[],\"list\":false,\"nullable\":false,\"type\":{\"scalar\":\"string\"}}},\"identifiers\":[[\"id\"]],\"operations\":{\"create\":{\"count\":true,\"many\":true,\"one\":true},\"delete\":{\"count\":true,\"first\":true,\"many\":true,\"unique\":true},\"find\":{\"count\":true,\"first\":true,\"many\":true,\"unique\":true},\"update\":{\"count\":true,\"first\":true,\"many\":true,\"unique\":true},\"upsert\":{\"unique\":true}}},\"books\":{\"fields\":{\"authorId\":{\"capabilities\":{\"filter\":[\"equals\"],\"select\":true},\"kind\":\"scalar\",\"lifecycle\":[],\"list\":false,\"nullable\":false,\"type\":{\"scalar\":\"string\"}},\"id\":{\"capabilities\":{\"filter\":[\"equals\"],\"select\":true},\"kind\":\"scalar\",\"lifecycle\":[],\"list\":false,\"nullable\":false,\"type\":{\"scalar\":\"string\"}},\"label\":{\"capabilities\":{\"select\":true},\"kind\":\"scalar\",\"lifecycle\":[\"COMPUTED_ON_READ\",\"VIRTUAL\"],\"list\":false,\"nullable\":false,\"type\":{\"scalar\":\"string\"}}},\"identifiers\":[[\"id\"]],\"operations\":{\"find\":{\"many\":true}}},\"samples\":{\"fields\":{\"amount\":{\"capabilities\":{\"create\":[],\"select\":true},\"kind\":\"scalar\",\"lifecycle\":[],\"list\":false,\"nullable\":false,\"type\":{\"scalar\":\"decimal\"}},\"at\":{\"capabilities\":{\"create\":[],\"select\":true},\"kind\":\"scalar\",\"lifecycle\":[],\"list\":false,\"nullable\":false,\"type\":{\"scalar\":\"datetime\"}},\"blob\":{\"capabilities\":{\"create\":[],\"select\":true},\"kind\":\"scalar\",\"lifecycle\":[],\"list\":false,\"nullable\":false,\"type\":{\"scalar\":\"bytes\"}},\"count\":{\"capabilities\":{\"create\":[],\"select\":true},\"kind\":\"scalar\",\"lifecycle\":[],\"list\":false,\"nullable\":false,\"type\":{\"scalar\":\"bigint\"}},\"id\":{\"capabilities\":{\"filter\":[\"equals\"],\"select\":true},\"kind\":\"scalar\",\"lifecycle\":[],\"list\":false,\"nullable\":false,\"type\":{\"scalar\":\"string\"}}},\"identifiers\":[[\"id\"]],\"operations\":{\"create\":{\"one\":true},\"find\":{\"unique\":true}}},\"secrets\":{\"fields\":{\"id\":{\"capabilities\":{\"filter\":[\"equals\"],\"select\":true},\"kind\":\"scalar\",\"lifecycle\":[],\"list\":false,\"nullable\":false,\"type\":{\"scalar\":\"string\"}}},\"identifiers\":[[\"id\"]],\"operations\":{}}},\"scalars\":{\"bigint\":{\"builtin\":true},\"bytes\":{\"builtin\":true},\"datetime\":{\"builtin\":true},\"decimal\":{\"builtin\":true},\"string\":{\"builtin\":true}},\"transactions\":\"interactive\"}";
 /**
  * The hash of the corpus's SECOND ClientContract — the same model and
- * configuration with `transactions: "none"` (family 6's `/_transactions`
- * absence). A row targets it by sending this hash, exactly as a client
- * generated against it would; the runner gives the row the Framework whose
- * ClientContract it names (the director, 2026-10-05). A literal, held to the
- * compiled value by `corpus-contract.spec.ts`.
+ * configuration with `transactions: "none"` (family 6's `/_transactions` absence).
+ * A row targets it by sending this hash, exactly as a client generated against it
+ * would; the runner gives the row the Framework whose ClientContract it names. A
+ * literal, held to the compiled value by `corpus-contract.spec.ts`.
  */
 export declare const CORPUS_NONE_CLIENT_CONTRACT_HASH = "sha256:d333e8396b9bf9127e0859ed69b9874f230058a597e2129e6b9e9b380daef618";
 /** The one record the corpus Adapter knows. */
@@ -394,8 +400,8 @@ export declare const CORPUS_AUTHOR: {
 /** The `where.id` that matches nothing. */
 export declare const CORPUS_NOBODY = "nobody";
 /**
- * The one `samples` record, in runtime forms — what an Adapter hands core,
- * and what the HTTP encoders must spell in wire forms (P1).
+ * The one `samples` record, in runtime forms — what an Adapter hands core, and
+ * what the HTTP encoders must spell in wire forms.
  */
 export declare const CORPUS_SAMPLE: {
     readonly id: "s1";

package/dist/protocol/corpus-contract.fixture.js

@@ -1,14 +1,5 @@
 import { createFramework, Decimal, FrameworkError } from "@aventara/core";
 import { createFakeAdapter } from "../adapters/fake-adapter.js";
-/**
- * The Framework every driven corpus row runs against: one model, one
- * configuration, and an in-memory Adapter whose answer is a pure function of
- * the operation it is handed — so a row's expected bytes are fixed facts, and
- * no row needs a provider (plan §13).
- *
- * Grows with the corpus (plan §6): each slice adds the resources its rows
- * need, and moves {@link CORPUS_CLIENT_CONTRACT_HASH} with them.
- */
 const identityString = {
     kind: "scalar",
     type: { scalar: "string" },
@@ -26,7 +17,6 @@ const writableString = {
         update: [],
     },
 };
-/** A non-JSON-native scalar the corpus reads (family 13): selectable, never filtered. */
 const wired = (scalar) => ({
     kind: "scalar",
     type: { scalar },
@@ -35,22 +25,7 @@ const wired = (scalar) => ({
     lifecycle: [],
     capabilities: { select: true, create: [] },
 });
-/** One `find.many`: what the corpus's supporting Resources advertise. */
 const findMany = { find: { many: true } };
-/**
- * The corpus's adapter model:
- *
- * - `authors` — every standard operation (family 2); its `secret` field is
- *   hidden at client scope (R1's client-hidden field);
- * - `books` — references `authors`, and deleting an author cascades into it
- *   ({@link CORPUS_REFERENTIAL_ACTIONS}; a plan's `V1019`); the client scope
- *   adds a computed `label` to it ({@link CORPUS_CLIENT_CONFIG}, F-828);
- * - `secrets` — its one operation restricted away at client scope (R1's
- *   client-restricted variant; M6's `operations: {}`);
- * - `hiddenRes` — hidden at client scope (R1's client-hidden Resource, M7);
- * - `samples` — one field of each scalar whose wire form is not its runtime
- *   form (`bigint`, `datetime`, `decimal`, `bytes`; family 13, P1, C1).
- */
 export const CORPUS_MODEL = {
     transactions: "interactive",
     scalars: {
@@ -105,23 +80,9 @@ export const CORPUS_MODEL = {
         },
     },
 };
-/** Deleting an author cascades into its books (an edge under `books`). */
 export const CORPUS_REFERENTIAL_ACTIONS = {
     books: [{ field: "author", target: "authors", onDelete: "cascade" }],
 };
-/**
- * The `where.id` a row sends to make the corpus Framework fail one way
- * (families 10 and 12, "a fake adapter returning the code, labelled so"):
- *
- * - `A4000`, `A4001`, `A4002`, `A3000` — the client guard throws
- *   `FrameworkError("A4000")`, denies (`false`), throws
- *   `FrameworkError("A4002")`, or throws a plain `Error`;
- * - `A2008`, `A2013`, `A2014` — the Adapter throws `FrameworkError` with that
- *   conflict code; `A3001` — it throws a plain `Error`;
- * - `A3002` — a plan step carrying it runs, and the Adapter's transaction then
- *   fails to commit;
- * - `A3003` — `samples.find.unique` answers a datetime the wire cannot spell.
- */
 export const CORPUS_TRIGGER = {
     unauthenticated: "A4000",
     guardDenies: "A4001",
@@ -133,8 +94,8 @@ export const CORPUS_TRIGGER = {
     adapterThrows: "A3001",
     commitFails: "A3002",
     unencodable: "A3003",
+    pipeOutputInvalid: "A3004",
 };
-/** The `where.id` an operation's arguments name, when it names one as a string. */
 function whereIdOf(args) {
     const where = typeof args === "object" && args !== null
         ? args.where
@@ -144,7 +105,6 @@ function whereIdOf(args) {
         : undefined;
     return typeof id === "string" ? id : undefined;
 }
-/** The corpus's one client guard: it decides nothing unless a row names a trigger. */
 function corpusGuard(context) {
     switch (whereIdOf(context.args)) {
         case CORPUS_TRIGGER.unauthenticated:
@@ -159,11 +119,13 @@ function corpusGuard(context) {
             return true;
     }
 }
-/**
- * The corpus's client-scope configuration: what the ClientContract hides or
- * restricts, and `books.label` — a VIRTUAL field added at client scope and
- * computed on read from `id` (F-828, plan S12).
- */
+function corpusPipe(args) {
+    if (whereIdOf(args) !== CORPUS_TRIGGER.pipeOutputInvalid) {
+        return undefined;
+    }
+    const record = args;
+    return { ...record, where: { ...record.where, nope: "x" } };
+}
 export const CORPUS_CLIENT_CONFIG = {
     fields: {
         books: {
@@ -187,46 +149,19 @@ export const CORPUS_CLIENT_CONFIG = {
             },
         },
     },
-    pipelines: { guards: [corpusGuard] },
+    pipelines: { guards: [corpusGuard], pipes: [corpusPipe] },
     restrictions: {
         authors: { fields: { secret: { hidden: true } } },
         secrets: { operations: { find: { many: false } } },
         hiddenRes: { hidden: true },
     },
 };
-/** The corpus Framework's mount point; every row's path is relative to it. */
 export const CORPUS_ENTRYPOINT = "/api";
-/**
- * The corpus ClientContract's hash: what a generated client for it sends as
- * `Aventara-Contract-Hash`. A literal, as a generated client holds it;
- * `corpus-contract.spec.ts` fails, naming this constant, when the compiled
- * contract moves.
- */
 export const CORPUS_CLIENT_CONTRACT_HASH = "sha256:07b1a75a6e8e88e30115ae81bcf7e3a12fa493bddce995a01867e2381bd158d0";
-/**
- * The corpus ClientContract as `GET /_contract` serves it: its JCS-canonical
- * bytes (Q8), `protocol.hash` included (M22). A literal, as a host must
- * serve it byte for byte; `corpus-contract.spec.ts` fails, naming this
- * constant, when the compiled contract moves.
- */
 export const CORPUS_CLIENT_CONTRACT_DOCUMENT = '{"enums":{},"limits":{"maxBooleanNodes":50,"maxListLimit":250,"maxNestingDepth":12,"maxRequestBytes":1048576,"maxTransactionOperations":20},"protocol":{"hash":"sha256:07b1a75a6e8e88e30115ae81bcf7e3a12fa493bddce995a01867e2381bd158d0","version":1},"resources":{"authors":{"fields":{"id":{"capabilities":{"filter":["equals"],"select":true},"kind":"scalar","lifecycle":[],"list":false,"nullable":false,"type":{"scalar":"string"}},"name":{"capabilities":{"create":[],"filter":["equals"],"select":true,"update":[]},"kind":"scalar","lifecycle":[],"list":false,"nullable":false,"type":{"scalar":"string"}}},"identifiers":[["id"]],"operations":{"create":{"count":true,"many":true,"one":true},"delete":{"count":true,"first":true,"many":true,"unique":true},"find":{"count":true,"first":true,"many":true,"unique":true},"update":{"count":true,"first":true,"many":true,"unique":true},"upsert":{"unique":true}}},"books":{"fields":{"authorId":{"capabilities":{"filter":["equals"],"select":true},"kind":"scalar","lifecycle":[],"list":false,"nullable":false,"type":{"scalar":"string"}},"id":{"capabilities":{"filter":["equals"],"select":true},"kind":"scalar","lifecycle":[],"list":false,"nullable":false,"type":{"scalar":"string"}},"label":{"capabilities":{"select":true},"kind":"scalar","lifecycle":["COMPUTED_ON_READ","VIRTUAL"],"list":false,"nullable":false,"type":{"scalar":"string"}}},"identifiers":[["id"]],"operations":{"find":{"many":true}}},"samples":{"fields":{"amount":{"capabilities":{"create":[],"select":true},"kind":"scalar","lifecycle":[],"list":false,"nullable":false,"type":{"scalar":"decimal"}},"at":{"capabilities":{"create":[],"select":true},"kind":"scalar","lifecycle":[],"list":false,"nullable":false,"type":{"scalar":"datetime"}},"blob":{"capabilities":{"create":[],"select":true},"kind":"scalar","lifecycle":[],"list":false,"nullable":false,"type":{"scalar":"bytes"}},"count":{"capabilities":{"create":[],"select":true},"kind":"scalar","lifecycle":[],"list":false,"nullable":false,"type":{"scalar":"bigint"}},"id":{"capabilities":{"filter":["equals"],"select":true},"kind":"scalar","lifecycle":[],"list":false,"nullable":false,"type":{"scalar":"string"}}},"identifiers":[["id"]],"operations":{"create":{"one":true},"find":{"unique":true}}},"secrets":{"fields":{"id":{"capabilities":{"filter":["equals"],"select":true},"kind":"scalar","lifecycle":[],"list":false,"nullable":false,"type":{"scalar":"string"}}},"identifiers":[["id"]],"operations":{}}},"scalars":{"bigint":{"builtin":true},"bytes":{"builtin":true},"datetime":{"builtin":true},"decimal":{"builtin":true},"string":{"builtin":true}},"transactions":"interactive"}';
-/**
- * The hash of the corpus's SECOND ClientContract — the same model and
- * configuration with `transactions: "none"` (family 6's `/_transactions`
- * absence). A row targets it by sending this hash, exactly as a client
- * generated against it would; the runner gives the row the Framework whose
- * ClientContract it names (the director, 2026-10-05). A literal, held to the
- * compiled value by `corpus-contract.spec.ts`.
- */
 export const CORPUS_NONE_CLIENT_CONTRACT_HASH = "sha256:d333e8396b9bf9127e0859ed69b9874f230058a597e2129e6b9e9b380daef618";
-/** The one record the corpus Adapter knows. */
 export const CORPUS_AUTHOR = { id: "a1", name: "Ada" };
-/** The `where.id` that matches nothing. */
 export const CORPUS_NOBODY = "nobody";
-/**
- * The one `samples` record, in runtime forms — what an Adapter hands core,
- * and what the HTTP encoders must spell in wire forms (P1).
- */
 export const CORPUS_SAMPLE = {
     id: "s1",
     count: 9007199254740993n,
@@ -234,25 +169,16 @@ export const CORPUS_SAMPLE = {
     amount: new Decimal("12.50"),
     blob: new Uint8Array([255, 0, 16]),
 };
-/** The conflict codes the corpus Adapter raises, and the text it raises them with. */
 const CONFLICTS = {
     [CORPUS_TRIGGER.conflict]: "A2008",
     [CORPUS_TRIGGER.concurrentModification]: "A2013",
     [CORPUS_TRIGGER.staleSelection]: "A2014",
 };
-/** The one record of each supporting Resource. */
 const SUPPORTING_RECORDS = {
     books: { id: "b1", authorId: CORPUS_AUTHOR.id },
     secrets: { id: "s1" },
     hiddenRes: { id: "h1" },
 };
-/**
- * What the corpus Adapter answers an operation. A trigger `where.id` fails it
- * ({@link CORPUS_TRIGGER}). Otherwise: for {@link CORPUS_NOBODY}, nothing — `0`
- * for a count, `[]` for a many, `null` for a single record; else `2` for a
- * count, the Resource's one record in a list for a many, and the one record
- * for a single-record operation (`samples`: {@link CORPUS_SAMPLE}).
- */
 function corpusAnswer(operation) {
     const id = whereIdOf(operation.arguments);
     const conflict = id === undefined ? undefined : CONFLICTS[id];
@@ -281,11 +207,6 @@ function corpusAnswer(operation) {
     }
     return CORPUS_AUTHOR;
 }
-/**
- * The fake Adapter's transaction, made to fail its commit when a step of the
- * plan named {@link CORPUS_TRIGGER.commitFails} — an infrastructure failure
- * after the work ran (`A3002`).
- */
 function failingCommit(transaction) {
     return async (work) => {
         let doomed = false;
@@ -303,16 +224,7 @@ function failingCommit(transaction) {
         return result;
     };
 }
-/**
- * A fresh corpus Framework, and the count of operations its Adapter has been
- * handed so far — a row's `adapterCalls` is read from it. `contractHash`
- * selects which corpus ClientContract it serves: the `transactions: "none"`
- * one when it is {@link CORPUS_NONE_CLIENT_CONTRACT_HASH}, the main one
- * otherwise (a stale or absent hash included).
- */
 export async function createCorpusFramework(contractHash) {
-    // Over the widened model type: which model is discovered is a runtime fact,
-    // and a literal-typed Framework costs type-checking the corpus never uses.
     const fake = createFakeAdapter({
         model: contractHash === CORPUS_NONE_CLIENT_CONTRACT_HASH
             ? { ...CORPUS_MODEL, transactions: "none" }

package/dist/protocol/in-process.driver.d.ts

@@ -1,11 +1,10 @@
 import type { AvProtocolDriver } from "./protocol-driver.js";
 /**
- * Driver 1 (plan S8, S9): the protocol hosted in process, with no HTTP stack —
- * a catch-all host (Q12) that hands `/_contract` to `protocol.encodeContract`,
- * `/_transactions` to the bound shortcut `protocol.handleTransaction`, every
- * other request to `protocol.handleOperation`, and writes back exactly what
- * they answer. What
- * it proves is the framework's own answer, host-free; driver 2 (S13) must
- * answer every row identically through a real server.
+ * Driver 1: the protocol hosted in process, with no HTTP stack — a catch-all host
+ * that hands `/_contract` to `protocol.encodeContract`, `/_transactions` to the
+ * bound shortcut `protocol.handleTransaction`, every other request to
+ * `protocol.handleOperation`, and writes back exactly what they answer. What it
+ * proves is the framework's own answer, host-free; driver 2 must answer every row
+ * identically through a real server.
  */
 export declare const inProcessDriver: AvProtocolDriver;

package/dist/protocol/in-process.driver.js

@@ -1,13 +1,4 @@
 import { AvProtocol } from "@aventara/core/protocol";
-/**
- * Driver 1 (plan S8, S9): the protocol hosted in process, with no HTTP stack —
- * a catch-all host (Q12) that hands `/_contract` to `protocol.encodeContract`,
- * `/_transactions` to the bound shortcut `protocol.handleTransaction`, every
- * other request to `protocol.handleOperation`, and writes back exactly what
- * they answer. What
- * it proves is the framework's own answer, host-free; driver 2 (S13) must
- * answer every row identically through a real server.
- */
 export const inProcessDriver = async (framework) => {
     const protocol = AvProtocol.bind(framework);
     return {

package/dist/protocol/per-route.driver.d.ts

@@ -1,12 +1,11 @@
 import type { AvProtocolDriver } from "./protocol-driver.js";
 /**
- * The per-route driver (plan S10): the protocol hosted in process as a host
- * that mounts ONE route per `protocol.surface()` entry — each operation on
- * `handleOperation`, `/_transactions` on `handleTransaction`, `/_contract` on
- * `encodeContract`, matched by method and path — and `protocol.answerAbsent`
- * as the fallback for everything it did not mount (Q12's first style).
- * `undefined` from the fallback is a path outside the protocol, which this
- * host answers with its own bodiless 404. Every corpus row must answer here
- * exactly as through driver 1's catch-all.
+ * The per-route driver: the protocol hosted in process as a host that mounts ONE
+ * route per `protocol.surface()` entry — each operation on `handleOperation`,
+ * `/_transactions` on `handleTransaction`, `/_contract` on `encodeContract`,
+ * matched by method and path — and `protocol.answerAbsent` as the fallback for
+ * everything it did not mount. `undefined` from the fallback is a path outside the
+ * protocol, which this host answers with its own bodiless 404. Every corpus row
+ * must answer here exactly as through driver 1's catch-all.
  */
 export declare const perRouteDriver: AvProtocolDriver;

package/dist/protocol/per-route.driver.js

@@ -1,20 +1,9 @@
 import { AvProtocol } from "@aventara/core/protocol";
-/** What this host answers a path the protocol says is the host's: its own bodiless 404. */
 const HOST_NOT_FOUND = Object.freeze({
     status: 404,
     headers: Object.freeze({}),
     body: "",
 });
-/**
- * The per-route driver (plan S10): the protocol hosted in process as a host
- * that mounts ONE route per `protocol.surface()` entry — each operation on
- * `handleOperation`, `/_transactions` on `handleTransaction`, `/_contract` on
- * `encodeContract`, matched by method and path — and `protocol.answerAbsent`
- * as the fallback for everything it did not mount (Q12's first style).
- * `undefined` from the fallback is a path outside the protocol, which this
- * host answers with its own bodiless 404. Every corpus row must answer here
- * exactly as through driver 1's catch-all.
- */
 export const perRouteDriver = async (framework) => {
     const protocol = AvProtocol.bind(framework);
     const mounted = new Map(protocol.surface().map((route) => [`${route.method} ${route.path}`, route]));

package/dist/protocol/protocol-conformance.d.ts

@@ -4,12 +4,11 @@ import type { AvProtocolDriver } from "./protocol-driver.js";
  *
  * Every row a host answers is driven — the rows whose `client.outcome` is
  * `"transport-error"` describe what a client receives instead of a framework
- * answer, so they are skipped (the director, 2026-10-05). Each driven row runs
- * against a fresh corpus Framework, through a fresh driver session, with one
- * request — the corpus Framework whose ClientContract hash the row's
- * `Aventara-Contract-Hash` names, as a generated client names it (the main
- * corpus contract for any other hash; the director, 2026-10-05) — and its
- * answer is held to the row's `server` block:
+ * answer, so they are skipped. Each driven row runs against a fresh corpus
+ * Framework, through a fresh driver session, with one request — the corpus
+ * Framework whose ClientContract hash the row's `Aventara-Contract-Hash` names, as
+ * a generated client names it — and its answer is held to the row's `server`
+ * block:
  *
  * - `status`, exactly;
  * - `code`: the body is a framework envelope (`AvProtocol.isOperationResponse`,
@@ -17,14 +16,14 @@ import type { AvProtocolDriver } from "./protocol-driver.js";
  * - `causeKeys`: the exact sorted key set of `cause`;
  * - `issues`: each issue's `code` and `path`, in order;
  * - `adapterCalls`: the operations the corpus Adapter was handed, exactly;
- * - `responseHeaders`: each named header present (names matched without
- *   regard to case) with exactly that value — a host may add its own;
+ * - `responseHeaders`: each named header present (names matched without regard to
+ *   case) with exactly that value — a host may add its own;
  * - `bodyBytes`: the body text, exactly.
  *
- * Resolves one result per driven row, in corpus order, each with the
- * mismatches found — none when the host conforms. A driver that throws is a
- * mismatch of its row, not a rejection of the run. Test-runner free: a
- * caller asserts on the results with whatever runner it uses.
+ * Resolves one result per driven row, in corpus order, each with the mismatches
+ * found — none when the host conforms. A driver that throws is a mismatch of its
+ * row, not a rejection of the run. Test-runner free: a caller asserts on the
+ * results with whatever runner it uses.
  */
 export declare function runAvProtocolConformance(driver: AvProtocolDriver): Promise<readonly {
     readonly label: string;

package/dist/protocol/protocol-conformance.js

@@ -1,33 +1,6 @@
 import { AvProtocol } from "@aventara/core/protocol";
 import { createCorpusFramework } from "./corpus-contract.fixture.js";
 import { AvProtocolFixtures } from "./protocol-fixtures.js";
-/**
- * `runAvProtocolConformance(driver)` — the corpus, driven through one host.
- *
- * Every row a host answers is driven — the rows whose `client.outcome` is
- * `"transport-error"` describe what a client receives instead of a framework
- * answer, so they are skipped (the director, 2026-10-05). Each driven row runs
- * against a fresh corpus Framework, through a fresh driver session, with one
- * request — the corpus Framework whose ClientContract hash the row's
- * `Aventara-Contract-Hash` names, as a generated client names it (the main
- * corpus contract for any other hash; the director, 2026-10-05) — and its
- * answer is held to the row's `server` block:
- *
- * - `status`, exactly;
- * - `code`: the body is a framework envelope (`AvProtocol.isOperationResponse`,
- *   the one envelope test) carrying that code — or, for `null`, is none;
- * - `causeKeys`: the exact sorted key set of `cause`;
- * - `issues`: each issue's `code` and `path`, in order;
- * - `adapterCalls`: the operations the corpus Adapter was handed, exactly;
- * - `responseHeaders`: each named header present (names matched without
- *   regard to case) with exactly that value — a host may add its own;
- * - `bodyBytes`: the body text, exactly.
- *
- * Resolves one result per driven row, in corpus order, each with the
- * mismatches found — none when the host conforms. A driver that throws is a
- * mismatch of its row, not a rejection of the run. Test-runner free: a
- * caller asserts on the results with whatever runner it uses.
- */
 export async function runAvProtocolConformance(driver) {
     const results = [];
     for (const row of AvProtocolFixtures) {
@@ -59,7 +32,6 @@ export async function runAvProtocolConformance(driver) {
     }
     return results;
 }
-/** Every way `response` departs from what the row's server block states. */
 function mismatchesOf(server, response, adapterCalls) {
     const mismatches = [];
     const expect = (what, actual, expected) => {
@@ -96,12 +68,10 @@ function mismatchesOf(server, response, adapterCalls) {
     }
     return mismatches;
 }
-/** The row's `Aventara-Contract-Hash`, its name matched without regard to case. */
 function contractHashOf(request) {
     const value = Object.entries(request.headers).find(([name]) => name.toLowerCase() === "aventara-contract-hash")?.[1];
     return typeof value === "string" ? value : undefined;
 }
-/** The parsed body, or `undefined` — which no envelope is — for text that is not JSON. */
 function parsedBody(text) {
     try {
         return JSON.parse(text);

package/dist/protocol/protocol-driver.d.ts

@@ -2,15 +2,13 @@ import type { Framework } from "@aventara/core";
 import type { AvProtocolRequest, AvProtocolResponse } from "@aventara/core/protocol";
 /**
  * One host under test, as the protocol conformance run drives it
- * (`runAvProtocolConformance`): given the corpus's Framework, mount the
- * protocol the way that host does, then answer each corpus request as that
- * host would answer it over HTTP — status, headers and body text, as an
- * `AvProtocolResponse`.
+ * (`runAvProtocolConformance`): given the corpus's Framework, mount the protocol
+ * the way that host does, then answer each corpus request as that host would
+ * answer it over HTTP — status, headers and body text, as an `AvProtocolResponse`.
  *
- * Driver 1 (`in-process.driver.ts`) calls the bound protocol's shortcuts
- * directly; a real host (a `node:http` server, Phase 11's Nest module) sends
- * the request over its own stack and reads back what arrived. The run calls
- * `close` once per row, after its one request.
+ * Driver 1 (`in-process.driver.ts`) calls the bound protocol's shortcuts directly;
+ * a real host sends the request over its own stack and reads back what arrived.
+ * The run calls `close` once per row, after its one request.
  */
 export type AvProtocolDriver = (framework: Framework) => Promise<{
     readonly send: (request: AvProtocolRequest) => Promise<AvProtocolResponse>;

package/dist/protocol/protocol-fixture.d.ts

@@ -1,24 +1,20 @@
 import type { OperationCode, ValidationCode } from "@aventara/core";
 import type { AvProtocolRequest } from "@aventara/core/protocol";
 /**
- * One row of the Phase 10 protocol fixture corpus: the HTTP request a host
- * receives (`request`), what the host must answer for it (`server`), and what
- * a generated client must do with that answer (`client`). Types only; the
- * rows live in `protocol-fixtures.ts`.
+ * Types only; the rows live in `protocol-fixtures.ts`.
  *
  * `request` is core's own request value, `AvProtocolRequest` from
- * `@aventara/core/protocol` (Q9), so a row is exactly what a host hands the
- * bound protocol: no second request shape exists for the corpus to drift from.
+ * `@aventara/core/protocol`, so a row is exactly what a host hands the bound
+ * protocol: no second request shape exists for the corpus to drift from.
  */
 export type AvProtocolFixture = {
     /**
-     * Stable across slices; the coverage gate reads it. A row that covers one
-     * of the specification's success rows begins with that row's operation
-     * name (`find.many …`, `create.one …`) or with `transaction` for the
+     * A row that covers one of the specification's success rows begins with that row's
+     * operation name (`find.many …`, `create.one …`) or with `transaction` for the
      * committed-plan row.
      */
     readonly label: string;
-    /** Method, entrypoint-relative path, headers, and a raw or parsed body (Q11). */
+    /** Method, entrypoint-relative path, headers, and a raw or parsed body. */
     readonly request: AvProtocolRequest;
     readonly server: {
         /**

package/dist/protocol/protocol-fixtures.js

@@ -1,14 +1,4 @@
 import { CORPUS_AUTHOR, CORPUS_CLIENT_CONTRACT_DOCUMENT, CORPUS_CLIENT_CONTRACT_HASH, CORPUS_NOBODY, CORPUS_NONE_CLIENT_CONTRACT_HASH, CORPUS_TRIGGER, } from "./corpus-contract.fixture.js";
-/**
- * The Phase 10 protocol fixture corpus: passive data, read by the coverage
- * gate (`protocol-coverage.spec.ts`) and, from later slices on, driven
- * through each host driver. Each slice adds the rows it settles and removes
- * what they cover from the gate's awaiting ledger.
- */
-/**
- * A well-formed generated-client request. A family-11 row's answer does not
- * depend on it: the answer is what arrived instead of a framework envelope.
- */
 const OPERATION_REQUEST = {
     method: "POST",
     path: "/_resources/authors/find/many",
@@ -19,21 +9,6 @@ const OPERATION_REQUEST = {
     },
     body: { kind: "raw", content: "{}" },
 };
-/**
- * Family 11 — transport errors (§13.5; R5). Each row is a response that is NOT
- * a framework envelope — produced by a proxy, a broken host or the network,
- * never by the framework — so a client raises `TransportError`, never a
- * `FrameworkError`. `AvProtocol.isOperationResponse` refuses every row's body
- * (`envelope-guard.spec.ts`), and the generated client's emitted check is held
- * to agree with it row by row (`packages/client`, the envelope pin).
- *
- * Every label begins `transport-error:`. These rows describe what a client
- * receives, not what a host must answer, so a host driver does not drive them:
- * it selects its rows by `client.outcome`, skipping every row whose outcome is
- * `"transport-error"` (the director, 2026-10-05) — never by label or by
- * `server.code === null`. `adapterCalls` is `0` because the framework produced
- * none of these answers.
- */
 const transportError = (label, status, bodyBytes) => ({
     label: `transport-error: ${label}`,
     request: OPERATION_REQUEST,
@@ -87,12 +62,6 @@ const TRANSPORT_ERRORS = [
     transportError("a negative operation index", 409, envelopeText("A2008", null, { message: "x", operation: -1 })),
     transportError("a fractional operation index", 409, envelopeText("A2008", null, { message: "x", operation: 0.5 })),
 ];
-/**
- * A generated client's request to the corpus Framework for one operation of
- * `authors` (`corpus-contract.fixture.ts`): its identity headers name the
- * corpus ClientContract, and it sends its own `Aventara-Request-Id`, so the
- * echo every framework answer carries (Q13) is a fixed fact of the row.
- */
 const corpusRequest = (operation, body, requestId, overrides = {}) => ({
     method: "POST",
     path: `/_resources/authors/${operation}`,
@@ -105,20 +74,10 @@ const corpusRequest = (operation, body, requestId, overrides = {}) => ({
     body: { kind: "raw", content: JSON.stringify(body) },
     ...overrides,
 });
-/** The framework's own headers on an answer to a request that sent `requestId`. */
 const answeredHeaders = (requestId) => ({
     "Content-Type": "application/json",
     "Aventara-Request-Id": requestId,
 });
-/**
- * Family 2 — success statuses (§13.2; plan S8). Every standard operation
- * through a found route: its success code at its status — `201` exactly for
- * `A1002` and `A1003`, `200` otherwise, `upsert.unique`'s `A1008` included —
- * with `cause: null`, the result in wire form, one Adapter call, and no
- * `Location` (P2: the framework's two headers are all it writes). The label
- * begins with the operation's name, which is how the coverage gate reads a
- * success row.
- */
 const success = (operation, body, status, code, data, label = "") => {
     const requestId = `corpus-${operation.replace(".", "-")}${label === "" ? "" : "-miss"}`;
     return {
@@ -157,13 +116,6 @@ const SUCCESS_STATUSES = [
     success("delete.count", WHERE, 200, "A1007", 2),
     success("upsert.unique", { ...WHERE, create: DATA, update: DATA }, 200, "A1008", CORPUS_AUTHOR),
 ];
-/**
- * F-828 (plan S12) — a computed field added under `client.fields` is read
- * through the HTTP surface like one added at root: `books.label`, VIRTUAL,
- * computed from `id` (`corpus-contract.fixture.ts`). It is in the default read,
- * and an explicit `select` of it answers it alone; the Adapter is asked only for
- * stored columns (core's `computed-read-runtime.scope-added-field.spec.ts`).
- */
 const scopeAdded = (label, body, requestId, data) => ({
     label: `scope-added: ${label}`,
     request: corpusRequest("find/many", body, requestId, {
@@ -179,15 +131,9 @@ const scopeAdded = (label, body, requestId, data) => ({
     client: { outcome: "resolve" },
 });
 const SCOPE_ADDED = [
-    scopeAdded("a computed field added under client.fields is in the default read (F-828)", {}, "corpus-scope-added-default", 
-    // The Contract orders the record's fields, not the Adapter.
-    [{ authorId: CORPUS_AUTHOR.id, id: "b1", label: "book:b1" }]),
-    scopeAdded("an explicit select of it answers it alone (F-828)", { select: ["label"] }, "corpus-scope-added-select", [{ label: "book:b1" }]),
+    scopeAdded("a computed field added under client.fields is in the default read", {}, "corpus-scope-added-default", [{ authorId: CORPUS_AUTHOR.id, id: "b1", label: "book:b1" }]),
+    scopeAdded("an explicit select of it answers it alone", { select: ["label"] }, "corpus-scope-added-select", [{ label: "book:b1" }]),
 ];
-/**
- * A request the protocol answers itself, before any Adapter call: the
- * framework's own envelope, exactly, at its code's status.
- */
 const refused = (label, request, status, code, message, headers = {}) => ({
     label,
     request,
@@ -205,20 +151,10 @@ const refused = (label, request, status, code, message, headers = {}) => ({
     client: { outcome: "framework-error", code },
 });
 const MALFORMED = "The request is malformed and cannot be interpreted.";
-/** `{"pad":"x…"}`, one byte over the default 1 MiB `maxRequestBytes` (§20.1). */
 const OVERSIZED = `{"pad":"${"x".repeat(1024 * 1024 + 1 - 10)}"}`;
 const rawBody = (requestId, content) => corpusRequest("find/many", {}, requestId, {
     body: { kind: "raw", content },
 });
-/**
- * Family 7 — body and media (§12.3, §12.6, Q11; plan S7, driven from S8). On
- * the raw arm: `{}` is valid (`find.many` above), and every other shape — a
- * list, a scalar, `null`, no body, text that is not JSON — is `A2000`; a
- * content type other than `application/json` is `A2011`; a decoded body over
- * the limit is `A2010`. On the parsed arm only the shape is the decoder's.
- * Routing metadata in the body is an argument like any other, refused by
- * core's own validation (N16), so it reaches the Framework but no Adapter.
- */
 const BODY_AND_MEDIA = [
     refused("body: a JSON list → 400 A2000", rawBody("corpus-body-list", "[]"), 400, "A2000", MALFORMED),
     refused("body: a JSON number → 400 A2000", rawBody("corpus-body-number", "3"), 400, "A2000", MALFORMED),
@@ -255,24 +191,16 @@ const BODY_AND_MEDIA = [
         client: { outcome: "framework-error", code: "A2004" },
     },
 ];
-/**
- * Family 8 — method (§12.1). A framework route accepts `POST` only; anything
- * else is `405 A2012` carrying `Allow: POST` (RFC 9110 §15.5.6; the
- * director, 2026-10-05).
- */
 const METHOD = [
     refused("method: GET on a resource route → 405 A2012 with Allow: POST", corpusRequest("find/many", {}, "corpus-method-get", { method: "GET" }), 405, "A2012", "The HTTP method is not allowed on this framework route.", { Allow: "POST" }),
 ];
-/** A generator's `GET /_contract`, with `headers` beside its own request id. */
 const contractRequest = (requestId, headers = {}, method = "GET") => ({
     method,
     path: "/_contract",
     headers: { "Aventara-Request-Id": requestId, ...headers },
     body: { kind: "raw", content: "" },
 });
-/** The corpus document's entity tag: the quoted contract hash (§12.5). */
 const CORPUS_ETAG = `"${CORPUS_CLIENT_CONTRACT_HASH}"`;
-/** `200` with the document: its exact bytes, `ETag`, `Cache-Control: no-cache`. */
 const contractServed = (label, requestId, headers = {}) => ({
     label: `contract: ${label}`,
     request: contractRequest(requestId, headers),
@@ -289,7 +217,6 @@ const contractServed = (label, requestId, headers = {}) => ({
     },
     client: { outcome: "resolve" },
 });
-/** `304 Not Modified`: no body, `ETag` and `Cache-Control` kept (RFC 9110 §15.4.5). */
 const contractNotModified = (label, requestId, ifNoneMatch) => ({
     label: `contract: ${label}`,
     request: contractRequest(requestId, { "If-None-Match": ifNoneMatch }),
@@ -306,14 +233,6 @@ const contractNotModified = (label, requestId, ifNoneMatch) => ({
     },
     client: { outcome: "resolve" },
 });
-/**
- * Family 1 — contract discovery (§12.5, Q8; plan S11). `GET /_contract`
- * serves the ClientContract's JCS bytes with `ETag` the quoted hash and
- * `Cache-Control: no-cache`, needs no identity header, and answers `304` with
- * no body when `If-None-Match` matches — weakly, in a list, or `*`. Any other
- * method is `405 A2012` with `Allow: GET`. A generator resolves both `200`
- * and `304` ("up to date", Phase 12).
- */
 const CONTRACT_DISCOVERY = [
     contractServed("GET → 200 with the JCS bytes, ETag and no-cache", "corpus-contract"),
     contractServed("no identity header is required, nor judged when sent", "corpus-contract-identity", {
@@ -329,24 +248,16 @@ const CONTRACT_DISCOVERY = [
     }),
     refused("method: POST on /_contract → 405 A2012 with Allow: GET", contractRequest("corpus-contract-post", {}, "POST"), 405, "A2012", "The HTTP method is not allowed on this framework route.", { Allow: "GET" }),
 ];
-/**
- * One node of a generated client's plan (§14, M25): the operation, its
- * arguments verbatim, and the fingerprint the client computed over them —
- * a literal, as the client sends it; `corpus-contract.spec.ts` recomputes
- * every one with core's `computeOperationFingerprint`.
- */
 const planNode = (resource, operation, args, fingerprint) => {
     const [family, variant] = operation.split(".");
     return { resource, family, variant, args, fingerprint };
 };
 const AUTHORS_FIND_MANY = planNode("authors", "find.many", {}, "fp1:1aLMnUbKspahv3fbsV7pKg");
-/** `POST /_transactions` with a plan of `nodes`, under the corpus identity. */
 const planRequest = (requestId, nodes, overrides = {}) => ({
     ...corpusRequest("", { operations: nodes }, requestId),
     path: "/_transactions",
     ...overrides,
 });
-/** A row refused by core's validation layer: its issues and cause keys, no Adapter call. */
 const invalid = (label, request, status, code, issues, operation) => ({
     label,
     request,
@@ -362,20 +273,6 @@ const invalid = (label, request, status, code, issues, operation) => ({
     },
     client: { outcome: "framework-error", code },
 });
-/**
- * Family 9 — transactions (§14; plan S9), through `/_transactions` under
- * ClientContract rules only (R1). A committed plan is `200 A1009` with each
- * step's data in plan order, a create included (P3); a rolled-back plan
- * answers its failing step's own code at that code's status, cause keys
- * `message` and `operation` (Q4, M15); a step that depends on rows an earlier
- * step's cascade removed is refused before anything runs (`V1019` → `422`);
- * and a plan node cannot carry an origin (N11).
- *
- * The R1 rows come in pairs, labelled `R1: <what> — single route` and
- * `R1: <what> — /_transactions`: the same refusal through both routes, the
- * plan's differing only by `cause.operation` (asserted pair by pair in
- * `corpus-contract.spec.ts`).
- */
 const TRANSACTIONS = [
     {
         label: "transaction — committed, a create included → 200 A1009 in plan order",
@@ -426,38 +323,31 @@ const TRANSACTIONS = [
     ...["scope", "origin"].map((key) => invalid(`transaction — a plan node carrying "${key}" cannot smuggle an origin → 422 A2004 / V1001`, planRequest(`corpus-tx-smuggle-${key}`, [
         { ...AUTHORS_FIND_MANY, [key]: "application" },
     ]), 422, "A2004", [{ code: "V1001", path: [key] }], 0)),
-    invalid("R1: a client-hidden field — single route", corpusRequest("find/many", { select: ["id", "secret"] }, "corpus-r1-field"), 422, "A2004", [{ code: "V1005", path: ["arguments", "select", 1] }]),
-    invalid("R1: a client-hidden field — /_transactions", planRequest("corpus-r1-field-tx", [
+    invalid("a client-hidden field — single route", corpusRequest("find/many", { select: ["id", "secret"] }, "corpus-r1-field"), 422, "A2004", [{ code: "V1005", path: ["arguments", "select", 1] }]),
+    invalid("a client-hidden field — /_transactions", planRequest("corpus-r1-field-tx", [
         AUTHORS_FIND_MANY,
         planNode("authors", "find.many", { select: ["id", "secret"] }, "fp1:1t8vSfPuohv1N5MIX8ccNw"),
     ]), 422, "A2004", [{ code: "V1005", path: ["arguments", "select", 1] }], 1),
-    invalid("R1: a client-restricted variant — single route", {
+    invalid("a client-restricted variant — single route", {
         ...corpusRequest("", {}, "corpus-r1-variant"),
         path: "/_resources/secrets/find/many",
     }, 404, "A2002", [{ code: "V1006", path: ["operation"] }]),
-    invalid("R1: a client-restricted variant — /_transactions", planRequest("corpus-r1-variant-tx", [
+    invalid("a client-restricted variant — /_transactions", planRequest("corpus-r1-variant-tx", [
         AUTHORS_FIND_MANY,
         planNode("secrets", "find.many", {}, "fp1:KegI5OcquDHi8z39VH11EQ"),
     ]), 404, "A2002", [{ code: "V1006", path: ["operation"] }], 1),
-    invalid("R1: a client-hidden Resource — single route", {
+    invalid("a client-hidden Resource — single route", {
         ...corpusRequest("", {}, "corpus-r1-resource"),
         path: "/_resources/hiddenRes/find/many",
     }, 404, "A2001", [{ code: "V1005", path: ["resource"] }]),
-    invalid("R1: a client-hidden Resource — /_transactions", planRequest("corpus-r1-resource-tx", [
+    invalid("a client-hidden Resource — /_transactions", planRequest("corpus-r1-resource-tx", [
         AUTHORS_FIND_MANY,
         planNode("hiddenRes", "find.many", {}, "fp1:UY6pLVLKM2LaIMnfQa0zGw"),
     ]), 404, "A2001", [{ code: "V1005", path: ["resource"] }], 1),
     refused("method: GET on /_transactions → 405 A2012 with Allow: POST", planRequest("corpus-tx-get", [AUTHORS_FIND_MANY], { method: "GET" }), 405, "A2012", "The HTTP method is not allowed on this framework route.", { Allow: "POST" }),
 ];
-/** A hash no corpus ClientContract has: a stale generated client's. */
 const STALE_HASH = `sha256:${"0".repeat(64)}`;
-/** The FVL's validation-failure text, which every A2001/A2002 envelope carries. */
 const VALIDATION_FAILED = "Operation arguments failed framework validation.";
-/**
- * An absence answer (Q2's O3): core's own envelope for the same request,
- * byte for byte (`corpus-contract.spec.ts` recomputes each operation row's
- * through `framework.execute`), with zero Adapter calls.
- */
 const absent = (label, request, status, code, cause) => ({
     label: `absent: ${label}`,
     request,
@@ -476,7 +366,6 @@ const absent = (label, request, status, code, cause) => ({
     },
     client: { outcome: "framework-error", code },
 });
-/** A corpus request to `path`, its identity headers overridden by `headers`. */
 const absentRequest = (path, requestId, headers = {}, method = "POST") => {
     const base = corpusRequest("", {}, requestId);
     return { ...base, method, path, headers: { ...base.headers, ...headers } };
@@ -501,16 +390,6 @@ const unavailableResource = (resource) => ({
         },
     ],
 });
-/**
- * Family 6 — the absence responder (Q2's O3, Q3; plan S10). What a request
- * for a route the ClientContract does not advertise answers, identically
- * whether the host mounts one route per `protocol.surface()` entry with
- * `protocol.answerAbsent` as its fallback or a catch-all whose decoder answers
- * absence (Q12) — both styles drive these rows. Identity first, so a stale
- * client hears `A2005` (F-716's server half), then the Resource, then the
- * operation; zero Adapter calls. `_transactions` under `"none"` is asked of
- * the corpus's second ClientContract, named by its hash.
- */
 const ABSENCE = [
     absent("an unadvertised operation, current hash → 404 A2002", absentRequest("/_resources/books/delete/many", "corpus-absent-op"), 404, "A2002", unavailableOperation("books", "delete.many")),
     absent("an unadvertised operation, stale hash → 409 A2005 (regenerate)", absentRequest("/_resources/books/delete/many", "corpus-absent-stale", {
@@ -525,9 +404,9 @@ const ABSENCE = [
         "Aventara-Protocol-Version": "2",
     }), 400, "A2006", { message: "Aventara protocol version does not match the server." }),
     absent("an unknown Resource → 404 A2001", absentRequest("/_resources/nope/find/many", "corpus-absent-resource"), 404, "A2001", unavailableResource("nope")),
-    absent("a Resource with operations: {} → 404 A2002 (M6)", absentRequest("/_resources/secrets/find/many", "corpus-absent-empty"), 404, "A2002", unavailableOperation("secrets", "find.many")),
-    absent("a client-hidden Resource → 404 A2001 (M7)", absentRequest("/_resources/hiddenRes/find/many", "corpus-absent-hidden"), 404, "A2001", unavailableResource("hiddenRes")),
-    absent('/_transactions under transactions "none" → 404 A2002 at ["operations"] (M17)', {
+    absent("a Resource with operations: {} → 404 A2002", absentRequest("/_resources/secrets/find/many", "corpus-absent-empty"), 404, "A2002", unavailableOperation("secrets", "find.many")),
+    absent("a client-hidden Resource → 404 A2001", absentRequest("/_resources/hiddenRes/find/many", "corpus-absent-hidden"), 404, "A2001", unavailableResource("hiddenRes")),
+    absent('/_transactions under transactions "none" → 404 A2002 at ["operations"]', {
         ...planRequest("corpus-absent-tx-none", [AUTHORS_FIND_MANY]),
         headers: {
             ...planRequest("corpus-absent-tx-none", [AUTHORS_FIND_MANY]).headers,
@@ -544,12 +423,6 @@ const ABSENCE = [
         ],
     }),
 ];
-/**
- * A row whose whole answer is stated: its status, its envelope byte for byte
- * (each object's keys in the order core writes them, as measured), its cause
- * keys and issues read off that envelope, and its Adapter calls. A success
- * code resolves; any other code is a framework error.
- */
 const answered = (label, request, status, adapterCalls, envelope, responseHeaders = answeredHeaders(String(request.headers["Aventara-Request-Id"]))) => {
     const { cause } = envelope;
     const issues = Array.isArray(cause?.issues)
@@ -576,16 +449,11 @@ const answered = (label, request, status, adapterCalls, envelope, responseHeader
             : { outcome: "framework-error", code: envelope.code },
     };
 };
-/** A corpus request to any Resource's operation route. */
 const routeRequest = (resource, operation, body, requestId, overrides = {}) => corpusRequest("", body, requestId, {
     path: `/_resources/${resource}/${operation.replace(".", "/")}`,
     ...overrides,
 });
 const NO_MATCH = "No record matched the unique selector.";
-/**
- * Family 3 — absence semantics (§13.4): what a request that matches nothing
- * answers, operation by operation. `find.first`'s `A1001` is family 2's.
- */
 const ABSENCE_SEMANTICS = [
     answered("absence: find.unique matching nothing → 404 A2003", routeRequest("authors", "find.unique", { where: { id: CORPUS_NOBODY } }, "corpus-none-find-unique"), 404, 1, { data: null, code: "A2003", cause: { message: NO_MATCH } }),
     answered("absence: find.many matching nothing → 200 A1000 with []", routeRequest("authors", "find.many", { where: { id: CORPUS_NOBODY } }, "corpus-none-find-many"), 200, 1, { data: [], code: "A1000", cause: null }),
@@ -595,34 +463,19 @@ const ABSENCE_SEMANTICS = [
     answered("absence: update.unique with no target → 404 A2003", routeRequest("authors", "update.unique", { where: { id: CORPUS_NOBODY }, data: DATA }, "corpus-none-update-unique"), 404, 1, { data: null, code: "A2003", cause: { message: NO_MATCH } }),
     answered("absence: delete.unique with no target → 404 A2003", routeRequest("authors", "delete.unique", { where: { id: CORPUS_NOBODY } }, "corpus-none-delete-unique"), 404, 1, { data: null, code: "A2003", cause: { message: NO_MATCH } }),
 ];
-/** `{ id: { equals: "a1" } }` wrapped in `depth` single-member `AND`s. */
 const nested = (depth) => depth === 0
     ? { id: { equals: CORPUS_AUTHOR.id } }
     : { AND: [nested(depth - 1)] };
-/** 51 filter nodes under one `OR`: one over the default `maxBooleanNodes` (50). */
 const TOO_MANY_NODES = {
     OR: Array.from({ length: 51 }, () => ({ id: { equals: CORPUS_AUTHOR.id } })),
 };
-/** A plan reference to `path` of step `operation`, whose fingerprint is `fingerprint`. */
 const ref = (operation, fingerprint, path) => ({
     $ref: { operation, fingerprint, path: [path] },
 });
-/** Step 0 of every reference row: create an author, selecting its id. */
 const CREATE_ID = planNode("authors", "create.one", { data: { name: CORPUS_AUTHOR.name }, select: ["id"] }, "fp1:aMKNYrUwcifOeY8ZYk4pow");
 const CREATE_ID_PRINT = CREATE_ID.fingerprint;
-/** A `find.first` that matches nothing: a source with no value to refer to. */
 const FIRST_NOBODY = planNode("authors", "find.first", { where: { id: CORPUS_NOBODY } }, "fp1:qNR9mD7_iVygNtmuuXjymw");
 const ARGUMENTS_FAILED = "Operation arguments failed framework validation.";
-/**
- * Family 4 — argument validation (§13.3; ADR 0008), core's own answers through
- * the HTTP surface: an unknown field (`V1005`), an unadvertised operator
- * (`V1006`), an invalid projection (`V1008`) → `A2004`; the three limits
- * (`V1013` nesting, `V1014` a plan's operation count, `V1015` filter nodes) →
- * `A2009`; a plan reference's index, fingerprint, path, type and value
- * (`V1016`, `V1017`, `V1010`, `V1011`, `V1018`) → `A2007`. Rollup precedence
- * (ADR 0008 decision 2), behaviourally: two `A2004` issues roll up together,
- * and a limit refuses alone, before a field defect is read.
- */
 const ARGUMENT_VALIDATION = [
     answered("argument: an unknown field in where → 422 A2004 / V1005", corpusRequest("find/many", { where: { nope: { equals: "x" } } }, "corpus-arg-field"), 422, 0, {
         data: null,
@@ -823,7 +676,6 @@ const ARGUMENT_VALIDATION = [
         },
     }),
 ];
-/** The corpus identity headers, with `overrides` applied and `omit` left out. */
 const identityHeaders = (requestId, overrides = {}, omit) => Object.fromEntries(Object.entries({
     "Content-Type": "application/json",
     "Aventara-Protocol-Version": "1",
@@ -832,19 +684,19 @@ const identityHeaders = (requestId, overrides = {}, omit) => Object.fromEntries(
     ...overrides,
 }).filter(([name]) => name !== omit));
 const STALE_CLIENT = "Generated client contract does not match the server. Regenerate the client.";
-/**
- * Family 5 — identity (§12.4; S7 follow-ups): a request missing either
- * identity header is malformed (`A2000`), another protocol version is
- * `A2006`, a stale or malformed hash is `A2005` with Appendix B.3's text (Q3),
- * all on a route that exists; header names are matched without regard to case.
- */
 const IDENTITY = [
     refused("identity: no Aventara-Protocol-Version → 400 A2000", corpusRequest("find/many", {}, "corpus-id-no-version", {
         headers: identityHeaders("corpus-id-no-version", {}, "Aventara-Protocol-Version"),
-    }), 400, "A2000", MALFORMED),
+    }), 400, "A2000", "The Aventara-Protocol-Version header is missing."),
     refused("identity: no Aventara-Contract-Hash → 400 A2000", corpusRequest("find/many", {}, "corpus-id-no-hash", {
         headers: identityHeaders("corpus-id-no-hash", {}, "Aventara-Contract-Hash"),
-    }), 400, "A2000", MALFORMED),
+    }), 400, "A2000", "The Aventara-Contract-Hash header is missing."),
+    refused("identity: neither identity header → 400 A2000 naming both", corpusRequest("find/many", {}, "corpus-id-none", {
+        headers: {
+            "Content-Type": "application/json",
+            "Aventara-Request-Id": "corpus-id-none",
+        },
+    }), 400, "A2000", "The Aventara-Protocol-Version and Aventara-Contract-Hash headers are missing."),
     refused("identity: another protocol version → 400 A2006", corpusRequest("find/many", {}, "corpus-id-version", {
         headers: identityHeaders("corpus-id-version", {
             "Aventara-Protocol-Version": "2",
@@ -864,16 +716,7 @@ const IDENTITY = [
         headers: Object.fromEntries(Object.entries(identityHeaders("corpus-id-case")).map(([name, value]) => [name.toLowerCase(), value])),
     }), 200, 1, { data: [CORPUS_AUTHOR], code: "A1000", cause: null }, answeredHeaders("corpus-id-case")),
 ];
-/** `authors.find.unique` naming the trigger `id` — what the guard or Adapter fails on. */
 const triggered = (id, requestId) => corpusRequest("find/unique", { where: { id } }, requestId);
-/**
- * Family 10 — internal and authorization (§13.2; Q5, Q6), from the corpus's
- * guard and Adapter failing on purpose (labelled by trigger,
- * `CORPUS_TRIGGER`): `A3000`–`A3003` → 500 with `{ message }` only — no
- * sub-code reaches the wire (Q5); `A4000` → 401, `A4001`/`A4002` → 403, with
- * no reason member (Q6). Every one is a framework error, never a transport
- * error: each body is an envelope.
- */
 const INTERNAL = [
     answered("internal: a guard that throws → 500 A3000", triggered(CORPUS_TRIGGER.guardThrows, "corpus-internal-a3000"), 500, 0, {
         data: null,
@@ -893,6 +736,11 @@ const INTERNAL = [
         code: "A3003",
         cause: { message: "Result serialization failed." },
     }),
+    answered("internal: a pipe whose output the server contract refuses → 500 A3004", routeRequest("authors", "find.many", { where: { id: CORPUS_TRIGGER.pipeOutputInvalid } }, "corpus-internal-a3004"), 500, 0, {
+        data: null,
+        code: "A3004",
+        cause: { message: "A server pipeline produced invalid arguments." },
+    }),
     answered("internal: a guard that requires authentication → 401 A4000", triggered(CORPUS_TRIGGER.unauthenticated, "corpus-internal-a4000"), 401, 0, {
         data: null,
         code: "A4000",
@@ -909,10 +757,6 @@ const INTERNAL = [
         cause: { message: "Denied by the corpus policy." },
     }),
 ];
-/**
- * Family 12 — conflict codes (§13.2): the corpus Adapter raising `A2008`,
- * `A2013` and `A2014` from an `update.unique` → 409, `cause.issues` absent.
- */
 const CONFLICT = [
     [CORPUS_TRIGGER.conflict, "A2008"],
     [CORPUS_TRIGGER.concurrentModification, "A2013"],
@@ -922,7 +766,6 @@ const CONFLICT = [
     code,
     cause: { message: `The corpus Adapter answered ${code}.` },
 }));
-/** The one `samples` record in wire form (P1): what both encoders must write. */
 const SAMPLE_WIRE = {
     id: "s1",
     count: "9007199254740993",
@@ -930,7 +773,6 @@ const SAMPLE_WIRE = {
     amount: "12.50",
     blob: "/wAQ",
 };
-/** A `samples` create whose `blob` is `blob`. */
 const sampleCreate = (blob, requestId) => routeRequest("samples", "create.one", {
     data: {
         count: "1",
@@ -939,13 +781,6 @@ const sampleCreate = (blob, requestId) => routeRequest("samples", "create.one",
         blob,
     },
 }, requestId);
-/**
- * Family 13 — wire scalars (P1, C1): a result carrying a `bigint`, a `Date`, a
- * `Decimal` and a `Uint8Array` is written as their exact wire strings; a
- * request `bytes` value whose padding carries non-zero bits is refused at the
- * field, and its canonical spelling accepted. (The unencodable result is
- * family 10's `A3003`.)
- */
 const WIRE_SCALARS = [
     answered("wire: a result's bigint, datetime, decimal and bytes in wire form → 200 A1000", routeRequest("samples", "find.unique", { where: { id: "s1" } }, "corpus-wire-result"), 200, 1, { data: SAMPLE_WIRE, code: "A1000", cause: null }),
     answered('wire: bytes "AB==" (non-zero pad bits) → 422 A2004 / V1003, no Adapter call', sampleCreate("AB==", "corpus-wire-pad-bits"), 422, 0, {
@@ -964,13 +799,6 @@ const WIRE_SCALARS = [
     }),
     answered('wire: bytes "AA==" (canonical) → 201 A1002', sampleCreate("AA==", "corpus-wire-canonical"), 201, 1, { data: SAMPLE_WIRE, code: "A1002", cause: null }),
 ];
-/**
- * Family 14 — correlation (Q13): `Aventara-Request-Id` is adopted when it is
- * 1–128 visible ASCII characters and echoed (every row above sends one and
- * states its echo, refusals included); otherwise it is ignored — a fresh id
- * is minted, whose value no row can state — and the request is never refused
- * over it.
- */
 const CORRELATION = [
     answered("correlation: a 128-character id is adopted and echoed", corpusRequest("find/many", {}, "x".repeat(128)), 200, 1, { data: [CORPUS_AUTHOR], code: "A1000", cause: null }),
     ...[

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@aventara/testing",
-  "version": "0.1.0-pilot.0",
+  "version": "0.1.0-pilot.2",
   "license": "SEE LICENSE IN LICENSE",
   "description": "Conformance and extension testing utilities for Aventara.",
   "type": "module",
@@ -20,13 +20,13 @@
     "LICENSE-ADDITIONAL-PERMISSION.md"
   ],
   "dependencies": {
-    "@aventara/core": "0.1.0-pilot.0"
+    "@aventara/core": "0.1.0-pilot.2"
   },
   "publishConfig": {
     "access": "public"
   },
   "scripts": {
-    "build": "tsc -p tsconfig.json",
+    "build": "tsc -p tsconfig.json --removeComments --declaration false && tsc -p tsconfig.json --emitDeclarationOnly && node ../../scripts/build/declaration-comments.sanitizer.ts dist",
     "typecheck": "tsc -p tsconfig.typecheck.json --noEmit",
     "test": "vitest run --typecheck --config ../../vitest.config.mts --root .",
     "lint": "biome lint src"