@astrale-os/sdk 0.6.0-beta.4 → 0.6.0-beta.41

package/dist/application/dependency/invoker.d.ts

@@ -1,26 +1,37 @@
 import type { Binary, Input } from '../../platform/client/index.js';
-import type { SessionRequestOptions } from '../../platform/client/session/index.js';
+import type { ExecutionRef, SessionRequestOptions, SessionRequestOptionsWithBody } from '../../platform/client/session/index.js';
 import type { NodeId } from '../../platform/graph/node/index.js';
-import type { CallableInputOf, CallableOutputOf, CallableResultOf, Domain, ResolvedMethod, KernelSchema, schema } from '../../platform/schema/index.js';
-import type { LocalCallable } from '../action/index.js';
-export type DependencyCallOptions = Pick<SessionRequestOptions, 'timeoutMs' | 'idempotencyKey'>;
+import type { CallableInputOf, CallableInputModeOf, CallableOutputOf, CallableResultOf, Domain, ResolvedFunction, ResolvedMethod, KernelSchema, schema } from '../../platform/schema/index.js';
+import type { AuthorityMode, AuthoritySelection, LocalCallable } from '../action/index.js';
+export type DependencyCallOptions = Pick<SessionRequestOptions, 'timeoutMs' | 'idempotencyKey' | 'body'>;
+export type DependencyBinaryCallOptions = Pick<SessionRequestOptionsWithBody, 'timeoutMs' | 'idempotencyKey' | 'body'>;
 type InstanceMethodOf<D extends Domain> = Extract<LocalCallable<D>, ResolvedMethod<unknown, unknown, false>>;
 type FunctionOrStaticMethodOf<D extends Domain> = Exclude<LocalCallable<D>, ResolvedMethod<unknown, unknown, false>>;
+type WithInputMode<C, Mode extends 'value' | 'binary'> = C extends unknown ? CallableInputModeOf<C> extends Mode ? C : never : never;
+type ValueFunctionOrStaticMethodOf<D extends Domain> = WithInputMode<FunctionOrStaticMethodOf<D>, 'value'>;
+type BinaryFunctionOf<D extends Domain> = WithInputMode<Extract<LocalCallable<D>, ResolvedFunction>, 'binary'>;
 type DependencyInputOf<C> = C extends unknown ? unknown extends CallableInputOf<C> ? Input : [CallableInputOf<C>] extends [void] ? undefined : CallableInputOf<C> : never;
-type DependencyResultOf<C> = unknown extends CallableOutputOf<C> ? unknown : CallableResultOf<C, Binary>;
+type HandlerResultOf<C> = unknown extends CallableOutputOf<C> ? unknown : CallableResultOf<C, Binary>;
+/** A durable callable answers with its Execution, as the Kernel Client's typed reference does. */
+type DependencyResultOf<C> = C extends {
+    readonly execution: {
+        readonly durable: true;
+    };
+} ? ExecutionRef<HandlerResultOf<C>> : HandlerResultOf<C>;
 /** One declared dependency, bound to one explicitly selected invocation authority. */
 export interface DependencyInvoker<D extends Domain> {
     readonly invoke: {
-        <const C extends FunctionOrStaticMethodOf<D>>(select: (domain: D) => C, input: NoInfer<DependencyInputOf<C>>, options?: DependencyCallOptions): Promise<DependencyResultOf<C>>;
+        <const C extends ValueFunctionOrStaticMethodOf<D>>(select: (domain: D) => C, input: NoInfer<DependencyInputOf<C>>, options?: DependencyCallOptions): Promise<DependencyResultOf<C>>;
         <const C extends InstanceMethodOf<D>>(select: (domain: D) => C, instance: NodeId, input: NoInfer<DependencyInputOf<C>>, options?: DependencyCallOptions): Promise<DependencyResultOf<C>>;
+        <const C extends BinaryFunctionOf<D>>(select: (domain: D) => C, metadata: NoInfer<DependencyInputOf<C>>, options: DependencyBinaryCallOptions): Promise<DependencyResultOf<C>>;
     };
 }
 /**
  * Direct Schema aliases with explicit authority selection and no default invoke.
- * self is the executing Domain; caller forwards the incoming Grant; union combines both.
- * The canonical Kernel is exposed through context.kernel.
+ * self is the executing Domain; caller forwards the incoming caller Identity, and is absent from a
+ * call that carried no credential. The canonical Kernel is exposed through context.kernel.
  */
-export type HandlerDependencies<D extends Domain> = Readonly<{
-    [Alias in keyof D['dependencies'] as D['dependencies'][Alias] extends schema.DomainOf<KernelSchema> ? never : Alias]: Readonly<Record<'caller' | 'self' | 'union', DependencyInvoker<Extract<D['dependencies'][Alias], Domain>>>>;
+export type HandlerDependencies<D extends Domain, Authority extends AuthorityMode = AuthorityMode> = Readonly<{
+    [Alias in keyof D['dependencies'] as D['dependencies'][Alias] extends schema.DomainOf<KernelSchema> ? never : Alias]: AuthoritySelection<DependencyInvoker<Extract<D['dependencies'][Alias], Domain>>, Authority>;
 }>;
 export {};

package/dist/application/domain.d.ts

@@ -0,0 +1,30 @@
+import type { ClassIcon, schema } from '../platform/schema/index.js';
+import type { Requirements } from './requirements/index.js';
+import type { Routes } from './routes/index.js';
+import type { Runtime, SchemaOfRuntime as RuntimeSchemaOf } from './runtime/index.js';
+import type { Frontend } from './view/index.js';
+declare const DOMAIN_DEFINITION_IDENTITY: unique symbol;
+declare const DOMAIN_DEFINITION_SCHEMA: unique symbol;
+/** Schema-independent type witness shared by every admitted Domain definition. */
+export interface DomainDefinitionIdentity {
+    readonly [DOMAIN_DEFINITION_IDENTITY]: true;
+}
+/** Inert source/build composition of one Domain: its exact Schema and authored Runtime. */
+export interface DomainDefinition<Schema extends schema.DomainSchema = schema.DomainSchema, RuntimeValue extends Runtime<Schema> = Runtime<Schema>, FrontendValue extends Frontend<Schema> | undefined = undefined, RoutesValue extends Routes | undefined = undefined, RequirementsValue extends Requirements | undefined = undefined> extends DomainDefinitionIdentity {
+    readonly schema: Schema;
+    readonly runtime: RuntimeValue;
+    readonly frontend?: FrontendValue;
+    readonly routes?: RoutesValue;
+    readonly requirements?: RequirementsValue;
+    /** The application's icon. */
+    readonly icon?: ClassIcon;
+    readonly [DOMAIN_DEFINITION_SCHEMA]: (schema: Schema) => Schema;
+}
+export type SchemaOfDomainDefinition<Value> = Value extends {
+    readonly schema: infer Schema;
+} ? Extract<Schema, schema.DomainSchema> : never;
+export type RuntimeOfDomainDefinition<Value> = Value extends {
+    readonly runtime: infer RuntimeValue;
+} ? Extract<RuntimeValue, Runtime> : never;
+export type SchemaOfRuntime<Value> = RuntimeSchemaOf<Value>;
+export {};

package/dist/application/index.d.ts

@@ -1,9 +1,9 @@
-export { defineApplication, isApplication } from './define.js';
-export type { ApplicationInput } from './define.js';
+export { defineDomain, isDomainDefinition } from './define.js';
+export type { DomainDefinitionInput } from './define.js';
 export { requirements } from './requirements/index.js';
 export type { AuthorityRequirements, AuthorityRequirementsInput, ClassOperation, ClassRequirement, ClassRequirementInput, CoreRequirement, CoreRequirementInput, FunctionRequirementTarget, Requirements, RequirementsInput, } from './requirements/index.js';
 export { route, routes } from './routes/index.js';
 export type { Route, RouteInput, RouteTarget, Routes } from './routes/index.js';
 export { defineFrontend, external, vite } from './view/index.js';
-export type { Frontend, FrontendInput, FrontendSource, IframeRequirements, ViewHostRequirements, } from './view/index.js';
-export type { Application, ApplicationIdentity, RuntimeOfApplication, SchemaOfApplication, SchemaOfRuntime, } from './application.js';
+export type { Frontend, FrontendInput, FrontendSource, ViewHostRequirements } from './view/index.js';
+export type { DomainDefinition, DomainDefinitionIdentity, RuntimeOfDomainDefinition, SchemaOfDomainDefinition, SchemaOfRuntime, } from './domain.js';

package/dist/application/index.js

@@ -1,4 +1,4 @@
-export { defineApplication, isApplication } from './define.js';
+export { defineDomain, isDomainDefinition } from './define.js';
 export { requirements } from './requirements/index.js';
 export { route, routes } from './routes/index.js';
 export { defineFrontend, external, vite } from './view/index.js';

package/dist/application/integration/define.d.ts

@@ -1,5 +1,5 @@
 import type { IntegrationDefinition, Integrations } from './integration.js';
-import type { IntegrationOperation, IntegrationOperations, IntegrationReplay } from './operation.js';
+import type { IntegrationOperation, IntegrationOperations, IntegrationReplay, ReplayableIntegrationDecision } from './operation.js';
 import type { Provider, ProviderImplementation } from './provider.js';
 type RuntimeDefinition = IntegrationDefinition<string, IntegrationOperations>;
 type ProviderOperations = Readonly<Record<string, (...input: readonly unknown[]) => unknown>>;
@@ -12,6 +12,13 @@ export interface DefineIntegration {
         readonly id: Id;
         readonly operations: Operations;
     }): IntegrationDefinition<Id, Operations>;
+    /**
+     * One operation and what another attempt of it may do. A decision that is never `unsafe` keeps
+     * the operation available to code that may run more than once, such as a durable Step.
+     */
+    operation<Input = void, Output = void>(input: {
+        readonly replay: ReplayableIntegrationDecision | ((input: Input) => ReplayableIntegrationDecision);
+    }): IntegrationOperation<Input, Output, ReplayableIntegrationDecision['kind']>;
     operation<Input = void, Output = void>(input: {
         readonly replay: IntegrationReplay<Input>;
     }): IntegrationOperation<Input, Output>;

package/dist/application/integration/index.d.ts

@@ -2,7 +2,7 @@ export { createIntegrationClients, bindProviders } from './client.js';
 export type { IntegrationAttempt, IntegrationCallCoordinates, IntegrationClientFactory, IntegrationInvocationOwner, } from './client.js';
 export { admitIntegrations, defineIntegration, defineProvider, requireIntegration, requireProvider, } from './define.js';
 export type { DefineIntegration, ProviderBinding } from './define.js';
-export type { IntegrationClient, IntegrationClients, IntegrationDefinition, Integrations, } from './integration.js';
-export type { IntegrationExecution, IntegrationInput, IntegrationOperation, IntegrationOperations, IntegrationOutput, IntegrationReplay, IntegrationReplayDecision, } from './operation.js';
+export type { IntegrationClient, IntegrationClients, IntegrationDefinition, Integrations, ReplayableIntegrationClient, ReplayableIntegrationClients, } from './integration.js';
+export type { IntegrationExecution, IntegrationInput, IntegrationOperation, IntegrationOperations, IntegrationOutput, IntegrationReplay, IntegrationReplayDecision, IntegrationReplayKind, IntegrationReplayOf, ReplayableIntegrationDecision, } from './operation.js';
 export type { Provider, ProviderImplementation, Providers } from './provider.js';
 export type { IntegrationAuthentication, IntegrationMintInput } from './authentication.js';

package/dist/application/integration/integration.d.ts

@@ -1,4 +1,4 @@
-import type { IntegrationOperation, IntegrationOperations } from './operation.js';
+import type { IntegrationOperation, IntegrationOperations, IntegrationReplayOf } from './operation.js';
 declare const INTEGRATION_DEFINITION: unique symbol;
 export interface IntegrationDefinition<Id extends string = string, Operations extends IntegrationOperations = IntegrationOperations> {
     readonly kind: 'integration';
@@ -16,4 +16,16 @@ export type IntegrationClient<Definition extends IntegrationDefinition> = Readon
 export type IntegrationClients<Definitions extends Integrations> = Readonly<{
     [Name in keyof Definitions]: IntegrationClient<Definitions[Name]>;
 }>;
+type ReplayableOperationName<Definition extends IntegrationDefinition> = {
+    [Name in keyof Definition['operations']]: 'unsafe' extends IntegrationReplayOf<Definition['operations'][Name]> ? never : Name;
+}[keyof Definition['operations']];
+/** The operations of one Integration that may be attempted again: each is `safe` or keyed. */
+export type ReplayableIntegrationClient<Definition extends IntegrationDefinition> = Pick<IntegrationClient<Definition>, ReplayableOperationName<Definition>>;
+/**
+ * Integration clients of code that may run more than once, such as a durable Step. An operation
+ * whose replay decision may be `unsafe` is absent: another attempt could repeat its effect.
+ */
+export type ReplayableIntegrationClients<Definitions extends Integrations> = Readonly<{
+    [Name in keyof Definitions]: ReplayableIntegrationClient<Definitions[Name]>;
+}>;
 export {};

package/dist/application/integration/operation.d.ts

@@ -1,6 +1,7 @@
 import type { BoundClientSession } from '../../platform/client/session/index.js';
 import type { IntegrationAuthentication } from './authentication.js';
 declare const INTEGRATION_OPERATION: unique symbol;
+declare const INTEGRATION_REPLAY: unique symbol;
 export type IntegrationReplayDecision = {
     readonly kind: 'safe';
 } | {
@@ -13,20 +14,28 @@ export type IntegrationReplayDecision = {
 } | {
     readonly kind: 'unsafe';
 };
+/** What another attempt of an operation may do: anything, once per key, or nothing. */
+export type IntegrationReplayKind = IntegrationReplayDecision['kind'];
+/** A decision that allows another attempt of the operation. */
+export type ReplayableIntegrationDecision = Exclude<IntegrationReplayDecision, {
+    readonly kind: 'unsafe';
+}>;
 export type IntegrationReplay<Input> = IntegrationReplayDecision | ((input: Input) => IntegrationReplayDecision);
 export interface IntegrationExecution {
     readonly callId: string;
     readonly signal: AbortSignal;
     readonly deadline: number;
     readonly idempotencyKey?: string;
-    /** Exact caller-bound invocation capability; absent for an anonymous invocation. */
+    /** Exact caller-bound invocation capability; absent when the call carried no credential. */
     readonly invoke?: BoundClientSession['invoke'];
-    /** Domain-self transport authentication; absent for an anonymous invocation. */
+    /** Domain-self transport authentication; absent only outside a Kernel invocation. */
     readonly auth?: IntegrationAuthentication;
 }
-export interface IntegrationOperation<Input = unknown, Output = unknown> {
+export interface IntegrationOperation<Input = unknown, Output = unknown, Replay extends IntegrationReplayKind = IntegrationReplayKind> {
     readonly replay: IntegrationReplay<Input>;
     readonly [INTEGRATION_OPERATION]: (input: Input) => Output;
+    /** Every kind its replay decision may take, as its definition proves them. */
+    readonly [INTEGRATION_REPLAY]: Replay;
 }
 export type IntegrationOperations = Readonly<Record<string, IntegrationOperation<never, unknown>>>;
 export type IntegrationInput<Operation> = Operation extends {
@@ -35,4 +44,8 @@ export type IntegrationInput<Operation> = Operation extends {
 export type IntegrationOutput<Operation> = Operation extends {
     readonly [INTEGRATION_OPERATION]: (input: never) => infer Output;
 } ? Output : never;
+/** The replay kinds an operation's definition proves; every kind when it proves none. */
+export type IntegrationReplayOf<Operation> = Operation extends {
+    readonly [INTEGRATION_REPLAY]: infer Replay;
+} ? Replay : IntegrationReplayKind;
 export {};

package/dist/application/mutation/authoring/properties.d.ts

@@ -1,9 +1,11 @@
 import type { MutationPropsInput } from '@astrale-os/kernel-core/graph/mutate';
 import type { PropertyInputOf, ResolvedClass, ResolvedProperty } from '@astrale-os/kernel-dsl/v1';
+import { PropertyValues } from '@astrale-os/kernel-dsl/v1/language';
+import type { StoredPropertyInputOf } from '../../../platform/schema/property-input.js';
 export type RichPropertyInput<Class> = PropertyInputOf<Class>;
 export type RichPropertyName<Class> = Extract<keyof PropertyInputOf<Class>, string>;
 export interface RichPropertyConditions<Class> {
-    readonly equals?: RichPropertyInput<Class>;
+    readonly equals?: StoredPropertyInputOf<Class>;
     readonly absent?: readonly RichPropertyName<Class>[];
 }
 export interface RichPropertyDelta<Class> {
@@ -12,11 +14,11 @@ export interface RichPropertyDelta<Class> {
 }
 export declare function properties<Class extends ResolvedClass>(selected: Class, input: RichPropertyInput<Class>): MutationPropsInput;
 export declare function conditions<Class extends ResolvedClass>(selected: Class, input: RichPropertyConditions<Class>): Readonly<{
-    equals?: Readonly<Record<`${string}:class.${string}.property.${string}`, import("@astrale-os/kernel-dsl/value").Value>> | undefined;
+    equals?: PropertyValues | undefined;
     absent?: readonly `${string}:class.${string}.property.${string}`[] | undefined;
 }>;
 export declare function delta<Class extends ResolvedClass>(selected: Class, input: RichPropertyDelta<Class>): Readonly<{
-    set: Readonly<Record<`${string}:class.${string}.property.${string}`, import("@astrale-os/kernel-dsl/value").Value>>;
+    set: Readonly<Record<`${string}:class.${string}.property.${string}`, import("@astrale-os/kernel-dsl/v1/language").PropertyValue>>;
     unset: readonly `${string}:class.${string}.property.${string}`[];
 }>;
 export declare function resolvedProperty<Class extends ResolvedClass>(selected: Class, name: RichPropertyName<Class>): ResolvedProperty;

package/dist/application/mutation/authoring/properties.js

@@ -1,10 +1,39 @@
 import { PropertyKey } from '@astrale-os/kernel-dsl/v1/addressing';
+import { PropertyValues } from '@astrale-os/kernel-dsl/v1/language';
 export function properties(selected, input) {
-    return selected.properties.from(input);
+    const ordinary = Object.create(null);
+    const receipts = [];
+    const sources = new Map();
+    for (const [name, value] of Object.entries(input)) {
+        const property = resolvedProperty(selected, name);
+        const previous = sources.get(property.key);
+        if (previous !== undefined) {
+            throw new TypeError(`Property ${property.key} is supplied through both ${JSON.stringify(previous)} and ${JSON.stringify(name)}.`);
+        }
+        sources.set(property.key, name);
+        if (isBlobProperty(property)) {
+            if (typeof value !== 'string') {
+                throw new TypeError(`Blob Property ${property.key} requires an upload receipt.`);
+            }
+            receipts.push([property.key, value]);
+        }
+        else {
+            ordinary[name] = value;
+        }
+    }
+    // Blob receipts are admitted by the Kernel executor. A property's ordinary validator expects
+    // the stored Ref, so run it only for ordinary write values before combining the two sets.
+    const admitted = selected.properties.from(ordinary);
+    return receipts.length === 0
+        ? admitted
+        : PropertyValues.create([
+            ...Object.entries(admitted).map(([key, value]) => [PropertyKey(key), value]),
+            ...receipts,
+        ]);
 }
 export function conditions(selected, input) {
     return Object.freeze({
-        ...(input.equals === undefined ? {} : { equals: properties(selected, input.equals) }),
+        ...(input.equals === undefined ? {} : { equals: selected.properties.from(input.equals) }),
         ...(input.absent === undefined
             ? {}
             : {
@@ -12,6 +41,10 @@ export function conditions(selected, input) {
             }),
     });
 }
+function isBlobProperty(property) {
+    const contract = property.definition.schema;
+    return (contract !== null && typeof contract === 'object' && contract['x-astrale-value-kind'] === 'blob');
+}
 export function delta(selected, input) {
     return Object.freeze({
         set: properties(selected, input.set ?? {}),

package/dist/application/mutation/authoring/transition.js

@@ -49,7 +49,10 @@ export function authorStateTransition(core, input) {
         class: selectedClassKey,
         props: conditions(selectedClass, {
             ...(suppliedAbsent === undefined ? {} : { absent: suppliedAbsent }),
-            equals: { ...suppliedEquals, ...from },
+            equals: {
+                ...suppliedEquals,
+                ...from,
+            },
         }),
     });
     core.updateNode({

package/dist/application/mutation/execution/execute.js

@@ -10,7 +10,7 @@ export async function executeMutation(client, domain, definition, input) {
     const operation = realizeMutation(definition, domain);
     try {
         const ast = MutationAST.build((builder) => operation.build(input, richMutationBuilder(builder)));
-        return projectMutation(operation, await client.mutate(ast, { expected: domain.closure }), input);
+        return projectMutation(operation, await client.mutate(ast), input);
     }
     catch (cause) {
         const expected = mutationFailure(cause);

package/dist/application/mutation/failure.d.ts

@@ -1,6 +1,12 @@
 export interface KernelMutationFailure extends Error {
     readonly code: `MUTATION_${string}`;
     readonly outcomeKnown: boolean;
+    /**
+     * The post-state rule a `MUTATION_POST_STATE_INVALID` refusal names, such as `duplicate-key`
+     * for a value a Class key already holds. Absent when the Kernel names none, and for every other
+     * refusal.
+     */
+    readonly rule?: string;
 }
 export interface StateTransitionFailure extends Error {
     readonly code: 'STATE_TRANSITION_ILLEGAL';

package/dist/application/mutation/failure.js

@@ -13,9 +13,10 @@ export function stateTransitionFailure(from, event) {
 export function mutationFailure(input) {
     if (!(input instanceof Error))
         return undefined;
-    const code = mutationCode(input);
-    if (code === undefined)
+    const reason = mutationReason(input);
+    if (reason === undefined)
         return undefined;
+    const { code } = reason;
     const explicit = input.outcomeKnown;
     if (explicit !== undefined && typeof explicit !== 'boolean')
         return undefined;
@@ -28,30 +29,35 @@ export function mutationFailure(input) {
             return undefined;
         return input;
     }
+    const rule = code === 'MUTATION_POST_STATE_INVALID' ? reason.rule : undefined;
     return Object.assign(new Error(input.message, { cause: input }), {
         code,
         outcomeKnown: explicit !== false && !UNKNOWN_OUTCOME_CODES.has(code),
+        ...(rule === undefined ? {} : { rule }),
     });
 }
-function mutationCode(input) {
+/**
+ * The Mutation refusal an error carries, on itself, as its Kernel reason, or as its protocol data:
+ * its code and, from the same carrier's details, the post-state rule it names.
+ */
+function mutationReason(input) {
     const value = input;
     if (value.code === 'STATE_TRANSITION_ILLEGAL')
-        return value.code;
-    for (const candidate of [
-        value.code,
-        directOrNestedCode(value.reason),
-        directOrNestedCode(value.data),
-    ]) {
-        if (typeof candidate === 'string' && candidate.startsWith('MUTATION_')) {
-            return candidate;
-        }
+        return { code: value.code };
+    for (const carrier of [value, value.reason, value.data]) {
+        const code = typeof carrier === 'string' ? carrier : field(carrier, 'code');
+        if (typeof code !== 'string' || !code.startsWith('MUTATION_'))
+            continue;
+        const rule = field(field(carrier, 'details'), 'rule');
+        return {
+            code: code,
+            ...(typeof rule === 'string' ? { rule } : {}),
+        };
     }
     return undefined;
 }
-function directOrNestedCode(input) {
-    return typeof input === 'string'
-        ? input
-        : input !== null && typeof input === 'object' && !Array.isArray(input)
-            ? Reflect.get(input, 'code')
-            : undefined;
+function field(input, key) {
+    return input !== null && typeof input === 'object' && !Array.isArray(input)
+        ? Reflect.get(input, key)
+        : undefined;
 }

package/dist/application/mutation/index.d.ts

@@ -5,4 +5,4 @@ export type { Mutation, MutationDefinition, MutationInputOf, MutationOutputOf }
 export type { CreatedNode, EdgeSelector, ExistingEndpoint, MutationEndpoint, QueryPrecondition, RichMutationBuilder, RichPropertyConditions, RichPropertyDelta, RichPropertyInput, RichPropertyName, } from './authoring/index.js';
 /** Canonical low-level Mutation documents remain available as the explicit escape hatch. */
 export * from '@astrale-os/kernel-core/graph/mutate';
-export type { LocalAlias, LocalBinding } from '../../platform/graph/alias.js';
+export type { LocalAlias } from '../../platform/graph/alias.js';

package/dist/application/query/collection/union.js

@@ -1,5 +1,5 @@
+import { definedClass } from '@astrale-os/kernel-client/graph';
 import { Query, QueryAST as QueryDocument } from '@astrale-os/kernel-core/graph/query';
-import { ClassKey } from '@astrale-os/kernel-dsl/v1/addressing';
 import { QueryCompositionError } from '../composite/errors.js';
 import { collectionIdentityOf } from './identity.js';
 import { COLLECTION_QUERY_LIMITS } from './limits.js';
@@ -80,8 +80,13 @@ export function partitionCollectionUnion(domain, compiled, values, maximumLogica
         if (identities.has(identity))
             invalid(`Collection union returned duplicate identity ${identity}.`);
         identities.add(identity);
-        const names = memberships.get(value.class) ?? memberNames(domain, compiled, value);
+        const names = memberships.has(value.class)
+            ? memberships.get(value.class)
+            : memberNames(domain, compiled, value);
         memberships.set(value.class, names);
+        // A Class added after this client was built belongs to no member it can name.
+        if (names === undefined)
+            continue;
         if (names.length === 0) {
             invalid(`Collection union returned ${value.class} outside every member extent.`);
         }
@@ -105,9 +110,11 @@ function realizeMember(definition, domain, outputPath, name) {
     }
 }
 function memberNames(domain, compiled, value) {
-    const exact = domain.definition(ClassKey.ref(ClassKey(value.class)));
+    const exact = definedClass(domain, value.class);
+    if (exact === undefined)
+        return undefined;
     const kind = valueKind(value);
-    if (exact?.ref.kind !== 'class' || exact.kind !== kind || exact.abstract) {
+    if (exact.kind !== kind || exact.abstract) {
         invalid(`Collection union returned inactive ${kind} Class ${value.class}.`);
     }
     const names = compiled.members.flatMap((member) => {

package/dist/application/query/composite/plan.d.ts

@@ -7,10 +7,6 @@ export declare const QUERY_COMPOSITION_LIMITS: Readonly<{
     maximumDependencyDepth: 8;
 }>;
 export interface QueryPlanAnalysis {
-    /** @deprecated Use physicalQueries. */
-    readonly queries: number;
-    /** @deprecated Use dependencyDepth. */
-    readonly depth: number;
     readonly logicalQueries: number;
     readonly physicalQueries: number;
     readonly dependencyDepth: number;

package/dist/application/query/composite/plan.js

@@ -53,8 +53,6 @@ export function analyzeQueryPlan(plan) {
         throw new QueryCompositionError('QUERY_COMPOSITION_LIMIT', `Composite Query exceeds ${QUERY_COMPOSITION_LIMITS.maximumPhysicalQueries} physical Queries or dependency depth ${QUERY_COMPOSITION_LIMITS.maximumDependencyDepth}.`);
     }
     return Object.freeze({
-        queries: physicalKeys.size,
-        depth: maximumDepth,
         logicalQueries,
         physicalQueries: physicalKeys.size,
         dependencyDepth: maximumDepth,

package/dist/application/query/conformance.d.ts

@@ -0,0 +1,15 @@
+import type { QueryResult } from '@astrale-os/kernel-core/graph/query';
+import type { Edge } from '../../platform/graph/edge/index.js';
+import type { Node } from '../../platform/graph/node/index.js';
+import type { Domain } from '../../platform/schema/index.js';
+/**
+ * The members of `values` whose Class `domain` defines, in order. The Kernel answers in its active
+ * Schema, so a result may hold values of a Class added after the client was built.
+ */
+export declare function definedValues<Value extends Node | Edge>(domain: Domain, values: readonly Value[]): readonly Value[];
+/**
+ * Check every value of `result` against the Domain this client was built from, by the Kernel
+ * Client's rule: a value fails only when a Property its Class defines holds an invalid value or a
+ * required one is absent. Properties and Classes the client does not know pass.
+ */
+export declare function requireConformance(domain: Domain, result: QueryResult): void;

package/dist/application/query/conformance.js

@@ -0,0 +1,46 @@
+import { definedClass, validateDefinedProperties } from '@astrale-os/kernel-client/graph';
+import { collectionIdentityOf } from './collection/identity.js';
+import { QueryValueMismatchError } from './failure.js';
+/**
+ * The members of `values` whose Class `domain` defines, in order. The Kernel answers in its active
+ * Schema, so a result may hold values of a Class added after the client was built.
+ */
+export function definedValues(domain, values) {
+    const defined = values.filter((value) => definedClass(domain, value.class) !== undefined);
+    return defined.length === values.length ? values : Object.freeze(defined);
+}
+/**
+ * Check every value of `result` against the Domain this client was built from, by the Kernel
+ * Client's rule: a value fails only when a Property its Class defines holds an invalid value or a
+ * required one is absent. Properties and Classes the client does not know pass.
+ */
+export function requireConformance(domain, result) {
+    for (const value of valuesOf(result)) {
+        const exact = definedClass(domain, value.class);
+        if (exact === undefined)
+            continue;
+        const [diagnostic] = validateDefinedProperties(exact, value.props);
+        if (diagnostic !== undefined) {
+            throw new QueryValueMismatchError(`${collectionIdentityOf(value)} at ${diagnostic.pointer}: ${diagnostic.message}`);
+        }
+    }
+}
+function* valuesOf(result) {
+    if (result.kind === 'graph') {
+        yield* result.graph.nodes;
+        yield* result.graph.edges;
+        return;
+    }
+    if (result.kind === 'nodes') {
+        for (const item of result.nodes)
+            if (item.kind === 'value')
+                yield item.value;
+        return;
+    }
+    for (const item of result.edges) {
+        for (const component of [item.edge, item.source, item.target]) {
+            if (component.kind === 'value')
+                yield component.value;
+        }
+    }
+}

package/dist/application/query/define.js

@@ -3,6 +3,7 @@ import { isDomain } from '@astrale-os/kernel-dsl/v1/domain';
 import { requireUniqueCollectionValues } from './collection/identity.js';
 import { COLLECTION_QUERY_LIMITS } from './collection/limits.js';
 import { realizeCollectionQuery, registerCollectionQuery, } from './collection/metadata.js';
+import { definedValues } from './conformance.js';
 import { queryResult } from './single/index.js';
 const DEFAULT_PAGE_SIZE = 256;
 const MAXIMUM_PAGES = 1_024;
@@ -27,7 +28,7 @@ export function defineCollectionQuery() {
                         kind: 'nodes',
                         projection: { kind: 'value' },
                     }),
-                    project: (pages) => requireUniqueCollectionValues(queryResult.completeNodeValues(pages, specification.id), `Collection Query ${specification.id}`),
+                    project: (pages) => definedValues(domain, requireUniqueCollectionValues(queryResult.completeNodeValues(pages, specification.id), `Collection Query ${specification.id}`)),
                 };
             }
             return {
@@ -38,12 +39,12 @@ export function defineCollectionQuery() {
                     kind: 'edges',
                     projection: { edge: 'value', source: 'reference', target: 'reference' },
                 }),
-                project: (pages) => requireUniqueCollectionValues(Object.freeze(pages.flatMap((page) => queryResult.edgeItems(page, specification.id).map((item) => {
+                project: (pages) => definedValues(domain, requireUniqueCollectionValues(Object.freeze(pages.flatMap((page) => queryResult.edgeItems(page, specification.id).map((item) => {
                     if (item.edge.kind !== 'value') {
                         throw new TypeError(`Collection Query ${specification.id} must project Edge values.`);
                     }
                     return item.edge.value;
-                }))), `Collection Query ${specification.id}`),
+                }))), `Collection Query ${specification.id}`)),
             };
         });
         registerCollectionQuery(definition, project);

package/dist/application/query/execution/execute.d.ts

@@ -6,7 +6,6 @@ import type { QueryDefinition } from '../query.js';
 export interface QueryClient {
     query<Ast extends QueryAST>(ast: Ast, options: {
         readonly page: QueryPageRequest;
-        readonly expected?: Domain['closure'];
     }): Promise<QueryResponse<QueryResultFor<Ast>>>;
 }
 export declare function executeQuery<DomainValue extends Domain, Output>(client: QueryClient, domain: DomainValue, query: QueryDefinition<DomainValue, void, Output>): Promise<Output>;

package/dist/application/query/execution/execute.js

@@ -1,6 +1,7 @@
 import { COLLECTION_QUERY_LIMITS } from '../collection/limits.js';
 import { compileCollectionUnion, partitionCollectionUnion } from '../collection/union.js';
 import { createQueryComposition, executeQueryPlan } from '../composite/index.js';
+import { requireConformance } from '../conformance.js';
 import { realizeQuery } from '../define.js';
 import { queryFailure } from '../failure.js';
 import { completeSelection, queryResult } from '../single/index.js';
@@ -9,7 +10,12 @@ export async function executeQuery(client, domain, query, input) {
     if (client === null || typeof client !== 'object' || typeof client.query !== 'function') {
         throw new TypeError('Query execution requires a Client query capability.');
     }
-    const execute = (ast, options) => client.query(ast, { ...options, expected: domain.closure });
+    // The Kernel answers in its active Schema; each value is checked against this client's Domain.
+    const execute = async (ast, options) => {
+        const response = await client.query(ast, options);
+        requireConformance(domain, response.result);
+        return response;
+    };
     const operation = realizeQuery(query, domain);
     try {
         if (operation.kind === 'single') {

package/dist/application/query/failure.d.ts

@@ -7,4 +7,12 @@ export declare class QueryPaginationError extends Error implements QueryFailure
     readonly name = "QueryPaginationError";
     constructor(code: QueryPaginationErrorCode, message: string);
 }
+/**
+ * A value the Kernel returned does not have the shape its Class has in the Domain this client was
+ * built from: one of its Properties changed type, or a Property the client requires is absent.
+ */
+export declare class QueryValueMismatchError extends Error implements QueryFailure {
+    readonly name = "QueryValueMismatchError";
+    readonly code = "QUERY_VALUE_MISMATCH";
+}
 export declare function queryFailure(input: unknown): QueryFailure | undefined;

package/dist/application/query/failure.js

@@ -6,6 +6,14 @@ export class QueryPaginationError extends Error {
         this.code = code;
     }
 }
+/**
+ * A value the Kernel returned does not have the shape its Class has in the Domain this client was
+ * built from: one of its Properties changed type, or a Property the client requires is absent.
+ */
+export class QueryValueMismatchError extends Error {
+    name = 'QueryValueMismatchError';
+    code = 'QUERY_VALUE_MISMATCH';
+}
 export function queryFailure(input) {
     if (!(input instanceof Error))
         return undefined;

package/dist/application/query/index.d.ts

@@ -1,7 +1,7 @@
 export { defineCollectionQuery, defineCompositeQuery, defineQuery, realizeQuery } from './define.js';
 export type { CollectionQuerySpec } from './collection/metadata.js';
 export { executeQuery, type QueryClient, type QueryExecutor } from './execution/index.js';
-export { QueryPaginationError, type QueryFailure, type QueryPaginationErrorCode, } from './failure.js';
+export { QueryPaginationError, QueryValueMismatchError, type QueryFailure, type QueryPaginationErrorCode, } from './failure.js';
 export type { CollectionQueryDefinition, CollectionValue, CompositeQueryDefinition, QueryAstOf, QueryDefinition, QueryInputOf, QueryOutputOf, SingleQueryDefinition, } from './query.js';
 export { queryResult } from './single/index.js';
 export type { CompleteQueryProjectionContext, PaginatedQuery, ProjectedQuery, QueryPages, QueryPagination, QueryProjectionContext, RawQuery, SingleQuery, } from './single/index.js';