@astrale-os/sdk 0.6.0-beta.36 → 0.6.0-beta.38

package/dist/application/action/context.d.ts

@@ -50,20 +50,23 @@ export interface DomainGraphExecutor<DomainValue extends Domain = Domain> {
 /** Whose authority one Kernel call exercises: the incoming caller's or the installed Domain's. */
 export type AuthorityMode = 'caller' | 'self';
 /**
- * One value per selectable authority. `self` exists in every invocation; `caller` exists only when
- * the call carried a credential, so it is absent from a call that carried none.
+ * One value per authority the code may act under. `self` exists in every invocation; `caller`
+ * exists only when the call carried a credential, so it is absent from a call that carried none.
  */
-export type AuthoritySelection<Value, Selectable extends AuthorityMode = AuthorityMode> = Readonly<Record<Selectable, Value> & {
-    readonly [Absent in Exclude<AuthorityMode, Selectable>]?: never;
+export type AuthoritySelection<Value, Authority extends AuthorityMode = AuthorityMode> = Readonly<Record<Authority, Value> & {
+    readonly [Absent in Exclude<AuthorityMode, Authority>]?: never;
 }>;
-export type DomainGraphExecutors<DomainValue extends Domain = Domain, Selectable extends AuthorityMode = AuthorityMode> = Readonly<DomainGraphExecutor<DomainValue> & AuthoritySelection<DomainGraphExecutor<DomainValue>, Selectable>>;
+export type DomainGraphExecutors<DomainValue extends Domain = Domain, Authority extends AuthorityMode = AuthorityMode> = Readonly<DomainGraphExecutor<DomainValue> & AuthoritySelection<DomainGraphExecutor<DomainValue>, Authority>>;
 /** Self-default Kernel session with one level of explicit authority selection. */
-export type DomainKernelSessions<Selectable extends AuthorityMode = AuthorityMode> = Readonly<BoundClientSession & AuthoritySelection<BoundClientSession, Selectable>>;
-/** What a handler holds toward the Kernel: the installed Domain authority by default. */
-interface DomainCapabilities<DomainValue extends Domain, Selectable extends AuthorityMode> {
-    readonly dependencies: HandlerDependencies<DomainValue, Selectable>;
-    readonly kernel: DomainKernelSessions<Selectable>;
-    readonly graph: DomainGraphExecutors<DomainValue, Selectable>;
+export type DomainKernelSessions<Authority extends AuthorityMode = AuthorityMode> = Readonly<BoundClientSession & AuthoritySelection<BoundClientSession, Authority>>;
+/**
+ * What code acting under `Authority` holds toward the Kernel and its dependencies, with the
+ * installed Domain authority by default. An Action and a durable Step receive the same capabilities.
+ */
+export interface DomainCapabilities<DomainValue extends Domain = Domain, Authority extends AuthorityMode = AuthorityMode> {
+    readonly dependencies: HandlerDependencies<DomainValue, Authority>;
+    readonly kernel: DomainKernelSessions<Authority>;
+    readonly graph: DomainGraphExecutors<DomainValue, Authority>;
     /** Convenience executor using the installed Domain authority (`graph.self`). */
     readonly query: QueryExecutor<DomainValue>;
     /** Convenience executor using the installed Domain authority (`graph.self`). */

package/dist/application/action/index.d.ts

@@ -1,5 +1,5 @@
 export { defineAction, isAction } from './define.js';
 export type { Action, ActionAddress, ActionAddressOf, ActionDefinition, CallableAtAddress, LocalCallable, ResolvedDomainOf, } from './action.js';
-export type { ActionContext, ActionBinaryInput, ActionExecution, AnonymousCaller, AuthenticatedCaller, AuthorityMode, AuthoritySelection, Caller, DomainGraphExecutor, DomainGraphExecutors, DomainKernelSessions, ResolvedCallable, } from './context.js';
+export type { ActionContext, ActionBinaryInput, ActionExecution, AnonymousCaller, AuthenticatedCaller, AuthorityMode, AuthoritySelection, Caller, DomainCapabilities, DomainGraphExecutor, DomainGraphExecutors, DomainKernelSessions, ResolvedCallable, } from './context.js';
 export type { ActionBinary, ActionOutputOf } from './output.js';
 export type { DeclaredErrorDefinition, DeclaredErrorFactory, DeclaredErrorFamily, DeclaredErrorOptions, DeclaredErrors, } from '../error/index.js';

package/dist/application/dependency/invoker.d.ts

@@ -1,5 +1,5 @@
 import type { Binary, Input } from '../../platform/client/index.js';
-import type { SessionRequestOptions, SessionRequestOptionsWithBody } from '../../platform/client/session/index.js';
+import type { ExecutionRef, SessionRequestOptions, SessionRequestOptionsWithBody } from '../../platform/client/session/index.js';
 import type { NodeId } from '../../platform/graph/node/index.js';
 import type { CallableInputOf, CallableInputModeOf, CallableOutputOf, CallableResultOf, Domain, ResolvedFunction, ResolvedMethod, KernelSchema, schema } from '../../platform/schema/index.js';
 import type { AuthorityMode, AuthoritySelection, LocalCallable } from '../action/index.js';
@@ -11,7 +11,13 @@ type WithInputMode<C, Mode extends 'value' | 'binary'> = C extends unknown ? Cal
 type ValueFunctionOrStaticMethodOf<D extends Domain> = WithInputMode<FunctionOrStaticMethodOf<D>, 'value'>;
 type BinaryFunctionOf<D extends Domain> = WithInputMode<Extract<LocalCallable<D>, ResolvedFunction>, 'binary'>;
 type DependencyInputOf<C> = C extends unknown ? unknown extends CallableInputOf<C> ? Input : [CallableInputOf<C>] extends [void] ? undefined : CallableInputOf<C> : never;
-type DependencyResultOf<C> = unknown extends CallableOutputOf<C> ? unknown : CallableResultOf<C, Binary>;
+type HandlerResultOf<C> = unknown extends CallableOutputOf<C> ? unknown : CallableResultOf<C, Binary>;
+/** A durable callable answers with its Execution, as the Kernel Client's typed reference does. */
+type DependencyResultOf<C> = C extends {
+    readonly execution: {
+        readonly durable: true;
+    };
+} ? ExecutionRef<HandlerResultOf<C>> : HandlerResultOf<C>;
 /** One declared dependency, bound to one explicitly selected invocation authority. */
 export interface DependencyInvoker<D extends Domain> {
     readonly invoke: {
@@ -25,7 +31,7 @@ export interface DependencyInvoker<D extends Domain> {
  * self is the executing Domain; caller forwards the incoming caller Identity, and is absent from a
  * call that carried no credential. The canonical Kernel is exposed through context.kernel.
  */
-export type HandlerDependencies<D extends Domain, Selectable extends AuthorityMode = AuthorityMode> = Readonly<{
-    [Alias in keyof D['dependencies'] as D['dependencies'][Alias] extends schema.DomainOf<KernelSchema> ? never : Alias]: AuthoritySelection<DependencyInvoker<Extract<D['dependencies'][Alias], Domain>>, Selectable>;
+export type HandlerDependencies<D extends Domain, Authority extends AuthorityMode = AuthorityMode> = Readonly<{
+    [Alias in keyof D['dependencies'] as D['dependencies'][Alias] extends schema.DomainOf<KernelSchema> ? never : Alias]: AuthoritySelection<DependencyInvoker<Extract<D['dependencies'][Alias], Domain>>, Authority>;
 }>;
 export {};

package/dist/application/integration/define.d.ts

@@ -1,5 +1,5 @@
 import type { IntegrationDefinition, Integrations } from './integration.js';
-import type { IntegrationOperation, IntegrationOperations, IntegrationReplay } from './operation.js';
+import type { IntegrationOperation, IntegrationOperations, IntegrationReplay, ReplayableIntegrationDecision } from './operation.js';
 import type { Provider, ProviderImplementation } from './provider.js';
 type RuntimeDefinition = IntegrationDefinition<string, IntegrationOperations>;
 type ProviderOperations = Readonly<Record<string, (...input: readonly unknown[]) => unknown>>;
@@ -12,6 +12,13 @@ export interface DefineIntegration {
         readonly id: Id;
         readonly operations: Operations;
     }): IntegrationDefinition<Id, Operations>;
+    /**
+     * One operation and what another attempt of it may do. A decision that is never `unsafe` keeps
+     * the operation available to code that may run more than once, such as a durable Step.
+     */
+    operation<Input = void, Output = void>(input: {
+        readonly replay: ReplayableIntegrationDecision | ((input: Input) => ReplayableIntegrationDecision);
+    }): IntegrationOperation<Input, Output, ReplayableIntegrationDecision['kind']>;
     operation<Input = void, Output = void>(input: {
         readonly replay: IntegrationReplay<Input>;
     }): IntegrationOperation<Input, Output>;

package/dist/application/integration/index.d.ts

@@ -2,7 +2,7 @@ export { createIntegrationClients, bindProviders } from './client.js';
 export type { IntegrationAttempt, IntegrationCallCoordinates, IntegrationClientFactory, IntegrationInvocationOwner, } from './client.js';
 export { admitIntegrations, defineIntegration, defineProvider, requireIntegration, requireProvider, } from './define.js';
 export type { DefineIntegration, ProviderBinding } from './define.js';
-export type { IntegrationClient, IntegrationClients, IntegrationDefinition, Integrations, } from './integration.js';
-export type { IntegrationExecution, IntegrationInput, IntegrationOperation, IntegrationOperations, IntegrationOutput, IntegrationReplay, IntegrationReplayDecision, } from './operation.js';
+export type { IntegrationClient, IntegrationClients, IntegrationDefinition, Integrations, ReplayableIntegrationClient, ReplayableIntegrationClients, } from './integration.js';
+export type { IntegrationExecution, IntegrationInput, IntegrationOperation, IntegrationOperations, IntegrationOutput, IntegrationReplay, IntegrationReplayDecision, IntegrationReplayKind, IntegrationReplayOf, ReplayableIntegrationDecision, } from './operation.js';
 export type { Provider, ProviderImplementation, Providers } from './provider.js';
 export type { IntegrationAuthentication, IntegrationMintInput } from './authentication.js';

package/dist/application/integration/integration.d.ts

@@ -1,4 +1,4 @@
-import type { IntegrationOperation, IntegrationOperations } from './operation.js';
+import type { IntegrationOperation, IntegrationOperations, IntegrationReplayOf } from './operation.js';
 declare const INTEGRATION_DEFINITION: unique symbol;
 export interface IntegrationDefinition<Id extends string = string, Operations extends IntegrationOperations = IntegrationOperations> {
     readonly kind: 'integration';
@@ -16,4 +16,16 @@ export type IntegrationClient<Definition extends IntegrationDefinition> = Readon
 export type IntegrationClients<Definitions extends Integrations> = Readonly<{
     [Name in keyof Definitions]: IntegrationClient<Definitions[Name]>;
 }>;
+type ReplayableOperationName<Definition extends IntegrationDefinition> = {
+    [Name in keyof Definition['operations']]: 'unsafe' extends IntegrationReplayOf<Definition['operations'][Name]> ? never : Name;
+}[keyof Definition['operations']];
+/** The operations of one Integration that may be attempted again: each is `safe` or keyed. */
+export type ReplayableIntegrationClient<Definition extends IntegrationDefinition> = Pick<IntegrationClient<Definition>, ReplayableOperationName<Definition>>;
+/**
+ * Integration clients of code that may run more than once, such as a durable Step. An operation
+ * whose replay decision may be `unsafe` is absent: another attempt could repeat its effect.
+ */
+export type ReplayableIntegrationClients<Definitions extends Integrations> = Readonly<{
+    [Name in keyof Definitions]: ReplayableIntegrationClient<Definitions[Name]>;
+}>;
 export {};

package/dist/application/integration/operation.d.ts

@@ -1,6 +1,7 @@
 import type { BoundClientSession } from '../../platform/client/session/index.js';
 import type { IntegrationAuthentication } from './authentication.js';
 declare const INTEGRATION_OPERATION: unique symbol;
+declare const INTEGRATION_REPLAY: unique symbol;
 export type IntegrationReplayDecision = {
     readonly kind: 'safe';
 } | {
@@ -13,6 +14,12 @@ export type IntegrationReplayDecision = {
 } | {
     readonly kind: 'unsafe';
 };
+/** What another attempt of an operation may do: anything, once per key, or nothing. */
+export type IntegrationReplayKind = IntegrationReplayDecision['kind'];
+/** A decision that allows another attempt of the operation. */
+export type ReplayableIntegrationDecision = Exclude<IntegrationReplayDecision, {
+    readonly kind: 'unsafe';
+}>;
 export type IntegrationReplay<Input> = IntegrationReplayDecision | ((input: Input) => IntegrationReplayDecision);
 export interface IntegrationExecution {
     readonly callId: string;
@@ -24,9 +31,11 @@ export interface IntegrationExecution {
     /** Domain-self transport authentication; absent only outside a Kernel invocation. */
     readonly auth?: IntegrationAuthentication;
 }
-export interface IntegrationOperation<Input = unknown, Output = unknown> {
+export interface IntegrationOperation<Input = unknown, Output = unknown, Replay extends IntegrationReplayKind = IntegrationReplayKind> {
     readonly replay: IntegrationReplay<Input>;
     readonly [INTEGRATION_OPERATION]: (input: Input) => Output;
+    /** Every kind its replay decision may take, as its definition proves them. */
+    readonly [INTEGRATION_REPLAY]: Replay;
 }
 export type IntegrationOperations = Readonly<Record<string, IntegrationOperation<never, unknown>>>;
 export type IntegrationInput<Operation> = Operation extends {
@@ -35,4 +44,8 @@ export type IntegrationInput<Operation> = Operation extends {
 export type IntegrationOutput<Operation> = Operation extends {
     readonly [INTEGRATION_OPERATION]: (input: never) => infer Output;
 } ? Output : never;
+/** The replay kinds an operation's definition proves; every kind when it proves none. */
+export type IntegrationReplayOf<Operation> = Operation extends {
+    readonly [INTEGRATION_REPLAY]: infer Replay;
+} ? Replay : IntegrationReplayKind;
 export {};

package/dist/application/mutation/execution/execute.js

@@ -10,7 +10,7 @@ export async function executeMutation(client, domain, definition, input) {
     const operation = realizeMutation(definition, domain);
     try {
         const ast = MutationAST.build((builder) => operation.build(input, richMutationBuilder(builder)));
-        return projectMutation(operation, await client.mutate(ast, { expected: domain.closure }), input);
+        return projectMutation(operation, await client.mutate(ast), input);
     }
     catch (cause) {
         const expected = mutationFailure(cause);

package/dist/application/mutation/failure.d.ts

@@ -1,6 +1,12 @@
 export interface KernelMutationFailure extends Error {
     readonly code: `MUTATION_${string}`;
     readonly outcomeKnown: boolean;
+    /**
+     * The post-state rule a `MUTATION_POST_STATE_INVALID` refusal names, such as `duplicate-key`
+     * for a value a Class key already holds. Absent when the Kernel names none, and for every other
+     * refusal.
+     */
+    readonly rule?: string;
 }
 export interface StateTransitionFailure extends Error {
     readonly code: 'STATE_TRANSITION_ILLEGAL';

package/dist/application/mutation/failure.js

@@ -13,9 +13,10 @@ export function stateTransitionFailure(from, event) {
 export function mutationFailure(input) {
     if (!(input instanceof Error))
         return undefined;
-    const code = mutationCode(input);
-    if (code === undefined)
+    const reason = mutationReason(input);
+    if (reason === undefined)
         return undefined;
+    const { code } = reason;
     const explicit = input.outcomeKnown;
     if (explicit !== undefined && typeof explicit !== 'boolean')
         return undefined;
@@ -28,30 +29,35 @@ export function mutationFailure(input) {
             return undefined;
         return input;
     }
+    const rule = code === 'MUTATION_POST_STATE_INVALID' ? reason.rule : undefined;
     return Object.assign(new Error(input.message, { cause: input }), {
         code,
         outcomeKnown: explicit !== false && !UNKNOWN_OUTCOME_CODES.has(code),
+        ...(rule === undefined ? {} : { rule }),
     });
 }
-function mutationCode(input) {
+/**
+ * The Mutation refusal an error carries, on itself, as its Kernel reason, or as its protocol data:
+ * its code and, from the same carrier's details, the post-state rule it names.
+ */
+function mutationReason(input) {
     const value = input;
     if (value.code === 'STATE_TRANSITION_ILLEGAL')
-        return value.code;
-    for (const candidate of [
-        value.code,
-        directOrNestedCode(value.reason),
-        directOrNestedCode(value.data),
-    ]) {
-        if (typeof candidate === 'string' && candidate.startsWith('MUTATION_')) {
-            return candidate;
-        }
+        return { code: value.code };
+    for (const carrier of [value, value.reason, value.data]) {
+        const code = typeof carrier === 'string' ? carrier : field(carrier, 'code');
+        if (typeof code !== 'string' || !code.startsWith('MUTATION_'))
+            continue;
+        const rule = field(field(carrier, 'details'), 'rule');
+        return {
+            code: code,
+            ...(typeof rule === 'string' ? { rule } : {}),
+        };
     }
     return undefined;
 }
-function directOrNestedCode(input) {
-    return typeof input === 'string'
-        ? input
-        : input !== null && typeof input === 'object' && !Array.isArray(input)
-            ? Reflect.get(input, 'code')
-            : undefined;
+function field(input, key) {
+    return input !== null && typeof input === 'object' && !Array.isArray(input)
+        ? Reflect.get(input, key)
+        : undefined;
 }

package/dist/application/query/collection/union.js

@@ -1,5 +1,5 @@
+import { definedClass } from '@astrale-os/kernel-client/graph';
 import { Query, QueryAST as QueryDocument } from '@astrale-os/kernel-core/graph/query';
-import { ClassKey } from '@astrale-os/kernel-dsl/v1/addressing';
 import { QueryCompositionError } from '../composite/errors.js';
 import { collectionIdentityOf } from './identity.js';
 import { COLLECTION_QUERY_LIMITS } from './limits.js';
@@ -80,8 +80,13 @@ export function partitionCollectionUnion(domain, compiled, values, maximumLogica
         if (identities.has(identity))
             invalid(`Collection union returned duplicate identity ${identity}.`);
         identities.add(identity);
-        const names = memberships.get(value.class) ?? memberNames(domain, compiled, value);
+        const names = memberships.has(value.class)
+            ? memberships.get(value.class)
+            : memberNames(domain, compiled, value);
         memberships.set(value.class, names);
+        // A Class added after this client was built belongs to no member it can name.
+        if (names === undefined)
+            continue;
         if (names.length === 0) {
             invalid(`Collection union returned ${value.class} outside every member extent.`);
         }
@@ -105,9 +110,11 @@ function realizeMember(definition, domain, outputPath, name) {
     }
 }
 function memberNames(domain, compiled, value) {
-    const exact = domain.definition(ClassKey.ref(ClassKey(value.class)));
+    const exact = definedClass(domain, value.class);
+    if (exact === undefined)
+        return undefined;
     const kind = valueKind(value);
-    if (exact?.ref.kind !== 'class' || exact.kind !== kind || exact.abstract) {
+    if (exact.kind !== kind || exact.abstract) {
         invalid(`Collection union returned inactive ${kind} Class ${value.class}.`);
     }
     const names = compiled.members.flatMap((member) => {

package/dist/application/query/conformance.d.ts

@@ -0,0 +1,15 @@
+import type { QueryResult } from '@astrale-os/kernel-core/graph/query';
+import type { Edge } from '../../platform/graph/edge/index.js';
+import type { Node } from '../../platform/graph/node/index.js';
+import type { Domain } from '../../platform/schema/index.js';
+/**
+ * The members of `values` whose Class `domain` defines, in order. The Kernel answers in its active
+ * Schema, so a result may hold values of a Class added after the client was built.
+ */
+export declare function definedValues<Value extends Node | Edge>(domain: Domain, values: readonly Value[]): readonly Value[];
+/**
+ * Check every value of `result` against the Domain this client was built from, by the Kernel
+ * Client's rule: a value fails only when a Property its Class defines holds an invalid value or a
+ * required one is absent. Properties and Classes the client does not know pass.
+ */
+export declare function requireConformance(domain: Domain, result: QueryResult): void;

package/dist/application/query/conformance.js

@@ -0,0 +1,46 @@
+import { definedClass, validateDefinedProperties } from '@astrale-os/kernel-client/graph';
+import { collectionIdentityOf } from './collection/identity.js';
+import { QueryValueMismatchError } from './failure.js';
+/**
+ * The members of `values` whose Class `domain` defines, in order. The Kernel answers in its active
+ * Schema, so a result may hold values of a Class added after the client was built.
+ */
+export function definedValues(domain, values) {
+    const defined = values.filter((value) => definedClass(domain, value.class) !== undefined);
+    return defined.length === values.length ? values : Object.freeze(defined);
+}
+/**
+ * Check every value of `result` against the Domain this client was built from, by the Kernel
+ * Client's rule: a value fails only when a Property its Class defines holds an invalid value or a
+ * required one is absent. Properties and Classes the client does not know pass.
+ */
+export function requireConformance(domain, result) {
+    for (const value of valuesOf(result)) {
+        const exact = definedClass(domain, value.class);
+        if (exact === undefined)
+            continue;
+        const [diagnostic] = validateDefinedProperties(exact, value.props);
+        if (diagnostic !== undefined) {
+            throw new QueryValueMismatchError(`${collectionIdentityOf(value)} at ${diagnostic.pointer}: ${diagnostic.message}`);
+        }
+    }
+}
+function* valuesOf(result) {
+    if (result.kind === 'graph') {
+        yield* result.graph.nodes;
+        yield* result.graph.edges;
+        return;
+    }
+    if (result.kind === 'nodes') {
+        for (const item of result.nodes)
+            if (item.kind === 'value')
+                yield item.value;
+        return;
+    }
+    for (const item of result.edges) {
+        for (const component of [item.edge, item.source, item.target]) {
+            if (component.kind === 'value')
+                yield component.value;
+        }
+    }
+}

package/dist/application/query/define.js

@@ -3,6 +3,7 @@ import { isDomain } from '@astrale-os/kernel-dsl/v1/domain';
 import { requireUniqueCollectionValues } from './collection/identity.js';
 import { COLLECTION_QUERY_LIMITS } from './collection/limits.js';
 import { realizeCollectionQuery, registerCollectionQuery, } from './collection/metadata.js';
+import { definedValues } from './conformance.js';
 import { queryResult } from './single/index.js';
 const DEFAULT_PAGE_SIZE = 256;
 const MAXIMUM_PAGES = 1_024;
@@ -27,7 +28,7 @@ export function defineCollectionQuery() {
                         kind: 'nodes',
                         projection: { kind: 'value' },
                     }),
-                    project: (pages) => requireUniqueCollectionValues(queryResult.completeNodeValues(pages, specification.id), `Collection Query ${specification.id}`),
+                    project: (pages) => definedValues(domain, requireUniqueCollectionValues(queryResult.completeNodeValues(pages, specification.id), `Collection Query ${specification.id}`)),
                 };
             }
             return {
@@ -38,12 +39,12 @@ export function defineCollectionQuery() {
                     kind: 'edges',
                     projection: { edge: 'value', source: 'reference', target: 'reference' },
                 }),
-                project: (pages) => requireUniqueCollectionValues(Object.freeze(pages.flatMap((page) => queryResult.edgeItems(page, specification.id).map((item) => {
+                project: (pages) => definedValues(domain, requireUniqueCollectionValues(Object.freeze(pages.flatMap((page) => queryResult.edgeItems(page, specification.id).map((item) => {
                     if (item.edge.kind !== 'value') {
                         throw new TypeError(`Collection Query ${specification.id} must project Edge values.`);
                     }
                     return item.edge.value;
-                }))), `Collection Query ${specification.id}`),
+                }))), `Collection Query ${specification.id}`)),
             };
         });
         registerCollectionQuery(definition, project);

package/dist/application/query/execution/execute.d.ts

@@ -6,7 +6,6 @@ import type { QueryDefinition } from '../query.js';
 export interface QueryClient {
     query<Ast extends QueryAST>(ast: Ast, options: {
         readonly page: QueryPageRequest;
-        readonly expected?: Domain['closure'];
     }): Promise<QueryResponse<QueryResultFor<Ast>>>;
 }
 export declare function executeQuery<DomainValue extends Domain, Output>(client: QueryClient, domain: DomainValue, query: QueryDefinition<DomainValue, void, Output>): Promise<Output>;

package/dist/application/query/execution/execute.js

@@ -1,6 +1,7 @@
 import { COLLECTION_QUERY_LIMITS } from '../collection/limits.js';
 import { compileCollectionUnion, partitionCollectionUnion } from '../collection/union.js';
 import { createQueryComposition, executeQueryPlan } from '../composite/index.js';
+import { requireConformance } from '../conformance.js';
 import { realizeQuery } from '../define.js';
 import { queryFailure } from '../failure.js';
 import { completeSelection, queryResult } from '../single/index.js';
@@ -9,7 +10,12 @@ export async function executeQuery(client, domain, query, input) {
     if (client === null || typeof client !== 'object' || typeof client.query !== 'function') {
         throw new TypeError('Query execution requires a Client query capability.');
     }
-    const execute = (ast, options) => client.query(ast, { ...options, expected: domain.closure });
+    // The Kernel answers in its active Schema; each value is checked against this client's Domain.
+    const execute = async (ast, options) => {
+        const response = await client.query(ast, options);
+        requireConformance(domain, response.result);
+        return response;
+    };
     const operation = realizeQuery(query, domain);
     try {
         if (operation.kind === 'single') {

package/dist/application/query/failure.d.ts

@@ -7,4 +7,12 @@ export declare class QueryPaginationError extends Error implements QueryFailure
     readonly name = "QueryPaginationError";
     constructor(code: QueryPaginationErrorCode, message: string);
 }
+/**
+ * A value the Kernel returned does not have the shape its Class has in the Domain this client was
+ * built from: one of its Properties changed type, or a Property the client requires is absent.
+ */
+export declare class QueryValueMismatchError extends Error implements QueryFailure {
+    readonly name = "QueryValueMismatchError";
+    readonly code = "QUERY_VALUE_MISMATCH";
+}
 export declare function queryFailure(input: unknown): QueryFailure | undefined;

package/dist/application/query/failure.js

@@ -6,6 +6,14 @@ export class QueryPaginationError extends Error {
         this.code = code;
     }
 }
+/**
+ * A value the Kernel returned does not have the shape its Class has in the Domain this client was
+ * built from: one of its Properties changed type, or a Property the client requires is absent.
+ */
+export class QueryValueMismatchError extends Error {
+    name = 'QueryValueMismatchError';
+    code = 'QUERY_VALUE_MISMATCH';
+}
 export function queryFailure(input) {
     if (!(input instanceof Error))
         return undefined;

package/dist/application/query/index.d.ts

@@ -1,7 +1,7 @@
 export { defineCollectionQuery, defineCompositeQuery, defineQuery, realizeQuery } from './define.js';
 export type { CollectionQuerySpec } from './collection/metadata.js';
 export { executeQuery, type QueryClient, type QueryExecutor } from './execution/index.js';
-export { QueryPaginationError, type QueryFailure, type QueryPaginationErrorCode, } from './failure.js';
+export { QueryPaginationError, QueryValueMismatchError, type QueryFailure, type QueryPaginationErrorCode, } from './failure.js';
 export type { CollectionQueryDefinition, CollectionValue, CompositeQueryDefinition, QueryAstOf, QueryDefinition, QueryInputOf, QueryOutputOf, SingleQueryDefinition, } from './query.js';
 export { queryResult } from './single/index.js';
 export type { CompleteQueryProjectionContext, PaginatedQuery, ProjectedQuery, QueryPages, QueryPagination, QueryProjectionContext, RawQuery, SingleQuery, } from './single/index.js';

package/dist/application/query/index.js

@@ -1,6 +1,6 @@
 export { defineCollectionQuery, defineCompositeQuery, defineQuery, realizeQuery } from './define.js';
 export { executeQuery } from './execution/index.js';
-export { QueryPaginationError, } from './failure.js';
+export { QueryPaginationError, QueryValueMismatchError, } from './failure.js';
 export { queryResult } from './single/index.js';
 /** Canonical Query language and authoring values accept DSL ResolvedClass directly. */
 export * from '@astrale-os/kernel-core/graph/query';

package/dist/application/workflow/authoring.d.ts

@@ -1,5 +1,5 @@
 export { defineWorkflow } from './define.js';
 export type { InlineWorkflowContext, WorkflowContext } from './context.js';
-export type { DurableCallable, DurableExecution, DurableStep, DurableStepAuthority, DurableWorkflowContext, } from './durable.js';
+export type { DurableCallable, DurableExecution, DurableStep, DurableStepAuthority, DurableWorkflowContext, SignalOutcome, } from './durable.js';
 export type { Workflow, WorkflowAddress, WorkflowDefinition, WorkflowOptions } from './workflow.js';
 export type { DeclaredErrorDefinition, DeclaredErrorFactory, DeclaredErrorFamily, DeclaredErrorOptions, DeclaredErrors, } from '../error/index.js';

package/dist/application/workflow/context.d.ts

@@ -12,4 +12,4 @@ export type InlineWorkflowContext<Callable extends ResolvedCallable, DomainValue
  * Exact Workflow context for one callable: engine-journaled when its Schema declares
  * `execution: { durable: true }`, otherwise run inside its invocation.
  */
-export type WorkflowContext<Callable extends ResolvedCallable, DomainValue extends Domain = Domain, Definitions extends Integrations = Readonly<Record<never, never>>, Errors extends DeclaredErrors = NoDeclaredErrors> = Callable extends DurableCallable ? DurableWorkflowContext<Callable, DomainValue, Errors> : InlineWorkflowContext<Callable, DomainValue, Definitions, Errors>;
+export type WorkflowContext<Callable extends ResolvedCallable, DomainValue extends Domain = Domain, Definitions extends Integrations = Readonly<Record<never, never>>, Errors extends DeclaredErrors = NoDeclaredErrors> = Callable extends DurableCallable ? DurableWorkflowContext<Callable, DomainValue, Definitions, Errors> : InlineWorkflowContext<Callable, DomainValue, Definitions, Errors>;

package/dist/application/workflow/durable.d.ts

@@ -1,11 +1,14 @@
 import type { IssuerId } from '../../platform/auth/index.js';
-import type { BoundClientSession, ExecutionOutcome, ExecutionRef } from '../../platform/client/session/index.js';
+import type { ExecutionOutcome, ExecutionRef } from '../../platform/client/session/index.js';
 import type { NodeId } from '../../platform/graph/node/index.js';
 import type { CallableInputOf, Domain, ResolvedMethod } from '../../platform/schema/index.js';
 import type { Value } from '../../platform/value/index.js';
+import type { DomainCapabilities, DomainKernelSessions } from '../action/index.js';
+import type { HandlerDependencies } from '../dependency/index.js';
 import type { DeclaredErrorFactory, DeclaredErrors, NoDeclaredErrors } from '../error/index.js';
+import type { Integrations, ReplayableIntegrationClients } from '../integration/index.js';
 import type { Mutation, MutationExecutor } from '../mutation/index.js';
-import type { QueryExecutor } from '../query/index.js';
+import type { QueryDefinition } from '../query/index.js';
 /** A callable whose Schema declares `execution: { durable: true }`. */
 export interface DurableCallable {
     readonly execution: {
@@ -31,31 +34,46 @@ export interface DurableExecution {
     readonly receiver?: NodeId;
 }
 /**
- * The Domain's own authority inside one Step. Kernel access exists only here, so every Kernel call
- * belongs to a journaled Step and a replay never repeats it.
+ * What one Step holds: the capabilities of an Action, acting as the Domain alone. Kernel access
+ * exists only here, so every Kernel call belongs to a journaled Step and a replay never repeats it.
+ * Every key below comes from one sequence derived from the Execution, the Step and the position of
+ * the call, which restarts with each attempt: a retried Step sends the same keys again.
  */
-export interface DurableStepAuthority<DomainValue extends Domain = Domain> {
+export interface DurableStepAuthority<DomainValue extends Domain = Domain, Definitions extends Integrations = Readonly<Record<never, never>>> extends DomainCapabilities<DomainValue, 'self'> {
     /**
      * Kernel Session acting as the Domain. Each `invoke` of a durable callable without an explicit
-     * `idempotencyKey` carries one derived from the Execution, the Step and its position, so a
-     * retried Step reaches the same durable child Execution. An `invoke` of any other callable
-     * carries no key, which the Kernel would refuse, and runs again when the Step is retried.
+     * `idempotencyKey` carries the next derived key, so a retried Step reaches the same durable child
+     * Execution. An `invoke` of any other callable carries no key, which the Kernel would refuse, and
+     * runs again when the Step is retried.
      */
-    readonly kernel: BoundClientSession;
-    readonly query: QueryExecutor<DomainValue>;
+    readonly kernel: DomainKernelSessions<'self'>;
+    /** Dependency invokers acting as the Domain, keyed like `kernel.invoke`. */
+    readonly dependencies: HandlerDependencies<DomainValue, 'self'>;
     /**
-     * Each Mutation carries a key derived from the Execution, the Step and its position. The Kernel
-     * commits a receipt with the write and answers a retried Step with its first result.
+     * Each Mutation carries the next derived key. The Kernel commits a receipt with the write and
+     * answers a retried Step with its first result.
      */
     readonly mutate: MutationExecutor<DomainValue>;
+    /**
+     * Operations a retried Step may attempt again. A keyed operation of source `execution` receives
+     * the next derived key as its idempotency key. An operation whose decision may be `unsafe` is
+     * absent, and refused before its Provider runs if its decision is `unsafe` anyway.
+     */
+    readonly integrations: ReplayableIntegrationClients<Definitions>;
 }
-export interface DurableStep<DomainValue extends Domain = Domain> {
+export interface DurableStep<DomainValue extends Domain = Domain, Definitions extends Integrations = Readonly<Record<never, never>>> {
     /**
      * Run `execute` once and journal its portable output; a replay returns the journaled output. A
-     * Step may run again when its outcome was not journaled: its Mutations and durable calls are
-     * answered from their keys, and any other effect must be idempotent.
+     * Step may run again when its outcome was not journaled: its Mutations, durable calls and keyed
+     * Integration operations are answered from their keys, and any other effect must be idempotent.
      */
-    run<Output>(id: string, execute: (authority: DurableStepAuthority<DomainValue>) => Output | Promise<Output>): Promise<Output>;
+    run<Output>(id: string, execute: (authority: DurableStepAuthority<DomainValue, Definitions>) => Output | Promise<Output>): Promise<Output>;
+    /**
+     * One journaled Query. A replay returns the result of its first run, so a later Step that depends
+     * on it resends the same request whenever it is retried.
+     */
+    query<Output>(id: string, query: QueryDefinition<DomainValue, void, Output>): Promise<Output>;
+    query<Input, Output>(id: string, query: QueryDefinition<DomainValue, Input, Output>, input: Input): Promise<Output>;
     /**
      * One journaled Mutation. A Step replayed after its commit receives the result of that commit
      * from the Kernel's receipt instead of writing again.
@@ -67,18 +85,35 @@ type DurableSelfOf<Callable> = Callable extends ResolvedMethod<unknown, unknown,
 } : {
     readonly self?: never;
 };
+/** What a bounded wait for a signal ended with: the signal's value, or its timeout. */
+export type SignalOutcome<Signal extends Value = Value> = {
+    readonly kind: 'signal';
+    readonly value: Signal;
+} | {
+    readonly kind: 'timeout';
+};
 /** Context of a durable Workflow: engine-journaled, acting as its Domain. */
-export type DurableWorkflowContext<Callable, DomainValue extends Domain = Domain, Errors extends DeclaredErrors = NoDeclaredErrors> = {
+export type DurableWorkflowContext<Callable, DomainValue extends Domain = Domain, Definitions extends Integrations = Readonly<Record<never, never>>, Errors extends DeclaredErrors = NoDeclaredErrors> = {
     readonly domain: DomainValue;
     readonly input: CallableInputOf<Callable>;
     readonly execution: DurableExecution;
     /** Construct one implementation-declared safe business error for `throw error(...)`. */
     readonly error: DeclaredErrorFactory<Errors>;
-    readonly step: DurableStep<DomainValue>;
+    readonly step: DurableStep<DomainValue, Definitions>;
     /** Durable timer kept by the engine, even while the Domain is idle or down. */
     sleep(durationMs: number): Promise<void>;
-    /** Resolve once `Execution.signal({ name, value })` delivers `name`, before or during the wait. */
-    promise<Signal extends Value = Value>(name: string): Promise<Signal>;
+    /**
+     * Wait for the value `Execution.signal({ name, value })` delivers once under `name`, whether it
+     * was sent before or during the wait.
+     */
+    awaitSignal<Signal extends Value = Value>(name: string): Promise<Signal>;
+    /**
+     * Wait at most `timeoutMs` for the signal `name`. The engine journals which came first, so a
+     * replay answers the same. A signal sent after the timeout is kept for a later wait.
+     */
+    awaitSignal<Signal extends Value = Value>(name: string, options: {
+        readonly timeoutMs: number;
+    }): Promise<SignalOutcome<Signal>>;
     /** Whether `error` is the engine's cooperative cancellation, which the Workflow may compensate. */
     cancelled(error: unknown): boolean;
     /** Wait durably for another Execution to end, by journaled polling of its `result`. */