@astrale-os/kernel-dsl 0.2.0-beta.8 → 1.0.0-beta.1

package/dist/v1/schema/validation/policy/context.js

@@ -1,5 +1,6 @@
 import { Key } from '../../../addressing/index.js';
 import { definitionRefIndex } from '../../../addressing/ordering.js';
+import { classSatisfies } from '../../../language/class/inheritance.js';
 import { diagnostic } from '../../diagnostic.js';
 const formatDefinitionRef = Key.of;
 export class PolicyValidationContext {
@@ -63,22 +64,10 @@ export class PolicyValidationContext {
     }
     /** Return true when candidate is the required Class or a same-kind descendant. */
     classExtends(candidate, required) {
-        if (definitionRefIndex(candidate) === definitionRefIndex(required))
-            return true;
-        const visited = new Set();
-        const visit = (ref) => {
-            const key = definitionRefIndex(ref);
-            if (key === definitionRefIndex(required))
-                return true;
-            if (visited.has(key))
-                return false;
-            visited.add(key);
-            const resolved = this.environment.resolveAny(ref);
-            if (resolved === undefined || resolved.ref.kind !== 'class')
-                return false;
-            return resolved.declaration.extends.some(visit);
-        };
-        return visit(candidate);
+        const resolve = (ref) => this.environment.resolveAny(ref)?.declaration;
+        const actual = resolve(candidate);
+        const target = resolve(required);
+        return actual !== undefined && target !== undefined && classSatisfies(actual, target, resolve);
     }
     add(code, pointer, message, ref) {
         this.diagnostics.push(diagnostic(code, pointer, message, ref));

package/dist/v1/schema/validation/policy/objects.d.ts

@@ -0,0 +1,4 @@
+import type { PolicyObjectRef } from '../../../language/index.js';
+import type { PolicyValidationContext } from './context.js';
+import type { ObjectContract } from './typing.js';
+export declare function referenceContracts(validation: PolicyValidationContext, ref: PolicyObjectRef, pointer: string): readonly ObjectContract[] | undefined;

package/dist/v1/schema/validation/policy/objects.js

@@ -0,0 +1,71 @@
+import { definitionRefIndex } from '../../../addressing/ordering.js';
+import { isMethodExecutable } from '../../../language/callable/executable.js';
+import { policyObjectKey, policyObjectOrigin } from '../../../language/index.js';
+const KERNEL_ORIGIN = 'kernel.astrale.ai';
+const PROJECTION_CLASS = nodeClassRef('Class');
+const PROJECTION_FUNCTION = nodeClassRef('Function');
+const PROJECTION_POLICY = nodeClassRef('Policy');
+const PROJECTION_VIEW = nodeClassRef('View');
+export function referenceContracts(validation, ref, pointer) {
+    const candidate = validation.environment.candidate;
+    const local = policyObjectOrigin(ref) === candidate.origin;
+    const direct = Object.values(candidate.dependencies).some((entry) => entry.origin === policyObjectOrigin(ref));
+    const owner = local
+        ? candidate
+        : direct
+            ? validation.environment.dependencies.get(policyObjectOrigin(ref))
+            : undefined;
+    if (owner === undefined)
+        return invalidPolicyObjectRef(validation, ref, pointer);
+    switch (ref.kind) {
+        case 'class': {
+            const resolved = validation.environment.resolve(ref);
+            return resolved?.ref.kind === ref.kind
+                ? [{ kind: 'exact', ref: PROJECTION_CLASS }]
+                : invalidPolicyObjectRef(validation, ref, pointer);
+        }
+        case 'method': {
+            const declaringClass = owner.classes[ref.owner.name];
+            const method = declaringClass?.kind === 'node' ? declaringClass.methods[ref.name] : undefined;
+            return method === undefined || !isMethodExecutable(declaringClass, method)
+                ? invalidPolicyObjectRef(validation, ref, pointer)
+                : [{ kind: 'exact', ref: PROJECTION_FUNCTION }];
+        }
+        case 'function':
+            return owner.functions[ref.name] === undefined
+                ? invalidPolicyObjectRef(validation, ref, pointer)
+                : [{ kind: 'exact', ref: PROJECTION_FUNCTION }];
+        case 'policy':
+            return owner.policies[ref.name] === undefined
+                ? invalidPolicyObjectRef(validation, ref, pointer)
+                : [{ kind: 'exact', ref: PROJECTION_POLICY }];
+        case 'view':
+            return owner.views[ref.name] === undefined
+                ? invalidPolicyObjectRef(validation, ref, pointer)
+                : [{ kind: 'exact', ref: PROJECTION_VIEW }];
+        case 'core': {
+            const node = owner.core.nodes[ref.name];
+            if (node === undefined)
+                return invalidPolicyObjectRef(validation, ref, pointer);
+            const resolved = validation.environment.resolve(node.class);
+            const analyzed = validation.analysis.definitions.get(definitionRefIndex(node.class));
+            // Core validation owns invalid Core Class diagnostics. Avoid adding Policy noise for
+            // a Node that cannot materialize in the first place.
+            if (node.class.origin !== owner.origin ||
+                resolved?.ref.kind !== 'class' ||
+                resolved.kind !== 'node' ||
+                analyzed === undefined) {
+                return undefined;
+            }
+            return [{ kind: 'exact', ref: node.class }];
+        }
+    }
+    return invalidPolicyObjectRef(validation, ref, pointer);
+}
+function invalidPolicyObjectRef(validation, ref, pointer) {
+    validation.add('PL_REF', `${pointer}/ref`, `${policyObjectKey(ref)} is not an exact local or direct-dependency projected Policy object.`, policyObjectKey(ref));
+    return undefined;
+}
+function nodeClassRef(name) {
+    return { origin: KERNEL_ORIGIN, kind: 'class', name };
+}

package/dist/v1/schema/validation/policy/references.js

@@ -1,7 +1,9 @@
 import { branchesOf, isConnected, targetMode } from '../../../language/policy/analysis/branches.js';
+import { policyVariableClass } from '../../../language/policy/model/policy.js';
 import { normalizePolicyExpression, normalizePolicyPattern, } from '../../../language/policy/normalization/normalize.js';
 import { MAX_REPEAT, MAX_VARIABLES } from './budgets.js';
 import { escapePointer } from './context.js';
+import { referenceContracts } from './objects.js';
 export function validatePolicyReferences(context) {
     for (const [name, declaration] of Object.entries(context.environment.candidate.policies)) {
         const pointer = `/policies/${escapePointer(name)}`;
@@ -34,15 +36,20 @@ function validateMatch(context, name, pattern, pointer) {
     for (const [index, branch] of branches.entries()) {
         const mode = targetMode(branch);
         if (mode === undefined) {
-            context.add('PL_TARGET', `${pointer}/match`, `Normalized branch ${index} must use object or both source and target, without mixing target modes.`);
+            context.add('PL_TARGET', `${pointer}/match`, `Normalized branch ${index} must use object or at least one of source and target, without mixing target modes.`);
             continue;
         }
         if (!isConnected(branch)) {
-            context.add('PL_CONNECTIVITY', `${pointer}/match`, `Normalized ${mode} branch ${index} does not connect subject, its target terms, and every scoped term.`);
+            context.add('PL_CONNECTIVITY', `${pointer}/match`, `Normalized ${mode} branch ${index} does not connect subject, every referenced protected term, and every scoped term.`);
         }
     }
 }
 function validatePatternNode(context, pattern, pointer, scope, declarations, uses) {
+    if ('sameNode' in pattern) {
+        validateTerm(context, pattern.sameNode.left, `${pointer}/sameNode/left`, scope, uses);
+        validateTerm(context, pattern.sameNode.right, `${pointer}/sameNode/right`, scope, uses);
+        return;
+    }
     if (isEdge(pattern)) {
         context.resolveEdge(pattern.class, `${pointer}/class`);
         validateTerm(context, pattern.source, `${pointer}/source`, scope, uses);
@@ -71,13 +78,16 @@ function validatePatternNode(context, pattern, pointer, scope, declarations, use
                 context.add('PL_VARIABLE_SCOPE', `${declarationPointer}/variable/id`, `Variable ${id} is declared more than once; variable IDs are globally unique.`);
             }
             else {
-                declarations.set(id, { ref: node.class, pointer: declarationPointer });
+                declarations.set(id, { pointer: declarationPointer });
             }
             if (nested.has(id)) {
                 context.add('PL_VARIABLE_SCOPE', `${declarationPointer}/variable/id`, `Variable ${id} shadows an enclosing variable.`);
             }
             nested.add(id);
-            context.resolveNodeClass(node.class, `${declarationPointer}/class`);
+            const classRef = policyVariableClass(node);
+            if (classRef !== undefined) {
+                context.resolveNodeClass(classRef, `${declarationPointer}/${'class' in node ? 'class' : 'selector/class'}`);
+            }
         }
         validatePatternNode(context, pattern.exists.where, `${pointer}/exists/where`, nested, declarations, uses);
         return;
@@ -89,6 +99,8 @@ function validatePatternNode(context, pattern, pointer, scope, declarations, use
     values.forEach((child, index) => validatePatternNode(context, child, `${pointer}/${key}/${index}`, scope, declarations, uses));
 }
 function validateTerm(context, term, pointer, scope, uses) {
+    if (term.kind === 'ref')
+        referenceContracts(context, term.ref, pointer);
     if (term.kind === 'variable') {
         if (!scope.has(term.id)) {
             context.add('PL_VARIABLE_SCOPE', pointer, `Variable ${term.id} is free, escaped, or outside its defining exists scope.`);

package/dist/v1/schema/validation/policy/typing.d.ts

@@ -12,6 +12,8 @@ export declare class PolicyTyping {
     constructor(context: PolicyValidationContext);
     validatePolicies(): void;
     policyAccepts(name: string, object: ObjectContract): boolean;
+    /** Whether each normalized branch of the Policy is typed for an object of this contract. */
+    policyBranchTyping(name: string, object: ObjectContract): readonly boolean[] | undefined;
     policyAcceptsEdge(name: string, source: ObjectContract, target: ObjectContract): boolean;
     concreteEndpointClasses(accepts: readonly ClassRef[]): readonly ClassRef[];
     endpointsOverlap(left: readonly ClassRef[], right: readonly ClassRef[]): boolean;

package/dist/v1/schema/validation/policy/typing.js

@@ -2,8 +2,16 @@ import { definitionRefIndex } from '../../../addressing/ordering.js';
 import { branchesOf, branchProduct, capBranches, targetMode, termKey, } from '../../../language/policy/analysis/branches.js';
 import { MAX_REPEAT } from './budgets.js';
 import { escapePointer } from './context.js';
+import { referenceContracts } from './objects.js';
 export class PolicyTyping {
     context;
+    // Expanded branches of each named Policy, cached by node identity. A Policy's expansion is reused
+    // across every composition path that reaches it (and across every use site and object contract,
+    // none of which the expansion depends on), so a shared-child composition DAG is expanded in work
+    // linear in the number of Policies instead of enumerating every path. The expansion result is
+    // independent of the reaching path up to the opaque term-namespace labels, which only ever
+    // disambiguate variables within one branch and leave targetMode and branch typing unchanged.
+    #expansions = new Map();
     constructor(context) {
         this.context = context;
     }
@@ -16,7 +24,7 @@ export class PolicyTyping {
                 const mode = targetMode(branch);
                 if (mode === undefined) {
                     if (!('match' in this.context.environment.candidate.policies[name].expression)) {
-                        this.context.add('PL_TARGET', `/policies/${escapePointer(name)}`, `Expanded normalized branch ${index} must use object or both source and target, without mixing target modes.`);
+                        this.context.add('PL_TARGET', `/policies/${escapePointer(name)}`, `Expanded normalized branch ${index} must use object or at least one of source and target, without mixing target modes.`);
                     }
                     continue;
                 }
@@ -34,9 +42,13 @@ export class PolicyTyping {
         }
     }
     policyAccepts(name, object) {
+        return this.policyBranchTyping(name, object)?.every(Boolean) ?? false;
+    }
+    /** Whether each normalized branch of the Policy is typed for an object of this contract. */
+    policyBranchTyping(name, object) {
         const branches = this.#expandedBranches(name, new Set(), `$use:${name}`);
         const use = { kind: 'object', object };
-        return branches !== undefined && branches.every((branch) => this.#branchIsTyped(branch, use));
+        return branches?.map((branch) => this.#branchIsTyped(branch, use));
     }
     policyAcceptsEdge(name, source, target) {
         const branches = this.#expandedBranches(name, new Set(), `$edge-use:${name}`);
@@ -54,6 +66,14 @@ export class PolicyTyping {
     #expandedBranches(name, visiting, namespace) {
         if (visiting.has(name))
             return undefined;
+        const cached = this.#expansions.get(name);
+        if (cached !== undefined || this.#expansions.has(name))
+            return cached;
+        const expanded = this.#expandDeclaration(name, visiting, namespace);
+        this.#expansions.set(name, expanded);
+        return expanded;
+    }
+    #expandDeclaration(name, visiting, namespace) {
         const declaration = this.context.normalized.get(name);
         if (declaration === undefined)
             return undefined;
@@ -83,11 +103,15 @@ export class PolicyTyping {
         const terms = new Set(use.kind === 'object' ? ['subject', 'object'] : ['subject', 'source', 'target']);
         for (const key of branch.variables.keys())
             terms.add(key);
+        for (const key of branch.terms.keys())
+            terms.add(key);
         for (const edge of branch.edges) {
             terms.add(termKey(edge.pattern.source, edge.namespace));
             terms.add(termKey(edge.pattern.target, edge.namespace));
         }
         const union = new UnionFind(terms);
+        for (const [left, right] of branch.equalities)
+            union.join(left, right);
         for (const variant of variants) {
             for (const [left, right] of variant.equalities)
                 union.join(left, right);
@@ -136,11 +160,19 @@ export class PolicyTyping {
             }
             return candidates;
         }
-        const exact = this.#exactInitial(term, branch);
-        return exact === undefined ? [] : this.#applyExact(candidates, exact);
-    }
-    #exactInitial(term, branch) {
-        return branch.variables.get(term);
+        const referenced = branch.terms.get(term);
+        if (referenced?.kind === 'ref') {
+            const contract = referenceContracts(this.context, referenced.ref, '/policies')?.[0];
+            return contract?.kind === 'exact' ? this.#applyExact(candidates, contract.ref) : [];
+        }
+        const selector = branch.variables.get(term);
+        if (selector === undefined)
+            return [];
+        if (selector.kind === 'exact')
+            return this.#applyExact(candidates, selector.class);
+        if (selector.kind === 'any')
+            return candidates;
+        return this.#applyRequirement(candidates, selector.class);
     }
     #applyExact(candidates, exact) {
         const result = [];
@@ -162,6 +194,22 @@ export class PolicyTyping {
                 .filter((ref) => candidate.requirements.every((required) => this.context.classExtends(ref, required)))
                 .map((ref) => ({ kind: 'exact', ref }))));
     }
+    #applyRequirement(candidates, required) {
+        const result = [];
+        for (const candidate of candidates) {
+            if (candidate.kind === 'exact') {
+                if (this.context.classExtends(candidate.ref, required))
+                    result.push(candidate);
+            }
+            else {
+                result.push({
+                    kind: 'open',
+                    requirements: uniqueClasses([...candidate.requirements, required]),
+                });
+            }
+        }
+        return uniqueCandidates(result);
+    }
     #applyEndpoint(candidates, accepts) {
         const result = [];
         for (const candidate of candidates) {

package/dist/v1/schema/validation/policy/uses.js

@@ -1,40 +1,48 @@
 import { Key } from '../../../addressing/index.js';
 import { definitionRefIndex } from '../../../addressing/ordering.js';
+import { isBinaryInput } from '../../../language/callable/model/callable.js';
+import { admittedCheckClasses, neverAdmittedClasses, } from '../../../language/policy/analysis/checks.js';
+import { checksNameTheCaller, isClassRuleChecks } from '../../../language/policy/model/policy.js';
 import { normalizePolicyChecks } from '../../../language/policy/normalization/normalize.js';
 import { GRAPH_NODE_PATH_SCHEMA_ID } from '../../../language/value/syntax/node-path/schema.js';
 import { MAX_BRANCHES, MAX_CHECK_DEPTH, MAX_CHECK_LEAVES, measureChecks } from './budgets.js';
 import { escapePointer } from './context.js';
+import { referenceContracts } from './objects.js';
 import { contractOfNodeDefinition } from './typing.js';
 const formatDefinitionRef = Key.of;
-const KERNEL_ORIGIN = 'kernel.astrale.ai';
-const PROJECTION_CLASS = nodeClassRef('Class');
-const PROJECTION_FUNCTION = nodeClassRef('Function');
-const PROJECTION_POLICY = nodeClassRef('Policy');
-const PROJECTION_VIEW = nodeClassRef('View');
+/** How a refusal names the checks of each site and the contract of their objects. */
+const SITE = {
+    callable: { checks: 'Callable checks', objects: 'the callable object contract' },
+    class: { checks: 'Class rule checks', objects: 'the Class rule object contract' },
+};
 export function validateReadUses(context, typing) {
-    for (const [name, declaration] of Object.entries(context.environment.candidate.classes)) {
-        if (declaration.kind !== 'node' || declaration.policies.read === undefined) {
-            continue;
-        }
-        const pointer = `/classes/${escapePointer(name)}/policies/read`;
-        const ref = declaration.policies.read;
-        if (!context.resolvePolicy(ref, pointer))
-            continue;
-        const object = {
-            kind: 'exact',
-            ref: { origin: context.environment.candidate.origin, kind: 'class', name },
-        };
-        if (!typing.policyAccepts(ref.name, object)) {
-            context.add('PL_USE', pointer, `${formatDefinitionRef(ref)} is not valid for every normalized branch of protected Class ${name}.`, formatDefinitionRef(ref));
-        }
-    }
+    validateClassPolicyUses(context, typing, 'read');
 }
 export function validateTraverseUses(context, typing) {
+    validateClassPolicyUses(context, typing, 'traverse');
+}
+function validateClassPolicyUses(context, typing, operation) {
     for (const [name, declaration] of Object.entries(context.environment.candidate.classes)) {
-        const ref = declaration.policies.traverse;
-        if (ref === undefined)
+        const ref = declaration.policies[operation];
+        if (typeof ref !== 'object')
+            continue;
+        const pointer = `/classes/${escapePointer(name)}/policies/${operation}`;
+        if (isClassRuleChecks(ref)) {
+            // A rule lifts the Class ceiling the way a named Policy does, so, as a Policy connects its
+            // subject, each way the rule holds must pass through a check of the caller.
+            if (!checksNameTheCaller(ref)) {
+                context.add('PL_CONNECTIVITY', pointer, `Every branch of the ${operation} rule of Node Class ${name} must check a Policy: sameNode alone names no caller.`);
+            }
+            // Structure admits Policy checks only on a Node Class: `self` is the observed exact Class.
+            validateChecks(context, typing, ref, {
+                site: 'class',
+                pointer,
+                input: {},
+                receiver: { origin: context.environment.candidate.origin, kind: 'class', name },
+                instanceMethod: true,
+            });
             continue;
-        const pointer = `/classes/${escapePointer(name)}/policies/traverse`;
+        }
         if (!context.resolvePolicy(ref, pointer))
             continue;
         if (declaration.kind === 'node') {
@@ -42,9 +50,9 @@ export function validateTraverseUses(context, typing) {
                 kind: 'exact',
                 ref: { origin: context.environment.candidate.origin, kind: 'class', name },
             };
-            if (!typing.policyAccepts(ref.name, object)) {
-                context.add('PL_USE', pointer, `${formatDefinitionRef(ref)} is not valid for every normalized branch of traversed Node Class ${name}.`, formatDefinitionRef(ref));
-            }
+            if (typing.policyAccepts(ref.name, object))
+                continue;
+            context.add('PL_USE', pointer, `${formatDefinitionRef(ref)} is not valid for every normalized branch of ${operation} Node Class ${name}.`, formatDefinitionRef(ref));
             continue;
         }
         const endpoints = declaration.orientation === 'directed'
@@ -52,29 +60,20 @@ export function validateTraverseUses(context, typing) {
             : declaration.endpoints;
         const sources = typing.concreteEndpointClasses(endpoints[0].accepts);
         const targets = typing.concreteEndpointClasses(endpoints[1].accepts);
-        let accepted = true;
-        for (const source of sources) {
-            for (const target of targets) {
-                if (!typing.policyAcceptsEdge(ref.name, { kind: 'exact', ref: source }, { kind: 'exact', ref: target })) {
-                    accepted = false;
-                    break;
-                }
-            }
-            if (!accepted)
-                break;
-        }
+        const accepted = sources.every((source) => targets.every((target) => typing.policyAcceptsEdge(ref.name, { kind: 'exact', ref: source }, { kind: 'exact', ref: target })));
         if (!accepted) {
-            context.add('PL_USE', pointer, `${formatDefinitionRef(ref)} is not valid for every concrete source/target pair of traversed Edge Class ${name}.`, formatDefinitionRef(ref));
+            context.add('PL_USE', pointer, `${formatDefinitionRef(ref)} is not valid for every concrete source/target pair of ${operation} Edge Class ${name}.`, formatDefinitionRef(ref));
         }
     }
 }
 export function validateCallableUses(context, typing) {
     for (const [name, declaration] of Object.entries(context.environment.candidate.functions)) {
-        if (declaration.policy === undefined)
+        if (typeof declaration.policy !== 'object')
             continue;
         validateChecks(context, typing, declaration.policy, {
+            site: 'callable',
             pointer: `/functions/${escapePointer(name)}/policy`,
-            input: declaration.input,
+            input: isBinaryInput(declaration.input) ? declaration.input.metadata : declaration.input,
             instanceMethod: false,
         });
     }
@@ -91,7 +90,7 @@ export function validateCallableUses(context, typing) {
 function validateDeclaredMethods(context, typing, namespace, name, methods, receiver) {
     const ownerAnalysis = context.analysis.definitions.get(definitionRefIndex(receiver));
     for (const [methodName, method] of Object.entries(methods)) {
-        if (method.policy === undefined)
+        if (typeof method.policy !== 'object')
             continue;
         // Definition analysis is the authority for the effective callable. A
         // missing entry is already a definition diagnostic, so avoid inventing a
@@ -99,6 +98,7 @@ function validateDeclaredMethods(context, typing, namespace, name, methods, rece
         if (ownerAnalysis !== undefined && !ownerAnalysis.methods.has(methodName))
             continue;
         validateChecks(context, typing, method.policy, {
+            site: 'callable',
             pointer: `/${namespace}/${escapePointer(name)}/methods/${escapePointer(methodName)}/policy`,
             input: method.input,
             receiver,
@@ -112,11 +112,27 @@ function validateChecks(validation, typing, expression, context) {
     if (measure.depth > MAX_CHECK_DEPTH ||
         measure.branches > MAX_BRANCHES ||
         measure.leaves > MAX_CHECK_LEAVES) {
-        validation.add('PL_BUDGET', context.pointer, `Callable checks require depth <= ${MAX_CHECK_DEPTH}, branches <= ${MAX_BRANCHES}, and leaves <= ${MAX_CHECK_LEAVES}; got ${measure.depth}, ${measure.branches}, ${measure.leaves}.`);
+        validation.add('PL_BUDGET', context.pointer, `${SITE[context.site].checks} require depth <= ${MAX_CHECK_DEPTH}, branches <= ${MAX_BRANCHES}, and leaves <= ${MAX_CHECK_LEAVES}; got ${measure.depth}, ${measure.branches}, ${measure.leaves}.`);
+    }
+    const leaves = new Map();
+    visitChecks(validation, typing, normalized, context, context.pointer, leaves);
+    for (const [object, className] of neverAdmittedClasses(normalized, leaves)) {
+        validation.add('PL_USE', context.pointer, `${SITE[context.site].checks} can never admit ${object} of Class ${className}.`, className);
     }
-    visitChecks(validation, typing, normalized, context, context.pointer);
 }
-function visitChecks(validation, typing, expression, context, pointer) {
+function visitChecks(validation, typing, expression, context, pointer, leaves) {
+    if ('sameNode' in expression) {
+        for (const [side, object] of Object.entries(expression.sameNode)) {
+            const objectPointer = `${pointer}/sameNode/${side}`;
+            if (object.kind === 'self')
+                selfContracts(validation, context, objectPointer);
+            else if (object.kind === 'input')
+                inputContracts(validation, context, object.field, objectPointer);
+            else
+                referenceContracts(validation, object.ref, objectPointer);
+        }
+        return;
+    }
     if ('check' in expression) {
         if (!validation.resolvePolicy(expression.check, `${pointer}/check`))
             return;
@@ -128,65 +144,26 @@ function visitChecks(validation, typing, expression, context, pointer) {
                 : referenceContracts(validation, expression.object.ref, objectPointer);
         if (contracts === undefined)
             return;
-        for (const contract of contracts) {
-            if (!typing.policyAccepts(expression.check.name, contract)) {
-                validation.add('PL_USE', pointer, `${formatDefinitionRef(expression.check)} is incompatible with the callable object contract.`, formatDefinitionRef(expression.check));
-                break;
-            }
+        const typings = new Map(contracts.map((contract) => [
+            contractName(contract),
+            typing.policyBranchTyping(expression.check.name, contract),
+        ]));
+        const admitted = admittedCheckClasses(typings);
+        if (admitted === undefined) {
+            validation.add('PL_USE', pointer, `${formatDefinitionRef(expression.check)} is incompatible with ${SITE[context.site].objects}.`, formatDefinitionRef(expression.check));
+            return;
         }
+        leaves.set(expression, { accepted: [...typings.keys()], admitted });
         return;
     }
     const { key, values } = checkOperands(expression);
     if (values.length === 0) {
         validation.add('PL_COMPOSITION', `${pointer}/${key}`, `${key} must be non-empty.`);
     }
-    values.forEach((child, index) => visitChecks(validation, typing, child, context, `${pointer}/${key}/${index}`));
+    values.forEach((child, index) => visitChecks(validation, typing, child, context, `${pointer}/${key}/${index}`, leaves));
 }
-function referenceContracts(validation, ref, pointer) {
-    const candidate = validation.environment.candidate;
-    if (ref.origin !== candidate.origin)
-        return invalidPolicyObjectRef(validation, ref, pointer);
-    switch (ref.kind) {
-        case 'class': {
-            const resolved = validation.environment.resolve(ref);
-            return resolved?.ref.kind === ref.kind
-                ? [{ kind: 'exact', ref: PROJECTION_CLASS }]
-                : invalidPolicyObjectRef(validation, ref, pointer);
-        }
-        case 'function':
-            return candidate.functions[ref.name] === undefined
-                ? invalidPolicyObjectRef(validation, ref, pointer)
-                : [{ kind: 'exact', ref: PROJECTION_FUNCTION }];
-        case 'policy':
-            return candidate.policies[ref.name] === undefined
-                ? invalidPolicyObjectRef(validation, ref, pointer)
-                : [{ kind: 'exact', ref: PROJECTION_POLICY }];
-        case 'view':
-            return candidate.views[ref.name] === undefined
-                ? invalidPolicyObjectRef(validation, ref, pointer)
-                : [{ kind: 'exact', ref: PROJECTION_VIEW }];
-        case 'core': {
-            const node = candidate.core.nodes[ref.name];
-            if (node === undefined)
-                return invalidPolicyObjectRef(validation, ref, pointer);
-            const resolved = validation.environment.resolve(node.class);
-            const analyzed = validation.analysis.definitions.get(definitionRefIndex(node.class));
-            // Core validation owns invalid Core Class diagnostics. Avoid adding Policy noise for
-            // a Node that cannot materialize in the first place.
-            if (node.class.origin !== candidate.origin ||
-                resolved?.ref.kind !== 'class' ||
-                resolved.kind !== 'node' ||
-                analyzed === undefined) {
-                return undefined;
-            }
-            return [contractOfNodeDefinition(node.class)];
-        }
-    }
-    return invalidPolicyObjectRef(validation, ref, pointer);
-}
-function invalidPolicyObjectRef(validation, ref, pointer) {
-    validation.add('PL_REF', `${pointer}/ref`, `${formatDefinitionRef(ref)} is not an exact local projected Policy object.`, formatDefinitionRef(ref));
-    return undefined;
+function contractName(contract) {
+    return contract.kind === 'exact' ? formatDefinitionRef(contract.ref) : 'default';
 }
 function selfContracts(validation, context, pointer) {
     if (!context.instanceMethod || context.receiver === undefined) {
@@ -253,6 +230,3 @@ function checkOperands(value) {
         ? { key: 'allOf', values: value.allOf }
         : { key: 'anyOf', values: value.anyOf };
 }
-function nodeClassRef(name) {
-    return { origin: KERNEL_ORIGIN, kind: 'class', name };
-}

package/dist/v1/schema/validation/value-api.d.ts

@@ -4,6 +4,8 @@ import type { JsonSchema } from '../../language/value/model/schema.js';
 import type { OrderingKind } from '../../language/value/ordering.js';
 import type { DomainSchema } from '../model/schema.js';
 export { VALUE_SCHEMA_DIALECT as DIALECT, VALUE_SCHEMA_VOCABULARY as VOCABULARY, } from '../../language/value/model/schema.js';
+export { blob, isBlobValueSchema as isBlob } from '../../language/value/model/blob.js';
+export type { BlobOptions, BlobReceipt, BlobRef, BlobSchema, } from '../../language/value/model/blob.js';
 export type { JsonSchema as Schema, JsonSchemaObject as SchemaObject, PathAnnotation, PropertyObjectSchema as PropertySchema, ValueSchemaContext as Context, } from '../../language/value/model/schema.js';
 export { instant } from '../../language/value/model/instant.js';
 export type { OrderingKind } from '../../language/value/ordering.js';

package/dist/v1/schema/validation/value-api.js

@@ -4,6 +4,7 @@ import { classifyOrdering as classifyOrderingWithRegistry } from '../../language
 import { createDomainValueSchemaRegistry } from '../resolution/value.registry.js';
 const registries = new WeakMap();
 export { VALUE_SCHEMA_DIALECT as DIALECT, VALUE_SCHEMA_VOCABULARY as VOCABULARY, } from '../../language/value/model/schema.js';
+export { blob, isBlobValueSchema as isBlob } from '../../language/value/model/blob.js';
 export { instant } from '../../language/value/model/instant.js';
 /** Validate one complete JSON value under the exact accepted schema that owns the contract. */
 export function validate(owner, contract, input, pointer = '') {

package/dist/v1/schema/validation/value.js

@@ -1,3 +1,4 @@
+import { isBinaryInput } from '../../language/callable/model/callable.js';
 import { validateValueSchema } from '../../language/value/profile/validate.js';
 import { diagnostic } from '../diagnostic.js';
 export function validateEmbeddedValueSchemas(schema, registry) {
@@ -21,7 +22,12 @@ function validateDefinition(declaration, pointer, registry, diagnostics) {
     }
 }
 function validateCallable(declaration, pointer, registry, diagnostics) {
-    validate(declaration.input, 'callable-input', `${pointer}/input`, registry, diagnostics);
+    if (isBinaryInput(declaration.input)) {
+        validate(declaration.input.metadata, 'callable-input', `${pointer}/input/metadata`, registry, diagnostics);
+    }
+    else {
+        validate(declaration.input, 'callable-input', `${pointer}/input`, registry, diagnostics);
+    }
     if (declaration.output.mode === 'value') {
         validate(declaration.output.schema, 'callable-output', `${pointer}/output/schema`, registry, diagnostics);
     }

package/dist/v1/schema/validation/view.js

@@ -9,21 +9,26 @@ export function validateViews(environment) {
         if (!sameRef(view.ref, ref)) {
             diagnostics.push(diagnostic('DV_REF_RESOLVES', `${pointer}/ref`, `View ref must be exactly ${formatDefinitionRef(ref)}.`, formatDefinitionRef(view.ref)));
         }
-        if (view.target.kind === 'definition') {
-            view.target.definitions.forEach((ref, index) => validateDefinitionTarget(environment, ref, `${pointer}/target/definitions/${index}`, diagnostics));
-        }
     }
+    validateEntrypoint(environment, diagnostics);
     return Object.freeze(diagnostics);
 }
+/** The entrypoint names one View this Domain declares for itself. */
+function validateEntrypoint(environment, diagnostics) {
+    const { entrypoint, origin, views } = environment.candidate;
+    if (entrypoint === undefined)
+        return;
+    // An own member only: a name such as `constructor` must not resolve on the prototype.
+    const view = entrypoint.origin === origin && Object.hasOwn(views, entrypoint.name)
+        ? views[entrypoint.name]
+        : undefined;
+    if (view === undefined) {
+        diagnostics.push(diagnostic('DV_ENTRYPOINT', '/entrypoint', `Entrypoint ${formatDefinitionRef(entrypoint)} is not a Domain-targeted View of ${origin}.`, formatDefinitionRef(entrypoint)));
+    }
+}
 function sameRef(left, right) {
     return left.origin === right.origin && left.kind === right.kind && left.name === right.name;
 }
-function validateDefinitionTarget(environment, ref, pointer, diagnostics) {
-    const target = environment.resolve(ref);
-    if (target === undefined || target.ref.kind !== 'class' || target.kind !== 'node') {
-        diagnostics.push(diagnostic('DV_VIEW_TARGET', pointer, `Definition target ${formatDefinitionRef(ref)} does not resolve to a Node Class.`, formatDefinitionRef(ref)));
-    }
-}
 function escapePointer(value) {
     return value.replaceAll('~', '~0').replaceAll('/', '~1');
 }

package/dist/value/accept.d.ts

@@ -6,3 +6,12 @@ import { type Options } from './limits.js';
  * Every source property is obtained from one descriptor snapshot. Accessors are never invoked.
  */
 export declare function accept(input: unknown, options?: Options): Value;
+/** Admit a canonically byte-bounded immutable snapshot; owned subtrees may be shared. */
+export declare function acceptImmutable(input: unknown, options?: Options): Value;
+/** Admit a read-only snapshot, sharing owned immutable subtrees without freezing new wrappers. */
+export declare function acceptForRead(input: unknown, options?: Options): Value;
+/**
+ * Private PropertyValues owner seam. Retain immediate recursive values, not the enclosing
+ * dictionary: its canonical coordinates are re-admitted by the Property owner on every use.
+ */
+export declare function acceptPropertyRoot(input: unknown): Value;