@astrale-os/kernel-client 0.6.0-beta.5 → 0.6.0-beta.51

package/dist/auth/auth.d.ts

@@ -1,4 +1,4 @@
-import type { Identity, IdentityId, MintedCredential, ProvisionRequest, ProvisionResult } from '@astrale-os/kernel-core/auth';
+import type { Identity, Authentication, IdentityId, MintedCredential, ProvisionRequest, ProvisionResult } from '@astrale-os/kernel-core/auth';
 import type { PathLike } from '@astrale-os/kernel-core/path';
 import type { Input } from '../client/index.js';
 import type { RequestOptions } from '../transport/index.js';
@@ -8,12 +8,11 @@ import type { WhoisInput } from './identity.js';
 export type AuthCall = (target: PathLike, input: Input, options?: RequestOptions) => Promise<Input>;
 export interface AuthApi {
     provision(input: ProvisionRequest, options?: RequestOptions): Promise<ProvisionResult>;
-    whoami(options?: RequestOptions): Promise<Identity>;
-    whois(input: WhoisInput, options?: RequestOptions): Promise<Identity | null>;
+    whoami(options?: RequestOptions): Promise<Identity & Authentication>;
+    whois(input: WhoisInput, options?: RequestOptions): Promise<(Identity & Authentication) | null>;
     can(input: PolicyDecisionInput, options?: RequestOptions): Promise<boolean>;
     mint(input: MintOptions, options?: RequestOptions): Promise<MintedCredential>;
     delegate(identity: IdentityId, input: DelegateOptions, options?: RequestOptions): Promise<MintedCredential>;
 }
 /** Bind the current Core identity syscalls without recreating legacy grant-edge verbs. */
 export declare function createAuth(call: AuthCall): AuthApi;
-//# sourceMappingURL=auth.d.ts.map

package/dist/auth/auth.js

@@ -13,4 +13,3 @@ export function createAuth(call) {
         ...credentialApi(call),
     });
 }
-//# sourceMappingURL=auth.js.map

package/dist/auth/authorization.d.ts

@@ -1,14 +1,13 @@
 import type { NodeId } from '@astrale-os/kernel-core/graph/node';
 import type { NodePath, PathLike } from '@astrale-os/kernel-core/path';
-import type { schema } from '@astrale-os/kernel-dsl/v1';
+import type { PolicyRef } from '@astrale-os/kernel-dsl/v1';
 import type { RequestOptions } from '../transport/index.js';
 import type { AuthCall } from './auth.js';
 export interface PolicyDecisionInput {
-    readonly policy: PathLike | schema.PolicyRef;
+    readonly policy: PathLike | PolicyRef;
     readonly object: NodeId;
 }
 export declare const IDENTITY_CAN_PATH: NodePath;
 export declare function authorizationApi(call: AuthCall): Readonly<{
     can(input: PolicyDecisionInput, options?: RequestOptions): Promise<boolean>;
 }>;
-//# sourceMappingURL=authorization.d.ts.map

package/dist/auth/authorization.js

@@ -15,4 +15,3 @@ function policyPath(input) {
         ? Path.from(input).raw
         : Path.project(input).raw;
 }
-//# sourceMappingURL=authorization.js.map

package/dist/auth/credential.d.ts

@@ -17,4 +17,3 @@ export declare function credentialApi(call: AuthCall): Readonly<{
     mint(input: MintOptions, options?: RequestOptions): Promise<MintedCredential>;
     delegate(principal: IdentityId, input: DelegateOptions, options?: RequestOptions): Promise<MintedCredential>;
 }>;
-//# sourceMappingURL=credential.d.ts.map

package/dist/auth/credential.js

@@ -19,4 +19,3 @@ function credential(input) {
     }
     return input;
 }
-//# sourceMappingURL=credential.js.map

package/dist/auth/identity.d.ts

@@ -1,15 +1,12 @@
-import type { Identity, IssuerId, Subject } from '@astrale-os/kernel-core/auth';
+import type { Authentication, Identity } from '@astrale-os/kernel-core/auth';
 import type { NodePath } from '@astrale-os/kernel-core/path';
 import type { RequestOptions } from '../transport/index.js';
 import type { AuthCall } from './auth.js';
-export interface WhoisInput {
-    readonly issuer: IssuerId;
-    readonly subject: Subject;
+export type WhoisInput = Authentication;
+export interface IdentityApi {
+    whoami(options?: RequestOptions): Promise<Identity & Authentication>;
+    whois(input: WhoisInput, options?: RequestOptions): Promise<(Identity & Authentication) | null>;
 }
 export declare const IDENTITY_WHOAMI_PATH: NodePath;
 export declare const IDENTITY_WHOIS_PATH: NodePath;
-export declare function identityApi(call: AuthCall): Readonly<{
-    whoami(options?: RequestOptions): Promise<Identity>;
-    whois(input: WhoisInput, options?: RequestOptions): Promise<Identity | null>;
-}>;
-//# sourceMappingURL=identity.d.ts.map
+export declare function identityApi(call: AuthCall): IdentityApi;

package/dist/auth/identity.js

@@ -13,4 +13,3 @@ export function identityApi(call) {
         },
     });
 }
-//# sourceMappingURL=identity.js.map

package/dist/auth/index.d.ts

@@ -4,4 +4,3 @@ export { IDENTITY_MINT_PATH, type DelegateOptions, type MintOptions } from './cr
 export { IDENTITY_WHOAMI_PATH, IDENTITY_WHOIS_PATH, type WhoisInput } from './identity.js';
 export { IDENTITY_PROVISION_PATH } from './provision.js';
 export type { Identity, IdentityId, Subject, IssuerId, MintedCredential, ProvisionRequest, ProvisionResult, UnresolvedGrant, UnresolvedIdentityExpr, } from '@astrale-os/kernel-core/auth';
-//# sourceMappingURL=index.d.ts.map

package/dist/auth/index.js

@@ -3,4 +3,3 @@ export { IDENTITY_CAN_PATH } from './authorization.js';
 export { IDENTITY_MINT_PATH } from './credential.js';
 export { IDENTITY_WHOAMI_PATH, IDENTITY_WHOIS_PATH } from './identity.js';
 export { IDENTITY_PROVISION_PATH } from './provision.js';
-//# sourceMappingURL=index.js.map

package/dist/auth/provision.d.ts

@@ -6,4 +6,3 @@ export declare const IDENTITY_PROVISION_PATH: NodePath;
 export declare function provisionApi(call: AuthCall): Readonly<{
     provision(input: ProvisionRequest, options?: RequestOptions): Promise<ProvisionResult>;
 }>;
-//# sourceMappingURL=provision.d.ts.map

package/dist/auth/provision.js

@@ -8,4 +8,3 @@ export function provisionApi(call) {
         },
     });
 }
-//# sourceMappingURL=provision.js.map

package/dist/client/admission.d.ts

@@ -2,4 +2,3 @@ import type { invocation as protocol } from '@astrale-os/kernel-protocol';
 import type { Call } from './request.js';
 /** Parent-private Call acceptance shared by Client and Client Session. */
 export declare function acceptCall(input: Call): protocol.Call;
-//# sourceMappingURL=admission.d.ts.map

package/dist/client/admission.js

@@ -32,4 +32,3 @@ function freezeValue(input) {
     }
     return input;
 }
-//# sourceMappingURL=admission.js.map

package/dist/client/client.d.ts

@@ -23,4 +23,3 @@ export declare class Client implements AuthenticatedClient {
     close(): void;
     private dispatchWith;
 }
-//# sourceMappingURL=client.d.ts.map

package/dist/client/client.js

@@ -90,4 +90,3 @@ function admitTransport(input) {
         ...(close === undefined ? {} : { close: close.bind(input) }),
     });
 }
-//# sourceMappingURL=client.js.map

package/dist/client/credential.d.ts

@@ -10,4 +10,3 @@ export interface AuthenticatedClient {
 export type CredentialDispatch = (credential: RemoteCredential, call: Call, options?: ClientDispatchOptions) => Promise<Result>;
 export declare function authenticated(dispatchWith: CredentialDispatch, credential: RemoteCredential): AuthenticatedClient;
 export declare function resolveCredential(input: RemoteCredential, signal?: AbortSignal): Promise<string>;
-//# sourceMappingURL=credential.d.ts.map

package/dist/client/credential.js

@@ -49,4 +49,3 @@ function cancellation(reason) {
         ? reason
         : new ClientError('Client request was cancelled.', { cause: reason });
 }
-//# sourceMappingURL=credential.js.map

package/dist/client/index.d.ts

@@ -4,4 +4,3 @@ export type { AuthenticatedClient, RemoteCredential } from './credential.js';
 export { call, type Call, type ClientDispatchOptions } from './request.js';
 export type { Binary, BinaryResponse, Input, RedirectResult, Result, Stream, StreamResult, ValueResult, } from './result.js';
 export { isAdmittedMissError, isAdmittedStaleRouteError } from './routing-control.js';
-//# sourceMappingURL=index.d.ts.map

package/dist/client/index.js

@@ -2,4 +2,3 @@ export { Client, dispatchTrace } from './client.js';
 export { acceptCall } from './admission.js';
 export { call } from './request.js';
 export { isAdmittedMissError, isAdmittedStaleRouteError } from './routing-control.js';
-//# sourceMappingURL=index.js.map

package/dist/client/request.d.ts

@@ -24,4 +24,3 @@ export interface AdmittedRequest {
 export declare function call(target: PathLike, input: Input): Call;
 export declare function admitRequest(input: Call, options: ClientDispatchOptions | undefined, lifecycle: AbortSignal): AdmittedRequest;
 export declare function invocation(request: AdmittedRequest, credential?: string, trace?: protocol.Trace): TransportRequest;
-//# sourceMappingURL=request.d.ts.map

package/dist/client/request.js

@@ -98,4 +98,3 @@ function lifecycleOptions(input, lifecycle) {
         ...(input?.idempotencyKey === undefined ? {} : { idempotencyKey: input.idempotencyKey }),
     });
 }
-//# sourceMappingURL=request.js.map

package/dist/client/result.d.ts

@@ -1,10 +1,10 @@
-import type { BinaryResult, CallableResult } from '@astrale-os/kernel-core/domain';
+import type { BinaryOutput, CallableResult } from '@astrale-os/kernel-core/callable';
 import type { Value } from '@astrale-os/kernel-dsl/value';
 import type { invocation as protocol } from '@astrale-os/kernel-protocol';
 /** Caller-visible value accepted from one admitted remote invocation. */
 export type Input = Value;
-/** Caller-visible finite binary response. */
-export type Binary = BinaryResult;
+/** Caller-visible buffered or streaming binary response. */
+export type Binary = BinaryOutput;
 /** Caller-owned remote stream. */
 export interface Stream extends AsyncIterable<Value> {
     cancel(reason?: string): Promise<void>;
@@ -33,4 +33,3 @@ export declare function requireValue(result: Promise<Result>): Promise<ValueResu
 export declare function requireStream(result: Promise<Result>): Promise<StreamResult>;
 export declare function requireBinary(result: Promise<Result>): Promise<BinaryResponse>;
 export {};
-//# sourceMappingURL=result.d.ts.map

package/dist/client/result.js

@@ -24,6 +24,8 @@ async function rejectMismatch(expected, result) {
     if (result.kind === 'stream') {
         await result.stream.cancel(`Expected ${expected} Function result.`).catch(() => undefined);
     }
+    if (result.kind === 'binary' && !(result.value.body instanceof Uint8Array)) {
+        await result.value.body[Symbol.asyncIterator]().return?.();
+    }
     mismatch(expected, result.kind);
 }
-//# sourceMappingURL=result.js.map

package/dist/client/routing-control.d.ts

@@ -8,4 +8,3 @@ export declare function admittedStaleRouteError(currentEtag: publication.Etag, i
 export declare function isAdmittedMissError(input: unknown): input is MissError;
 /** Distinguish decoded routing control from public or caller-supplied lookalike errors. */
 export declare function isAdmittedStaleRouteError(input: unknown): input is StaleRouteError;
-//# sourceMappingURL=routing-control.d.ts.map

package/dist/client/routing-control.js

@@ -21,4 +21,3 @@ export function isAdmittedMissError(input) {
 export function isAdmittedStaleRouteError(input) {
     return input instanceof StaleRouteError && admittedStaleRoutes.has(input);
 }
-//# sourceMappingURL=routing-control.js.map

package/dist/errors/client-error.d.ts

@@ -1,4 +1,3 @@
 export declare class ClientError extends Error {
     constructor(message: string, options?: ErrorOptions);
 }
-//# sourceMappingURL=client-error.d.ts.map

package/dist/errors/client-error.js

@@ -1,7 +1,8 @@
 export class ClientError extends Error {
     constructor(message, options) {
+        if (message.trim() === '')
+            throw new TypeError('Client error message must be non-blank.');
         super(message, options);
         this.name = 'ClientError';
     }
 }
-//# sourceMappingURL=client-error.js.map

package/dist/errors/index.d.ts

@@ -1,7 +1,7 @@
-export { ClientError } from './client-error.js';
-export { MissError } from './miss-error.js';
-export { ProtocolError, type ProtocolErrorOptions } from './protocol-error.js';
-export { ResponseError } from './response-error.js';
-export { StaleRouteError } from './stale-route-error.js';
-export { TransportError, type TransportDelivery, type TransportErrorOptions, type TransportPhase, } from './transport-error.js';
-//# sourceMappingURL=index.d.ts.map
+export * from './client-error.js';
+export * from './miss-error.js';
+export * from './protocol-error.js';
+export * from './response-error.js';
+export * from './session-error.js';
+export * from './stale-route-error.js';
+export * from './transport-error.js';

package/dist/errors/index.js

@@ -1,7 +1,7 @@
-export { ClientError } from './client-error.js';
-export { MissError } from './miss-error.js';
-export { ProtocolError } from './protocol-error.js';
-export { ResponseError } from './response-error.js';
-export { StaleRouteError } from './stale-route-error.js';
-export { TransportError, } from './transport-error.js';
-//# sourceMappingURL=index.js.map
+export * from './client-error.js';
+export * from './miss-error.js';
+export * from './protocol-error.js';
+export * from './response-error.js';
+export * from './session-error.js';
+export * from './stale-route-error.js';
+export * from './transport-error.js';

package/dist/errors/miss-error.d.ts

@@ -6,4 +6,3 @@ export declare class MissError extends ClientError {
     readonly name = "MissError";
     constructor(invocation: protocol.InvocationId);
 }
-//# sourceMappingURL=miss-error.d.ts.map

package/dist/errors/miss-error.js

@@ -8,4 +8,3 @@ export class MissError extends ClientError {
         this.invocation = invocation;
     }
 }
-//# sourceMappingURL=miss-error.js.map

package/dist/errors/protocol-error.d.ts

@@ -7,4 +7,3 @@ export declare class ProtocolError extends ClientError {
     readonly invocation?: protocol.InvocationId;
     constructor(message: string, options?: ProtocolErrorOptions);
 }
-//# sourceMappingURL=protocol-error.d.ts.map

package/dist/errors/protocol-error.js

@@ -7,4 +7,3 @@ export class ProtocolError extends ClientError {
         this.invocation = options?.invocation;
     }
 }
-//# sourceMappingURL=protocol-error.js.map

package/dist/errors/response-error.d.ts

@@ -9,4 +9,3 @@ export declare class ResponseError extends ClientError {
     readonly reason?: errors.ErrorReason;
     constructor(code: errors.ErrorCode, message: string, invocation: protocol.InvocationId, data?: Value | undefined);
 }
-//# sourceMappingURL=response-error.d.ts.map

package/dist/errors/response-error.js

@@ -14,4 +14,3 @@ export class ResponseError extends ClientError {
         this.reason = errors.reasonOf(data);
     }
 }
-//# sourceMappingURL=response-error.js.map

package/dist/errors/session-error.d.ts

@@ -0,0 +1,9 @@
+import { ClientError } from './client-error.js';
+export type SessionFailure = 'cancelled' | 'closed' | 'timeout';
+export interface SessionErrorOptions extends ErrorOptions {
+    readonly failure: SessionFailure;
+}
+export declare class SessionError extends ClientError {
+    readonly failure: SessionFailure;
+    constructor(message: string, options: SessionErrorOptions);
+}

package/dist/errors/session-error.js

@@ -0,0 +1,9 @@
+import { ClientError } from './client-error.js';
+export class SessionError extends ClientError {
+    failure;
+    constructor(message, options) {
+        super(message, options);
+        this.name = 'SessionError';
+        this.failure = options.failure;
+    }
+}

package/dist/errors/stale-route-error.d.ts

@@ -7,4 +7,3 @@ export declare class StaleRouteError extends ClientError {
     readonly name = "StaleRouteError";
     constructor(currentEtag: publication.Etag, invocation: protocol.InvocationId);
 }
-//# sourceMappingURL=stale-route-error.d.ts.map

package/dist/errors/stale-route-error.js

@@ -10,4 +10,3 @@ export class StaleRouteError extends ClientError {
         this.invocation = invocation;
     }
 }
-//# sourceMappingURL=stale-route-error.js.map

package/dist/errors/transport-error.d.ts

@@ -3,16 +3,28 @@ import { ClientError } from './client-error.js';
 /** Whether an invocation is proven not to have crossed the transport boundary. */
 export type TransportDelivery = 'not-sent' | 'unknown';
 /** Observable transport phase in which communication stopped. */
-export type TransportPhase = 'connect' | 'send' | 'receive' | 'timeout' | 'closed';
-export interface TransportErrorOptions extends ErrorOptions {
-    readonly phase: TransportPhase;
+export type TransportPhase = 'connect' | 'send' | 'receive' | 'timeout' | 'closed' | 'unknown';
+export type TransportContext = {
+    readonly kind: 'acquisition';
+    readonly resource: 'publication' | 'bundle';
+} | {
+    readonly kind: 'invocation';
     readonly delivery: TransportDelivery;
     readonly invocation?: protocol.InvocationId;
+};
+export interface AcquisitionTransportErrorOptions extends ErrorOptions {
+    readonly phase: TransportPhase;
+    readonly resource: 'publication' | 'bundle';
 }
-export declare class TransportError extends ClientError {
+export interface InvocationTransportErrorOptions extends ErrorOptions {
     readonly phase: TransportPhase;
     readonly delivery: TransportDelivery;
     readonly invocation?: protocol.InvocationId;
-    constructor(message: string, options: TransportErrorOptions);
 }
-//# sourceMappingURL=transport-error.d.ts.map
+export declare class TransportError extends ClientError {
+    readonly phase: TransportPhase;
+    readonly context: TransportContext;
+    private constructor();
+    static acquisition(message: string, options: AcquisitionTransportErrorOptions): TransportError;
+    static invocation(message: string, options: InvocationTransportErrorOptions): TransportError;
+}

package/dist/errors/transport-error.js

@@ -1,14 +1,18 @@
 import { ClientError } from './client-error.js';
 export class TransportError extends ClientError {
     phase;
-    delivery;
-    invocation;
-    constructor(message, options) {
+    context;
+    constructor(message, phase, context, options) {
         super(message, options);
+        this.phase = phase;
+        this.context = context;
         this.name = 'TransportError';
-        this.phase = options.phase;
-        this.delivery = options.delivery;
-        this.invocation = options.invocation;
+        Object.freeze(context);
+    }
+    static acquisition(message, options) {
+        return new TransportError(message, options.phase, { kind: 'acquisition', resource: options.resource }, options);
+    }
+    static invocation(message, options) {
+        return new TransportError(message, options.phase, { kind: 'invocation', delivery: options.delivery, invocation: options.invocation }, options);
     }
 }
-//# sourceMappingURL=transport-error.js.map

package/dist/graph/domain/binding.d.ts

@@ -0,0 +1,22 @@
+import type { Edge } from '@astrale-os/kernel-core/graph/edge';
+import type { Node } from '@astrale-os/kernel-core/graph/node';
+import type { QueryAST, QuerySingleSourceClassOf } from '@astrale-os/kernel-core/graph/query';
+import type { Domain } from '@astrale-os/kernel-dsl/v1/domain';
+import type { AnyResolvedClass, ResolvedClass } from '@astrale-os/kernel-dsl/v1/language';
+import type { GraphApi, GraphQueryOptions } from '../graph.js';
+import type { BoundEdge, BoundNode } from './model.js';
+import type { BoundQueryPage } from './page.js';
+import type { MethodCall } from './project.js';
+export type DomainQueryOptions = Omit<GraphQueryOptions, 'expected'>;
+type AdmittedSourceClasses<Query extends QueryAST> = [QuerySingleSourceClassOf<Query>] extends [
+    never
+] ? never : QuerySingleSourceClassOf<Query> extends AnyResolvedClass ? unknown : never;
+export interface DomainBinding<DomainValue extends Domain = Domain> {
+    readonly domain: DomainValue;
+    readonly graph: GraphApi;
+    query<Query extends QueryAST>(query: Query & AdmittedSourceClasses<Query>, options: DomainQueryOptions): Promise<BoundQueryPage<Query>>;
+    wrapNode<Class extends ResolvedClass<'node'>>(selected: Class, node: Node): BoundNode<Class>;
+    wrapEdge<Class extends ResolvedClass<'edge'>>(selected: Class, edge: Edge): BoundEdge<Class>;
+}
+export declare function createDomainBinding<DomainValue extends Domain>(domain: DomainValue, graph: GraphApi, call: MethodCall): DomainBinding<DomainValue>;
+export {};

package/dist/graph/domain/binding.js

@@ -0,0 +1,123 @@
+import { ClassKey } from '@astrale-os/kernel-dsl/v1/addressing';
+import { isDomain } from '@astrale-os/kernel-dsl/v1/domain';
+import { provenanceOfGraphValue, provenanceOfResponse } from '../provenance.js';
+import { selectedEdges, selectedNodes } from './page.js';
+import { projectEdge, projectNode } from './project.js';
+import { provenanceOfProjectedValue, sameClosure } from './provenance.js';
+export function createDomainBinding(domain, graph, call) {
+    if (!isDomain(domain))
+        throw new TypeError('Domain binding requires an admitted DSL Domain.');
+    const wrapNode = (selected, node) => {
+        requireOwnedClass(domain, selected);
+        const provenance = requireProvenance(domain, node);
+        const exact = requireExactClass(domain, node.class, 'node');
+        if (!exact.satisfies(selected))
+            throw new TypeError(`${exact.key} does not satisfy ${selected.key}.`);
+        const diagnostics = exact.validateProperties(node.props);
+        if (diagnostics.length > 0)
+            throw new TypeError(`Node ${node.id} has invalid exact Properties.`);
+        return projectNode(selected, node, provenance, call);
+    };
+    const wrapEdge = (selected, edge) => {
+        requireOwnedClass(domain, selected);
+        const provenance = requireProvenance(domain, edge);
+        const exact = requireExactClass(domain, edge.class, 'edge');
+        if (!exact.satisfies(selected))
+            throw new TypeError(`${exact.key} does not satisfy ${selected.key}.`);
+        const diagnostics = exact.validateProperties(edge.props);
+        if (diagnostics.length > 0)
+            throw new TypeError('Edge has invalid exact Properties.');
+        return projectEdge(selected, edge, provenance);
+    };
+    return Object.freeze({
+        domain,
+        graph,
+        async query(query, options) {
+            const selected = selectedSourceClass(domain, query);
+            const response = await graph.query(query, { ...options, expected: domain.closure });
+            const provenance = provenanceOfResponse(response);
+            if (provenance === undefined || !sameClosure(provenance.closure, domain.closure)) {
+                throw new TypeError('Authenticated query provenance was not retained.');
+            }
+            const next = response.page.next === undefined
+                ? undefined
+                : () => this.query(query, {
+                    ...options,
+                    page: { ...options.page, after: response.page.next },
+                });
+            if (selected.kind === 'node') {
+                const nodes = selectedNodes(response).map((node) => wrapNode(selected, node));
+                return Object.freeze({
+                    nodes: Object.freeze(nodes),
+                    raw: response,
+                    ...(next === undefined ? {} : { next }),
+                    refine: (value, target) => refineNode(domain, call, value, target, provenance),
+                });
+            }
+            const edges = selectedEdges(response).map((edge) => wrapEdge(selected, edge));
+            return Object.freeze({
+                edges: Object.freeze(edges),
+                raw: response,
+                ...(next === undefined ? {} : { next }),
+                refine: (value, target) => refineEdge(domain, value, target, provenance),
+            });
+        },
+        wrapNode,
+        wrapEdge,
+    });
+}
+function selectedSourceClass(domain, query) {
+    if (query.steps.some((step) => step.op === 'expand')) {
+        throw new TypeError('Rich Domain queries do not yet project expanded bindings.');
+    }
+    if (query.source.terms.length !== 1 || query.source.terms[0]?.kind !== 'class') {
+        throw new TypeError('Rich Domain queries require one exact Class source term.');
+    }
+    const sourceBinding = query.source.kind === 'node' ? query.source.binding : query.source.bindings.edge;
+    if (query.select.binding !== sourceBinding) {
+        throw new TypeError('Rich Domain queries must select their original source binding.');
+    }
+    const selected = domain.definition(query.source.terms[0].class);
+    if (selected?.ref.kind !== 'class' || selected.kind !== query.source.kind) {
+        throw new TypeError('Query source Class is absent or has the wrong graph kind.');
+    }
+    return selected;
+}
+function refineNode(domain, call, value, target, page) {
+    requireOwnedClass(domain, target);
+    const provenance = requirePageProvenance(value, page);
+    const exact = requireExactClass(domain, value.class, 'node');
+    return exact.satisfies(target) ? projectNode(target, value, provenance, call) : undefined;
+}
+function refineEdge(domain, value, target, page) {
+    requireOwnedClass(domain, target);
+    const provenance = requirePageProvenance(value, page);
+    const exact = requireExactClass(domain, value.class, 'edge');
+    return exact.satisfies(target) ? projectEdge(target, value, provenance) : undefined;
+}
+function requirePageProvenance(value, page) {
+    const provenance = provenanceOfProjectedValue(value);
+    if (provenance?.page !== page.page) {
+        throw new TypeError('Refinement requires a value from this exact result page.');
+    }
+    return provenance;
+}
+function requireOwnedClass(domain, selected) {
+    if (domain.definition(selected.key) !== selected) {
+        throw new TypeError('Selected Class does not belong to the bound Domain closure.');
+    }
+}
+function requireProvenance(domain, value) {
+    const provenance = provenanceOfGraphValue(value);
+    if (provenance === undefined || !sameClosure(provenance.closure, domain.closure)) {
+        throw new TypeError('Graph value lacks matching authenticated query provenance.');
+    }
+    return provenance;
+}
+function requireExactClass(domain, key, kind) {
+    const exact = domain.definition(ClassKey.ref(ClassKey(key)));
+    if (exact?.ref.kind !== 'class' || exact.kind !== kind || exact.abstract) {
+        throw new TypeError(`Exact ${kind} Class ${key} is not active and concrete.`);
+    }
+    return exact;
+}

package/dist/graph/domain/domain.typecheck.d.ts

@@ -0,0 +1 @@
+export {};