@hydranium/protocol 1.0.0-next.4 → 1.0.0-next.40

package/src/messages/primitives.ts

@@ -0,0 +1,215 @@
+/********************************************************************************
+ * Copyright (c) 2026 CrossBreeze, EclipseSource and others.
+ *
+ * This program and the accompanying materials are made available under the
+ * terms of the MIT License which is available in the project root.
+ *
+ * SPDX-License-Identifier: MIT
+ ********************************************************************************/
+
+import { ResponseError } from 'vscode-jsonrpc';
+
+/**
+ * The framework externalizes user-facing strings and SELECTS no locale: it
+ * relays the one its client declared and renders with whatever templates the
+ * adopter installed, defaulting to its English. Every such string carries a
+ * stable code beside that English, and exactly one side renders it — the side
+ * that knows the reading user's language.
+ *
+ * Which side that is depends on the message, not on the package. A server
+ * message is rendered by the server, at the one seam every carrier passes
+ * through, in the locale it was handed at init. A message the client tier raises
+ * is rendered there, because those fire when the server is unreachable. Nothing
+ * is rendered twice: two renders of one sentence are two authorities over it,
+ * and they diverge on the first reword.
+ *
+ * Codes are `hydranium/<unscoped-package>/<name>`. The package segment locates
+ * the declaration, so a message is declared in the package that raises it and a
+ * code never names a package it does not live in. `.` and `:` are forbidden in a
+ * segment: they are i18next's default key and namespace separators, where either
+ * silently becomes a nested lookup that misses.
+ */
+export type MessageParams = Readonly<Record<string, string | number>>;
+
+type Placeholder<S extends string> = S extends `${string}{${infer Name}}${infer Rest}` ? Name | Placeholder<Rest> : never;
+
+export type ParamsOf<S extends string> = [Placeholder<S>] extends [never]
+   ? Record<never, never>
+   : Readonly<Record<Placeholder<S>, string | number>>;
+
+/** Required exactly when the text has placeholders, absent when it does not. */
+export type ParamsArg<S extends string> = [Placeholder<S>] extends [never] ? [] : [params: ParamsOf<S>];
+
+/**
+ * Rejects a text argument already widened to `string`. Load-bearing rather than
+ * defensive: the whole compile-time guarantee is conditional on `S` inferring a
+ * literal, and for a concatenated or pre-widened text the placeholder set
+ * silently becomes empty, `format()` accepts no arguments, and the missing
+ * substitution surfaces only at runtime.
+ */
+export type LiteralText<S extends string> = string extends S ? never : S;
+
+export interface MessageDefinition<S extends string> {
+   readonly code: string;
+   readonly text: S;
+   format(...args: ParamsArg<S>): string;
+}
+
+/**
+ * Declare a message. Placeholder names are inferred from `text` rather than
+ * declared again in a type argument: a second spelling of every name is the
+ * repetition that drifts, since adding a placeholder to the sentence and not to
+ * the type compiles.
+ */
+export function defineMessage<S extends string>(code: string, text: LiteralText<S>): MessageDefinition<S> {
+   const literal = text as S;
+   return { code, text: literal, format: (...args) => interpolate(literal, args[0] ?? {}) };
+}
+
+const PLACEHOLDER = /\{([^}]+)\}/g;
+
+/**
+ * Substitute `{name}` tokens, leaving an unfilled token in place.
+ *
+ * It must not throw. This runs over an adopter's translation as well as our own
+ * text, so a typo in a foreign catalogue has to degrade to a slightly wrong
+ * sentence rather than raise inside a toast render. Re-scanning the result to
+ * detect an unfilled token is what an earlier form did, and it cannot work:
+ * `String.replace` does not rescan replacement text, so the check could not tell
+ * an unfilled placeholder from user data shaped like one — an element literally
+ * named `{separator}` crashed at the authoring site.
+ */
+export function interpolate(template: string, params: MessageParams): string {
+   // Indexed rather than `key in params`: a hand-built or version-skewed
+   // identity can arrive with no params at all, and `in` throws on a non-object
+   // where a lookup degrades.
+   const lookup = params as Record<string, string | number | undefined> | undefined;
+   return template.replace(PLACEHOLDER, (match, key: string) => {
+      const value = lookup?.[key];
+      return value === undefined ? match : String(value);
+   });
+}
+
+export interface MessageIdentity {
+   readonly code: string;
+   readonly params: MessageParams;
+}
+
+/**
+ * Envelope for a protocol `data` field. Namespaced under one key so it co-exists
+ * with a carrier's own `data` conventions rather than occupying `data` itself.
+ */
+export interface HydraniumMessageData {
+   readonly hydranium: MessageIdentity;
+}
+
+/** An identity plus its resolved English — everything a renderer needs, on any carrier. */
+export interface ResolvedMessage extends MessageIdentity {
+   readonly text: string;
+}
+
+export function messageData<S extends string>(message: MessageDefinition<S>, ...args: ParamsArg<S>): HydraniumMessageData {
+   return { hydranium: { code: message.code, params: args[0] ?? {} } };
+}
+
+/**
+ * Identity plus resolved English, for a hand-off carrying a value rather than a
+ * protocol field. The result is structured-clone safe, so it survives a process
+ * hop where one intervenes and costs nothing where none does.
+ */
+export function resolve<S extends string>(message: MessageDefinition<S>, ...args: ParamsArg<S>): ResolvedMessage {
+   return { code: message.code, text: message.format(...args), params: args[0] ?? {} };
+}
+
+/**
+ * Validates every field {@link MessageIdentity} declares, `params` included.
+ * A guard over foreign input that checks only `code` while declaring `params`
+ * non-optional hands `undefined` to the renderer, which fails with the worst
+ * polarity available: invisible in English, crashing only once a translation is
+ * loaded.
+ */
+export function hasMessageIdentity(data: unknown): data is HydraniumMessageData {
+   if (typeof data !== 'object' || data === null || Array.isArray(data) || !('hydranium' in data)) {
+      return false;
+   }
+   const identity = (data as { hydranium: unknown }).hydranium;
+   if (typeof identity !== 'object' || identity === null || Array.isArray(identity)) {
+      return false;
+   }
+   const candidate = identity as Partial<MessageIdentity>;
+   return typeof candidate.code === 'string' && typeof candidate.params === 'object' && candidate.params !== null;
+}
+
+/**
+ * A type alias rather than a subclass. Only `code`, `message` and `data` cross
+ * the wire, so a subclass buys nothing there: `instanceof` does not survive
+ * reconstruction, and the subclass costs an `Object.setPrototypeOf` in every
+ * constructor purely to undo what `ResponseError`'s own constructor does.
+ */
+export type HydraniumResponseError = ResponseError<HydraniumMessageData>;
+
+/**
+ * The numeric `code` and the message's catalogue code are unrelated and both are
+ * needed: `ResponseError.code` is an `integer`, so it cannot hold a
+ * `hydranium/…` key, and it is what a caller switches on after reconstruction.
+ */
+export function messageError<S extends string>(
+   code: number,
+   message: MessageDefinition<S>,
+   ...params: ParamsArg<S>
+): HydraniumResponseError {
+   return new ResponseError(code, message.format(...params), messageData(message, ...params));
+}
+
+/**
+ * Render on the side that knows the reading user's locale. `translations` is
+ * whatever flat `code → template` map the host exposes; omitting it is how an
+ * adopter without i18n opts out, and yields the English.
+ */
+export function renderFrameworkMessage(message: ResolvedMessage, translations?: Record<string, string>): string {
+   const template = translations?.[message.code];
+   return template ? interpolate(template, message.params) : message.text;
+}
+
+export function resolvedFromResponseError(error: ResponseError<unknown>): ResolvedMessage | undefined {
+   return hasMessageIdentity(error.data) ? { ...error.data.hydranium, text: error.message } : undefined;
+}
+
+/**
+ * The detail half of a `{detail}` placeholder. A technical error string is safe
+ * to pass as a parameter for the same reason a number is: it is not itself
+ * translatable text, so it needs no code of its own. A PROSE fragment is not,
+ * and must become one code per value instead.
+ */
+export function describeError(error: unknown): string {
+   return error instanceof Error ? error.message : String(error);
+}
+
+/**
+ * Recognises a declaration among a barrel's exports. The `format` check is what
+ * discriminates: a `code` + `text` pair alone admits any object that happens to
+ * carry both.
+ */
+export function isMessageDeclaration(value: unknown): value is MessageDefinition<string> {
+   const candidate = value as { code?: unknown; text?: unknown; format?: unknown } | null;
+   return (
+      typeof candidate === 'object' &&
+      candidate !== null &&
+      typeof candidate.code === 'string' &&
+      typeof candidate.text === 'string' &&
+      typeof candidate.format === 'function'
+   );
+}
+
+/**
+ * Every declaration a `./messages` barrel exports.
+ *
+ * A caller cannot get there with `Object.values(barrel).filter(isMessageDeclaration)`:
+ * a barrel's value type is a union of its declarations AND its functions, and
+ * `filter` will not narrow a function type down to a `MessageDefinition`, so the
+ * result stays the union and reading `.code` off it does not compile. Taking the
+ * barrel as an opaque object is what makes the one-liner work.
+ */
+export function collectMessages(barrel: object): MessageDefinition<string>[] {
+   return (Object.values(barrel) as unknown[]).filter(isMessageDeclaration);
+}

package/src/model-server.ts

@@ -64,8 +64,8 @@ export interface CloseModelArgs extends TransferClientArgs {}
 export interface TransferUpdatedEvent<TDocument> {
    document: TDocument;
    sourceClientId: string;
-   /** See `ModelDocumentUpdateReason` in `./data/events` for the canonical reason set + semantics. */
-   reason: 'changed' | 'deleted' | 'rebuilt' | 'saved';
+   /** See `TransferDocumentUpdateReason` in `./data/events` for the canonical reason set + semantics. */
+   reason: 'changed' | 'rebuilt' | 'saved';
 }
 
 export interface TransferSavedEvent<TDocument> {

package/src/rpc/bind-rpc-methods.ts

@@ -7,7 +7,7 @@
  * SPDX-License-Identifier: MIT
  ********************************************************************************/
 
-import type { MessageConnection } from 'vscode-jsonrpc';
+import { ResponseError, type MessageConnection } from 'vscode-jsonrpc';
 import type { LatencyCollector } from '../latency-collector';
 import { type Disposable, DisposableCollection } from '../util';
 import { defaultIsNotification } from './create-rpc-proxy';
@@ -70,6 +70,36 @@ export interface BindRpcMethodsOptions {
     * Requests and notifications are both timed. Absent by default (no overhead).
     */
    readonly latency?: LatencyCollector;
+
+   /**
+    * Produce the `message` an outgoing rejection carries, so a user-facing
+    * error is rendered by the side that knows the reading user's language.
+    * Applied at this one chokepoint, which is what covers a caller's
+    * additional methods as well as the framework's own.
+    *
+    * Only a `ResponseError` is routed through it — a plain `Error` carries no
+    * identity to render from, and rewriting its message would relabel a
+    * developer-facing failure as a translated one. The rejection is
+    * RECONSTRUCTED rather than mutated, because the thrown value may be a
+    * shared constant; nothing is lost, since only `code`, `message` and `data`
+    * cross the wire and `instanceof` does not survive reconstruction anyway.
+    *
+    * Notifications are not covered, and "they have no reply channel" is only
+    * half the reason — a notification's own PAYLOAD can carry prose. What makes
+    * this sound is where that prose comes from: the only user-facing text on
+    * the data head's client surface is the diagnostics riding the
+    * document-updated and document-saved events, and those are read off
+    * `LangiumDocument.diagnostics`, which the document builder has already
+    * rendered at `Validated`. So they arrive rendered rather than escaping
+    * unrendered. A notification that ever carries prose of its OWN needs its
+    * own render at the raise site, as GLSP's actions do.
+    */
+   readonly renderErrorMessage?: (error: ResponseError<unknown>) => string;
+}
+
+/** The rejection to throw in place of `err`, with its message rendered. */
+function renderRejection(err: unknown, render: (error: ResponseError<unknown>) => string): unknown {
+   return err instanceof ResponseError ? new ResponseError(err.code, render(err), err.data) : err;
 }
 
 /**
@@ -91,8 +121,10 @@ export interface BindRpcMethodsOptions {
  *
  * Errors thrown synchronously from a request handler — or surfaced as a
  * rejected promise — propagate back to the caller through vscode-jsonrpc's
- * standard error envelope. Errors from a notification handler cannot, and are
- * routed to {@link BindRpcMethodsOptions.onNotificationError} instead.
+ * standard error envelope, with the message rendered when
+ * {@link BindRpcMethodsOptions.renderErrorMessage} is supplied. Errors from a
+ * notification handler cannot propagate, and are routed to
+ * {@link BindRpcMethodsOptions.onNotificationError} instead.
  *
  * Accepts either a ready connection or a `Promise<MessageConnection>` —
  * registrations queue until the connection resolves, then attach. The
@@ -154,7 +186,20 @@ export function bindRpcMethods<T extends object>(
                })
             );
          } else {
-            disposables.push(resolved.onRequest(wireName, async (params: unknown) => dispatch(params)));
+            const render = options.renderErrorMessage;
+            disposables.push(
+               resolved.onRequest(wireName, async (params: unknown) => {
+                  if (!render) {
+                     return dispatch(params);
+                  }
+                  try {
+                     // Awaited inside the try, or a rejected promise escapes it.
+                     return await dispatch(params);
+                  } catch (err: unknown) {
+                     throw renderRejection(err, render);
+                  }
+               })
+            );
          }
       }
    };

package/src/rpc/create-rpc-proxy.ts

@@ -136,6 +136,14 @@ export interface CreateRpcProxyOptions<TLocal extends object = never> {
     * `bindRpcMethods` call) still capture per-method latency. Absent by default.
     */
    readonly latency?: BindRpcMethodsOptions['latency'];
+
+   /**
+    * Forwarded to the inbound {@link localTarget} binding: renders the message
+    * an outgoing rejection carries. Only the inbound direction has rejections
+    * to render — the outbound proxy is this side making requests, and a
+    * rejection it receives was rendered by whoever answered.
+    */
+   readonly renderErrorMessage?: BindRpcMethodsOptions['renderErrorMessage'];
 }
 
 /**
@@ -225,7 +233,12 @@ export function createRpcProxy<T extends object, TLocal extends object = never>(
    // connection; see `localTarget` for why no `Disposable` is surfaced.
    const { localTarget, localMethods } = options;
    if (localTarget && localMethods && localMethods.length > 0) {
-      const binding = bindRpcMethods(connection, localTarget, localMethods, { methodNamespace, isNotification, latency: options.latency });
+      const binding = bindRpcMethods(connection, localTarget, localMethods, {
+         methodNamespace,
+         isNotification,
+         latency: options.latency,
+         renderErrorMessage: options.renderErrorMessage
+      });
       resolvedConnection.then(conn => conn.onClose(() => binding.dispose())).catch(() => undefined);
    }
 

package/src/testing/catalogue-audit.ts

@@ -0,0 +1,111 @@
+/********************************************************************************
+ * Copyright (c) 2026 CrossBreeze, EclipseSource and others.
+ *
+ * This program and the accompanying materials are made available under the
+ * terms of the MIT License which is available in the project root.
+ *
+ * SPDX-License-Identifier: MIT
+ ********************************************************************************/
+
+import { collectMessages } from '../messages/primitives';
+
+/**
+ * Audit a translation catalogue against the codes that actually exist.
+ *
+ * **The one failure mode a catalogue has, and the only one nothing else
+ * catches.** A key naming no declared code falls back to the English — which is
+ * byte-identical to a deliberate omission, so a typo is invisible at runtime and
+ * indistinguishable from the partial-catalogue behaviour every adopter relies
+ * on. Nothing on the render path can tell them apart, `theia nls-extract`
+ * reports what the SOURCE declares rather than whether a catalogue matches it,
+ * and the framework's own gates see only the framework's own files.
+ *
+ * Shipped as test support rather than as a runtime check on purpose: an
+ * orphaned key is an authoring mistake, and failing a server boot over one would
+ * take a running product down for a cosmetic defect.
+ */
+
+/**
+ * Flatten a nested catalogue into the `/`-joined keys a message code is spelled
+ * with, dropping `_`-prefixed keys as notes to a human reader.
+ *
+ * Nesting is a HOST convention, not the framework's: Theia flattens a nested
+ * catalogue by joining keys with `/`, which is the separator a code already
+ * uses, so an adopter on that host writes the file nested and one handed
+ * straight to a `DefaultMessageRenderer` writes it flat. Both end up here.
+ *
+ * `_`-prefixed keys are dropped by PREFIX rather than by matching one literal
+ * name, so a second note added to a file cannot silently become a catalogue
+ * entry. A code is three `/`-separated segments, so no real entry can begin
+ * with `_`.
+ */
+export function flattenCatalogue(catalogue: Record<string, unknown>, prefix = ''): Record<string, string> {
+   const flat: Record<string, string> = {};
+   for (const [key, value] of Object.entries(catalogue)) {
+      if (key.startsWith('_')) {
+         continue;
+      }
+      const joined = prefix ? `${prefix}/${key}` : key;
+      if (typeof value === 'string') {
+         flat[joined] = value;
+      } else if (typeof value === 'object' && value !== null) {
+         Object.assign(flat, flattenCatalogue(value as Record<string, unknown>, joined));
+      }
+   }
+   return flat;
+}
+
+/** Options for {@link findUndeclaredCodes}. */
+export interface CatalogueAuditOptions {
+   /**
+    * Key prefixes to skip, for entries whose codes are NOT declared through a
+    * `defineMessage` barrel.
+    *
+    * The real case is a host's own mechanism: Theia's `nls.localize` takes its
+    * key as an inline literal at the call site, so those keys exist only in
+    * source text and no barrel can enumerate them. Keep this as narrow as the
+    * host layer actually is — exempting a namespace is exempting every typo in
+    * it, which is what this function exists to find.
+    */
+   readonly exemptPrefixes?: readonly string[];
+}
+
+/**
+ * Every catalogue key that names no code any of `barrels` declares.
+ *
+ * Barrels are taken as opaque objects and read with {@link collectMessages},
+ * which is what lets a caller pass a `import * as messages` namespace directly:
+ * a barrel's value type is a union of its declarations AND its functions, and
+ * filtering that union will not narrow to a `MessageDefinition`.
+ *
+ * Returns the offending keys rather than a boolean, so a failing assertion names
+ * WHICH key is wrong — a count says only that something is.
+ */
+export function findUndeclaredCodes(
+   catalogueKeys: readonly string[],
+   barrels: readonly object[],
+   options: CatalogueAuditOptions = {}
+): string[] {
+   const declared = new Set(barrels.flatMap(barrel => collectMessages(barrel).map(message => message.code)));
+   const exempt = options.exemptPrefixes ?? [];
+   return catalogueKeys.filter(key => !exempt.some(prefix => key.startsWith(prefix)) && !declared.has(key));
+}
+
+/**
+ * Keys present in more than one catalogue — the shape a split catalogue rots
+ * into.
+ *
+ * Exactly one side renders a given message, so two catalogues holding one code
+ * are two authorities over one sentence and they diverge on the first reword.
+ * Nothing at runtime notices: both sides render, and whichever ran last wins on
+ * its own surface.
+ *
+ * Takes the key sets rather than a boolean answer for the same reason as
+ * {@link findUndeclaredCodes}, and reports NOTHING when a set is empty — an
+ * empty catalogue shares no key with anything, so a caller must assert
+ * non-emptiness separately or a failed read passes this vacuously.
+ */
+export function findSharedCodes(first: readonly string[], second: readonly string[]): string[] {
+   const other = new Set(second);
+   return first.filter(key => other.has(key));
+}

package/src/testing/data-doubles.ts

@@ -34,7 +34,14 @@
 import { Emitter, type MessageConnection } from 'vscode-jsonrpc';
 import type { DataPort } from '../client/data-port';
 import type { DataClientProtocol } from '../data/data-server-protocol';
-import type { ProjectsChangedEvent, TransferDocumentSavedEvent, TransferDocumentUpdatedEvent } from '../data/events';
+import type {
+   ProjectsChangedEvent,
+   TransferDocumentDeletedEvent,
+   TransferDocumentSavedEvent,
+   TransferDocumentsBuiltEvent,
+   TransferDocumentUpdatedEvent
+} from '../data/events';
+import type { ResolvedMessage } from '../messages/primitives';
 import type { Project } from '../project';
 import type { TransferDiagnostic } from '../transfer-diagnostic';
 import type { TransferElement } from '../transfer-element';
@@ -73,10 +80,11 @@ export interface FakeDataPort extends DataPort {
    /**
     * Every {@link DataPort.reportError} call, in order. Read from outside: this
     * is the only place a transport failure surfaces, so a test for the failure
-    * path asserts on the `context` string here rather than on a rejection that
-    * the consumer may legitimately swallow.
+    * path asserts here rather than on a rejection the consumer may legitimately
+    * swallow. Prefer asserting on `message.code`, which is stable, over
+    * `message.text`, which is the English default and may be reworded.
     */
-   readonly reported: readonly { readonly error: unknown; readonly context: string }[];
+   readonly reported: readonly { readonly error: unknown; readonly message: ResolvedMessage }[];
    /**
     * Fire {@link DataPort.onDispose} — the host tearing the transport down, a
     * language-server restart being the case that forces the event to exist.
@@ -96,7 +104,7 @@ export interface FakeDataPort extends DataPort {
  */
 export function makeFakeDataPort(options: FakeDataPortOptions): FakeDataPort {
    const connections: MessageConnection[] = [];
-   const reported: { error: unknown; context: string }[] = [];
+   const reported: { error: unknown; message: ResolvedMessage }[] = [];
    const disposeEmitter = new Emitter<void>();
    return {
       clientId: options.clientId ?? 'fake-data-port',
@@ -108,8 +116,8 @@ export function makeFakeDataPort(options: FakeDataPortOptions): FakeDataPort {
          connections.push(connection);
          return connection;
       },
-      reportError(error: unknown, context: string): void {
-         reported.push({ error, context });
+      reportError(error: unknown, message: ResolvedMessage): void {
+         reported.push({ error, message });
       },
       fireDispose(): void {
          disposeEmitter.fire(undefined);
@@ -132,6 +140,10 @@ export interface CapturingDataClient<
    readonly updates: TransferDocumentUpdatedEvent<TTransfer, TDiagnostic>[];
    /** Every `onDocumentSaved` event, in arrival order. */
    readonly saves: TransferDocumentSavedEvent<TTransfer, TDiagnostic>[];
+   /** Every `onDocumentDeleted` event, in arrival order. */
+   readonly deletions: TransferDocumentDeletedEvent[];
+   /** Every `onDocumentsBuilt` event, in arrival order. */
+   readonly builds: TransferDocumentsBuiltEvent[];
    /** Every `onProjectsChanged` event, in arrival order. */
    readonly projectsChanges: ProjectsChangedEvent<TProject>[];
 }
@@ -139,7 +151,7 @@ export interface CapturingDataClient<
 /**
  * A {@link DataClientProtocol} that records every notification it receives.
  *
- * Recording ALL THREE channels even when a suite reads one is deliberate: an
+ * Recording EVERY channel even when a suite reads one is deliberate: an
  * event delivered on the wrong channel is a real defect of the data head, and a
  * double that drops the other two turns it into silence on the one being
  * watched.
@@ -156,6 +168,8 @@ export function makeCapturingDataClient<
 >(overrides: Partial<DataClientProtocol<TTransfer, TDiagnostic, TProject>> = {}): CapturingDataClient<TTransfer, TDiagnostic, TProject> {
    const updates: TransferDocumentUpdatedEvent<TTransfer, TDiagnostic>[] = [];
    const saves: TransferDocumentSavedEvent<TTransfer, TDiagnostic>[] = [];
+   const deletions: TransferDocumentDeletedEvent[] = [];
+   const builds: TransferDocumentsBuiltEvent[] = [];
    const projectsChanges: ProjectsChangedEvent<TProject>[] = [];
    const client: DataClientProtocol<TTransfer, TDiagnostic, TProject> = {
       onDocumentUpdated:
@@ -168,11 +182,21 @@ export function makeCapturingDataClient<
          (event => {
             saves.push(event);
          }),
+      onDocumentDeleted:
+         overrides.onDocumentDeleted ??
+         (event => {
+            deletions.push(event);
+         }),
+      onDocumentsBuilt:
+         overrides.onDocumentsBuilt ??
+         (event => {
+            builds.push(event);
+         }),
       onProjectsChanged:
          overrides.onProjectsChanged ??
          (event => {
             projectsChanges.push(event);
          })
    };
-   return { client, updates, saves, projectsChanges };
+   return { client, updates, saves, deletions, builds, projectsChanges };
 }

package/src/testing/index.ts

@@ -10,7 +10,9 @@
 // Subpath barrel for `@hydranium/protocol/testing` — the BROWSER-NEUTRAL shared
 // primitives: `makeFakeClock` (deterministic `Clock` double on one virtual time
 // axis), `waitFor` / `tick`, the client-side data-head doubles
-// (`makeFakeDataPort` / `makeCapturingDataClient`), and the `Harness` marker
+// (`makeFakeDataPort` / `makeCapturingDataClient`), the translation-catalogue
+// audit (`flattenCatalogue` / `findUndeclaredCodes` / `findSharedCodes`), and
+// the `Harness` marker
 // interface every framework harness extends. Kept out of the main barrel so production bundles don't pull
 // the test scaffolding in by default; adopters opt in by importing from
 // `@hydranium/protocol/testing`.
@@ -20,6 +22,7 @@
 // type, so they cannot be made portable and live at `./testing/node` instead.
 // The same rule the package surface uses — the portable name is the short one.
 
+export * from './catalogue-audit';
 export * from './data-doubles';
 export * from './fake-clock';
 export * from './harness';

package/src/transfer-diagnostic.ts

@@ -7,6 +7,8 @@
  * SPDX-License-Identifier: MIT
  ********************************************************************************/
 
+import { type MessageParams, type ResolvedMessage } from './messages/primitives';
+
 /**
  * Generic, transport-friendly diagnostic shape used by the model-server protocol.
  *
@@ -56,6 +58,21 @@ export interface TransferDiagnostic {
     * is not usable as a rule identity on its own.
     */
    code?: number | string;
+   /**
+    * Substitutions for the placeholders in the message this {@link code} names,
+    * present only for a diagnostic raised from a framework message declaration.
+    *
+    * Without them a translated template renders with its `{name}` tokens left
+    * standing, because substitution leaves an unmatched token in place rather
+    * than raising — so a surface that translates from {@link code} alone is
+    * correct for a parameterless sentence and visibly wrong for a parameterised
+    * one. This is the field that makes the second case work; the LSP carrier has
+    * always moved the params, and no carrier below it did.
+    *
+    * Prefer {@link TransferDiagnostic.resolved} over reading this: it decides
+    * whether an identity is present at all, which a lone `params` cannot.
+    */
+   params?: MessageParams;
 }
 
 export namespace TransferDiagnostic {
@@ -74,6 +91,29 @@ export namespace TransferDiagnostic {
       return diagnostic.type === 'parsing-error';
    }
 
+   /**
+    * The diagnostic as a renderable message, for a surface that translates.
+    * `undefined` when it carries no framework identity — a syntactic error, an
+    * adopter's own check, a linker failure — which is the case a caller must
+    * distinguish rather than render.
+    *
+    * Hand the result to `renderFrameworkMessage` with whatever catalogue the
+    * host has loaded. The `text` is the server's English, so a code the
+    * catalogue does not carry still yields a complete sentence.
+    *
+    * `code` alone does not establish an identity: it also holds Langium's
+    * internal code and an adopter's own, and either would be looked up against a
+    * catalogue that cannot have it. Requiring `params` is what discriminates,
+    * and it is why a parameterless framework message still populates the field
+    * with an empty object rather than omitting it.
+    */
+   export function resolved(diagnostic: TransferDiagnostic): ResolvedMessage | undefined {
+      if (typeof diagnostic.code !== 'string' || diagnostic.params === undefined) {
+         return undefined;
+      }
+      return { code: diagnostic.code, params: diagnostic.params, text: diagnostic.message };
+   }
+
    export function getPath(diagnostic: TransferDiagnostic): string {
       return diagnostic.property ? `${diagnostic.element}${ELEMENT_PROPERTY_SEPARATOR}${diagnostic.property}` : diagnostic.element;
    }