@astrale-os/kernel-dsl 1.0.0-beta.2 → 1.0.0-beta.20

package/dist/v1/schema/rule.js

@@ -0,0 +1,440 @@
+import { defaultLimits } from '@astrale-os/kernel-dsl/value';
+import { deepFreeze } from '../language/freeze.js';
+import { limits } from '../language/limits.js';
+const ANY = ['{/path*}'];
+const CHECKS = [
+    '/classes/{class}/policies/{operation}{/path*}',
+    '/functions/{function}/policy{/path*}',
+    '/classes/{class}/methods/{method}/policy{/path*}',
+];
+const DEPENDENCIES = ['/dependencies/{alias}', '/dependencies'];
+const count = (value) => value.toLocaleString('en-US');
+const { dependency, policy } = limits;
+const at = (field) => [
+    `/functions/{function}${field}`,
+    `/classes/{class}/methods/{method}${field}`,
+];
+/**
+ * Every Schema diagnostic code with the rule it reports. A code added to the DSL does not compile
+ * until it is described here.
+ */
+export const RULES = deepFreeze({
+    DV_ACCEPTANCE_CONTEXT: {
+        stage: 'context',
+        positions: ['/dependencies'],
+        statement: 'A Schema is resolved, compiled or bundled only with the exact dependency closure its acceptance retained in this process.',
+    },
+    DV_CALLABLE_ADMISSION: {
+        stage: 'rule',
+        positions: at('/admission/maxAge'),
+        statement: 'An admission age is an integer number of seconds from 1 to 300.',
+        enforces: 'A destination decides a call only under an admission at most that many seconds old.',
+    },
+    DV_CALLABLE_AUTH: {
+        stage: 'rule',
+        positions: at('/auth'),
+        statement: 'A durable Function or Method is authenticated or authorized, never anonymous.',
+        enforces: 'A durable call runs as an Execution that records its caller and its admitted input, is resubmitted from them, and settles one value outcome.',
+    },
+    DV_CALLABLE_IO: {
+        stage: 'rule',
+        // A Method takes a value input only: its input has no mode.
+        positions: ['/functions/{function}/input/mode', ...at('/output/mode')],
+        statement: 'A durable Function or Method takes a value input and returns a value output.',
+    },
+    DV_CLASS_ABSTRACT: {
+        stage: 'rule',
+        positions: ['/classes/{class}/policies'],
+        statement: 'An abstract Class declares no read or traverse Policy.',
+        enforces: 'No Node or Edge is of an abstract Class exactly: only its concrete descendants are.',
+    },
+    DV_CLASS_ACYCLIC: {
+        stage: 'rule',
+        positions: ['/classes/{class}/extends/{index}'],
+        statement: 'No Class extends itself, directly or through its ancestors.',
+    },
+    DV_CLASS_INHERITANCE: {
+        stage: 'context',
+        positions: ['/classes/{class}/extends/{index}'],
+        statement: 'No Class extends a final Class, of its own Domain or of a dependency.',
+    },
+    DV_CLASS_KIND: {
+        stage: 'context',
+        positions: ['/classes/{class}/extends/{index}'],
+        statement: 'A Class extends only Classes of its own kind: a Node Class Node Classes, an Edge Class Edge Classes.',
+    },
+    DV_CORE_EDGE_CLASS: {
+        stage: 'context',
+        positions: ['/core/edges/{index}/class', '/core/edges/{index}'],
+        statement: 'A Core Edge is of a concrete Edge Class of its Domain whose endpoints accept the Classes of its source and target.',
+    },
+    DV_CORE_EDGE_CONSTRAINTS: {
+        stage: 'context',
+        positions: ['/core/edges', '/core/edges/{index}', '/core/nodes/{slug}'],
+        statement: 'The Core Edges of a Schema hold the noSelf and acyclic constraints of their Classes, and every Core Node, and every Definition a Core Edge names, the Edge counts of the concrete Edge Classes whose endpoints accept it, each over its own Edges, a Definition its maximum only.',
+    },
+    DV_CORE_EDGE_KEY: {
+        stage: 'rule',
+        positions: ['/core/edges/{index}'],
+        statement: 'No two Core Edges share their Edge Class, source and target.',
+    },
+    DV_CORE_EDGE_PROPERTIES: {
+        stage: 'context',
+        positions: ['/core/edges/{index}/properties{/path*}'],
+        statement: 'The Properties of a Core Edge satisfy its Class: every required Property that no automatic program writes is present, every automatic one is absent, and each value fits its schema.',
+    },
+    DV_CORE_EDGE_UNIQUE: {
+        stage: 'context',
+        positions: ['/core/edges/{index}'],
+        statement: 'No two Core Edges hold one key under a unique tuple that covers their Classes.',
+    },
+    DV_CORE_NODE_CLASS: {
+        stage: 'rule',
+        positions: ['/core/nodes/{slug}/class'],
+        statement: 'A Core Node is of a concrete Node Class of its Domain.',
+    },
+    DV_CORE_NODE_PROPERTIES: {
+        stage: 'context',
+        positions: ['/core/nodes/{slug}/properties{/path*}'],
+        statement: 'The Properties of a Core Node satisfy its Class: every required Property that no automatic program writes is present, every automatic one is absent, and each value fits its schema.',
+    },
+    DV_CORE_NODE_UNIQUE: {
+        stage: 'context',
+        positions: ['/core/nodes/{slug}'],
+        statement: 'No two Core Nodes hold one key under a unique tuple that covers their Classes.',
+    },
+    DV_CORE_REF: {
+        stage: 'rule',
+        positions: ['/core/edges/{index}/source', '/core/edges/{index}/target'],
+        statement: 'A Core Edge endpoint names its Domain or a Definition its Domain declares and projects: a Class, Function, executable Method, Policy, View or Core Node.',
+    },
+    DV_DATA_COMPOSITION: {
+        stage: 'context',
+        positions: ['/classes/{class}/extends/{index}', '/classes/{class}/data'],
+        statement: 'A Node Class has at most one data declaration, its own or inherited from one declaring Class, and declares none of its own when it inherits one.',
+    },
+    DV_DEPENDENCY_ACYCLIC: {
+        stage: 'context',
+        positions: [...DEPENDENCIES],
+        statement: 'The dependency closure of a Domain has no cycle and never reaches its own origin.',
+    },
+    DV_DEPENDENCY_DIRECT: {
+        stage: 'rule',
+        positions: ['/dependencies'],
+        statement: 'Every origin a reference names, other than the Domain’s own, is a direct dependency.',
+    },
+    DV_DEPENDENCY_EXACT: {
+        stage: 'context',
+        positions: [...DEPENDENCIES],
+        statement: 'The lookup serves every dependency of the closure exactly: the Schema of its origin whose revision is the one pinned.',
+    },
+    DV_DEPENDENCY_LIMITS: {
+        stage: 'context',
+        positions: ['/dependencies', '/dependencies/{alias}'],
+        statement: `A Domain has at most ${dependency.direct} direct dependencies, a closure of at most ${dependency.closure} Domains and a dependency depth of at most ${dependency.depth}.`,
+        limits: ['dependency.direct', 'dependency.closure', 'dependency.depth'],
+    },
+    DV_DEPENDENCY_REVISION_COHERENCE: {
+        stage: 'context',
+        positions: [...DEPENDENCIES],
+        statement: 'The dependency closure holds at most one revision of each origin.',
+    },
+    DV_DEPENDENCY_UNIQUE: {
+        stage: 'rule',
+        positions: ['/dependencies/{alias}/origin'],
+        statement: 'A Domain depends on each origin through one alias, and never on its own origin.',
+    },
+    DV_EDGE_ACCEPTS: {
+        stage: 'context',
+        positions: ['/classes/{class}/endpoints/{endpoint}/accepts/{index}'],
+        statement: 'An Edge endpoint accepts only Node Classes of its Domain or of a direct dependency.',
+    },
+    DV_EDGE_CLASS_COMPOSITION: {
+        stage: 'context',
+        positions: ['/classes/{class}/extends/{index}'],
+        statement: 'An Edge Class refines each Edge Class it extends: the same orientation, endpoints whose accepted Classes and counts fit within its parent’s, its parent’s constraints and Property contract.',
+    },
+    DV_EDGE_FOREIGN_MINIMUM: {
+        stage: 'rule',
+        positions: ['/classes/{class}/endpoints/{endpoint}/{count}'],
+        statement: 'An Edge endpoint that accepts a Class another Domain owns requires no minimum count: neither 1 nor 1..*.',
+        enforces: 'Every Node an endpoint accepts holds a number of Edges of the Class within its count: at least one for 1 and 1..*, at most one for 0..1 and 1.',
+    },
+    DV_EDGE_LIFETIME: {
+        stage: 'rule',
+        positions: ['/classes/{class}/endpoints/{endpoint}/onDelete'],
+        statement: 'An endpoint that can hold a Node of another Domain does not declare restrict, and no endpoint declares detach in an Edge Class with an endpoint that requires an Edge.',
+        enforces: 'Deleting a Node at a restrict endpoint is refused unless the same transition deletes the Edge; at a detach endpoint the Edge is deleted with the Node.',
+    },
+    DV_EDGE_ROLE: {
+        stage: 'rule',
+        positions: ['/classes/{class}/endpoints/{endpoint}/role'],
+        statement: 'The two endpoints of an Edge Class have distinct roles.',
+    },
+    DV_EDGE_UNIQUE: {
+        stage: 'context',
+        positions: ['/classes/{class}/unique/{index}/{index}/property'],
+        statement: 'Each Property a unique tuple of an Edge Class names is a Property of the Class, own or inherited, that is keyable: a string, number, boolean or instant that no automatic program writes.',
+        enforces: 'No two Edges of the Class and of its concrete descendants share the values of a tuple’s fields while each of those fields is present.',
+    },
+    DV_ENTRYPOINT: {
+        stage: 'rule',
+        positions: ['/entrypoint'],
+        statement: 'The entrypoint names a View its Domain declares.',
+    },
+    DV_JSON_VALUE: {
+        stage: 'structure',
+        positions: ANY,
+        statement: `The document is portable JSON: as text, UTF-8 that parses, within ${count(defaultLimits.maxBytes)} bytes, with no byte-order mark and no repeated member name; as a value, null, booleans, finite numbers other than negative zero, strings, arrays and plain objects, with no string or member name that holds U+0000 or a lone surrogate or exceeds ${count(defaultLimits.maxStringBytes)} bytes of UTF-8, at most ${count(defaultLimits.maxDepth)} nested arrays and objects, and at most ${count(defaultLimits.maxMembers)} members and items in all.`,
+        conditions: ['#/$defs/portable-string/not'],
+    },
+    DV_METHOD_ABSTRACT: {
+        stage: 'rule',
+        positions: [
+            '/classes/{class}/methods/{method}/policy',
+            '/classes/{class}/methods/{method}/admission',
+        ],
+        statement: 'An abstract Method of an abstract Class has no executable declaration, so it declares neither a Policy nor an admission age.',
+    },
+    DV_METHOD_COMPOSITION: {
+        stage: 'context',
+        positions: ['/classes/{class}/methods', '/classes/{class}/methods/{method}'],
+        statement: 'A Class keeps the exact signature of every abstract Method it inherits, declares locally a Method it inherits ambiguously, and, when concrete, declares locally every abstract Method it inherits.',
+    },
+    DV_NODE_UNIQUE: {
+        stage: 'context',
+        positions: ['/classes/{class}/unique/{index}/{index}'],
+        statement: 'Each Property a unique tuple of a Node Class names is a Property of the Class, own or inherited, that is keyable: a string, number, boolean or instant that no automatic program writes.',
+        enforces: 'No two Nodes of the Class and of its concrete descendants share the values of a tuple while every Property of the tuple has a value; a Node missing one holds no key.',
+    },
+    DV_PROPERTY_AUTO: {
+        stage: 'context',
+        positions: [
+            '/classes/{class}/properties/{property}/auto/on',
+            '/classes/{class}/properties/{property}/auto/set',
+        ],
+        statement: 'A required automatic Property is written on create, and the instant setter writes only a Property whose schema is an instant.',
+        enforces: 'The Kernel sets the Property to the instant of each transition of its events, and refuses a transition that writes it.',
+    },
+    DV_PROPERTY_IMMUTABLE: {
+        stage: 'rule',
+        positions: ['/classes/{class}/properties/{property}/immutable'],
+        statement: 'An immutable Property is neither automatic nor a State Property, and a required one is immutable from create, not once.',
+        enforces: 'A create Property is written only when its Node or Edge is created; a once Property is written only while it is absent, and never unset.',
+    },
+    DV_PROPERTY_STATE: {
+        stage: 'rule',
+        positions: ['/classes/{class}/properties/{property}/state'],
+        statement: 'A State Property is required and not automatic, has the string enumeration of exactly its states as schema, and a topology whose initial state and transition targets are its states.',
+        enforces: 'Its value is always one of its states; the Kernel does not hold changes to its transitions.',
+    },
+    DV_REF_RESOLVES: {
+        stage: 'context',
+        positions: [
+            '/classes/{class}/ref',
+            '/classes/{class}/extends/{index}',
+            '/functions/{function}/ref',
+            '/policies/{policy}/ref',
+            '/views/{view}/ref',
+            '/core/nodes/{slug}/ref',
+        ],
+        statement: 'A declaration’s ref is its own key, and every Class a Class extends exists in its Domain or in a direct dependency.',
+    },
+    DV_VALUE_SCHEMA: {
+        stage: 'context',
+        positions: [
+            '/classes/{class}/properties/{property}/schema{/path*}',
+            ...at('/input{/path*}'),
+            ...at('/output/schema{/path*}'),
+            ...at('/output/item{/path*}'),
+        ],
+        statement: 'Every embedded value schema is in the value language: its diagnostic names the refusal in `valueCode`, and the schema of an automatic or State Property is not a blob.',
+        conditions: ['#/$defs/node-property-definition/allOf/0/if'],
+    },
+    PL_BUDGET: {
+        stage: 'rule',
+        positions: ['/policies/{policy}', ...CHECKS],
+        statement: `A Policy stays within its budgets once expanded: pattern depth ${policy.patternDepth}, ${policy.normalizedBranches} normalized branches, ${policy.edgePredicates} Edge predicates a branch and ${policy.referencedDomains} referenced Domains; and checks within depth ${policy.checkDepth}, ${policy.checkBranches} branches and ${policy.checkLeaves} leaves.`,
+        limits: [
+            'policy.patternDepth',
+            'policy.normalizedBranches',
+            'policy.edgePredicates',
+            'policy.referencedDomains',
+            'policy.checkDepth',
+            'policy.checkBranches',
+            'policy.checkLeaves',
+        ],
+    },
+    PL_COMPOSITION: {
+        stage: 'rule',
+        positions: ['/policies/{policy}'],
+        statement: 'Named Policies compose without a cycle.',
+    },
+    PL_CONNECTIVITY: {
+        stage: 'rule',
+        positions: ['/policies/{policy}/expression/match', ...CHECKS],
+        statement: 'Every normalized branch of a Policy pattern connects its subject with each object, endpoint and variable it names, and every branch of a check tree checks a Policy.',
+    },
+    PL_REF: {
+        stage: 'context',
+        positions: ['/policies/{policy}/expression{/path*}', ...CHECKS],
+        statement: 'Every reference in a Policy resolves: a named Policy to one its Domain declares, a Class to a Node or Edge Class of its Domain or of a direct dependency, an object to a projected Definition.',
+    },
+    PL_REPEAT: {
+        stage: 'rule',
+        positions: ['/policies/{policy}/expression{/path*}'],
+        statement: 'The minimum of a repeated Edge pattern is at most its maximum.',
+    },
+    PL_TARGET: {
+        stage: 'rule',
+        positions: ['/policies/{policy}', '/policies/{policy}/expression/match'],
+        statement: 'Every normalized branch of a Policy targets either its object or its source and target endpoints, without mixing the two.',
+    },
+    PL_TYPING: {
+        stage: 'context',
+        positions: ['/policies/{policy}'],
+        statement: 'Every expanded branch of a named Policy is typed at its own use: its endpoint and repeat contracts do not contradict.',
+    },
+    PL_USE: {
+        stage: 'context',
+        positions: [...CHECKS],
+        statement: 'A Policy holds where it is used: a Class Policy for every Node or source and target pair of its Class, each check for the objects it admits, and each check tree can admit every Class its object accepts.',
+        enforces: 'A read Policy decides which callers observe the values of a Class’s Nodes or Edges, a traverse Policy which callers use them structurally; an absent one admits every caller.',
+    },
+    PL_VARIABLE_SCOPE: {
+        stage: 'rule',
+        positions: ['/policies/{policy}/expression{/path*}'],
+        statement: 'Every Policy variable is declared once, by one exists, is used only inside it, shadows no enclosing variable, and is used at least once.',
+    },
+    STRUCTURE_BINARY_INPUT: {
+        stage: 'structure',
+        positions: ['/functions/{function}/input'],
+        statement: 'A Function input in binary mode is a binary input: it declares its metadata and maximumBytes.',
+        conditions: ['#/$defs/function-definition/properties/input/anyOf/1/not'],
+    },
+    STRUCTURE_CALLABLE_POLICY_AUTH: {
+        stage: 'structure',
+        positions: at('/policy'),
+        statement: 'Only an authorized Function or Method declares a Policy.',
+        conditions: ['#/$defs/function-definition/if', '#/$defs/method-definition/if'],
+    },
+    STRUCTURE_DEPENDENCY_ALIAS: {
+        stage: 'structure',
+        positions: ['/dependencies/{alias}'],
+        statement: 'A dependency alias is neither prototype nor constructor.',
+        conditions: ['#/$defs/dependency-alias/not'],
+    },
+    STRUCTURE_DOMAIN_NAME: {
+        stage: 'structure',
+        positions: ['/name'],
+        statement: 'The Domain name is one line of text, without control characters or surrounding spaces.',
+    },
+    STRUCTURE_DUPLICATE_ITEM: {
+        stage: 'structure',
+        positions: [
+            '/classes/{class}/extends/{index}',
+            '/classes/{class}/endpoints/{endpoint}/accepts/{index}',
+            '/classes/{class}/properties/{property}/auto/on/{index}',
+            '/classes/{class}/unique/{index}',
+            '/classes/{class}/unique/{index}/{index}',
+        ],
+        statement: 'A set holds no item twice: extends, accepts, auto.on, unique and each unique tuple, where two tuples of the same fields are one.',
+    },
+    STRUCTURE_EDGE_BLOB: {
+        stage: 'structure',
+        positions: ['/classes/{class}/properties/{property}/schema/x-astrale-value-kind'],
+        statement: 'The schema of an Edge Property is not a blob: only a Node holds Blob contents.',
+        conditions: ['#/$defs/edge-property-definition/properties/schema/not'],
+    },
+    STRUCTURE_EDGE_ORIENTATION: {
+        stage: 'structure',
+        positions: [
+            '/classes/{class}/endpoints',
+            '/classes/{class}/unique',
+            '/classes/{class}/constraints/acyclic',
+        ],
+        statement: 'A directed Edge Class has source and target endpoints and an undirected one two incident endpoints, and only a directed one declares unique tuples or is acyclic.',
+        enforces: 'No Edges of an acyclic Class form a directed cycle.',
+        conditions: ['#/$defs/edge-class/if'],
+    },
+    STRUCTURE_FORMAT: {
+        stage: 'structure',
+        positions: ANY,
+        statement: 'A string matches the pattern of its position: an origin, a member name, a revision, a media type, a dependency alias or a Core slug.',
+    },
+    STRUCTURE_KEY: {
+        stage: 'structure',
+        positions: ANY,
+        statement: 'Every key of a record matches the pattern of the names it holds.',
+    },
+    STRUCTURE_MAXIMUM: {
+        stage: 'structure',
+        positions: ANY,
+        statement: 'A string, list or number is no greater than the bound of its position.',
+        limits: ['policy.variablesPerExists', 'policy.repetition'],
+    },
+    STRUCTURE_MINIMUM: {
+        stage: 'structure',
+        positions: ANY,
+        statement: 'A string, list or number is no less than the bound of its position.',
+    },
+    STRUCTURE_PROPERTY_KEY: {
+        stage: 'structure',
+        positions: [
+            '/classes/{class}/unique/{index}/{index}',
+            '/classes/{class}/unique/{index}/{index}/property',
+            '/core/nodes/{slug}/properties/{key}',
+            '/core/edges/{index}/properties/{key}',
+        ],
+        statement: 'A Property is named by its canonical key, <origin>:class.<Class>.property.<name>.',
+    },
+    STRUCTURE_PROTO_KEY: {
+        stage: 'structure',
+        positions: ANY,
+        statement: 'No object of the document has a member named __proto__, except the transitions of a State.',
+        conditions: [
+            '#/$defs/json-value/anyOf/5/propertyNames/not',
+            '#/$defs/value-schema/anyOf/1/propertyNames/not',
+        ],
+    },
+    STRUCTURE_REQUIRED: {
+        stage: 'structure',
+        positions: ANY,
+        statement: 'Every required field is present.',
+    },
+    STRUCTURE_STATE_TRANSITIONS: {
+        stage: 'structure',
+        positions: ['/classes/{class}/properties/{property}/state/transitions'],
+        statement: 'State transitions map each non-empty state name to a map from non-empty event names to non-empty state names.',
+    },
+    STRUCTURE_TYPE: {
+        stage: 'structure',
+        positions: ANY,
+        statement: 'Every value has the JSON type of its position.',
+    },
+    STRUCTURE_UNION: {
+        stage: 'structure',
+        positions: ANY,
+        statement: 'A value matches one of the variants of its position.',
+    },
+    STRUCTURE_UNKNOWN_FIELD: {
+        stage: 'structure',
+        positions: ANY,
+        statement: 'An object has only the fields of its position.',
+    },
+    STRUCTURE_VALUE: {
+        stage: 'structure',
+        positions: ANY,
+        statement: 'A literal or enumerated position holds one of its values.',
+    },
+    UNSUPPORTED_DOCUMENT_FORMAT: {
+        stage: 'structure',
+        positions: ['/format'],
+        statement: 'The document format is astrale.dsl.',
+    },
+    UNSUPPORTED_DSL_VERSION: {
+        stage: 'structure',
+        positions: ['/version'],
+        statement: 'The document version is one this DSL reads: v1.',
+    },
+});

package/dist/v1/schema/validation/callable.d.ts

@@ -1,4 +1,37 @@
+import type { ClassRef } from '../../addressing/index.js';
+import type { CallableDefinition } from '../../language/callable/model/callable.js';
+import type { ValueSchemaRegistry } from '../../language/value/reference/registry.js';
 import type { SchemaDiagnostic } from '../diagnostic.js';
 import type { DomainSchemaIR } from '../model/schema.js';
-/** Validate the execution modifier of every local Function and Node Method. */
-export declare function validateCallables(schema: DomainSchemaIR): readonly SchemaDiagnostic[];
+/**
+ * One callable contract a Domain schema declares: where it is written, and the Node Class that
+ * receives its call, which its Policy names `self`. A contract is validated by the same rules
+ * wherever it is: in a Domain schema, at its declaration, or on the Node of a Function instance,
+ * which carries it (`acceptCallable`).
+ */
+export interface DeclaredContract {
+    readonly contract: CallableDefinition;
+    /** Its declaration's JSON Pointer, which its diagnostics point within. */
+    readonly pointer: string;
+    /** The owner of an instance Method; a Function and a static Method have none. */
+    readonly receiver?: ClassRef;
+    /** The Node Class and name of a Method; absent for a Function. */
+    readonly method?: {
+        readonly owner: ClassRef;
+        readonly name: string;
+    };
+}
+/** Every callable contract one Domain schema declares: each Function, then each Node Method. */
+export declare function declaredContracts(schema: DomainSchemaIR): readonly DeclaredContract[];
+/**
+ * Validate the ref of every Function declaration, then the value schemas, execution modifier and
+ * admission age of every declared contract.
+ */
+export declare function validateContracts(schema: DomainSchemaIR, registry: ValueSchemaRegistry): readonly SchemaDiagnostic[];
+/**
+ * Validate one callable contract written at `pointer`, except its Policy (`validateContractPolicy`):
+ * its value schemas against the owner registry, its execution modifier and its admission age.
+ */
+export declare function validateContract(contract: CallableDefinition, pointer: string, registry: ValueSchemaRegistry, diagnostics: SchemaDiagnostic[]): void;
+/** Validate the execution modifier and admission age of one callable contract at `pointer`. */
+export declare function validateCallableModifiers(declaration: CallableDefinition, pointer: string, diagnostics: SchemaDiagnostic[]): void;

package/dist/v1/schema/validation/callable.js

@@ -1,21 +1,80 @@
+import { equalDefinitionRefs } from '../../addressing/definition-ref.js';
+import { Key } from '../../addressing/key.js';
+import { isAdmissionMaxAge, MAXIMUM_ADMISSION_AGE_SECONDS, } from '../../language/callable/admission.js';
 import { isBinaryInput } from '../../language/callable/model/callable.js';
+import { escapePointerToken } from '../../language/value/syntax/pointer.js';
 import { diagnostic } from '../diagnostic.js';
-/** Validate the execution modifier of every local Function and Node Method. */
-export function validateCallables(schema) {
-    const diagnostics = [];
+import { validateCallable } from './value.js';
+/** Every callable contract one Domain schema declares: each Function, then each Node Method. */
+export function declaredContracts(schema) {
+    const contracts = [];
     for (const [name, declaration] of Object.entries(schema.functions)) {
-        validateExecution(declaration, `/functions/${escapePointer(name)}`, diagnostics);
+        contracts.push({ contract: declaration, pointer: `/functions/${escapePointerToken(name)}` });
     }
     for (const [name, declaration] of Object.entries(schema.classes)) {
         if (declaration.kind !== 'node')
             continue;
+        const owner = { origin: schema.origin, kind: 'class', name };
         for (const [method, value] of Object.entries(declaration.methods)) {
-            const pointer = `/classes/${escapePointer(name)}/methods/${escapePointer(method)}`;
-            validateExecution(value, pointer, diagnostics);
+            const pointer = `/classes/${escapePointerToken(name)}/methods/${escapePointerToken(method)}`;
+            contracts.push({
+                contract: value,
+                pointer,
+                ...(value.static ? {} : { receiver: owner }),
+                method: { owner, name: method },
+            });
         }
     }
+    return contracts;
+}
+/**
+ * Validate the ref of every Function declaration, then the value schemas, execution modifier and
+ * admission age of every declared contract.
+ */
+export function validateContracts(schema, registry) {
+    const diagnostics = [];
+    for (const [name, declaration] of Object.entries(schema.functions)) {
+        validateFunctionRef(schema.origin, name, declaration.ref, diagnostics);
+    }
+    for (const { contract, pointer } of declaredContracts(schema)) {
+        validateContract(contract, pointer, registry, diagnostics);
+    }
     return Object.freeze(diagnostics);
 }
+/**
+ * A Function declaration names itself by its ref: its own key in its own Domain. The ref belongs to
+ * the declaration, not to its contract, which a Node carries without one.
+ */
+function validateFunctionRef(origin, name, declared, diagnostics) {
+    const ref = { origin, kind: 'function', name };
+    if (equalDefinitionRefs(declared, ref))
+        return;
+    diagnostics.push(diagnostic('DV_REF_RESOLVES', `/functions/${escapePointerToken(name)}/ref`, `Function ref must be exactly ${Key.of(ref)}.`, Key.of(declared)));
+}
+/**
+ * Validate one callable contract written at `pointer`, except its Policy (`validateContractPolicy`):
+ * its value schemas against the owner registry, its execution modifier and its admission age.
+ */
+export function validateContract(contract, pointer, registry, diagnostics) {
+    validateCallable(contract, pointer, registry, diagnostics);
+    validateCallableModifiers(contract, pointer, diagnostics);
+}
+/** Validate the execution modifier and admission age of one callable contract at `pointer`. */
+export function validateCallableModifiers(declaration, pointer, diagnostics) {
+    validateExecution(declaration, pointer, diagnostics);
+    validateAdmission(declaration, pointer, diagnostics);
+}
+/**
+ * An admission age is a whole number of seconds within the language ceiling. It has no zero
+ * spelling: an absent admission age is the one canonical form of a call admitted afresh.
+ */
+function validateAdmission(declaration, pointer, diagnostics) {
+    if (declaration.admission === undefined)
+        return;
+    if (isAdmissionMaxAge(declaration.admission.maxAge))
+        return;
+    diagnostics.push(diagnostic('DV_CALLABLE_ADMISSION', `${pointer}/admission/maxAge`, `An admission age is an integer number of seconds from 1 to ${MAXIMUM_ADMISSION_AGE_SECONDS}; omit it to admit every call afresh.`));
+}
 /**
  * An Execution records its initiating caller and its admitted input, from which the run is
  * resubmitted, and retains one portable outcome. A durable callable therefore needs a known caller,
@@ -34,6 +93,3 @@ function validateExecution(declaration, pointer, diagnostics) {
         diagnostics.push(diagnostic('DV_CALLABLE_IO', `${pointer}/output/mode`, 'A durable callable requires a value output.'));
     }
 }
-function escapePointer(value) {
-    return value.replaceAll('~', '~0').replaceAll('/', '~1');
-}

package/dist/v1/schema/validation/class.d.ts

@@ -1,10 +1,14 @@
 import type { ClassRef } from '../../addressing/index.js';
 import type { ClassDefinition } from '../../language/class/model/class.js';
+import type { ValueSchemaRegistry } from '../../language/value/reference/registry.js';
 import type { DefinitionAnalysisResult } from '../analysis/class.js';
 import type { SchemaDiagnostic } from '../diagnostic.js';
 import type { DomainResolutionContext } from '../resolution/context.js';
-/** Validate the semantic contracts owned by Class declarations. */
-export declare function validateDefinitions(environment: DomainResolutionContext, analysis: DefinitionAnalysisResult): readonly SchemaDiagnostic[];
+/**
+ * Validate the semantic contracts owned by Class declarations. `registry` is the candidate's value
+ * registry; each dependency's is built at most once, so the Classes share them.
+ */
+export declare function validateDefinitions(environment: DomainResolutionContext, analysis: DefinitionAnalysisResult, registry: ValueSchemaRegistry): readonly SchemaDiagnostic[];
 /** Whether `child` safely refines its parent Edge contract `parent`. */
 export declare function edgeContractRefines(environment: DomainResolutionContext, child: Extract<ClassDefinition, {
     readonly kind: 'edge';