@astrale-os/kernel-dsl 1.0.0-beta.1 → 1.0.0-beta.11

package/dist/v1/language/value/profile/canonicalize.js

@@ -7,10 +7,11 @@ const TYPE_RANK = new Map(TYPE_ORDER.map((name, index) => [name, index]));
 const encoder = new TextEncoder();
 /** Canonicalizes syntax without rewriting the schema's algebra. Validate first. */
 export function canonicalizeValueSchema(schema, context, registry) {
+    void context;
     void registry;
-    return canonicalizeSchema(schema, true, context);
+    return canonicalizeSchema(schema, true);
 }
-function canonicalizeSchema(schema, root, context) {
+function canonicalizeSchema(schema, root) {
     if (typeof schema === 'boolean')
         return schema;
     const result = {};
@@ -39,17 +40,17 @@ function canonicalizeSchema(schema, root, context) {
             result[keyword] = canonicalizePathAnnotation(value);
         }
         else if (SCHEMA_SINGLE_KEYWORDS.has(keyword) && isJsonSchema(value)) {
-            result[keyword] = canonicalizeSchema(value, false, context);
+            result[keyword] = canonicalizeSchema(value, false);
         }
         else if (SCHEMA_ARRAY_KEYWORDS.has(keyword) && Array.isArray(value)) {
-            result[keyword] = value.map((entry) => isJsonSchema(entry) ? canonicalizeSchema(entry, false, context) : canonicalizeJson(entry));
+            result[keyword] = value.map((entry) => isJsonSchema(entry) ? canonicalizeSchema(entry, false) : canonicalizeJson(entry));
         }
         else if (SCHEMA_MAP_KEYWORDS.has(keyword) && isJsonObject(value)) {
             const schemas = {};
             for (const name of Object.keys(value).sort()) {
                 const entry = value[name];
                 schemas[name] = isJsonSchema(entry)
-                    ? canonicalizeSchema(entry, false, context)
+                    ? canonicalizeSchema(entry, false)
                     : canonicalizeJson(entry);
             }
             result[keyword] = schemas;

package/dist/v1/schema/compatibility/api.d.ts

@@ -1,3 +1,4 @@
 export { compare, compareMeaning, compareStructure } from './compare.js';
+export { closedParents } from './extension.js';
 export { requiredBump } from './versioning/index.js';
 export type { Analysis, Assessment, Bump, Comparison, ComparisonEntry, ComparisonEvidence, ComparisonRequest, ComparisonScope, Facet, Fingerprint, MeaningComparison, Observation, RequiredBump, SchemaIdentity, StructureComparison, Subject, Usage, VersionChange, } from './model.js';

package/dist/v1/schema/compatibility/api.js

@@ -1,2 +1,3 @@
 export { compare, compareMeaning, compareStructure } from './compare.js';
+export { closedParents } from './extension.js';
 export { requiredBump } from './versioning/index.js';

package/dist/v1/schema/compatibility/comparators/classes.d.ts

@@ -1,5 +1,6 @@
 import type { Value as JsonValue } from '@astrale-os/kernel-dsl/value';
 import type { Key as SemanticKey } from '../../../addressing/index.js';
+import type { Inheritance } from '../../../language/class/model/class.js';
 import type { EffectiveField } from '../../analysis/class.js';
 import type { Context } from '../context.js';
 import type { ClassCoordinate } from '../coordinate.js';
@@ -10,10 +11,12 @@ interface ClassRequirement {
     readonly ancestors: readonly SemanticKey[];
 }
 /**
- * A reference needs the Class to exist with its kind, abstractness and orientation; inheritance
- * additionally takes on the source ancestors, class policies, data contract and, for an Edge, the
- * endpoint and constraint contracts. A target projected onto a source requirement keeps only the
- * ancestors the source named, so a superset satisfies it while a removal changes it.
+ * A reference needs the Class to exist with its kind, abstractness and orientation, and, for an
+ * Edge, the uniqueness tuples that cover it, its ancestors' included: a dependent may name one of
+ * its Edges by any of them. Inheritance additionally takes on the source ancestors, class
+ * policies, data contract and, for an Edge, the endpoint and constraint contracts. A target
+ * projected onto a source requirement keeps only the ancestors the source named, so a superset
+ * satisfies it while a removal changes it.
  */
 export declare function classMeaning(context: Context, coordinate: ClassCoordinate, level: DependencyMeaningLevel, onto?: ClassRequirement): {
     readonly meaning: JsonValue;
@@ -38,6 +41,8 @@ export declare function compareLostProperties({ pair, report, }: {
     readonly pair: SubjectPair;
     readonly report: Report;
 }): void;
+/** Which Classes may extend a Class, as an extension facet compares it. */
+export declare function inheritanceMeaning(inheritance: Inheritance): JsonValue;
 /** Newly required data is an obligation even though it was absent from the source footprint. */
 export declare function compareAddedProperties({ context, pair, report, }: {
     readonly context: ComparisonContext;

package/dist/v1/schema/compatibility/comparators/classes.js

@@ -1,4 +1,5 @@
 import { compareUnicode } from '../../../addressing/ordering.js';
+import { compareEdgeUniqueTuples, coveringEdgeUniqueTuples, } from '../../../language/class/unique.js';
 import { isClassRuleChecks } from '../../../language/policy/model/policy.js';
 import { deepFreeze } from '../../canonical/freeze.js';
 import { effectiveDefinition } from '../context.js';
@@ -8,10 +9,12 @@ import { CLASS_FIELDS, PROPERTY_FIELDS, fieldsOf } from '../fields.js';
 import { usageOf } from '../references.js';
 import { semanticValueSchema } from './values.js';
 /**
- * A reference needs the Class to exist with its kind, abstractness and orientation; inheritance
- * additionally takes on the source ancestors, class policies, data contract and, for an Edge, the
- * endpoint and constraint contracts. A target projected onto a source requirement keeps only the
- * ancestors the source named, so a superset satisfies it while a removal changes it.
+ * A reference needs the Class to exist with its kind, abstractness and orientation, and, for an
+ * Edge, the uniqueness tuples that cover it, its ancestors' included: a dependent may name one of
+ * its Edges by any of them. Inheritance additionally takes on the source ancestors, class
+ * policies, data contract and, for an Edge, the endpoint and constraint contracts. A target
+ * projected onto a source requirement keeps only the ancestors the source named, so a superset
+ * satisfies it while a removal changes it.
  */
 export function classMeaning(context, coordinate, level, onto) {
     const owner = context.schemas.get(coordinate.ref.origin);
@@ -23,10 +26,12 @@ export function classMeaning(context, coordinate, level, onto) {
     const requirement = Object.freeze({
         ancestors,
     });
+    const covering = coveringTuples(context, declaration);
     const meaning = {
         coordinate: 'class',
         level: level,
         ...fieldsOf({ declaration, roles: CLASS_FIELDS, level }),
+        ...(covering.length === 0 ? {} : { unique: covering }),
         ...(level === 'inherit'
             ? {
                 extends: onto === undefined
@@ -109,6 +114,18 @@ function ancestorKeys(context, ref) {
     visit(ref);
     return [...seen].sort(compareUnicode);
 }
+/**
+ * The uniqueness tuples covering an Edge Class (`coveringEdgeUniqueTuples`): those it and each of
+ * its ancestors declare, each with the Class declaring it, whose extent it bounds, in Class then
+ * tuple order. A Node Class's own tuples stay its declared field.
+ */
+function coveringTuples(context, declaration) {
+    if (declaration.kind !== 'edge')
+        return [];
+    return [
+        ...coveringEdgeUniqueTuples(declaration, (ref) => context.schemas.get(ref.origin)?.classes[ref.name]),
+    ].sort((left, right) => compareUnicode(left.class, right.class) || compareEdgeUniqueTuples(left.fields, right.fields));
+}
 /**
  * A Class a dependent references or inherits keeps every effective Property it had, whichever
  * ancestor declares it. Each Property is compared on its owner, which still declares it when the
@@ -139,6 +156,10 @@ function propertyIdentities(identities) {
         properties: Object.fromEntries(identities.map((identity) => [identity, true])),
     });
 }
+/** Which Classes may extend a Class, as an extension facet compares it. */
+export function inheritanceMeaning(inheritance) {
+    return deepFreeze({ coordinate: 'class', inheritance });
+}
 /** Newly required data is an obligation even though it was absent from the source footprint. */
 export function compareAddedProperties({ context, pair, report, }) {
     if (pair.source?.kind !== 'class' || pair.target?.kind !== 'class')

package/dist/v1/schema/compatibility/comparators/index.d.ts

@@ -5,7 +5,7 @@ import type { ComparisonContext, SubjectPair } from '../scope.js';
 export declare function compareFacet({ context, pair, facet, }: {
     readonly context: ComparisonContext;
     readonly pair: SubjectPair;
-    readonly facet: Exclude<Facet, 'class.composition' | 'class.properties' | 'property.required'>;
+    readonly facet: Exclude<Facet, 'class.composition' | 'class.properties' | 'class.inheritance' | 'property.required'>;
 }): {
     readonly before?: Value;
     readonly after?: Value;

package/dist/v1/schema/compatibility/extension.d.ts

@@ -0,0 +1,11 @@
+import type { Key } from '../../addressing/index.js';
+import type { DomainSchema } from '../model/schema.js';
+/**
+ * The Classes of the target's origin that a Class of the dependent extends and the target does not
+ * open to it, as Keys in order (DM-CLASS-INHERITANCE). A parent the target no longer declares is
+ * not closed: losing it is an ancestry change.
+ */
+export declare function closedParents({ dependent, target, }: {
+    readonly dependent: DomainSchema;
+    readonly target: DomainSchema;
+}): readonly Key[];

package/dist/v1/schema/compatibility/extension.js

@@ -0,0 +1,22 @@
+import { compareUnicode } from '../../addressing/ordering.js';
+import { admitsForeignSubclass } from '../../language/class/inheritance.js';
+import { keyForDefinitionRef } from './coordinate.js';
+/**
+ * The Classes of the target's origin that a Class of the dependent extends and the target does not
+ * open to it, as Keys in order (DM-CLASS-INHERITANCE). A parent the target no longer declares is
+ * not closed: losing it is an ancestry change.
+ */
+export function closedParents({ dependent, target, }) {
+    const closed = new Set();
+    if (dependent.origin === target.origin)
+        return [];
+    for (const declaration of Object.values(dependent.classes))
+        for (const parent of declaration.extends) {
+            if (parent.origin !== target.origin)
+                continue;
+            const declared = target.classes[parent.name];
+            if (declared !== undefined && !admitsForeignSubclass(declared))
+                closed.add(keyForDefinitionRef(parent));
+        }
+    return Object.freeze([...closed].sort(compareUnicode));
+}

package/dist/v1/schema/compatibility/fields.d.ts

@@ -15,7 +15,7 @@ export type DependencyMeaningLevel = 'reference' | 'inherit';
  * compile until it is classified, so meaning can only be narrowed by an explicit decision.
  */
 export type FieldRole = 'always' | 'inherit' | 'members' | {
-    readonly excluded: 'identity' | 'annotation' | 'authorization' | 'presentation';
+    readonly excluded: 'identity' | 'annotation' | 'authorization' | 'extension' | 'presentation';
 };
 /** The coordinate Key already names the declaration; its `ref` is never repeated in the meaning. */
 export declare const CLASS_FIELDS: Readonly<{
@@ -24,12 +24,16 @@ export declare const CLASS_FIELDS: Readonly<{
     }>;
     kind: "always";
     abstract: "always";
+    inheritance: Readonly<{
+        excluded: 'extension';
+    }>;
     orientation: "always";
     extends: "inherit";
     policies: "inherit";
     data: "inherit";
     endpoints: "inherit";
     constraints: "inherit";
+    unique: "always";
     properties: "members";
     methods: "members";
     description: Readonly<{
@@ -50,9 +54,11 @@ export declare const PROPERTY_FIELDS: Readonly<{
     }>;
 }>;
 /**
- * The auth level and Policy check are decided by the Runtime at invocation, never compiled against.
- * The execution modifier decides what an invocation returns; an accepted Schema carries it only
- * when durable, so ordinary callables keep their meaning unchanged.
+ * The auth level, the Policy check and the admission age are authorization: decided by the Runtime
+ * at invocation, never compiled against. The admission age only bounds how old the admission a
+ * destination decides a call under may be. The execution modifier decides what an invocation
+ * returns; an accepted Schema carries it only when durable, so ordinary callables keep their meaning
+ * unchanged.
  */
 export declare const CALLABLE_FIELDS: Readonly<{
     ref: Readonly<{
@@ -63,6 +69,9 @@ export declare const CALLABLE_FIELDS: Readonly<{
     static: "always";
     abstract: "always";
     execution: "always";
+    admission: Readonly<{
+        excluded: 'authorization';
+    }>;
     auth: Readonly<{
         excluded: 'authorization';
     }>;
@@ -114,12 +123,16 @@ export declare const FIELD_ROLES: Readonly<{
         }>;
         kind: "always";
         abstract: "always";
+        inheritance: Readonly<{
+            excluded: 'extension';
+        }>;
         orientation: "always";
         extends: "inherit";
         policies: "inherit";
         data: "inherit";
         endpoints: "inherit";
         constraints: "inherit";
+        unique: "always";
         properties: "members";
         methods: "members";
         description: Readonly<{
@@ -148,6 +161,9 @@ export declare const FIELD_ROLES: Readonly<{
         static: "always";
         abstract: "always";
         execution: "always";
+        admission: Readonly<{
+            excluded: 'authorization';
+        }>;
         auth: Readonly<{
             excluded: 'authorization';
         }>;

package/dist/v1/schema/compatibility/fields.js

@@ -1,18 +1,25 @@
 const IDENTITY = Object.freeze({ excluded: 'identity' });
 const ANNOTATION = Object.freeze({ excluded: 'annotation' });
 const AUTHORIZATION = Object.freeze({ excluded: 'authorization' });
+/** Who may extend a Class is no meaning a dependent compiles against. */
+const EXTENSION = Object.freeze({ excluded: 'extension' });
 const PRESENTATION = Object.freeze({ excluded: 'presentation' });
 /** The coordinate Key already names the declaration; its `ref` is never repeated in the meaning. */
 export const CLASS_FIELDS = Object.freeze({
     ref: IDENTITY,
     kind: 'always',
     abstract: 'always',
+    inheritance: EXTENSION,
     orientation: 'always',
     extends: 'inherit',
     policies: 'inherit',
     data: 'inherit',
     endpoints: 'inherit',
     constraints: 'inherit',
+    // A uniqueness tuple bounds every write of the Classes it covers and what a step through them
+    // reaches, so every dependent that names the Class relies on it, not only one that extends it.
+    // The meaning holds every tuple covering the Class, an ancestor's included (`classMeaning`).
+    unique: 'always',
     properties: 'members',
     methods: 'members',
     description: ANNOTATION,
@@ -27,9 +34,11 @@ export const PROPERTY_FIELDS = Object.freeze({
     description: ANNOTATION,
 });
 /**
- * The auth level and Policy check are decided by the Runtime at invocation, never compiled against.
- * The execution modifier decides what an invocation returns; an accepted Schema carries it only
- * when durable, so ordinary callables keep their meaning unchanged.
+ * The auth level, the Policy check and the admission age are authorization: decided by the Runtime
+ * at invocation, never compiled against. The admission age only bounds how old the admission a
+ * destination decides a call under may be. The execution modifier decides what an invocation
+ * returns; an accepted Schema carries it only when durable, so ordinary callables keep their meaning
+ * unchanged.
  */
 export const CALLABLE_FIELDS = Object.freeze({
     ref: IDENTITY,
@@ -38,6 +47,7 @@ export const CALLABLE_FIELDS = Object.freeze({
     static: 'always',
     abstract: 'always',
     execution: 'always',
+    admission: AUTHORIZATION,
     auth: AUTHORIZATION,
     policy: AUTHORIZATION,
     description: ANNOTATION,

package/dist/v1/schema/compatibility/model.d.ts

@@ -17,6 +17,13 @@ export interface ComparisonRequest {
          * unresolvable or unsupported Key of the target origin, is rejected with DM_CAPABILITY_INVALID.
          */
         readonly capabilities?: readonly Key[];
+        /**
+         * `true` when the dependent already holds its binding to the target, as the installer holds
+         * one a Domain was installed with: the Classes of the target origin it extends are then not
+         * judged for inheritance (DM-CLASS-INHERITANCE). Otherwise each must be `'open'` in the
+         * target. It enters no evidence: a held comparison has the facts of a compatible judged one.
+         */
+        readonly held?: boolean;
     } | {
         readonly kind: 'members';
         readonly source: DomainSchema;
@@ -46,7 +53,7 @@ export interface Usage {
     readonly key?: Key;
     readonly relation: ReferenceSite | 'member' | 'abstract' | 'selection' | 'capability';
 }
-export type Facet = 'class.reference' | 'class.inherit' | 'class.composition' | 'class.properties' | 'class.endpoints' | 'property' | 'property.required' | 'method.existence' | 'method.object' | 'method.inheritance' | 'method.signature' | 'function.existence' | 'function.signature' | 'policy' | 'view' | 'core';
+export type Facet = 'class.reference' | 'class.inherit' | 'class.composition' | 'class.properties' | 'class.endpoints' | 'class.inheritance' | 'property' | 'property.required' | 'method.existence' | 'method.object' | 'method.inheritance' | 'method.signature' | 'function.existence' | 'function.signature' | 'policy' | 'view' | 'core';
 /** A fact about a compared facet, including unchanged facets. No admission decision is implied. */
 export interface Observation {
     readonly id: string;
@@ -81,8 +88,9 @@ export interface Assessment {
  * meaning evidence never records whether capabilities were declared. A referenced or inherited Class
  * that loses an effective Property (`class.properties`) raises structure to version 4 and meaning to
  * version 2, and structure is version 4 too when it records that a dependent Policy lost what it
- * relies on (`method.object`, `class.endpoints`). Those facts are recorded only on such a loss, so
- * every other comparison, every compatible one included, keeps its bytes.
+ * relies on (`method.object`, `class.endpoints`) or that a Class the dependent extends became final
+ * (`class.inheritance`). Those facts are recorded only on such a loss, so every other comparison,
+ * every compatible one included, keeps its bytes.
  */
 export interface ComparisonEvidence {
     readonly kind: 'structure' | 'meaning';

package/dist/v1/schema/compatibility/scope.d.ts

@@ -25,6 +25,8 @@ export interface ComparisonContext {
      * structure records them only when they fail, so a compatible comparison keeps its bytes.
      */
     readonly reliance: readonly Reference[];
+    /** Whether the dependent holds its binding to the target, so its extensions are not judged. */
+    readonly held: boolean;
     pair(coordinate: Coordinate): SubjectPair;
 }
 export declare function prepare(request: ComparisonRequest): ComparisonContext;

package/dist/v1/schema/compatibility/scope.js

@@ -42,6 +42,7 @@ export function prepare(request) {
         roots: [...rootReferences(dependent), ...capabilities],
         capabilities,
         reliance: policyReliance(dependent, source.origin),
+        held: scope.held === true,
     });
 }
 /**
@@ -63,9 +64,10 @@ export function selectMembers(source, target, keys) {
         })),
         capabilities: [],
         reliance: [],
+        held: false,
     });
 }
-function comparisonContext({ kind, source, target, dependent, before, roots, capabilities, reliance, }) {
+function comparisonContext({ kind, source, target, dependent, before, roots, capabilities, reliance, held, }) {
     resolve(target);
     const after = contextOf(target);
     const pairs = new Map();
@@ -78,6 +80,7 @@ function comparisonContext({ kind, source, target, dependent, before, roots, cap
         roots,
         capabilities,
         reliance,
+        held,
         scope: Object.freeze({
             kind,
             source: schemaIdentity(source),

package/dist/v1/schema/compatibility/structure/index.js

@@ -12,8 +12,9 @@ export function analyzeStructure(context) {
         ...result,
         compatible: result.assessments.every(({ satisfied }) => satisfied),
         // Each version adds one requirement policy and applies only when its fact is present: 3 a
-        // declared capability root, 4 a lost effective Property of a reached Class or a failed Policy
-        // reliance, facts recorded only when they fail. Without one, evidence keeps its version-2 bytes.
+        // declared capability root, 4 a lost effective Property of a reached Class, a failed Policy
+        // reliance or a refused extension, facts recorded only when they fail. Without one, evidence
+        // keeps its version-2 bytes.
         evidence: evidenceOf({
             kind: 'structure',
             version: recordsFailureOnlyFact(result.assessments)
@@ -27,13 +28,14 @@ export function analyzeStructure(context) {
 }
 /**
  * The facts structure records only when they fail: a referenced or inherited Class that lost an
- * effective Property, and what a dependent Policy relies on (a Method object, a matched Edge's
- * endpoints).
+ * effective Property, what a dependent Policy relies on (a Method object, a matched Edge's
+ * endpoints), and a Class the dependent extends that became final.
  */
 const FAILURE_ONLY_FACETS = new Set([
     'class.properties',
     'method.object',
     'class.endpoints',
+    'class.inheritance',
 ]);
 function recordsFailureOnlyFact(assessments) {
     return assessments.some(({ requirement }) => FAILURE_ONLY_FACETS.has(requirement.kind));

package/dist/v1/schema/compatibility/structure/requirements.js

@@ -1,9 +1,11 @@
 import { Key } from '../../../addressing/index.js';
-import { compareAddedProperties, compareLostProperties } from '../comparators/classes.js';
+import { inheritanceOf } from '../../../language/class/inheritance.js';
+import { compareAddedProperties, compareLostProperties, inheritanceMeaning, } from '../comparators/classes.js';
 import { compareFacet } from '../comparators/index.js';
 import { fingerprintMeaning } from '../comparators/values.js';
 import { contextInvalid } from '../context.js';
 import { methodCoordinate } from '../coordinate.js';
+import { closedParents } from '../extension.js';
 import { callableReferences, classReferences, inherits, memberReferences, usageOf, valueReferences, } from '../references.js';
 /** Structure follows data and abstract obligations; concrete IO never expands its requirements. */
 export function compareRequirements({ context, report, }) {
@@ -73,6 +75,7 @@ export function compareRequirements({ context, report, }) {
             compareLostProperties({ pair, report });
     }
     compareReliance({ context, report });
+    compareExtension({ context, report });
 }
 /**
  * What a dependent Policy relies on is recorded only when it fails: a Method it names that is gone
@@ -95,3 +98,31 @@ function compareReliance({ context, report, }) {
         report.record({ pair, facet, before, after, requirement: { kind: facet } });
     }
 }
+/**
+ * A Class of the compared origin one of the dependent's own Classes extends must be `'open'` in the
+ * target, unless the dependent holds its binding to that target. The fact is recorded only when it
+ * fails, like a Policy reliance, so a compatible comparison keeps its evidence bytes: `'open'`, what
+ * a subclass of another Domain requires, before, and the target's inheritance after.
+ */
+function compareExtension({ context, report, }) {
+    if (context.held || context.dependent === undefined)
+        return;
+    const closed = new Set(closedParents({ dependent: context.dependent, target: context.target }));
+    if (closed.size === 0)
+        return;
+    for (const reference of context.roots) {
+        if (reference.usage.relation !== 'extends' || !closed.has(reference.coordinate.key))
+            continue;
+        const pair = context.pair(reference.coordinate);
+        if (pair.target?.kind !== 'class')
+            continue;
+        report.note(reference);
+        report.record({
+            pair,
+            facet: 'class.inheritance',
+            before: inheritanceMeaning('open'),
+            after: inheritanceMeaning(inheritanceOf(pair.target.analysis.declaration)),
+            requirement: { kind: 'class.inheritance' },
+        });
+    }
+}

package/dist/v1/schema/compatibility/versioning/surface.d.ts

@@ -1,7 +1,7 @@
 import type { Report } from '../report.js';
 import type { ComparisonContext } from '../scope.js';
 /**
- * Compare inherited contracts and newly imposed obligations on existing Classes.
+ * Compare inherited contracts, newly imposed obligations and who may extend existing Classes.
  * Obligations are reported at their declaring Method: changed signatures retain their comparison;
  * an unchanged obligation newly inherited by a Class is added and unsatisfied.
  */

package/dist/v1/schema/compatibility/versioning/surface.js

@@ -1,10 +1,11 @@
+import { admitsForeignSubclass, inheritanceOf } from '../../../language/class/inheritance.js';
 import { methodInheritance } from '../comparators/callables.js';
-import { compareAddedProperties } from '../comparators/classes.js';
+import { compareAddedProperties, inheritanceMeaning } from '../comparators/classes.js';
 import { compareFacet } from '../comparators/index.js';
 import { fingerprintMeaning } from '../comparators/values.js';
 import { classCoordinate, methodCoordinate } from '../coordinate.js';
 /**
- * Compare inherited contracts and newly imposed obligations on existing Classes.
+ * Compare inherited contracts, newly imposed obligations and who may extend existing Classes.
  * Obligations are reported at their declaring Method: changed signatures retain their comparison;
  * an unchanged obligation newly inherited by a Class is added and unsatisfied.
  */
@@ -25,6 +26,7 @@ export function compareSurface({ context, report, }) {
             requirement: { kind: 'class.inherit' },
         });
         compareAddedProperties({ context, pair, report });
+        compareExtension({ pair, report });
         for (const [key, method] of source.analysis.requirements)
             if (!established.has(key))
                 established.set(key, method);
@@ -54,6 +56,32 @@ export function compareSurface({ context, report, }) {
             });
     }
 }
+/**
+ * A changed inheritance is observed on its Class, and is major when an `'open'` Class stops being
+ * open: only an `'open'` Class admits a subclass of another Domain (DM-CLASS-INHERITANCE). Closing
+ * or finalizing a Class no other Domain may extend takes nothing from a dependent; opening one
+ * grants an extension, which the floor, counting added members only, leaves at a patch.
+ */
+function compareExtension({ pair, report, }) {
+    if (pair.source?.kind !== 'class' || pair.target?.kind !== 'class')
+        return;
+    const source = pair.source.analysis.declaration;
+    const target = pair.target.analysis.declaration;
+    const before = inheritanceOf(source);
+    const after = inheritanceOf(target);
+    if (before === after)
+        return;
+    report.record({
+        pair,
+        facet: 'class.inheritance',
+        before: inheritanceMeaning(before),
+        after: inheritanceMeaning(after),
+        requirement: {
+            kind: 'class.inheritance',
+            satisfied: !admitsForeignSubclass(source) || admitsForeignSubclass(target),
+        },
+    });
+}
 function changed({ before, after }) {
     return (before === undefined ||
         after === undefined ||

package/dist/v1/schema/diagnostic.d.ts

@@ -1,4 +1,4 @@
-export type SchemaDiagnosticCode = 'DM_CAPABILITY_INVALID' | 'DM_MEMBER_ROOT_INVALID' | 'DM_DEPENDENCY_CONTEXT_INVALID' | 'DM_DEPENDENCY_NOT_RETAINED' | 'DM_MEANING_INCONSISTENT' | 'DM_MEMBER_ORIGIN_MISMATCH' | 'DV_ACCEPTANCE_CONTEXT' | 'DV_CALLABLE_AUTH' | 'DV_CALLABLE_IO' | 'DV_CALLABLE_POLICY_AUTH' | 'DV_CLASS_ABSTRACT' | 'DV_CLASS_ACYCLIC' | 'DV_CLASS_KIND' | 'DV_CORE_EDGE_CLASS' | 'DV_CORE_EDGE_CONSTRAINTS' | 'DV_CORE_EDGE_KEY' | 'DV_CORE_EDGE_PROPERTIES' | 'DV_CORE_NODE_CLASS' | 'DV_CORE_NODE_PROPERTIES' | 'DV_CORE_REF' | 'DV_DATA_COMPOSITION' | 'DV_DEPENDENCY_ACYCLIC' | 'DV_DEPENDENCY_DIRECT' | 'DV_DEPENDENCY_EXACT' | 'DV_DEPENDENCY_LIMITS' | 'DV_DEPENDENCY_REVISION_COHERENCE' | 'DV_DEPENDENCY_UNIQUE' | 'DV_EDGE_ACCEPTS' | 'DV_EDGE_CLASS_COMPOSITION' | 'DV_EDGE_CONSTRAINT' | 'DV_EDGE_FOREIGN_MINIMUM' | 'DV_EDGE_ROLE' | 'DV_EDGE_UNDIRECTED' | 'DV_ENTRYPOINT' | 'DV_JSON_VALUE' | 'DV_METHOD_ABSTRACT' | 'DV_METHOD_COMPOSITION' | 'DV_PROPERTY_AUTO' | 'DV_PROPERTY_COMPOSITION' | 'DV_PROPERTY_IMMUTABLE' | 'DV_PROPERTY_STATE' | 'DV_REF_RESOLVES' | 'DV_VALUE_SCHEMA' | 'PL_BUDGET' | 'PL_COMPOSITION' | 'PL_CONNECTIVITY' | 'PL_REF' | 'PL_REPEAT' | 'PL_TARGET' | 'PL_TYPING' | 'PL_USE' | 'PL_VARIABLE_SCOPE' | 'STRUCTURE_ABSTRACT_POLICY' | 'STRUCTURE_CALLABLE_POLICY_AUTH' | 'STRUCTURE_DUPLICATE_ITEM' | 'STRUCTURE_EDGE_ORIENTATION' | 'STRUCTURE_FORMAT' | 'STRUCTURE_INVALID' | 'STRUCTURE_KEY' | 'STRUCTURE_MAXIMUM' | 'STRUCTURE_MINIMUM' | 'STRUCTURE_MULTIPLE' | 'STRUCTURE_REQUIRED' | 'STRUCTURE_TYPE' | 'STRUCTURE_UNION' | 'STRUCTURE_UNKNOWN_FIELD' | 'STRUCTURE_VALUE' | 'UNSUPPORTED_DOCUMENT_FORMAT' | 'UNSUPPORTED_DSL_VERSION';
+export type SchemaDiagnosticCode = 'DM_CAPABILITY_INVALID' | 'DM_MEMBER_ROOT_INVALID' | 'DM_DEPENDENCY_CONTEXT_INVALID' | 'DM_DEPENDENCY_NOT_RETAINED' | 'DM_MEANING_INCONSISTENT' | 'DM_MEMBER_ORIGIN_MISMATCH' | 'DV_ACCEPTANCE_CONTEXT' | 'DV_CALLABLE_ADMISSION' | 'DV_CALLABLE_AUTH' | 'DV_CALLABLE_IO' | 'DV_CALLABLE_POLICY_AUTH' | 'DV_CLASS_ABSTRACT' | 'DV_CLASS_ACYCLIC' | 'DV_CLASS_INHERITANCE' | 'DV_CLASS_KIND' | 'DV_CORE_EDGE_CLASS' | 'DV_CORE_EDGE_CONSTRAINTS' | 'DV_CORE_EDGE_KEY' | 'DV_CORE_EDGE_PROPERTIES' | 'DV_CORE_EDGE_UNIQUE' | 'DV_CORE_NODE_CLASS' | 'DV_CORE_NODE_PROPERTIES' | 'DV_CORE_NODE_UNIQUE' | 'DV_CORE_REF' | 'DV_DATA_COMPOSITION' | 'DV_DEPENDENCY_ACYCLIC' | 'DV_DEPENDENCY_DIRECT' | 'DV_DEPENDENCY_EXACT' | 'DV_DEPENDENCY_LIMITS' | 'DV_DEPENDENCY_REVISION_COHERENCE' | 'DV_DEPENDENCY_UNIQUE' | 'DV_EDGE_ACCEPTS' | 'DV_EDGE_CLASS_COMPOSITION' | 'DV_EDGE_CONSTRAINT' | 'DV_EDGE_FOREIGN_MINIMUM' | 'DV_EDGE_LIFETIME' | 'DV_EDGE_ROLE' | 'DV_EDGE_UNDIRECTED' | 'DV_EDGE_UNIQUE' | 'DV_ENTRYPOINT' | 'DV_JSON_VALUE' | 'DV_METHOD_ABSTRACT' | 'DV_METHOD_COMPOSITION' | 'DV_NODE_UNIQUE' | 'DV_PROPERTY_AUTO' | 'DV_PROPERTY_COMPOSITION' | 'DV_PROPERTY_IMMUTABLE' | 'DV_PROPERTY_STATE' | 'DV_REF_RESOLVES' | 'DV_VALUE_SCHEMA' | 'PL_BUDGET' | 'PL_COMPOSITION' | 'PL_CONNECTIVITY' | 'PL_REF' | 'PL_REPEAT' | 'PL_TARGET' | 'PL_TYPING' | 'PL_USE' | 'PL_VARIABLE_SCOPE' | 'STRUCTURE_ABSTRACT_POLICY' | 'STRUCTURE_CALLABLE_POLICY_AUTH' | 'STRUCTURE_DUPLICATE_ITEM' | 'STRUCTURE_EDGE_ORIENTATION' | 'STRUCTURE_FORMAT' | 'STRUCTURE_INVALID' | 'STRUCTURE_KEY' | 'STRUCTURE_MAXIMUM' | 'STRUCTURE_MINIMUM' | 'STRUCTURE_MULTIPLE' | 'STRUCTURE_REQUIRED' | 'STRUCTURE_TYPE' | 'STRUCTURE_UNION' | 'STRUCTURE_UNKNOWN_FIELD' | 'STRUCTURE_VALUE' | 'UNSUPPORTED_DOCUMENT_FORMAT' | 'UNSUPPORTED_DSL_VERSION';
 export interface SchemaDiagnostic<out Code extends SchemaDiagnosticCode = SchemaDiagnosticCode> {
     readonly code: Code;
     readonly pointer: string;

package/dist/v1/schema/normalization/domain.js

@@ -1,6 +1,7 @@
 import { json } from '@astrale-os/kernel-dsl/value';
 import { compareDefinitionRefs, compareUnicode } from '../../addressing/ordering.js';
 import { isBinaryInput } from '../../language/callable/model/callable.js';
+import { compareEdgeUniqueFields, compareEdgeUniqueTuples, compareNodeUniqueTuples, } from '../../language/class/unique.js';
 import { normalizeClassRule, normalizePolicyChecks, normalizePolicyExpression, } from '../../language/policy/normalization/normalize.js';
 import { admitStateTopology } from '../../language/state/topology.js';
 import { canonicalizeValueSchema } from '../../language/value/profile/canonicalize.js';
@@ -61,6 +62,7 @@ function canonicalizeClass(value) {
         ref: value.ref,
         kind: value.kind,
         abstract: value.abstract,
+        ...(value.inheritance === undefined ? {} : { inheritance: value.inheritance }),
         extends: [...value.extends].sort(compareDefinitionRefs),
         properties: mapRecord(value.properties, canonicalizeProperty),
     };
@@ -71,6 +73,7 @@ function canonicalizeClass(value) {
             ...(value.data === undefined ? {} : { data: { mediaType: value.data.mediaType } }),
             ...(value.icon === undefined ? {} : { icon: value.icon }),
             policies: canonicalizeNodePolicies(value.policies),
+            ...(value.unique === undefined ? {} : { unique: canonicalizeNodeUnique(value.unique) }),
         };
     }
     return value.orientation === 'directed'
@@ -80,6 +83,7 @@ function canonicalizeClass(value) {
             endpoints: canonicalizeDirectedEndpoints(value.endpoints),
             policies: value.policies,
             constraints: value.constraints,
+            ...(value.unique === undefined ? {} : { unique: canonicalizeUnique(value.unique) }),
         }
         : {
             ...base,
@@ -89,6 +93,18 @@ function canonicalizeClass(value) {
             constraints: value.constraints,
         };
 }
+/** A set of Node key tuples, each a set of Property keys, both in their canonical order. */
+function canonicalizeNodeUnique(tuples) {
+    return tuples
+        .map((tuple) => [...tuple].sort(compareUnicode))
+        .sort(compareNodeUniqueTuples);
+}
+/** A set of key tuples, each a set of fields: fields and tuples take their canonical order. */
+function canonicalizeUnique(tuples) {
+    return tuples
+        .map((tuple) => [...tuple].sort(compareEdgeUniqueFields))
+        .sort(compareEdgeUniqueTuples);
+}
 /** A rule keeps one spelling: normalized checks, or the Policy a lone `self` check names. */
 function canonicalizeNodePolicies(value) {
     return {
@@ -115,6 +131,8 @@ function canonicalizeCallable(value) {
         output: canonicalizeCallableOutput(value.output),
         // Ordinary execution has one canonical form, so existing revisions never move.
         ...(value.execution?.durable === true ? { execution: { durable: true } } : {}),
+        // Absence is the one spelling of a call admitted afresh; validation refuses any other.
+        ...(value.admission === undefined ? {} : { admission: { maxAge: value.admission.maxAge } }),
     };
     return value.auth === 'authorized'
         ? {

package/dist/v1/schema/validation/callable.d.ts

@@ -1,4 +1,4 @@
 import type { SchemaDiagnostic } from '../diagnostic.js';
 import type { DomainSchemaIR } from '../model/schema.js';
-/** Validate the execution modifier of every local Function and Node Method. */
+/** Validate the execution modifier and admission age of every local Function and Node Method. */
 export declare function validateCallables(schema: DomainSchemaIR): readonly SchemaDiagnostic[];