drivers(turso): an unsafe identifier on the remote transport answers 400 INVALID_REQUEST, not an opaque 500

.changeset/turso-unsafe-identifier-envelope.md

@@ -0,0 +1,27 @@
+---
+'@objectstack/driver-turso': patch
+'@objectstack/spec': patch
+---
+
+drivers(turso): an unsafe identifier on the remote transport answers `400 INVALID_REQUEST`, not an opaque 500
+
+`RemoteTransport.assertSafeIdentifier` is the one gate for every position where
+an identifier is inlined into SQL — the `object`, `field` and `groupBy`
+field/output-key positions of `aggregate`, the table and column names in
+`syncSchema` / `syncSchemasBatch`, and the index name and columns in unique-index
+sync — plus the free function of the same name in the remote canonical backfill.
+All of them threw a bare `Error` with no `code` and no `status`, so `mapDataError`
+reached none of its classifying branches and served a sanitised **500**: a caller
+whose own identifier was refused was told the server had faulted, and an SDK
+reading a 5xx retries a request that can never succeed.
+
+Every one of those refusals now carries the ADR-0112 envelope `code:
+'INVALID_REQUEST'`, `status: 400`, built by one constructor so the positions
+cannot answer three ways. `@objectstack/spec` gains only the error-code ledger's
+provenance row registering this driver as an emitter of a code seven packages
+already register — the registered-code union is byte-identical (248 codes before
+and after) and no new code is minted.
+
+**Nothing about which identifiers are refused changed.** `SAFE_IDENTIFIER` and
+every refusal message are untouched; exactly the inputs refused before are
+refused after, with byte-identical prose. Only `code` and `status` are new.

packages/drivers/driver-turso/src/remote-canonical-backfill.ts

@@ -93,6 +93,12 @@
  * twin's contract calls out, kept across the transport boundary.
  */
 
+// [#14287] The unsafe-identifier refusal's ADR-0112 envelope, from the one
+// place that decides it. Imported rather than re-spelled so this module and
+// `RemoteTransport` cannot answer one condition two ways; `turso-driver.ts`
+// already loads both modules together, so the edge costs nothing at runtime.
+import { unsafeIdentifierError } from './remote-transport.js';
+
 /** The `@libsql/client` surface this module uses — nothing more. */
 export interface RemoteBackfillClient {
  execute(stmt: { sql: string; args?: unknown[] } | string): Promise<{
@@ -218,9 +224,34 @@ export const REMOTE_BACKFILL_EPOCH_MS_MAX = 4_102_444_800_000;
  */
 const SAFE_IDENTIFIER = /^[a-zA-Z_][a-zA-Z0-9_]*$/;
 
-function assertSafeIdentifier(name: string): void {
+/**
+ * [#14287] The second producer of the transport's unsafe-identifier refusal,
+ * carrying the identical ADR-0112 envelope — `INVALID_REQUEST` / 400 — through
+ * the one constructor that decides it ({@link unsafeIdentifierError}). One
+ * condition, one wire answer, whichever of the two helpers refused it.
+ *
+ * ## Measured: on THIS module's paths the envelope is defence in depth, not a
+ * ## wire answer — and saying so is the point
+ *
+ * Both callers flatten the throw by design: {@link probeRemoteCanonicalColumns}
+ * turns it into `{ error: message }` and {@link backfillRemoteCanonicalColumn}
+ * into `report.error`, because ADR-0053 D-B3 forbids a migration from taking a
+ * boot down. So `code` and `status` reach no response envelope from here today
+ * — only the MESSAGE survives, into the report a caller logs. The envelope is
+ * still worth carrying, for two reasons and no third: the two producers of one
+ * condition must not drift onto two spellings (the card's own "decide the code
+ * once" argument), and a future caller that propagates instead of reporting
+ * inherits the right answer rather than re-deriving one.
+ *
+ * ⛔ It is therefore NOT the wire-reachability evidence for this package's
+ * ledger provenance row — `RemoteTransport`'s DDL and `aggregate` positions
+ * are, and they answer over HTTP. Exported so the envelope has a real pin: no
+ * exported path can observe it, and an unobservable assertion is the phantom
+ * check `AGENTS.md` names rather than a test.
+ */
+export function assertSafeIdentifier(name: string): void {
  if (!SAFE_IDENTIFIER.test(name)) {
- throw new Error(`remote canonical backfill: unsafe identifier rejected: "${name}"`);
+ throw unsafeIdentifierError(`remote canonical backfill: unsafe identifier rejected: "${name}"`);
  }
 }
 

packages/drivers/driver-turso/src/remote-transport-aggregation-alias-quoting.test.ts

@@ -216,6 +216,21 @@ describe('[#14113] RemoteTransport — the aggregation alias is escaped, not gat
  });
 
  describe('regression controls — the positions this card did NOT touch', () => {
+ /**
+ * [#14287] Every control below asserts the ADR-0112 envelope beside the
+ * sentence, because "still refuses" was the half that was true all along
+ * and the half that was WRONG was invisible to it: these positions threw a
+ * bare `Error`, which `mapDataError` served as an opaque 500. #14287 gave
+ * the one producer `code: 'INVALID_REQUEST'` / `status: 400`. Asserting
+ * `message` alone here would let a regression to the bare `Error` land
+ * green through the very controls written to hold this shape.
+ */
+ const envelopeOf = (err: unknown) => ({
+ code: (err as { code?: unknown }).code,
+ status: (err as { status?: unknown }).status,
+ });
+ const ENVELOPE = { code: 'INVALID_REQUEST', status: 400 };
+
  it('the `field` position still refuses an unsafe identifier, and sends nothing', async () => {
  // `SAFE_IDENTIFIER` is doing real work here: `field` becomes a column
  // REFERENCE, which is grammar. Escaping is the answer for a NAME only.
@@ -233,6 +248,8 @@ describe('[#14113] RemoteTransport — the aggregation alias is escaped, not gat
  // itself safe is what makes this case reach the `field` check at all.
  expect(err.message).toContain('unsafe identifier rejected');
  expect(err.message).toContain('amount"; DROP TABLE showcase_delivery; --');
+ // [#14287] …and it is a 400 the caller can act on, not an opaque 500.
+ expect(envelopeOf(err)).toEqual(ENVELOPE);
  expect(seen).toEqual([]);
  });
 
@@ -248,6 +265,7 @@ describe('[#14113] RemoteTransport — the aggregation alias is escaped, not gat
  (e) => e as Error,
  );
  expect(err.message).toContain('unsafe identifier rejected');
+ expect(envelopeOf(err)).toEqual(ENVELOPE);
  expect(seen).toEqual([]);
  });
 
@@ -277,6 +295,10 @@ describe('[#14113] RemoteTransport — the aggregation alias is escaped, not gat
  );
  expect(err.message).toContain('unsafe identifier rejected');
  expect(err.message).toContain('showcase_delivery.region');
+ // [#14287] The GATING is what this control holds; the ENVELOPE is what
+ // that card added to it. Both are pinned, so the open gating card cannot
+ // be mistaken for having landed.
+ expect(envelopeOf(err)).toEqual(ENVELOPE);
  expect(seen).toEqual([]);
  });
 

.changeset/turso-unsafe-identifier-envelope.md

@@ -0,0 +1,27 @@
+---
+'@objectstack/driver-turso': patch
+'@objectstack/spec': patch
+---
+
+drivers(turso): an unsafe identifier on the remote transport answers `400 INVALID_REQUEST`, not an opaque 500
+
+`RemoteTransport.assertSafeIdentifier` is the one gate for every position where
+an identifier is inlined into SQL — the `object`, `field` and `groupBy`
+field/output-key positions of `aggregate`, the table and column names in
+`syncSchema` / `syncSchemasBatch`, and the index name and columns in unique-index
+sync — plus the free function of the same name in the remote canonical backfill.
+All of them threw a bare `Error` with no `code` and no `status`, so `mapDataError`
+reached none of its classifying branches and served a sanitised **500**: a caller
+whose own identifier was refused was told the server had faulted, and an SDK
+reading a 5xx retries a request that can never succeed.
+
+Every one of those refusals now carries the ADR-0112 envelope `code:
+'INVALID_REQUEST'`, `status: 400`, built by one constructor so the positions
+cannot answer three ways. `@objectstack/spec` gains only the error-code ledger's
+provenance row registering this driver as an emitter of a code seven packages
+already register — the registered-code union is byte-identical (248 codes before
+and after) and no new code is minted.
+
+**Nothing about which identifiers are refused changed.** `SAFE_IDENTIFIER` and
+every refusal message are untouched; exactly the inputs refused before are
+refused after, with byte-identical prose. Only `code` and `status` are new.

packages/drivers/driver-turso/src/remote-canonical-backfill.ts

@@ -93,6 +93,12 @@
  * twin's contract calls out, kept across the transport boundary.
  */
 
+// [#14287] The unsafe-identifier refusal's ADR-0112 envelope, from the one
+// place that decides it. Imported rather than re-spelled so this module and
+// `RemoteTransport` cannot answer one condition two ways; `turso-driver.ts`
+// already loads both modules together, so the edge costs nothing at runtime.
+import { unsafeIdentifierError } from './remote-transport.js';
+
 /** The `@libsql/client` surface this module uses — nothing more. */
 export interface RemoteBackfillClient {
  execute(stmt: { sql: string; args?: unknown[] } | string): Promise<{
@@ -218,9 +224,34 @@ export const REMOTE_BACKFILL_EPOCH_MS_MAX = 4_102_444_800_000;
  */
 const SAFE_IDENTIFIER = /^[a-zA-Z_][a-zA-Z0-9_]*$/;
 
-function assertSafeIdentifier(name: string): void {
+/**
+ * [#14287] The second producer of the transport's unsafe-identifier refusal,
+ * carrying the identical ADR-0112 envelope — `INVALID_REQUEST` / 400 — through
+ * the one constructor that decides it ({@link unsafeIdentifierError}). One
+ * condition, one wire answer, whichever of the two helpers refused it.
+ *
+ * ## Measured: on THIS module's paths the envelope is defence in depth, not a
+ * ## wire answer — and saying so is the point
+ *
+ * Both callers flatten the throw by design: {@link probeRemoteCanonicalColumns}
+ * turns it into `{ error: message }` and {@link backfillRemoteCanonicalColumn}
+ * into `report.error`, because ADR-0053 D-B3 forbids a migration from taking a
+ * boot down. So `code` and `status` reach no response envelope from here today
+ * — only the MESSAGE survives, into the report a caller logs. The envelope is
+ * still worth carrying, for two reasons and no third: the two producers of one
+ * condition must not drift onto two spellings (the card's own "decide the code
+ * once" argument), and a future caller that propagates instead of reporting
+ * inherits the right answer rather than re-deriving one.
+ *
+ * ⛔ It is therefore NOT the wire-reachability evidence for this package's
+ * ledger provenance row — `RemoteTransport`'s DDL and `aggregate` positions
+ * are, and they answer over HTTP. Exported so the envelope has a real pin: no
+ * exported path can observe it, and an unobservable assertion is the phantom
+ * check `AGENTS.md` names rather than a test.
+ */
+export function assertSafeIdentifier(name: string): void {
  if (!SAFE_IDENTIFIER.test(name)) {
- throw new Error(`remote canonical backfill: unsafe identifier rejected: "${name}"`);
+ throw unsafeIdentifierError(`remote canonical backfill: unsafe identifier rejected: "${name}"`);
  }
 }
 

packages/drivers/driver-turso/src/remote-transport-aggregation-alias-quoting.test.ts

@@ -216,6 +216,21 @@ describe('[#14113] RemoteTransport — the aggregation alias is escaped, not gat
  });
 
  describe('regression controls — the positions this card did NOT touch', () => {
+ /**
+ * [#14287] Every control below asserts the ADR-0112 envelope beside the
+ * sentence, because "still refuses" was the half that was true all along
+ * and the half that was WRONG was invisible to it: these positions threw a
+ * bare `Error`, which `mapDataError` served as an opaque 500. #14287 gave
+ * the one producer `code: 'INVALID_REQUEST'` / `status: 400`. Asserting
+ * `message` alone here would let a regression to the bare `Error` land
+ * green through the very controls written to hold this shape.
+ */
+ const envelopeOf = (err: unknown) => ({
+ code: (err as { code?: unknown }).code,
+ status: (err as { status?: unknown }).status,
+ });
+ const ENVELOPE = { code: 'INVALID_REQUEST', status: 400 };
+
  it('the `field` position still refuses an unsafe identifier, and sends nothing', async () => {
  // `SAFE_IDENTIFIER` is doing real work here: `field` becomes a column
  // REFERENCE, which is grammar. Escaping is the answer for a NAME only.
@@ -233,6 +248,8 @@ describe('[#14113] RemoteTransport — the aggregation alias is escaped, not gat
  // itself safe is what makes this case reach the `field` check at all.
  expect(err.message).toContain('unsafe identifier rejected');
  expect(err.message).toContain('amount"; DROP TABLE showcase_delivery; --');
+ // [#14287] …and it is a 400 the caller can act on, not an opaque 500.
+ expect(envelopeOf(err)).toEqual(ENVELOPE);
  expect(seen).toEqual([]);
  });
 
@@ -248,6 +265,7 @@ describe('[#14113] RemoteTransport — the aggregation alias is escaped, not gat
  (e) => e as Error,
  );
  expect(err.message).toContain('unsafe identifier rejected');
+ expect(envelopeOf(err)).toEqual(ENVELOPE);
  expect(seen).toEqual([]);
  });
 
@@ -277,6 +295,10 @@ describe('[#14113] RemoteTransport — the aggregation alias is escaped, not gat
  );
  expect(err.message).toContain('unsafe identifier rejected');
  expect(err.message).toContain('showcase_delivery.region');
+ // [#14287] The GATING is what this control holds; the ENVELOPE is what
+ // that card added to it. Both are pinned, so the open gating card cannot
+ // be mistaken for having landed.
+ expect(envelopeOf(err)).toEqual(ENVELOPE);
  expect(seen).toEqual([]);
  });
 

.changeset/turso-unsafe-identifier-envelope.md

@@ -0,0 +1,27 @@
+---
+'@objectstack/driver-turso': patch
+'@objectstack/spec': patch
+---
+
+drivers(turso): an unsafe identifier on the remote transport answers `400 INVALID_REQUEST`, not an opaque 500
+
+`RemoteTransport.assertSafeIdentifier` is the one gate for every position where
+an identifier is inlined into SQL — the `object`, `field` and `groupBy`
+field/output-key positions of `aggregate`, the table and column names in
+`syncSchema` / `syncSchemasBatch`, and the index name and columns in unique-index
+sync — plus the free function of the same name in the remote canonical backfill.
+All of them threw a bare `Error` with no `code` and no `status`, so `mapDataError`
+reached none of its classifying branches and served a sanitised **500**: a caller
+whose own identifier was refused was told the server had faulted, and an SDK
+reading a 5xx retries a request that can never succeed.
+
+Every one of those refusals now carries the ADR-0112 envelope `code:
+'INVALID_REQUEST'`, `status: 400`, built by one constructor so the positions
+cannot answer three ways. `@objectstack/spec` gains only the error-code ledger's
+provenance row registering this driver as an emitter of a code seven packages
+already register — the registered-code union is byte-identical (248 codes before
+and after) and no new code is minted.
+
+**Nothing about which identifiers are refused changed.** `SAFE_IDENTIFIER` and
+every refusal message are untouched; exactly the inputs refused before are
+refused after, with byte-identical prose. Only `code` and `status` are new.

packages/drivers/driver-turso/src/remote-canonical-backfill.ts

@@ -93,6 +93,12 @@
  * twin's contract calls out, kept across the transport boundary.
  */
 
+// [#14287] The unsafe-identifier refusal's ADR-0112 envelope, from the one
+// place that decides it. Imported rather than re-spelled so this module and
+// `RemoteTransport` cannot answer one condition two ways; `turso-driver.ts`
+// already loads both modules together, so the edge costs nothing at runtime.
+import { unsafeIdentifierError } from './remote-transport.js';
+
 /** The `@libsql/client` surface this module uses — nothing more. */
 export interface RemoteBackfillClient {
  execute(stmt: { sql: string; args?: unknown[] } | string): Promise<{
@@ -218,9 +224,34 @@ export const REMOTE_BACKFILL_EPOCH_MS_MAX = 4_102_444_800_000;
  */
 const SAFE_IDENTIFIER = /^[a-zA-Z_][a-zA-Z0-9_]*$/;
 
-function assertSafeIdentifier(name: string): void {
+/**
+ * [#14287] The second producer of the transport's unsafe-identifier refusal,
+ * carrying the identical ADR-0112 envelope — `INVALID_REQUEST` / 400 — through
+ * the one constructor that decides it ({@link unsafeIdentifierError}). One
+ * condition, one wire answer, whichever of the two helpers refused it.
+ *
+ * ## Measured: on THIS module's paths the envelope is defence in depth, not a
+ * ## wire answer — and saying so is the point
+ *
+ * Both callers flatten the throw by design: {@link probeRemoteCanonicalColumns}
+ * turns it into `{ error: message }` and {@link backfillRemoteCanonicalColumn}
+ * into `report.error`, because ADR-0053 D-B3 forbids a migration from taking a
+ * boot down. So `code` and `status` reach no response envelope from here today
+ * — only the MESSAGE survives, into the report a caller logs. The envelope is
+ * still worth carrying, for two reasons and no third: the two producers of one
+ * condition must not drift onto two spellings (the card's own "decide the code
+ * once" argument), and a future caller that propagates instead of reporting
+ * inherits the right answer rather than re-deriving one.
+ *
+ * ⛔ It is therefore NOT the wire-reachability evidence for this package's
+ * ledger provenance row — `RemoteTransport`'s DDL and `aggregate` positions
+ * are, and they answer over HTTP. Exported so the envelope has a real pin: no
+ * exported path can observe it, and an unobservable assertion is the phantom
+ * check `AGENTS.md` names rather than a test.
+ */
+export function assertSafeIdentifier(name: string): void {
  if (!SAFE_IDENTIFIER.test(name)) {
- throw new Error(`remote canonical backfill: unsafe identifier rejected: "${name}"`);
+ throw unsafeIdentifierError(`remote canonical backfill: unsafe identifier rejected: "${name}"`);
  }
 }
 

packages/drivers/driver-turso/src/remote-transport-aggregation-alias-quoting.test.ts

@@ -216,6 +216,21 @@ describe('[#14113] RemoteTransport — the aggregation alias is escaped, not gat
  });
 
  describe('regression controls — the positions this card did NOT touch', () => {
+ /**
+ * [#14287] Every control below asserts the ADR-0112 envelope beside the
+ * sentence, because "still refuses" was the half that was true all along
+ * and the half that was WRONG was invisible to it: these positions threw a
+ * bare `Error`, which `mapDataError` served as an opaque 500. #14287 gave
+ * the one producer `code: 'INVALID_REQUEST'` / `status: 400`. Asserting
+ * `message` alone here would let a regression to the bare `Error` land
+ * green through the very controls written to hold this shape.
+ */
+ const envelopeOf = (err: unknown) => ({
+ code: (err as { code?: unknown }).code,
+ status: (err as { status?: unknown }).status,
+ });
+ const ENVELOPE = { code: 'INVALID_REQUEST', status: 400 };
+
  it('the `field` position still refuses an unsafe identifier, and sends nothing', async () => {
  // `SAFE_IDENTIFIER` is doing real work here: `field` becomes a column
  // REFERENCE, which is grammar. Escaping is the answer for a NAME only.
@@ -233,6 +248,8 @@ describe('[#14113] RemoteTransport — the aggregation alias is escaped, not gat
  // itself safe is what makes this case reach the `field` check at all.
  expect(err.message).toContain('unsafe identifier rejected');
  expect(err.message).toContain('amount"; DROP TABLE showcase_delivery; --');
+ // [#14287] …and it is a 400 the caller can act on, not an opaque 500.
+ expect(envelopeOf(err)).toEqual(ENVELOPE);
  expect(seen).toEqual([]);
  });
 
@@ -248,6 +265,7 @@ describe('[#14113] RemoteTransport — the aggregation alias is escaped, not gat
  (e) => e as Error,
  );
  expect(err.message).toContain('unsafe identifier rejected');
+ expect(envelopeOf(err)).toEqual(ENVELOPE);
  expect(seen).toEqual([]);
  });
 
@@ -277,6 +295,10 @@ describe('[#14113] RemoteTransport — the aggregation alias is escaped, not gat
  );
  expect(err.message).toContain('unsafe identifier rejected');
  expect(err.message).toContain('showcase_delivery.region');
+ // [#14287] The GATING is what this control holds; the ENVELOPE is what
+ // that card added to it. Both are pinned, so the open gating card cannot
+ // be mistaken for having landed.
+ expect(envelopeOf(err)).toEqual(ENVELOPE);
  expect(seen).toEqual([]);
  });
 

.changeset/turso-unsafe-identifier-envelope.md

@@ -0,0 +1,27 @@
+---
+'@objectstack/driver-turso': patch
+'@objectstack/spec': patch
+---
+
+drivers(turso): an unsafe identifier on the remote transport answers `400 INVALID_REQUEST`, not an opaque 500
+
+`RemoteTransport.assertSafeIdentifier` is the one gate for every position where
+an identifier is inlined into SQL — the `object`, `field` and `groupBy`
+field/output-key positions of `aggregate`, the table and column names in
+`syncSchema` / `syncSchemasBatch`, and the index name and columns in unique-index
+sync — plus the free function of the same name in the remote canonical backfill.
+All of them threw a bare `Error` with no `code` and no `status`, so `mapDataError`
+reached none of its classifying branches and served a sanitised **500**: a caller
+whose own identifier was refused was told the server had faulted, and an SDK
+reading a 5xx retries a request that can never succeed.
+
+Every one of those refusals now carries the ADR-0112 envelope `code:
+'INVALID_REQUEST'`, `status: 400`, built by one constructor so the positions
+cannot answer three ways. `@objectstack/spec` gains only the error-code ledger's
+provenance row registering this driver as an emitter of a code seven packages
+already register — the registered-code union is byte-identical (248 codes before
+and after) and no new code is minted.
+
+**Nothing about which identifiers are refused changed.** `SAFE_IDENTIFIER` and
+every refusal message are untouched; exactly the inputs refused before are
+refused after, with byte-identical prose. Only `code` and `status` are new.

packages/drivers/driver-turso/src/remote-canonical-backfill.ts

@@ -93,6 +93,12 @@
  * twin's contract calls out, kept across the transport boundary.
  */
 
+// [#14287] The unsafe-identifier refusal's ADR-0112 envelope, from the one
+// place that decides it. Imported rather than re-spelled so this module and
+// `RemoteTransport` cannot answer one condition two ways; `turso-driver.ts`
+// already loads both modules together, so the edge costs nothing at runtime.
+import { unsafeIdentifierError } from './remote-transport.js';
+
 /** The `@libsql/client` surface this module uses — nothing more. */
 export interface RemoteBackfillClient {
  execute(stmt: { sql: string; args?: unknown[] } | string): Promise<{
@@ -218,9 +224,34 @@ export const REMOTE_BACKFILL_EPOCH_MS_MAX = 4_102_444_800_000;
  */
 const SAFE_IDENTIFIER = /^[a-zA-Z_][a-zA-Z0-9_]*$/;
 
-function assertSafeIdentifier(name: string): void {
+/**
+ * [#14287] The second producer of the transport's unsafe-identifier refusal,
+ * carrying the identical ADR-0112 envelope — `INVALID_REQUEST` / 400 — through
+ * the one constructor that decides it ({@link unsafeIdentifierError}). One
+ * condition, one wire answer, whichever of the two helpers refused it.
+ *
+ * ## Measured: on THIS module's paths the envelope is defence in depth, not a
+ * ## wire answer — and saying so is the point
+ *
+ * Both callers flatten the throw by design: {@link probeRemoteCanonicalColumns}
+ * turns it into `{ error: message }` and {@link backfillRemoteCanonicalColumn}
+ * into `report.error`, because ADR-0053 D-B3 forbids a migration from taking a
+ * boot down. So `code` and `status` reach no response envelope from here today
+ * — only the MESSAGE survives, into the report a caller logs. The envelope is
+ * still worth carrying, for two reasons and no third: the two producers of one
+ * condition must not drift onto two spellings (the card's own "decide the code
+ * once" argument), and a future caller that propagates instead of reporting
+ * inherits the right answer rather than re-deriving one.
+ *
+ * ⛔ It is therefore NOT the wire-reachability evidence for this package's
+ * ledger provenance row — `RemoteTransport`'s DDL and `aggregate` positions
+ * are, and they answer over HTTP. Exported so the envelope has a real pin: no
+ * exported path can observe it, and an unobservable assertion is the phantom
+ * check `AGENTS.md` names rather than a test.
+ */
+export function assertSafeIdentifier(name: string): void {
  if (!SAFE_IDENTIFIER.test(name)) {
- throw new Error(`remote canonical backfill: unsafe identifier rejected: "${name}"`);
+ throw unsafeIdentifierError(`remote canonical backfill: unsafe identifier rejected: "${name}"`);
  }
 }
 

packages/drivers/driver-turso/src/remote-transport-aggregation-alias-quoting.test.ts

@@ -216,6 +216,21 @@ describe('[#14113] RemoteTransport — the aggregation alias is escaped, not gat
  });
 
  describe('regression controls — the positions this card did NOT touch', () => {
+ /**
+ * [#14287] Every control below asserts the ADR-0112 envelope beside the
+ * sentence, because "still refuses" was the half that was true all along
+ * and the half that was WRONG was invisible to it: these positions threw a
+ * bare `Error`, which `mapDataError` served as an opaque 500. #14287 gave
+ * the one producer `code: 'INVALID_REQUEST'` / `status: 400`. Asserting
+ * `message` alone here would let a regression to the bare `Error` land
+ * green through the very controls written to hold this shape.
+ */
+ const envelopeOf = (err: unknown) => ({
+ code: (err as { code?: unknown }).code,
+ status: (err as { status?: unknown }).status,
+ });
+ const ENVELOPE = { code: 'INVALID_REQUEST', status: 400 };
+
  it('the `field` position still refuses an unsafe identifier, and sends nothing', async () => {
  // `SAFE_IDENTIFIER` is doing real work here: `field` becomes a column
  // REFERENCE, which is grammar. Escaping is the answer for a NAME only.
@@ -233,6 +248,8 @@ describe('[#14113] RemoteTransport — the aggregation alias is escaped, not gat
  // itself safe is what makes this case reach the `field` check at all.
  expect(err.message).toContain('unsafe identifier rejected');
  expect(err.message).toContain('amount"; DROP TABLE showcase_delivery; --');
+ // [#14287] …and it is a 400 the caller can act on, not an opaque 500.
+ expect(envelopeOf(err)).toEqual(ENVELOPE);
  expect(seen).toEqual([]);
  });
 
@@ -248,6 +265,7 @@ describe('[#14113] RemoteTransport — the aggregation alias is escaped, not gat
  (e) => e as Error,
  );
  expect(err.message).toContain('unsafe identifier rejected');
+ expect(envelopeOf(err)).toEqual(ENVELOPE);
  expect(seen).toEqual([]);
  });
 
@@ -277,6 +295,10 @@ describe('[#14113] RemoteTransport — the aggregation alias is escaped, not gat
  );
  expect(err.message).toContain('unsafe identifier rejected');
  expect(err.message).toContain('showcase_delivery.region');
+ // [#14287] The GATING is what this control holds; the ENVELOPE is what
+ // that card added to it. Both are pinned, so the open gating card cannot
+ // be mistaken for having landed.
+ expect(envelopeOf(err)).toEqual(ENVELOPE);
  expect(seen).toEqual([]);
  });
 

.changeset/turso-unsafe-identifier-envelope.md

@@ -0,0 +1,27 @@
+---
+'@objectstack/driver-turso': patch
+'@objectstack/spec': patch
+---
+
+drivers(turso): an unsafe identifier on the remote transport answers `400 INVALID_REQUEST`, not an opaque 500
+
+`RemoteTransport.assertSafeIdentifier` is the one gate for every position where
+an identifier is inlined into SQL — the `object`, `field` and `groupBy`
+field/output-key positions of `aggregate`, the table and column names in
+`syncSchema` / `syncSchemasBatch`, and the index name and columns in unique-index
+sync — plus the free function of the same name in the remote canonical backfill.
+All of them threw a bare `Error` with no `code` and no `status`, so `mapDataError`
+reached none of its classifying branches and served a sanitised **500**: a caller
+whose own identifier was refused was told the server had faulted, and an SDK
+reading a 5xx retries a request that can never succeed.
+
+Every one of those refusals now carries the ADR-0112 envelope `code:
+'INVALID_REQUEST'`, `status: 400`, built by one constructor so the positions
+cannot answer three ways. `@objectstack/spec` gains only the error-code ledger's
+provenance row registering this driver as an emitter of a code seven packages
+already register — the registered-code union is byte-identical (248 codes before
+and after) and no new code is minted.
+
+**Nothing about which identifiers are refused changed.** `SAFE_IDENTIFIER` and
+every refusal message are untouched; exactly the inputs refused before are
+refused after, with byte-identical prose. Only `code` and `status` are new.

packages/drivers/driver-turso/src/remote-canonical-backfill.ts

@@ -93,6 +93,12 @@
  * twin's contract calls out, kept across the transport boundary.
  */
 
+// [#14287] The unsafe-identifier refusal's ADR-0112 envelope, from the one
+// place that decides it. Imported rather than re-spelled so this module and
+// `RemoteTransport` cannot answer one condition two ways; `turso-driver.ts`
+// already loads both modules together, so the edge costs nothing at runtime.
+import { unsafeIdentifierError } from './remote-transport.js';
+
 /** The `@libsql/client` surface this module uses — nothing more. */
 export interface RemoteBackfillClient {
  execute(stmt: { sql: string; args?: unknown[] } | string): Promise<{
@@ -218,9 +224,34 @@ export const REMOTE_BACKFILL_EPOCH_MS_MAX = 4_102_444_800_000;
  */
 const SAFE_IDENTIFIER = /^[a-zA-Z_][a-zA-Z0-9_]*$/;
 
-function assertSafeIdentifier(name: string): void {
+/**
+ * [#14287] The second producer of the transport's unsafe-identifier refusal,
+ * carrying the identical ADR-0112 envelope — `INVALID_REQUEST` / 400 — through
+ * the one constructor that decides it ({@link unsafeIdentifierError}). One
+ * condition, one wire answer, whichever of the two helpers refused it.
+ *
+ * ## Measured: on THIS module's paths the envelope is defence in depth, not a
+ * ## wire answer — and saying so is the point
+ *
+ * Both callers flatten the throw by design: {@link probeRemoteCanonicalColumns}
+ * turns it into `{ error: message }` and {@link backfillRemoteCanonicalColumn}
+ * into `report.error`, because ADR-0053 D-B3 forbids a migration from taking a
+ * boot down. So `code` and `status` reach no response envelope from here today
+ * — only the MESSAGE survives, into the report a caller logs. The envelope is
+ * still worth carrying, for two reasons and no third: the two producers of one
+ * condition must not drift onto two spellings (the card's own "decide the code
+ * once" argument), and a future caller that propagates instead of reporting
+ * inherits the right answer rather than re-deriving one.
+ *
+ * ⛔ It is therefore NOT the wire-reachability evidence for this package's
+ * ledger provenance row — `RemoteTransport`'s DDL and `aggregate` positions
+ * are, and they answer over HTTP. Exported so the envelope has a real pin: no
+ * exported path can observe it, and an unobservable assertion is the phantom
+ * check `AGENTS.md` names rather than a test.
+ */
+export function assertSafeIdentifier(name: string): void {
  if (!SAFE_IDENTIFIER.test(name)) {
- throw new Error(`remote canonical backfill: unsafe identifier rejected: "${name}"`);
+ throw unsafeIdentifierError(`remote canonical backfill: unsafe identifier rejected: "${name}"`);
  }
 }
 

packages/drivers/driver-turso/src/remote-transport-aggregation-alias-quoting.test.ts

@@ -216,6 +216,21 @@ describe('[#14113] RemoteTransport — the aggregation alias is escaped, not gat
  });
 
  describe('regression controls — the positions this card did NOT touch', () => {
+ /**
+ * [#14287] Every control below asserts the ADR-0112 envelope beside the
+ * sentence, because "still refuses" was the half that was true all along
+ * and the half that was WRONG was invisible to it: these positions threw a
+ * bare `Error`, which `mapDataError` served as an opaque 500. #14287 gave
+ * the one producer `code: 'INVALID_REQUEST'` / `status: 400`. Asserting
+ * `message` alone here would let a regression to the bare `Error` land
+ * green through the very controls written to hold this shape.
+ */
+ const envelopeOf = (err: unknown) => ({
+ code: (err as { code?: unknown }).code,
+ status: (err as { status?: unknown }).status,
+ });
+ const ENVELOPE = { code: 'INVALID_REQUEST', status: 400 };
+
  it('the `field` position still refuses an unsafe identifier, and sends nothing', async () => {
  // `SAFE_IDENTIFIER` is doing real work here: `field` becomes a column
  // REFERENCE, which is grammar. Escaping is the answer for a NAME only.
@@ -233,6 +248,8 @@ describe('[#14113] RemoteTransport — the aggregation alias is escaped, not gat
  // itself safe is what makes this case reach the `field` check at all.
  expect(err.message).toContain('unsafe identifier rejected');
  expect(err.message).toContain('amount"; DROP TABLE showcase_delivery; --');
+ // [#14287] …and it is a 400 the caller can act on, not an opaque 500.
+ expect(envelopeOf(err)).toEqual(ENVELOPE);
  expect(seen).toEqual([]);
  });
 
@@ -248,6 +265,7 @@ describe('[#14113] RemoteTransport — the aggregation alias is escaped, not gat
  (e) => e as Error,
  );
  expect(err.message).toContain('unsafe identifier rejected');
+ expect(envelopeOf(err)).toEqual(ENVELOPE);
  expect(seen).toEqual([]);
  });
 
@@ -277,6 +295,10 @@ describe('[#14113] RemoteTransport — the aggregation alias is escaped, not gat
  );
  expect(err.message).toContain('unsafe identifier rejected');
  expect(err.message).toContain('showcase_delivery.region');
+ // [#14287] The GATING is what this control holds; the ENVELOPE is what
+ // that card added to it. Both are pinned, so the open gating card cannot
+ // be mistaken for having landed.
+ expect(envelopeOf(err)).toEqual(ENVELOPE);
  expect(seen).toEqual([]);
  });
 

.changeset/turso-unsafe-identifier-envelope.md

@@ -0,0 +1,27 @@
+---
+'@objectstack/driver-turso': patch
+'@objectstack/spec': patch
+---
+
+drivers(turso): an unsafe identifier on the remote transport answers `400 INVALID_REQUEST`, not an opaque 500
+
+`RemoteTransport.assertSafeIdentifier` is the one gate for every position where
+an identifier is inlined into SQL — the `object`, `field` and `groupBy`
+field/output-key positions of `aggregate`, the table and column names in
+`syncSchema` / `syncSchemasBatch`, and the index name and columns in unique-index
+sync — plus the free function of the same name in the remote canonical backfill.
+All of them threw a bare `Error` with no `code` and no `status`, so `mapDataError`
+reached none of its classifying branches and served a sanitised **500**: a caller
+whose own identifier was refused was told the server had faulted, and an SDK
+reading a 5xx retries a request that can never succeed.
+
+Every one of those refusals now carries the ADR-0112 envelope `code:
+'INVALID_REQUEST'`, `status: 400`, built by one constructor so the positions
+cannot answer three ways. `@objectstack/spec` gains only the error-code ledger's
+provenance row registering this driver as an emitter of a code seven packages
+already register — the registered-code union is byte-identical (248 codes before
+and after) and no new code is minted.
+
+**Nothing about which identifiers are refused changed.** `SAFE_IDENTIFIER` and
+every refusal message are untouched; exactly the inputs refused before are
+refused after, with byte-identical prose. Only `code` and `status` are new.

packages/drivers/driver-turso/src/remote-canonical-backfill.ts

@@ -93,6 +93,12 @@
  * twin's contract calls out, kept across the transport boundary.
  */
 
+// [#14287] The unsafe-identifier refusal's ADR-0112 envelope, from the one
+// place that decides it. Imported rather than re-spelled so this module and
+// `RemoteTransport` cannot answer one condition two ways; `turso-driver.ts`
+// already loads both modules together, so the edge costs nothing at runtime.
+import { unsafeIdentifierError } from './remote-transport.js';
+
 /** The `@libsql/client` surface this module uses — nothing more. */
 export interface RemoteBackfillClient {
  execute(stmt: { sql: string; args?: unknown[] } | string): Promise<{
@@ -218,9 +224,34 @@ export const REMOTE_BACKFILL_EPOCH_MS_MAX = 4_102_444_800_000;
  */
 const SAFE_IDENTIFIER = /^[a-zA-Z_][a-zA-Z0-9_]*$/;
 
-function assertSafeIdentifier(name: string): void {
+/**
+ * [#14287] The second producer of the transport's unsafe-identifier refusal,
+ * carrying the identical ADR-0112 envelope — `INVALID_REQUEST` / 400 — through
+ * the one constructor that decides it ({@link unsafeIdentifierError}). One
+ * condition, one wire answer, whichever of the two helpers refused it.
+ *
+ * ## Measured: on THIS module's paths the envelope is defence in depth, not a
+ * ## wire answer — and saying so is the point
+ *
+ * Both callers flatten the throw by design: {@link probeRemoteCanonicalColumns}
+ * turns it into `{ error: message }` and {@link backfillRemoteCanonicalColumn}
+ * into `report.error`, because ADR-0053 D-B3 forbids a migration from taking a
+ * boot down. So `code` and `status` reach no response envelope from here today
+ * — only the MESSAGE survives, into the report a caller logs. The envelope is
+ * still worth carrying, for two reasons and no third: the two producers of one
+ * condition must not drift onto two spellings (the card's own "decide the code
+ * once" argument), and a future caller that propagates instead of reporting
+ * inherits the right answer rather than re-deriving one.
+ *
+ * ⛔ It is therefore NOT the wire-reachability evidence for this package's
+ * ledger provenance row — `RemoteTransport`'s DDL and `aggregate` positions
+ * are, and they answer over HTTP. Exported so the envelope has a real pin: no
+ * exported path can observe it, and an unobservable assertion is the phantom
+ * check `AGENTS.md` names rather than a test.
+ */
+export function assertSafeIdentifier(name: string): void {
  if (!SAFE_IDENTIFIER.test(name)) {
- throw new Error(`remote canonical backfill: unsafe identifier rejected: "${name}"`);
+ throw unsafeIdentifierError(`remote canonical backfill: unsafe identifier rejected: "${name}"`);
  }
 }
 

packages/drivers/driver-turso/src/remote-transport-aggregation-alias-quoting.test.ts

@@ -216,6 +216,21 @@ describe('[#14113] RemoteTransport — the aggregation alias is escaped, not gat
  });
 
  describe('regression controls — the positions this card did NOT touch', () => {
+ /**
+ * [#14287] Every control below asserts the ADR-0112 envelope beside the
+ * sentence, because "still refuses" was the half that was true all along
+ * and the half that was WRONG was invisible to it: these positions threw a
+ * bare `Error`, which `mapDataError` served as an opaque 500. #14287 gave
+ * the one producer `code: 'INVALID_REQUEST'` / `status: 400`. Asserting
+ * `message` alone here would let a regression to the bare `Error` land
+ * green through the very controls written to hold this shape.
+ */
+ const envelopeOf = (err: unknown) => ({
+ code: (err as { code?: unknown }).code,
+ status: (err as { status?: unknown }).status,
+ });
+ const ENVELOPE = { code: 'INVALID_REQUEST', status: 400 };
+
  it('the `field` position still refuses an unsafe identifier, and sends nothing', async () => {
  // `SAFE_IDENTIFIER` is doing real work here: `field` becomes a column
  // REFERENCE, which is grammar. Escaping is the answer for a NAME only.
@@ -233,6 +248,8 @@ describe('[#14113] RemoteTransport — the aggregation alias is escaped, not gat
  // itself safe is what makes this case reach the `field` check at all.
  expect(err.message).toContain('unsafe identifier rejected');
  expect(err.message).toContain('amount"; DROP TABLE showcase_delivery; --');
+ // [#14287] …and it is a 400 the caller can act on, not an opaque 500.
+ expect(envelopeOf(err)).toEqual(ENVELOPE);
  expect(seen).toEqual([]);
  });
 
@@ -248,6 +265,7 @@ describe('[#14113] RemoteTransport — the aggregation alias is escaped, not gat
  (e) => e as Error,
  );
  expect(err.message).toContain('unsafe identifier rejected');
+ expect(envelopeOf(err)).toEqual(ENVELOPE);
  expect(seen).toEqual([]);
  });
 
@@ -277,6 +295,10 @@ describe('[#14113] RemoteTransport — the aggregation alias is escaped, not gat
  );
  expect(err.message).toContain('unsafe identifier rejected');
  expect(err.message).toContain('showcase_delivery.region');
+ // [#14287] The GATING is what this control holds; the ENVELOPE is what
+ // that card added to it. Both are pinned, so the open gating card cannot
+ // be mistaken for having landed.
+ expect(envelopeOf(err)).toEqual(ENVELOPE);
  expect(seen).toEqual([]);
  });
 

.changeset/turso-unsafe-identifier-envelope.md

@@ -0,0 +1,27 @@
+---
+'@objectstack/driver-turso': patch
+'@objectstack/spec': patch
+---
+
+drivers(turso): an unsafe identifier on the remote transport answers `400 INVALID_REQUEST`, not an opaque 500
+
+`RemoteTransport.assertSafeIdentifier` is the one gate for every position where
+an identifier is inlined into SQL — the `object`, `field` and `groupBy`
+field/output-key positions of `aggregate`, the table and column names in
+`syncSchema` / `syncSchemasBatch`, and the index name and columns in unique-index
+sync — plus the free function of the same name in the remote canonical backfill.
+All of them threw a bare `Error` with no `code` and no `status`, so `mapDataError`
+reached none of its classifying branches and served a sanitised **500**: a caller
+whose own identifier was refused was told the server had faulted, and an SDK
+reading a 5xx retries a request that can never succeed.
+
+Every one of those refusals now carries the ADR-0112 envelope `code:
+'INVALID_REQUEST'`, `status: 400`, built by one constructor so the positions
+cannot answer three ways. `@objectstack/spec` gains only the error-code ledger's
+provenance row registering this driver as an emitter of a code seven packages
+already register — the registered-code union is byte-identical (248 codes before
+and after) and no new code is minted.
+
+**Nothing about which identifiers are refused changed.** `SAFE_IDENTIFIER` and
+every refusal message are untouched; exactly the inputs refused before are
+refused after, with byte-identical prose. Only `code` and `status` are new.

packages/drivers/driver-turso/src/remote-canonical-backfill.ts

@@ -93,6 +93,12 @@
  * twin's contract calls out, kept across the transport boundary.
  */
 
+// [#14287] The unsafe-identifier refusal's ADR-0112 envelope, from the one
+// place that decides it. Imported rather than re-spelled so this module and
+// `RemoteTransport` cannot answer one condition two ways; `turso-driver.ts`
+// already loads both modules together, so the edge costs nothing at runtime.
+import { unsafeIdentifierError } from './remote-transport.js';
+
 /** The `@libsql/client` surface this module uses — nothing more. */
 export interface RemoteBackfillClient {
  execute(stmt: { sql: string; args?: unknown[] } | string): Promise<{
@@ -218,9 +224,34 @@ export const REMOTE_BACKFILL_EPOCH_MS_MAX = 4_102_444_800_000;
  */
 const SAFE_IDENTIFIER = /^[a-zA-Z_][a-zA-Z0-9_]*$/;
 
-function assertSafeIdentifier(name: string): void {
+/**
+ * [#14287] The second producer of the transport's unsafe-identifier refusal,
+ * carrying the identical ADR-0112 envelope — `INVALID_REQUEST` / 400 — through
+ * the one constructor that decides it ({@link unsafeIdentifierError}). One
+ * condition, one wire answer, whichever of the two helpers refused it.
+ *
+ * ## Measured: on THIS module's paths the envelope is defence in depth, not a
+ * ## wire answer — and saying so is the point
+ *
+ * Both callers flatten the throw by design: {@link probeRemoteCanonicalColumns}
+ * turns it into `{ error: message }` and {@link backfillRemoteCanonicalColumn}
+ * into `report.error`, because ADR-0053 D-B3 forbids a migration from taking a
+ * boot down. So `code` and `status` reach no response envelope from here today
+ * — only the MESSAGE survives, into the report a caller logs. The envelope is
+ * still worth carrying, for two reasons and no third: the two producers of one
+ * condition must not drift onto two spellings (the card's own "decide the code
+ * once" argument), and a future caller that propagates instead of reporting
+ * inherits the right answer rather than re-deriving one.
+ *
+ * ⛔ It is therefore NOT the wire-reachability evidence for this package's
+ * ledger provenance row — `RemoteTransport`'s DDL and `aggregate` positions
+ * are, and they answer over HTTP. Exported so the envelope has a real pin: no
+ * exported path can observe it, and an unobservable assertion is the phantom
+ * check `AGENTS.md` names rather than a test.
+ */
+export function assertSafeIdentifier(name: string): void {
  if (!SAFE_IDENTIFIER.test(name)) {
- throw new Error(`remote canonical backfill: unsafe identifier rejected: "${name}"`);
+ throw unsafeIdentifierError(`remote canonical backfill: unsafe identifier rejected: "${name}"`);
  }
 }
 

packages/drivers/driver-turso/src/remote-transport-aggregation-alias-quoting.test.ts

@@ -216,6 +216,21 @@ describe('[#14113] RemoteTransport — the aggregation alias is escaped, not gat
  });
 
  describe('regression controls — the positions this card did NOT touch', () => {
+ /**
+ * [#14287] Every control below asserts the ADR-0112 envelope beside the
+ * sentence, because "still refuses" was the half that was true all along
+ * and the half that was WRONG was invisible to it: these positions threw a
+ * bare `Error`, which `mapDataError` served as an opaque 500. #14287 gave
+ * the one producer `code: 'INVALID_REQUEST'` / `status: 400`. Asserting
+ * `message` alone here would let a regression to the bare `Error` land
+ * green through the very controls written to hold this shape.
+ */
+ const envelopeOf = (err: unknown) => ({
+ code: (err as { code?: unknown }).code,
+ status: (err as { status?: unknown }).status,
+ });
+ const ENVELOPE = { code: 'INVALID_REQUEST', status: 400 };
+
  it('the `field` position still refuses an unsafe identifier, and sends nothing', async () => {
  // `SAFE_IDENTIFIER` is doing real work here: `field` becomes a column
  // REFERENCE, which is grammar. Escaping is the answer for a NAME only.
@@ -233,6 +248,8 @@ describe('[#14113] RemoteTransport — the aggregation alias is escaped, not gat
  // itself safe is what makes this case reach the `field` check at all.
  expect(err.message).toContain('unsafe identifier rejected');
  expect(err.message).toContain('amount"; DROP TABLE showcase_delivery; --');
+ // [#14287] …and it is a 400 the caller can act on, not an opaque 500.
+ expect(envelopeOf(err)).toEqual(ENVELOPE);
  expect(seen).toEqual([]);
  });
 
@@ -248,6 +265,7 @@ describe('[#14113] RemoteTransport — the aggregation alias is escaped, not gat
  (e) => e as Error,
  );
  expect(err.message).toContain('unsafe identifier rejected');
+ expect(envelopeOf(err)).toEqual(ENVELOPE);
  expect(seen).toEqual([]);
  });
 
@@ -277,6 +295,10 @@ describe('[#14113] RemoteTransport — the aggregation alias is escaped, not gat
  );
  expect(err.message).toContain('unsafe identifier rejected');
  expect(err.message).toContain('showcase_delivery.region');
+ // [#14287] The GATING is what this control holds; the ENVELOPE is what
+ // that card added to it. Both are pinned, so the open gating card cannot
+ // be mistaken for having landed.
+ expect(envelopeOf(err)).toEqual(ENVELOPE);
  expect(seen).toEqual([]);
  });
 

.changeset/turso-unsafe-identifier-envelope.md

@@ -0,0 +1,27 @@
+---
+'@objectstack/driver-turso': patch
+'@objectstack/spec': patch
+---
+
+drivers(turso): an unsafe identifier on the remote transport answers `400 INVALID_REQUEST`, not an opaque 500
+
+`RemoteTransport.assertSafeIdentifier` is the one gate for every position where
+an identifier is inlined into SQL — the `object`, `field` and `groupBy`
+field/output-key positions of `aggregate`, the table and column names in
+`syncSchema` / `syncSchemasBatch`, and the index name and columns in unique-index
+sync — plus the free function of the same name in the remote canonical backfill.
+All of them threw a bare `Error` with no `code` and no `status`, so `mapDataError`
+reached none of its classifying branches and served a sanitised **500**: a caller
+whose own identifier was refused was told the server had faulted, and an SDK
+reading a 5xx retries a request that can never succeed.
+
+Every one of those refusals now carries the ADR-0112 envelope `code:
+'INVALID_REQUEST'`, `status: 400`, built by one constructor so the positions
+cannot answer three ways. `@objectstack/spec` gains only the error-code ledger's
+provenance row registering this driver as an emitter of a code seven packages
+already register — the registered-code union is byte-identical (248 codes before
+and after) and no new code is minted.
+
+**Nothing about which identifiers are refused changed.** `SAFE_IDENTIFIER` and
+every refusal message are untouched; exactly the inputs refused before are
+refused after, with byte-identical prose. Only `code` and `status` are new.

packages/drivers/driver-turso/src/remote-canonical-backfill.ts

@@ -93,6 +93,12 @@
  * twin's contract calls out, kept across the transport boundary.
  */
 
+// [#14287] The unsafe-identifier refusal's ADR-0112 envelope, from the one
+// place that decides it. Imported rather than re-spelled so this module and
+// `RemoteTransport` cannot answer one condition two ways; `turso-driver.ts`
+// already loads both modules together, so the edge costs nothing at runtime.
+import { unsafeIdentifierError } from './remote-transport.js';
+
 /** The `@libsql/client` surface this module uses — nothing more. */
 export interface RemoteBackfillClient {
  execute(stmt: { sql: string; args?: unknown[] } | string): Promise<{
@@ -218,9 +224,34 @@ export const REMOTE_BACKFILL_EPOCH_MS_MAX = 4_102_444_800_000;
  */
 const SAFE_IDENTIFIER = /^[a-zA-Z_][a-zA-Z0-9_]*$/;
 
-function assertSafeIdentifier(name: string): void {
+/**
+ * [#14287] The second producer of the transport's unsafe-identifier refusal,
+ * carrying the identical ADR-0112 envelope — `INVALID_REQUEST` / 400 — through
+ * the one constructor that decides it ({@link unsafeIdentifierError}). One
+ * condition, one wire answer, whichever of the two helpers refused it.
+ *
+ * ## Measured: on THIS module's paths the envelope is defence in depth, not a
+ * ## wire answer — and saying so is the point
+ *
+ * Both callers flatten the throw by design: {@link probeRemoteCanonicalColumns}
+ * turns it into `{ error: message }` and {@link backfillRemoteCanonicalColumn}
+ * into `report.error`, because ADR-0053 D-B3 forbids a migration from taking a
+ * boot down. So `code` and `status` reach no response envelope from here today
+ * — only the MESSAGE survives, into the report a caller logs. The envelope is
+ * still worth carrying, for two reasons and no third: the two producers of one
+ * condition must not drift onto two spellings (the card's own "decide the code
+ * once" argument), and a future caller that propagates instead of reporting
+ * inherits the right answer rather than re-deriving one.
+ *
+ * ⛔ It is therefore NOT the wire-reachability evidence for this package's
+ * ledger provenance row — `RemoteTransport`'s DDL and `aggregate` positions
+ * are, and they answer over HTTP. Exported so the envelope has a real pin: no
+ * exported path can observe it, and an unobservable assertion is the phantom
+ * check `AGENTS.md` names rather than a test.
+ */
+export function assertSafeIdentifier(name: string): void {
  if (!SAFE_IDENTIFIER.test(name)) {
- throw new Error(`remote canonical backfill: unsafe identifier rejected: "${name}"`);
+ throw unsafeIdentifierError(`remote canonical backfill: unsafe identifier rejected: "${name}"`);
  }
 }
 

packages/drivers/driver-turso/src/remote-transport-aggregation-alias-quoting.test.ts

@@ -216,6 +216,21 @@ describe('[#14113] RemoteTransport — the aggregation alias is escaped, not gat
  });
 
  describe('regression controls — the positions this card did NOT touch', () => {
+ /**
+ * [#14287] Every control below asserts the ADR-0112 envelope beside the
+ * sentence, because "still refuses" was the half that was true all along
+ * and the half that was WRONG was invisible to it: these positions threw a
+ * bare `Error`, which `mapDataError` served as an opaque 500. #14287 gave
+ * the one producer `code: 'INVALID_REQUEST'` / `status: 400`. Asserting
+ * `message` alone here would let a regression to the bare `Error` land
+ * green through the very controls written to hold this shape.
+ */
+ const envelopeOf = (err: unknown) => ({
+ code: (err as { code?: unknown }).code,
+ status: (err as { status?: unknown }).status,
+ });
+ const ENVELOPE = { code: 'INVALID_REQUEST', status: 400 };
+
  it('the `field` position still refuses an unsafe identifier, and sends nothing', async () => {
  // `SAFE_IDENTIFIER` is doing real work here: `field` becomes a column
  // REFERENCE, which is grammar. Escaping is the answer for a NAME only.
@@ -233,6 +248,8 @@ describe('[#14113] RemoteTransport — the aggregation alias is escaped, not gat
  // itself safe is what makes this case reach the `field` check at all.
  expect(err.message).toContain('unsafe identifier rejected');
  expect(err.message).toContain('amount"; DROP TABLE showcase_delivery; --');
+ // [#14287] …and it is a 400 the caller can act on, not an opaque 500.
+ expect(envelopeOf(err)).toEqual(ENVELOPE);
  expect(seen).toEqual([]);
  });
 
@@ -248,6 +265,7 @@ describe('[#14113] RemoteTransport — the aggregation alias is escaped, not gat
  (e) => e as Error,
  );
  expect(err.message).toContain('unsafe identifier rejected');
+ expect(envelopeOf(err)).toEqual(ENVELOPE);
  expect(seen).toEqual([]);
  });
 
@@ -277,6 +295,10 @@ describe('[#14113] RemoteTransport — the aggregation alias is escaped, not gat
  );
  expect(err.message).toContain('unsafe identifier rejected');
  expect(err.message).toContain('showcase_delivery.region');
+ // [#14287] The GATING is what this control holds; the ENVELOPE is what
+ // that card added to it. Both are pinned, so the open gating card cannot
+ // be mistaken for having landed.
+ expect(envelopeOf(err)).toEqual(ENVELOPE);
  expect(seen).toEqual([]);
  });