@aventara/testing 1.0.0-rc.0 → 1.0.0-rc.10

package/dist/adapters/fake-adapter.d.ts

@@ -1,43 +1,43 @@
-import type { Adapter, AdapterModel } from "@aventara/core";
-import type { AdapterOperation } from "@aventara/core/internal";
+import type { AvAdapter, AvAdapterModel } from "@aventara/core";
+import type { AvAdapterOperation } from "@aventara/core/internal";
 /** Answers one operation the fake Adapter is handed. */
-export type FakeAdapterExecute<M extends AdapterModel> = (operation: AdapterOperation<M>) => unknown | Promise<unknown>;
+export type AvFakeAdapterExecute<M extends AvAdapterModel> = (operation: AvAdapterOperation<M>) => unknown | Promise<unknown>;
 /** How a transaction ended: `"committed"` or `"rolled-back"`. */
-export type FakeTransactionOutcome = "committed" | "rolled-back";
+export type AvFakeTransactionOutcome = "committed" | "rolled-back";
 /** One settled transaction boundary: what ran inside it, and how it ended. */
-export type FakeTransactionTrace<M extends AdapterModel> = {
+export type AvFakeTransactionTrace<M extends AvAdapterModel> = {
     /** The operations run inside the transaction, in order. */
-    readonly operations: readonly AdapterOperation<M>[];
+    readonly operations: readonly AvAdapterOperation<M>[];
     /** How the transaction ended. */
-    readonly outcome: FakeTransactionOutcome;
+    readonly outcome: AvFakeTransactionOutcome;
 };
 /**
  * Rollback for state the test owns: `snapshot` when a transaction begins,
  * `restore` when its work rejects. Without it, the fake Adapter records
  * transaction boundaries but keeps whatever the work wrote.
  */
-export type FakeAdapterRollback<S> = {
+export type AvFakeAdapterRollback<S> = {
     /** Captures the state before a transaction's work runs. */
     readonly snapshot: () => S;
     /** Puts the captured state back after the work rejects. */
     readonly restore: (snapshot: S) => void;
 };
 /** Options for {@link createFakeAdapter}. */
-export type FakeAdapterOptions<M extends AdapterModel, S = unknown> = {
+export type AvFakeAdapterOptions<M extends AvAdapterModel, S = unknown> = {
     /** The adapter model the fake Adapter reports. */
     readonly model: M;
     /** Answers each operation; without it, every operation resolves `undefined`. */
-    readonly execute?: FakeAdapterExecute<M>;
-    /** Makes transactions roll back the test's own state; see {@link FakeAdapterRollback}. */
-    readonly rollback?: FakeAdapterRollback<S>;
+    readonly execute?: AvFakeAdapterExecute<M>;
+    /** Makes transactions roll back the test's own state; see {@link AvFakeAdapterRollback}. */
+    readonly rollback?: AvFakeAdapterRollback<S>;
 };
 /**
  * The Adapter {@link createFakeAdapter} returns, with a record of every
  * operation and transaction it ran.
  */
-export type FakeAdapter<M extends AdapterModel = AdapterModel> = Adapter<M> & {
-    readonly operations: readonly AdapterOperation<M>[];
-    readonly transactions: readonly FakeTransactionTrace<M>[];
+export type AvFakeAdapter<M extends AvAdapterModel = AvAdapterModel> = AvAdapter<M> & {
+    readonly operations: readonly AvAdapterOperation<M>[];
+    readonly transactions: readonly AvFakeTransactionTrace<M>[];
 };
 /** A provider-free, in-memory Adapter for framework and conformance tests. */
-export declare function createFakeAdapter<M extends AdapterModel, S = unknown>(options: FakeAdapterOptions<M, S>): FakeAdapter<M>;
+export declare function createFakeAdapter<M extends AvAdapterModel, S = unknown>(options: AvFakeAdapterOptions<M, S>): AvFakeAdapter<M>;

package/dist/index.d.ts

@@ -1,5 +1,5 @@
-export type { AdapterFactory } from "./adapters/adapter-factory.js";
-export type { FakeAdapter, FakeAdapterExecute, FakeAdapterOptions, FakeAdapterRollback, FakeTransactionOutcome, FakeTransactionTrace, } from "./adapters/fake-adapter.js";
+export type { AvAdapterFactory } from "./adapters/adapter-factory.js";
+export type { AvFakeAdapter, AvFakeAdapterExecute, AvFakeAdapterOptions, AvFakeAdapterRollback, AvFakeTransactionOutcome, AvFakeTransactionTrace, } from "./adapters/fake-adapter.js";
 export { createFakeAdapter } from "./adapters/fake-adapter.js";
 export { runAvProtocolConformance } from "./protocol/protocol-conformance.js";
 export { AvProtocolCorpus } from "./protocol/protocol-corpus.js";

package/dist/protocol/corpus-contract.fixture.d.ts

@@ -1,5 +1,6 @@
-import type { Framework, PipelineContext } from "@aventara/core";
-import { Decimal } from "@aventara/core";
+import type { AvAdapterModel, AvContext, AvFramework, AvPrebuiltContracts } from "@aventara/core";
+import { AvDecimal } from "@aventara/core";
+import type { AvAdapterOperation } from "@aventara/core/internal";
 /**
  * The corpus's adapter model:
  *
@@ -7,7 +8,7 @@ import { Decimal } from "@aventara/core";
  *   client scope;
  * - `books`: references `authors`, and deleting an author cascades into it
  *   ({@link CORPUS_REFERENTIAL_ACTIONS}; a plan's `V1019`); the client scope
- *   adds a computed `label` to it ({@link CORPUS_CLIENT_CONFIG});
+ *   defines a computed `label` the client alone sees ({@link CORPUS_RESOURCES});
  * - `secrets`: its one operation restricted away at client scope;
  * - `hiddenRes`: hidden at client scope;
  * - `samples`: one field of each scalar whose wire form is not its runtime
@@ -283,9 +284,9 @@ export declare const CORPUS_REFERENTIAL_ACTIONS: {
  * The `where.id` a row sends to make the corpus Framework fail one way:
  *
  * - `A4000`, `A4001`, `A4002`, `A3000` — the client guard throws
- *   `FrameworkError("A4000")`, denies (`false`), throws
- *   `FrameworkError("A4002")`, or throws a plain `Error`;
- * - `A2008`, `A2013`, `A2014` — the Adapter throws `FrameworkError` with that
+ *   `AvError("A4000")`, denies (`false`), throws
+ *   `AvError("A4002")`, or throws a plain `Error`;
+ * - `A2008`, `A2013`, `A2014` — the Adapter throws `AvError` with that
  *   conflict code; `A3001` — it throws a plain `Error`;
  * - `A3002` — a plan step carrying it runs, and the Adapter's transaction then
  *   fails to commit;
@@ -307,65 +308,78 @@ export declare const CORPUS_TRIGGER: {
     readonly pipeOutputInvalid: "A3004";
 };
 /** The corpus's one client guard: it decides nothing unless a row names a trigger. */
-declare function corpusGuard(context: PipelineContext): boolean;
+declare function corpusGuard(context: AvContext): boolean;
 /**
  * The corpus's one client pipe: it rewrites nothing unless a row names the
  * `A3004` trigger, and then adds a filter on a field the server does not have.
  */
 declare function corpusPipe(args: unknown): unknown;
 /**
- * The corpus's client-scope configuration: what the ClientContract hides or
- * restricts, and `books.label`, a VIRTUAL field added at client scope and
- * computed on read from `id`.
+ * The corpus's root `resources` tree: `books.label`, a VIRTUAL field computed on
+ * read from `id`.
  */
-export declare const CORPUS_CLIENT_CONFIG: {
-    readonly fields: {
-        readonly books: {
+export declare const CORPUS_RESOURCES: {
+    readonly books: {
+        readonly fields: {
             readonly label: {
-                readonly type: {
-                    readonly scalar: "string";
+                readonly definition: {
+                    readonly type: {
+                        readonly scalar: "string";
+                    };
+                    readonly nullable: false;
+                    readonly list: false;
+                    readonly lifecycle: readonly ["VIRTUAL"];
+                };
+                readonly pipelines: {
+                    readonly compute: {
+                        readonly read: {
+                            readonly dependsOn: readonly ["id"];
+                            readonly compute: ({ record, }: {
+                                readonly record: Readonly<Record<string, unknown>>;
+                            }) => string;
+                        };
+                    };
                 };
-                readonly nullable: false;
-                readonly list: false;
-                readonly lifecycle: readonly ["VIRTUAL"];
             };
         };
     };
-    readonly behaviors: {
-        readonly books: {
-            readonly fields: {
-                readonly label: {
-                    readonly read: {
-                        readonly dependsOn: readonly ["id"];
-                        readonly compute: ({ record, }: {
-                            readonly record: Readonly<Record<string, unknown>>;
-                        }) => string;
-                    };
+};
+/** The corpus's application layer: `books.label` is the client's only. */
+export declare const CORPUS_APPLICATION_CONFIG: {
+    readonly exposed: true;
+    readonly exemptions: {
+        readonly resources: {
+            readonly books: {
+                readonly fields: {
+                    readonly label: true;
                 };
             };
         };
     };
+};
+/**
+ * The corpus's client layer: what the ClientContract hides or restricts, and
+ * the client's own guard and pipe.
+ */
+export declare const CORPUS_CLIENT_CONFIG: {
     readonly pipelines: {
         readonly guards: readonly [typeof corpusGuard];
         readonly pipes: readonly [typeof corpusPipe];
     };
-    readonly restrictions: {
-        readonly authors: {
-            readonly fields: {
-                readonly secret: {
-                    readonly hidden: true;
+    readonly exposed: true;
+    readonly exemptions: {
+        readonly resources: {
+            readonly authors: {
+                readonly fields: {
+                    readonly secret: true;
                 };
             };
-        };
-        readonly secrets: {
-            readonly operations: {
-                readonly find: {
-                    readonly many: false;
+            readonly secrets: {
+                readonly operations: {
+                    readonly find: readonly ["many"];
                 };
             };
-        };
-        readonly hiddenRes: {
-            readonly hidden: true;
+            readonly hiddenRes: true;
         };
     };
 };
@@ -375,20 +389,26 @@ export declare const CORPUS_ENTRYPOINT = "/api";
  * The corpus ClientContract's hash: what a generated client for it sends as
  * `Aventara-Contract-Hash`. A literal, as a generated client holds it.
  */
-export declare const CORPUS_CLIENT_CONTRACT_HASH = "sha256:07b1a75a6e8e88e30115ae81bcf7e3a12fa493bddce995a01867e2381bd158d0";
+export declare const CORPUS_CLIENT_CONTRACT_HASH = "sha256:502530d5b918266c61f45e70035acd7d9637bbf7305c5572106185d5e63ec307";
 /**
  * The corpus ClientContract as `GET /_contract` serves it: its JCS-canonical
  * bytes, `protocol.hash` included. A literal, as a host must serve it byte for
  * byte.
  */
-export declare const CORPUS_CLIENT_CONTRACT_DOCUMENT = "{\"enums\":{},\"limits\":{\"maxBooleanNodes\":50,\"maxListLimit\":250,\"maxNestingDepth\":12,\"maxRequestBytes\":1048576,\"maxTransactionOperations\":20},\"protocol\":{\"hash\":\"sha256:07b1a75a6e8e88e30115ae81bcf7e3a12fa493bddce995a01867e2381bd158d0\",\"version\":1},\"resources\":{\"authors\":{\"fields\":{\"id\":{\"capabilities\":{\"filter\":[\"equals\"],\"select\":true},\"kind\":\"scalar\",\"lifecycle\":[],\"list\":false,\"nullable\":false,\"type\":{\"scalar\":\"string\"}},\"name\":{\"capabilities\":{\"create\":[],\"filter\":[\"equals\"],\"select\":true,\"update\":[]},\"kind\":\"scalar\",\"lifecycle\":[],\"list\":false,\"nullable\":false,\"type\":{\"scalar\":\"string\"}}},\"identifiers\":[[\"id\"]],\"operations\":{\"create\":{\"count\":true,\"many\":true,\"one\":true},\"delete\":{\"count\":true,\"first\":true,\"many\":true,\"unique\":true},\"find\":{\"count\":true,\"first\":true,\"many\":true,\"unique\":true},\"update\":{\"count\":true,\"first\":true,\"many\":true,\"unique\":true},\"upsert\":{\"unique\":true}}},\"books\":{\"fields\":{\"authorId\":{\"capabilities\":{\"filter\":[\"equals\"],\"select\":true},\"kind\":\"scalar\",\"lifecycle\":[],\"list\":false,\"nullable\":false,\"type\":{\"scalar\":\"string\"}},\"id\":{\"capabilities\":{\"filter\":[\"equals\"],\"select\":true},\"kind\":\"scalar\",\"lifecycle\":[],\"list\":false,\"nullable\":false,\"type\":{\"scalar\":\"string\"}},\"label\":{\"capabilities\":{\"select\":true},\"kind\":\"scalar\",\"lifecycle\":[\"COMPUTED_ON_READ\",\"VIRTUAL\"],\"list\":false,\"nullable\":false,\"type\":{\"scalar\":\"string\"}}},\"identifiers\":[[\"id\"]],\"operations\":{\"find\":{\"many\":true}}},\"samples\":{\"fields\":{\"amount\":{\"capabilities\":{\"create\":[],\"select\":true},\"kind\":\"scalar\",\"lifecycle\":[],\"list\":false,\"nullable\":false,\"type\":{\"scalar\":\"decimal\"}},\"at\":{\"capabilities\":{\"create\":[],\"select\":true},\"kind\":\"scalar\",\"lifecycle\":[],\"list\":false,\"nullable\":false,\"type\":{\"scalar\":\"datetime\"}},\"blob\":{\"capabilities\":{\"create\":[],\"select\":true},\"kind\":\"scalar\",\"lifecycle\":[],\"list\":false,\"nullable\":false,\"type\":{\"scalar\":\"bytes\"}},\"count\":{\"capabilities\":{\"create\":[],\"select\":true},\"kind\":\"scalar\",\"lifecycle\":[],\"list\":false,\"nullable\":false,\"type\":{\"scalar\":\"bigint\"}},\"id\":{\"capabilities\":{\"filter\":[\"equals\"],\"select\":true},\"kind\":\"scalar\",\"lifecycle\":[],\"list\":false,\"nullable\":false,\"type\":{\"scalar\":\"string\"}}},\"identifiers\":[[\"id\"]],\"operations\":{\"create\":{\"one\":true},\"find\":{\"unique\":true}}},\"secrets\":{\"fields\":{\"id\":{\"capabilities\":{\"filter\":[\"equals\"],\"select\":true},\"kind\":\"scalar\",\"lifecycle\":[],\"list\":false,\"nullable\":false,\"type\":{\"scalar\":\"string\"}}},\"identifiers\":[[\"id\"]],\"operations\":{}}},\"scalars\":{\"bigint\":{\"builtin\":true},\"bytes\":{\"builtin\":true},\"datetime\":{\"builtin\":true},\"decimal\":{\"builtin\":true},\"string\":{\"builtin\":true}},\"transactions\":\"interactive\"}";
+export declare const CORPUS_CLIENT_CONTRACT_DOCUMENT = "{\"enums\":{},\"limits\":{\"maxBooleanNodes\":50,\"maxJsonDepth\":64,\"maxListLimit\":250,\"maxNestingDepth\":12,\"maxRequestBytes\":1048576,\"maxTransactionOperations\":20},\"protocol\":{\"hash\":\"sha256:502530d5b918266c61f45e70035acd7d9637bbf7305c5572106185d5e63ec307\",\"version\":1},\"resources\":{\"authors\":{\"fields\":{\"id\":{\"capabilities\":{\"filter\":[\"equals\"],\"select\":true},\"kind\":\"scalar\",\"lifecycle\":[],\"list\":false,\"nullable\":false,\"type\":{\"scalar\":\"string\"}},\"name\":{\"capabilities\":{\"create\":[],\"filter\":[\"equals\"],\"select\":true,\"update\":[]},\"kind\":\"scalar\",\"lifecycle\":[],\"list\":false,\"nullable\":false,\"type\":{\"scalar\":\"string\"}}},\"identifiers\":[[\"id\"]],\"operations\":{\"create\":{\"count\":true,\"many\":true,\"one\":true},\"delete\":{\"count\":true,\"first\":true,\"many\":true,\"unique\":true},\"find\":{\"count\":true,\"first\":true,\"many\":true,\"unique\":true},\"update\":{\"count\":true,\"first\":true,\"many\":true,\"unique\":true},\"upsert\":{\"unique\":true}}},\"books\":{\"fields\":{\"authorId\":{\"capabilities\":{\"filter\":[\"equals\"],\"select\":true},\"kind\":\"scalar\",\"lifecycle\":[],\"list\":false,\"nullable\":false,\"type\":{\"scalar\":\"string\"}},\"id\":{\"capabilities\":{\"filter\":[\"equals\"],\"select\":true},\"kind\":\"scalar\",\"lifecycle\":[],\"list\":false,\"nullable\":false,\"type\":{\"scalar\":\"string\"}},\"label\":{\"capabilities\":{\"select\":true},\"kind\":\"scalar\",\"lifecycle\":[\"COMPUTED_ON_READ\",\"VIRTUAL\"],\"list\":false,\"nullable\":false,\"type\":{\"scalar\":\"string\"}}},\"identifiers\":[[\"id\"]],\"operations\":{\"find\":{\"many\":true}}},\"samples\":{\"fields\":{\"amount\":{\"capabilities\":{\"create\":[],\"select\":true},\"kind\":\"scalar\",\"lifecycle\":[],\"list\":false,\"nullable\":false,\"type\":{\"scalar\":\"decimal\"}},\"at\":{\"capabilities\":{\"create\":[],\"select\":true},\"kind\":\"scalar\",\"lifecycle\":[],\"list\":false,\"nullable\":false,\"type\":{\"scalar\":\"datetime\"}},\"blob\":{\"capabilities\":{\"create\":[],\"select\":true},\"kind\":\"scalar\",\"lifecycle\":[],\"list\":false,\"nullable\":false,\"type\":{\"scalar\":\"bytes\"}},\"count\":{\"capabilities\":{\"create\":[],\"select\":true},\"kind\":\"scalar\",\"lifecycle\":[],\"list\":false,\"nullable\":false,\"type\":{\"scalar\":\"bigint\"}},\"id\":{\"capabilities\":{\"filter\":[\"equals\"],\"select\":true},\"kind\":\"scalar\",\"lifecycle\":[],\"list\":false,\"nullable\":false,\"type\":{\"scalar\":\"string\"}}},\"identifiers\":[[\"id\"]],\"operations\":{\"create\":{\"one\":true},\"find\":{\"unique\":true}}},\"secrets\":{\"fields\":{\"id\":{\"capabilities\":{\"filter\":[\"equals\"],\"select\":true},\"kind\":\"scalar\",\"lifecycle\":[],\"list\":false,\"nullable\":false,\"type\":{\"scalar\":\"string\"}}},\"identifiers\":[[\"id\"]],\"operations\":{}}},\"scalars\":{\"bigint\":{\"builtin\":true},\"bytes\":{\"builtin\":true},\"datetime\":{\"builtin\":true},\"decimal\":{\"builtin\":true},\"string\":{\"builtin\":true}},\"transactions\":\"interactive\"}";
 /**
  * The hash of the corpus's second ClientContract: the same model and
  * configuration with `transactions: "none"` (the `/_transactions` absence
  * rows). A row targets it by sending this hash, exactly as a client generated
  * against it would.
  */
-export declare const CORPUS_NONE_CLIENT_CONTRACT_HASH = "sha256:d333e8396b9bf9127e0859ed69b9874f230058a597e2129e6b9e9b380daef618";
+export declare const CORPUS_NONE_CLIENT_CONTRACT_HASH = "sha256:5e99809294a2aae922b635e9a44b464b1b6e03359a54d30420292c62676a7ce5";
+/**
+ * The hash of the corpus's third ClientContract: the same model and
+ * configuration with the framework's `access` option ({@link CORPUS_ACCESS}),
+ * so it carries the `access` section and its `POST /_access/can` route.
+ */
+export declare const CORPUS_ACCESS_CLIENT_CONTRACT_HASH = "sha256:e45cdbc0c5f27e94058a1e0a1e4b9e532522ebeddcbb68170ac6ec6b45ca0d23";
 /** The one record the corpus Adapter knows. */
 export declare const CORPUS_AUTHOR: {
     readonly id: "a1";
@@ -404,18 +424,173 @@ export declare const CORPUS_SAMPLE: {
     readonly id: "s1";
     readonly count: 9007199254740993n;
     readonly at: Date;
-    readonly amount: Decimal;
+    readonly amount: AvDecimal;
     readonly blob: Uint8Array<ArrayBuffer>;
 };
 /**
- * A fresh corpus Framework, and the count of operations its Adapter has been
- * handed so far — a row's `adapterCalls` is read from it. `contractHash`
- * selects which corpus ClientContract it serves: the `transactions: "none"`
- * one when it is {@link CORPUS_NONE_CLIENT_CONTRACT_HASH}, the main one
+ * The corpus's access provider, behind {@link CORPUS_ACCESS_CLIENT_CONTRACT_HASH}:
+ * every request is anonymous (`me: null`, the same through every host), and its
+ * policy answers by the question alone, never by a row. Every operation is
+ * allowed, every row is in scope, every field readable, except: no `authors`
+ * row is in the delete scope; a question about `books` is refused by an
+ * `AvError` the engine throws; and any question about `samples` is the engine's
+ * own defect.
+ */
+export declare const CORPUS_ACCESS: {
+    state: () => {
+        me: null;
+    };
+    policy: {
+        can: ({ resource }: {
+            readonly principal: unknown;
+            readonly origin: import("@aventara/core").AvRequestOrigin;
+            readonly resource: string;
+        } & {
+            readonly action: "read" | "create" | "update" | "delete";
+            readonly row?: Readonly<Record<string, unknown>>;
+            readonly before?: Readonly<Record<string, unknown>>;
+            readonly beforeGrants?: readonly string[];
+            readonly exists: (resource: string, where: import("@aventara/core").AvPolicyWhere) => Promise<boolean>;
+        }) => true;
+        scopeOf: ({ resource, action }: {
+            readonly principal: unknown;
+            readonly origin: import("@aventara/core").AvRequestOrigin;
+            readonly resource: string;
+        } & {
+            readonly action: "read" | "update" | "delete";
+        }) => boolean;
+        fieldsOf: () => {
+            always: "all";
+            perRow: {};
+        };
+    };
+};
+/**
+ * The corpus Framework's configuration, over a fresh corpus Adapter, and the
+ * count of operations that Adapter has been handed so far. `contractHash`
+ * selects which corpus ClientContract it compiles to: the `transactions:
+ * "none"` one when it is {@link CORPUS_NONE_CLIENT_CONTRACT_HASH}, the one with
+ * `access` when it is {@link CORPUS_ACCESS_CLIENT_CONTRACT_HASH}, the main one
  * otherwise (a stale or absent hash included).
  */
-export declare function createCorpusFramework(contractHash?: string): Promise<{
-    readonly framework: Framework;
+export declare function corpusConfiguration(contractHash?: string): {
+    config: {
+        access?: {
+            state: () => {
+                me: null;
+            };
+            policy: {
+                can: ({ resource }: {
+                    readonly principal: unknown;
+                    readonly origin: import("@aventara/core").AvRequestOrigin;
+                    readonly resource: string;
+                } & {
+                    readonly action: "read" | "create" | "update" | "delete";
+                    readonly row?: Readonly<Record<string, unknown>>;
+                    readonly before?: Readonly<Record<string, unknown>>;
+                    readonly beforeGrants?: readonly string[];
+                    readonly exists: (resource: string, where: import("@aventara/core").AvPolicyWhere) => Promise<boolean>;
+                }) => true;
+                scopeOf: ({ resource, action }: {
+                    readonly principal: unknown;
+                    readonly origin: import("@aventara/core").AvRequestOrigin;
+                    readonly resource: string;
+                } & {
+                    readonly action: "read" | "update" | "delete";
+                }) => boolean;
+                fieldsOf: () => {
+                    always: "all";
+                    perRow: {};
+                };
+            };
+        };
+        api: string;
+        adapter: import("@aventara/core").AvAdapter<AvAdapterModel> & {
+            readonly operations: readonly AvAdapterOperation<AvAdapterModel>[];
+            readonly transactions: readonly import("../adapters/fake-adapter.js").AvFakeTransactionTrace<AvAdapterModel>[];
+        } & {
+            transaction?: <T>(work: (executor: import("@aventara/core/internal").AvAdapterTransactionExecutor<AvAdapterModel>) => Promise<T>) => Promise<T>;
+            referentialActions: {
+                readonly books: readonly [{
+                    readonly field: "author";
+                    readonly target: "authors";
+                    readonly references: readonly ["authorId"];
+                    readonly onDelete: "cascade";
+                }];
+            };
+        };
+        resources: {
+            readonly books: {
+                readonly fields: {
+                    readonly label: {
+                        readonly definition: {
+                            readonly type: {
+                                readonly scalar: "string";
+                            };
+                            readonly nullable: false;
+                            readonly list: false;
+                            readonly lifecycle: readonly ["VIRTUAL"];
+                        };
+                        readonly pipelines: {
+                            readonly compute: {
+                                readonly read: {
+                                    readonly dependsOn: readonly ["id"];
+                                    readonly compute: ({ record, }: {
+                                        readonly record: Readonly<Record<string, unknown>>;
+                                    }) => string;
+                                };
+                            };
+                        };
+                    };
+                };
+            };
+        };
+        application: {
+            readonly exposed: true;
+            readonly exemptions: {
+                readonly resources: {
+                    readonly books: {
+                        readonly fields: {
+                            readonly label: true;
+                        };
+                    };
+                };
+            };
+        };
+        client: {
+            readonly pipelines: {
+                readonly guards: readonly [typeof corpusGuard];
+                readonly pipes: readonly [typeof corpusPipe];
+            };
+            readonly exposed: true;
+            readonly exemptions: {
+                readonly resources: {
+                    readonly authors: {
+                        readonly fields: {
+                            readonly secret: true;
+                        };
+                    };
+                    readonly secrets: {
+                        readonly operations: {
+                            readonly find: readonly ["many"];
+                        };
+                    };
+                    readonly hiddenRes: true;
+                };
+            };
+        };
+    };
+    adapterCalls: () => number;
+};
+/**
+ * A fresh corpus Framework, and the count of operations its Adapter has been
+ * handed so far — a row's `adapterCalls` is read from it. `contractHash` selects
+ * which corpus ClientContract it serves ({@link corpusConfiguration}). With
+ * `prebuilt`, its Contracts are loaded from that file when it matches, as a
+ * serverless deployment's would be.
+ */
+export declare function createCorpusFramework(contractHash?: string, prebuilt?: AvPrebuiltContracts): Promise<{
+    readonly framework: AvFramework;
     readonly adapterCalls: () => number;
 }>;
 export {};

package/dist/protocol/corpus-contract.fixture.js

@@ -1,4 +1,4 @@
-import { createFramework, Decimal, FrameworkError } from "@aventara/core";
+import { AvDecimal, AvError, createFramework } from "@aventara/core";
 import { createFakeAdapter } from "../adapters/fake-adapter.js";
 const identityString = {
     kind: "scalar",
@@ -113,13 +113,13 @@ function whereIdOf(args) {
     return typeof id === "string" ? id : undefined;
 }
 function corpusGuard(context) {
-    switch (whereIdOf(context.args)) {
+    switch (whereIdOf(context.$args)) {
         case CORPUS_TRIGGER.unauthenticated:
-            throw new FrameworkError("A4000", "Authentication is required.");
+            throw new AvError("A4000", "Authentication is required.");
         case CORPUS_TRIGGER.guardDenies:
             return false;
         case CORPUS_TRIGGER.policyDenies:
-            throw new FrameworkError("A4002", "Denied by the corpus policy.");
+            throw new AvError("A4002", "Denied by the corpus policy.");
         case CORPUS_TRIGGER.guardThrows:
             throw new Error("the corpus guard failed");
         default:
@@ -133,47 +133,55 @@ function corpusPipe(args) {
     const record = args;
     return { ...record, where: { ...record.where, nope: "x" } };
 }
-export const CORPUS_CLIENT_CONFIG = {
-    fields: {
-        books: {
+export const CORPUS_RESOURCES = {
+    books: {
+        fields: {
             label: {
-                type: { scalar: "string" },
-                nullable: false,
-                list: false,
-                lifecycle: ["VIRTUAL"],
-            },
-        },
-    },
-    behaviors: {
-        books: {
-            fields: {
-                label: {
-                    read: {
-                        dependsOn: ["id"],
-                        compute: ({ record, }) => `book:${String(record.id)}`,
+                definition: {
+                    type: { scalar: "string" },
+                    nullable: false,
+                    list: false,
+                    lifecycle: ["VIRTUAL"],
+                },
+                pipelines: {
+                    compute: {
+                        read: {
+                            dependsOn: ["id"],
+                            compute: ({ record, }) => `book:${String(record.id)}`,
+                        },
                     },
                 },
             },
         },
     },
+};
+export const CORPUS_APPLICATION_CONFIG = {
+    exposed: true,
+    exemptions: { resources: { books: { fields: { label: true } } } },
+};
+export const CORPUS_CLIENT_CONFIG = {
     pipelines: { guards: [corpusGuard], pipes: [corpusPipe] },
-    restrictions: {
-        authors: { fields: { secret: { hidden: true } } },
-        secrets: { operations: { find: { many: false } } },
-        hiddenRes: { hidden: true },
+    exposed: true,
+    exemptions: {
+        resources: {
+            authors: { fields: { secret: true } },
+            secrets: { operations: { find: ["many"] } },
+            hiddenRes: true,
+        },
     },
 };
 export const CORPUS_ENTRYPOINT = "/api";
-export const CORPUS_CLIENT_CONTRACT_HASH = "sha256:07b1a75a6e8e88e30115ae81bcf7e3a12fa493bddce995a01867e2381bd158d0";
-export const CORPUS_CLIENT_CONTRACT_DOCUMENT = '{"enums":{},"limits":{"maxBooleanNodes":50,"maxListLimit":250,"maxNestingDepth":12,"maxRequestBytes":1048576,"maxTransactionOperations":20},"protocol":{"hash":"sha256:07b1a75a6e8e88e30115ae81bcf7e3a12fa493bddce995a01867e2381bd158d0","version":1},"resources":{"authors":{"fields":{"id":{"capabilities":{"filter":["equals"],"select":true},"kind":"scalar","lifecycle":[],"list":false,"nullable":false,"type":{"scalar":"string"}},"name":{"capabilities":{"create":[],"filter":["equals"],"select":true,"update":[]},"kind":"scalar","lifecycle":[],"list":false,"nullable":false,"type":{"scalar":"string"}}},"identifiers":[["id"]],"operations":{"create":{"count":true,"many":true,"one":true},"delete":{"count":true,"first":true,"many":true,"unique":true},"find":{"count":true,"first":true,"many":true,"unique":true},"update":{"count":true,"first":true,"many":true,"unique":true},"upsert":{"unique":true}}},"books":{"fields":{"authorId":{"capabilities":{"filter":["equals"],"select":true},"kind":"scalar","lifecycle":[],"list":false,"nullable":false,"type":{"scalar":"string"}},"id":{"capabilities":{"filter":["equals"],"select":true},"kind":"scalar","lifecycle":[],"list":false,"nullable":false,"type":{"scalar":"string"}},"label":{"capabilities":{"select":true},"kind":"scalar","lifecycle":["COMPUTED_ON_READ","VIRTUAL"],"list":false,"nullable":false,"type":{"scalar":"string"}}},"identifiers":[["id"]],"operations":{"find":{"many":true}}},"samples":{"fields":{"amount":{"capabilities":{"create":[],"select":true},"kind":"scalar","lifecycle":[],"list":false,"nullable":false,"type":{"scalar":"decimal"}},"at":{"capabilities":{"create":[],"select":true},"kind":"scalar","lifecycle":[],"list":false,"nullable":false,"type":{"scalar":"datetime"}},"blob":{"capabilities":{"create":[],"select":true},"kind":"scalar","lifecycle":[],"list":false,"nullable":false,"type":{"scalar":"bytes"}},"count":{"capabilities":{"create":[],"select":true},"kind":"scalar","lifecycle":[],"list":false,"nullable":false,"type":{"scalar":"bigint"}},"id":{"capabilities":{"filter":["equals"],"select":true},"kind":"scalar","lifecycle":[],"list":false,"nullable":false,"type":{"scalar":"string"}}},"identifiers":[["id"]],"operations":{"create":{"one":true},"find":{"unique":true}}},"secrets":{"fields":{"id":{"capabilities":{"filter":["equals"],"select":true},"kind":"scalar","lifecycle":[],"list":false,"nullable":false,"type":{"scalar":"string"}}},"identifiers":[["id"]],"operations":{}}},"scalars":{"bigint":{"builtin":true},"bytes":{"builtin":true},"datetime":{"builtin":true},"decimal":{"builtin":true},"string":{"builtin":true}},"transactions":"interactive"}';
-export const CORPUS_NONE_CLIENT_CONTRACT_HASH = "sha256:d333e8396b9bf9127e0859ed69b9874f230058a597e2129e6b9e9b380daef618";
+export const CORPUS_CLIENT_CONTRACT_HASH = "sha256:502530d5b918266c61f45e70035acd7d9637bbf7305c5572106185d5e63ec307";
+export const CORPUS_CLIENT_CONTRACT_DOCUMENT = '{"enums":{},"limits":{"maxBooleanNodes":50,"maxJsonDepth":64,"maxListLimit":250,"maxNestingDepth":12,"maxRequestBytes":1048576,"maxTransactionOperations":20},"protocol":{"hash":"sha256:502530d5b918266c61f45e70035acd7d9637bbf7305c5572106185d5e63ec307","version":1},"resources":{"authors":{"fields":{"id":{"capabilities":{"filter":["equals"],"select":true},"kind":"scalar","lifecycle":[],"list":false,"nullable":false,"type":{"scalar":"string"}},"name":{"capabilities":{"create":[],"filter":["equals"],"select":true,"update":[]},"kind":"scalar","lifecycle":[],"list":false,"nullable":false,"type":{"scalar":"string"}}},"identifiers":[["id"]],"operations":{"create":{"count":true,"many":true,"one":true},"delete":{"count":true,"first":true,"many":true,"unique":true},"find":{"count":true,"first":true,"many":true,"unique":true},"update":{"count":true,"first":true,"many":true,"unique":true},"upsert":{"unique":true}}},"books":{"fields":{"authorId":{"capabilities":{"filter":["equals"],"select":true},"kind":"scalar","lifecycle":[],"list":false,"nullable":false,"type":{"scalar":"string"}},"id":{"capabilities":{"filter":["equals"],"select":true},"kind":"scalar","lifecycle":[],"list":false,"nullable":false,"type":{"scalar":"string"}},"label":{"capabilities":{"select":true},"kind":"scalar","lifecycle":["COMPUTED_ON_READ","VIRTUAL"],"list":false,"nullable":false,"type":{"scalar":"string"}}},"identifiers":[["id"]],"operations":{"find":{"many":true}}},"samples":{"fields":{"amount":{"capabilities":{"create":[],"select":true},"kind":"scalar","lifecycle":[],"list":false,"nullable":false,"type":{"scalar":"decimal"}},"at":{"capabilities":{"create":[],"select":true},"kind":"scalar","lifecycle":[],"list":false,"nullable":false,"type":{"scalar":"datetime"}},"blob":{"capabilities":{"create":[],"select":true},"kind":"scalar","lifecycle":[],"list":false,"nullable":false,"type":{"scalar":"bytes"}},"count":{"capabilities":{"create":[],"select":true},"kind":"scalar","lifecycle":[],"list":false,"nullable":false,"type":{"scalar":"bigint"}},"id":{"capabilities":{"filter":["equals"],"select":true},"kind":"scalar","lifecycle":[],"list":false,"nullable":false,"type":{"scalar":"string"}}},"identifiers":[["id"]],"operations":{"create":{"one":true},"find":{"unique":true}}},"secrets":{"fields":{"id":{"capabilities":{"filter":["equals"],"select":true},"kind":"scalar","lifecycle":[],"list":false,"nullable":false,"type":{"scalar":"string"}}},"identifiers":[["id"]],"operations":{}}},"scalars":{"bigint":{"builtin":true},"bytes":{"builtin":true},"datetime":{"builtin":true},"decimal":{"builtin":true},"string":{"builtin":true}},"transactions":"interactive"}';
+export const CORPUS_NONE_CLIENT_CONTRACT_HASH = "sha256:5e99809294a2aae922b635e9a44b464b1b6e03359a54d30420292c62676a7ce5";
+export const CORPUS_ACCESS_CLIENT_CONTRACT_HASH = "sha256:e45cdbc0c5f27e94058a1e0a1e4b9e532522ebeddcbb68170ac6ec6b45ca0d23";
 export const CORPUS_AUTHOR = { id: "a1", name: "Ada" };
 export const CORPUS_NOBODY = "nobody";
 export const CORPUS_SAMPLE = {
     id: "s1",
     count: 9007199254740993n,
     at: new Date("2026-10-05T12:34:56.789Z"),
-    amount: new Decimal("12.50"),
+    amount: new AvDecimal("12.50"),
     blob: new Uint8Array([255, 0, 16]),
 };
 const CONFLICTS = {
@@ -190,7 +198,7 @@ function corpusAnswer(operation) {
     const id = whereIdOf(operation.arguments);
     const conflict = id === undefined ? undefined : CONFLICTS[id];
     if (conflict !== undefined) {
-        throw new FrameworkError(conflict, `The corpus Adapter answered ${conflict}.`);
+        throw new AvError(conflict, `The corpus Adapter answered ${conflict}.`);
     }
     if (id === CORPUS_TRIGGER.adapterThrows) {
         throw new Error("the corpus Adapter failed");
@@ -214,6 +222,22 @@ function corpusAnswer(operation) {
     }
     return CORPUS_AUTHOR;
 }
+export const CORPUS_ACCESS = {
+    state: () => ({ me: null }),
+    policy: {
+        can: ({ resource }) => {
+            if (resource === "samples") {
+                throw new Error("the corpus policy failed");
+            }
+            if (resource === "books") {
+                throw new AvError("A4002", "The corpus policy refuses books.");
+            }
+            return true;
+        },
+        scopeOf: ({ resource, action }) => !(resource === "authors" && action === "delete"),
+        fieldsOf: () => ({ always: "all", perRow: {} }),
+    },
+};
 function failingCommit(transaction) {
     return async (work) => {
         let doomed = false;
@@ -231,7 +255,7 @@ function failingCommit(transaction) {
         return result;
     };
 }
-export async function createCorpusFramework(contractHash) {
+export function corpusConfiguration(contractHash) {
     const fake = createFakeAdapter({
         model: contractHash === CORPUS_NONE_CLIENT_CONTRACT_HASH
             ? { ...CORPUS_MODEL, transactions: "none" }
@@ -244,10 +268,25 @@ export async function createCorpusFramework(contractHash) {
             ? {}
             : { transaction: failingCommit(fake.transaction) }),
     });
+    return {
+        config: {
+            api: CORPUS_ENTRYPOINT,
+            adapter,
+            resources: CORPUS_RESOURCES,
+            application: CORPUS_APPLICATION_CONFIG,
+            client: CORPUS_CLIENT_CONFIG,
+            ...(contractHash === CORPUS_ACCESS_CLIENT_CONTRACT_HASH
+                ? { access: CORPUS_ACCESS }
+                : {}),
+        },
+        adapterCalls: () => adapter.operations.length,
+    };
+}
+export async function createCorpusFramework(contractHash, prebuilt) {
+    const { config, adapterCalls } = corpusConfiguration(contractHash);
     const framework = await createFramework({
-        entrypoint: CORPUS_ENTRYPOINT,
-        adapter,
-        client: CORPUS_CLIENT_CONFIG,
+        ...config,
+        ...(prebuilt === undefined ? {} : { prebuilt }),
     });
-    return { framework, adapterCalls: () => adapter.operations.length };
+    return { framework, adapterCalls };
 }

package/dist/protocol/in-process.driver.d.ts

@@ -2,7 +2,7 @@ import type { AvProtocolDriver } from "./protocol-driver.js";
 /**
  * The protocol hosted in process, with no HTTP stack: `/_contract` goes to
  * `protocol.encodeContract`, `/_transactions` to `protocol.handleTransaction`,
- * every other request to `protocol.handleOperation`, and the answer is written
- * back as it is.
+ * `/_access/can` to `protocol.handleCan`, every other request to
+ * `protocol.handleOperation`, and the answer is written back as it is.
  */
 export declare const inProcessDriver: AvProtocolDriver;