@astrale-os/sdk 0.6.0-beta.41 → 0.6.0-beta.43

package/docs/queries.md

@@ -0,0 +1,442 @@
+# Queries
+
+A Query recipe is a typed business observation over the graph. Its guarantees:
+
+- **Typed by the Domain.** Handles, conditions, rows and answers are typed from the Domain's
+  Schema. A Class, Property or relation the Domain cannot name does not compile.
+- **Bounded before it reads.** Every verb carries its bound. Before anything is sent, the SDK
+  refuses a recipe past its bounds, and a relation that crosses a dependency Class the Domain does
+  not declare.
+- **One snapshot per read.** Each read is one Kernel invocation at its own snapshot. Facets,
+  steps and pages of one recipe share none. A read whose root lists more than 32,768 ids in
+  `id.in` is the exception: the SDK sends it in consecutive parts, each at its own snapshot, and
+  merges their rows in the Kernel's order.
+- **Authority-neutral.** A recipe names no authority; each call names the authority it reads
+  under.
+- **One error per refusal.** A read the SDK or the Kernel refuses raises one `QueryError` by code.
+  A network failure, and a refusal that says when to retry, pass as they came. Business refusals
+  are the recipe's declared errors.
+
+A recipe reads on a Host whose Kernel serves Query v7 and the Class of each row. A Kernel that
+refuses Query v7 by name raises `QueryError` `UNSUPPORTED` with `feature: 'v7'`; a Runtime that
+does not name that refusal answers `REFUSED`, with `kernelCode: 'INTERNAL_ERROR'`. An answer that
+leaves out a row's Class raises `UNSUPPORTED` with `feature: 'classes'`. Query v7 is not served
+in maintenance or repair sessions: the Kernel refuses it with `INSTANCE_MAINTENANCE`, which passes
+as it came, and a migration that runs there reads with [Query V6](legacy/query-v6.md).
+
+```ts
+import type { NodeId } from '@astrale-os/sdk/graph/node'
+import { defineQuery } from '@astrale-os/sdk/query'
+import { z } from 'zod'
+
+import type { schema } from '#schema'
+
+export const articleWithComments = defineQuery<typeof schema>()('publishing.article.with-comments', {
+  build: (article: NodeId, d) =>
+    d.Article.with((a) => ({
+      author: a.author.find(),
+      pinned: a
+        .via(d.comment_on, { direction: 'incoming' })
+        .where((_comment, edge) => edge.pinned.eq(true))
+        .orderBy((comment) => comment.postedAt.desc())
+        .first(3),
+      comments: a.via(d.comment_on, { direction: 'incoming' }).count({ upTo: 1_000 }),
+    })).find(article),
+  output: (row, article, { error }) => {
+    if (row === undefined) throw error('ARTICLE_NOT_FOUND', { article })
+    return row
+  },
+  errors: {
+    ARTICLE_NOT_FOUND: {
+      family: 'NOT_FOUND',
+      message: 'The article does not exist.',
+      details: z.strictObject({ article: z.string() }),
+    },
+  },
+})
+
+// In an Action that declares `errors: { ...articleWithComments.errors }`
+const article = await query(articleWithComments, input.article, { as: 'caller' })
+```
+
+## Handles
+
+`build(input, d)` receives the handles of the Domain:
+
+| Handle | What it reads |
+| --- | --- |
+| `d.Article` | A Node Class of the Domain. An Edge Class handle (`d.comment_on`) reads Edges at the root. |
+| `d.directory.Person` | A Class of the dependency the Schema aliases `directory`. |
+| `d.kernel.<Class>` | A Kernel Class. |
+| `d.core.<node>` | A Core node of the Domain, as a target: `get(d.core.settings)`, `rel.is(d.core.settings)`. |
+| `d.origin` | The Domain's origin. |
+| `d.document(query)` | One canonical v7 document; see [Canonical documents](#canonical-documents). |
+
+A Class or alias named `kernel`, `core`, `origin` or `document` has no handle.
+
+## Reads
+
+A read starts from a Class handle, is narrowed with `where`, ordered with `orderBy`, carries
+relations with `with`, and ends with the verb that says how much it reads:
+
+| Verb | Answers | Refusals |
+| --- | --- | --- |
+| `get(id?)` | Exactly one row | None: `NOT_FOUND`. A second: `INTEGRITY`. One the reader may not read: `NOT_READABLE`. |
+| `find(id?)` | One row, or `undefined` | A second: `INTEGRITY`. One the reader may not read: `NOT_READABLE`. |
+| `first()` | The first row, or `undefined` | |
+| `first(n)` | Up to `n` rows | |
+| `first(n, { more: true })` | `{ rows, more }`, reading `n + 1` rows | |
+| `page({ max })` | `{ rows, next? }`; only as a recipe's single read | |
+| `all({ max })` | Every row | Past `max`: `TOO_MANY`. |
+| `exists(id?)` | `boolean` | |
+| `count({ upTo })` | `{ count, more }`; `more` says the count reached `upTo` | |
+
+`get` asserts that the row exists, so it reads the ids the Domain itself holds; for an id a caller
+sends, use `find` and raise a declared error from `output` (see [Errors](#errors)).
+
+`id` is a `NodeId`, a `NodePath` or a Core node. `.pick()` renders rows as references,
+`{ id, $class }`. `.includeWithheld()` keeps the rows the reader may not read in a list, as
+`{ id, $class, $withheld }` naming the values withheld. `get` and `find` raise `NOT_READABLE` on
+such a row, since it exists. `d.A.union(d.B)` reads the Nodes of both Classes.
+
+### Conditions
+
+`where` takes one condition or a list, an implicit `and`. A falsy entry of the list is skipped, so
+an optional filter is written in place:
+
+```ts
+d.Article.where((a) => [
+  a.state.eq('published'),
+  filter.author && a.author.is(filter.author),
+  filter.since && a.publishedAt.gte(filter.since),
+  filter.featured !== undefined && a.featured.eq(filter.featured),
+])
+```
+
+A filter whose value may be `false` or `0` is written `filter.x !== undefined && …` when it
+applies whenever the caller sends it: with `filter.x && …`, those values would skip the entry. When
+`false` means no filter, say so: `filter.x ? a.x.eq(true) : undefined`.
+
+| Term | Meaning |
+| --- | --- |
+| `p.eq(v)` | Equal. `eq(null)` matches a stored null. |
+| `p.in(values)` | One of at most 16 values. |
+| `node.id.eq(id)`, `node.id.in(ids)` | The Node is this one, or one of these. `id.in` takes any length at a read's root; elsewhere a read carries at most 32,768 ids and values. |
+| `node.path.eq(path)`, `node.path.in(paths)` | The Node is at this path, or at one of these. |
+| `p.isSet()`, `p.isMissing()` | The value is present, or absent. |
+| `p.gt`, `p.gte`, `p.lt`, `p.lte` | Ranges, on text, numbers and open values. |
+| `p.between(lower, upper)` | `lower <= value < upper`. |
+| `p.startsWith(prefix)` | A text prefix. |
+| `node.is(Class)`, `node.isExactly(Class)` | The Node is of the Class, or a subclass for `is`. It narrows the handle and the rows. |
+| `node.is(Class, (n) => conditions)` | The Node is of the Class and meets conditions written on the narrowed handle. |
+| `c.and(…)`, `c.or(…)`, `c.not()` | Combinators on any condition. |
+
+A relation is a condition too:
+
+| Term | Meaning |
+| --- | --- |
+| `rel.is(target)` | The relation reaches this Node. |
+| `rel.exists()` | It reaches any Node. |
+| `rel.some(cond?)`, `rel.none(cond?)`, `rel.every(cond)` | Over the Nodes it reaches. |
+| `rel.atLeast(n, cond?)`, `rel.atMost(n, cond?)`, `rel.exactly(n, cond?)` | How many it reaches. |
+
+The callback of a relation condition receives `(node, edge)`: conditions on the far Node and on
+the Edge's Properties.
+
+### Order
+
+`orderBy` takes one key or a list: `orderBy((a) => [a.publishedAt.desc(), a.title.asc()])`. Rows
+without the value sort last; `asc({ missing: 'first' })` sorts them first. On a union whose
+Classes map one name to different Properties, the name filters but does not order.
+
+### Relations
+
+A to-one end is named by its far role: `a.author` reads the author of an Article. Any Edge is read
+with `.via(edge, { direction })`, where `direction` is `outgoing`, `incoming` or `incident`.
+`.via([e1, e2])` reads several Edge Classes. `direction` is required when both ends accept the
+Class, or when the Edges listed leave it in different directions.
+
+A relation reads with the root verbs, per parent row: `get`, `find`, `first`, `all`, `count` and
+`exists`. A relation's `get` that finds none, or a second row, raises `INTEGRITY` naming the
+relation. A relation also takes `where`, `orderBy`, `with`, `pick`, `includeWithheld`, `distinct`
+and `withEdge()`, which adds the Edge's Class and Properties to each row under `$edge`.
+
+`.with((a) => ({ name: read }))` adds each relation's answer to the row under the name given. A
+name a row already carries does not compile, and neither does a `.with` that reads another root:
+read it as a facet of the recipe.
+
+### Rows
+
+A Node row is portable JSON: `id`, `$class`, and every Property by name. An optional Property may
+be absent; `null` is a stored null. `$class` is typed as the Class or any subclass the Domain can
+name. A Property whose name the SDK takes goes under `$prop` by its name: `id` on rows, a handle
+member (`id`, `path`, `is`, `isExactly`, `via`) on handles, and an Edge's roles on an Edge read at
+the root. A Property named `path` is `row.path` on a row and `a.$prop.path` on a handle. These
+names are frozen, and no Property name starts with `$`, so a Property never moves. Two Properties of one name that two parent Classes declare, when the Class
+declares none of its own, each go under `$` and their owner's name in lower camel case:
+`row.$record.title`. The SDK's row keys (`$class`, `$edge`, `$source`, `$target`, `$withheld` and
+`$prop`) are frozen too, and an owner group that would take one gets one more `$`: an owner named
+`Class` groups under `$$class`.
+
+An Edge read at the root answers rows of `{ $class, $source, $target }`, the Edge's Properties,
+and both ends' rows under their roles. `edgeKey(row)` gives the `{ source, target, class }` a
+Mutation or a guard names an Edge by. An Edge root's `get()`, `find()` and `exists()` take no id,
+and its `first(n)` takes no `{ more }`.
+
+## Recipes
+
+`defineQuery<Schema>()(id, { build, output?, errors? })` defines a recipe. Its id is unique in the
+Domain: dot-separated segments of lowercase letters, digits and `-`.
+
+`build` returns one read, or a record of facets read together:
+
+```ts
+build: (account: NodeId, d) => ({
+  account: d.Account.get(account),
+  invoices: d.Invoice.where((i) => i.account.is(account)).all({ max: 500 }),
+})
+```
+
+A facet may be a read, a list of reads (`items.map((item) => d.Item.get(item))`), or `undefined`
+for a read the input makes optional.
+
+Reads that wait for others are chained with `steps`, `build`'s third parameter.
+`steps(first, (earlier) => next, …)` takes two to eight steps and reads them in order. The first
+is a record of facets; each next one is a function of the merged results of the steps before it,
+and returns a record of facets none of them read. A facet name read again does not compile, and
+throws a `TypeError` before the step reads. A recipe whose reads wait for none returns them
+without `steps`. These steps order the reads of one call: they are not a Workflow's durable
+Steps, and nothing of them is journaled or replayed.
+
+```ts
+build: (id: NodeId, { Article, Comment }, steps) =>
+  steps({ article: Article.find(id) }, ({ article }) => ({
+    comments:
+      article &&
+      Comment.where((c) => [
+        c.article.is(id),
+        article.publishedAt && c.postedAt.gte(article.publishedAt),
+      ]).first(20),
+  })),
+```
+
+`output(results, input, { error, is })` maps the results to the recipe's answer. It is
+synchronous and pure, and returns portable JSON. Without it, the recipe answers what `build` read.
+`is(row, classKey)` narrows a row to a Class or its subclasses. An expected case is a union in the
+output, not an error.
+
+## Calling a recipe
+
+An Action calls `query(recipe, input, { as })`, where `as` is `executor` (the authority the handler
+executes with) or `caller` (the incoming caller). An `auth: 'anonymous'` callable reads as
+`executor` only. A recipe with no input is called with `undefined`.
+
+A page recipe, whose single read is `.page({ max })`, takes the page size and the cursor at the
+call and answers `{ rows, next? }`; its `output` keeps `rows` and `next`. `size` is a whole number
+from 1 to `max`, `max` when omitted; any other value throws a `TypeError`:
+
+```ts
+const first = await query(articleTitles, undefined, { as: 'caller', size: 50 })
+const second = first.next
+  ? await query(articleTitles, undefined, { as: 'caller', size: 50, after: first.next })
+  : undefined
+```
+
+A durable Workflow reads in a Step, as its executor:
+`step.query('load-article', articleById, input.article, { as: 'executor' })`. The output is
+journaled, and a replay returns it. A `QueryError` other than `REFUSED`, or the `TypeError` of an
+undeclared crossing (S12), fails the Step at once, and a replay throws it again. A `REFUSED` read
+is a failed attempt like any Kernel refusal: a permanent one exhausts the Step at once, and a
+stale snapshot spends no attempt. An inline Workflow calls `query(recipe, input, { as })` from its
+context, as an Action does, inside a named `step.run`.
+
+## Errors
+
+A read that cannot be answered raises `QueryError`, with the recipe's id, a code and the details
+of that code:
+
+| Code | When | Details |
+| --- | --- | --- |
+| `NOT_FOUND` | A root `get` found nothing. | `class`; `target` when the read named one |
+| `NOT_READABLE` | `get` or `find` met a fact the reader may not read. | `class`; `id`, a Node's id or an Edge's key |
+| `INTEGRITY` | A relation's `get` found none, or a second row came where one is allowed. | `relation`; `parent` for a relation; `found: 0 \| 2` |
+| `TOO_MANY` | Past a verb's `max`, a verb bound of 83,332, the recipe's 100,000 rows or its 32 reads. | `limit: 'max' \| 'rows' \| 'reads'`; `bound` |
+| `REFUSED` | The Kernel refused the read. | `kernelCode`; `retryable`, whether a retry may succeed |
+| `INPUT_INVALID` | The SDK or the Kernel refused the query the recipe built, before reading anything. | `kernelCode`, `phase` and `path` when the Kernel names them; `limit: 'in'` for an `in` past 16 values |
+| `OUTDATED` | The Host's Registry does not match the Domain's build. | `kernelCode: 'QUERY_EXPECTATION_MISMATCH'` |
+| `UNSUPPORTED` | The Kernel does not serve Query v7, or its answer leaves out a row's Class. | `feature: 'v7' \| 'classes'` |
+
+`isQueryError(error, code?)` recognizes one.
+
+A refusal the caller handles by code is declared in `errors`, as on Actions, and raised by
+`output`:
+
+```ts
+const articleNotFound = {
+  family: 'NOT_FOUND',
+  message: 'The article does not exist.',
+  details: z.strictObject({ article: z.string() }),
+} as const
+
+export const articleAuthor = defineQuery<typeof schema>()('publishing.article.author', {
+  build: (article: NodeId, d) => d.Article.with((a) => ({ author: a.author.find() })).find(article),
+  output: (row, article, { error }) => {
+    if (row === undefined) throw error('ARTICLE_NOT_FOUND', { article })
+    return row.author === undefined
+      ? { kind: 'unassigned' as const }
+      : { kind: 'assigned' as const, author: row.author.id }
+  },
+  errors: { ARTICLE_NOT_FOUND: articleNotFound },
+})
+```
+
+A Function lets a recipe's error reach its own caller by declaring it again:
+`{ errors: { ...articleAuthor.errors } }`.
+
+## Bounds and checks
+
+Before a step sends anything, the SDK checks:
+
+- **Bounds (S11).** A recipe makes at most 32 reads and reads at most 100,000 rows, counted from
+  its verbs' bounds and its relations per parent row. A verb's bound is at most 83,332. Past one,
+  the read raises `TOO_MANY`. An `in` takes at most 16 values; past them, it raises
+  `INPUT_INVALID`. Fewer than 2 or more than 8 steps do not compile, and `steps` throws a
+  `TypeError` when `build` calls it.
+- **Requirements (S12).** A relation that crosses a Class of a direct dependency needs `read` and
+  `traverse` on that Class in the Domain's `requirements({ classes })`. A requirement on a parent
+  covers its children. Otherwise the call throws a `TypeError` naming the recipe, the relation and
+  the requirement to add. Roots, Kernel Classes and the Domain's own Classes need nothing. A
+  relation an empty list folds away is checked as if the list were not empty. A condition the
+  input leaves unbuilt, such as a falsy `where` entry or an `undefined` facet, is not checked.
+
+`checkRecipe(recipe, sampleInput, { domain })` from `@astrale-os/sdk/testing` runs both checks in
+a test, without a Kernel, on the first step it builds for its sample input. Give it an input that
+builds every optional condition, and test later steps through a call. Given the Domain's
+definition it checks S12; given the Schema alone it skips S12.
+
+The Domain linter also reads recipes:
+
+- `QRY-RECIPE-CLOCK` refuses a clock read in `build` or `output`. Take now in the input.
+- `QRY-RECIPE-ROWS` warns when a recipe's constant bounds multiply past 10,000 rows.
+- `QRY-RECIPE-FALSY` warns on a condition entry `x && p.eq(x)` or `x ? p.eq(x) : undefined`
+  whose `x` may be `false` or `0`, wherever falsy entries are skipped. Write
+  `x !== undefined && p.eq(x)` to compare whenever `x` is set, or say that `false` or `0` means no
+  filter: `x ? p.eq(true) : undefined` for a flag, `x !== undefined && x !== 0 && p.gte(x)` for a
+  number.
+
+## Beyond v7
+
+What v7 cannot express is bridged inside the recipe, with a step or in `output`. A bridge's bound
+and steps count toward the recipe's bounds, and its callers never see it. When the Kernel serves
+the construct, the bridge moves into the read and the output type does not change. Beyond a long
+root `id.in`, the SDK never splits a read behind its author.
+
+| The business asks | Bridge inside the recipe |
+| --- | --- |
+| A value compared with a parent's | A first step reads the parent and the next compares with its value; or read both and filter in `output`. |
+| Two parts of a pattern meeting at one Node | Read both with `.with`, compare in `output`. |
+| Ancestors, a sub-tree at any depth | One step per level reads the next with `id.in`, up to 8 steps. |
+| Sums, averages, groups | Read the values with `all({ max })`, compute in `output`. |
+| Case-insensitive search, locale sorting | A normalized Property the Domain writes, or filter and sort in `output`. |
+| Several unrelated lists | Facets of one recipe, each read at its own snapshot. |
+
+A filter in `output` runs after the Kernel applied the verb's bound.
+
+## Canonical documents
+
+`d.document(query)` reads one canonical v7 document whose lists carry a `limit`. Its rows are typed
+`unknown`, so `output` validates them:
+
+```ts
+import { z } from 'zod'
+
+export const recentArticles = defineQuery<typeof schema>()('publishing.article.recent', {
+  build: (_: undefined, d) =>
+    d.document({
+      query: 'astrale.query/7',
+      list: { nodes: ['publishing.example:class.Article'], select: 'value', limit: 20 },
+    }),
+  output: (rows) => z.array(z.looseObject({ id: z.string() })).parse(rows),
+})
+```
+
+## Mutation recipes
+
+A Mutation takes the same form, over the same handles:
+`defineMutation<Schema>()(id, { build, output?, reject?, errors? })`. `build(input, d, mutation)`
+is synchronous; each write names its Class by its handle, and a write names one Class:
+
+```ts
+// The Schema declares the key: no two Workspaces share a slug.
+const Workspace = nodeClass({ properties: { slug: property(z.string()) }, unique: [['slug']], … })
+
+export const createWorkspace = defineMutation<typeof schema>()('workspace.create', {
+  build: (input: { readonly slug: string }, { Workspace }, mutation) => {
+    mutation.createNode({ as: 'workspace', class: Workspace, props: { slug: input.slug } })
+  },
+  reject: (failure, input, { error }) => {
+    if (failure.code !== 'MUTATION_POST_STATE_INVALID' || failure.rule !== 'duplicate-key') {
+      throw failure
+    }
+    throw error('SLUG_TAKEN', { slug: input.slug })
+  },
+  errors: { SLUG_TAKEN: slugTaken },
+})
+
+await mutate(createWorkspace, { slug }, { as: 'caller' })
+```
+
+`output(result, input)` maps the committed `MutationResult`, which the recipe answers without it.
+`reject(failure, input, { error, is })` maps an expected refusal to the same output, or raises a
+declared error: here the Kernel refuses a second Workspace with the slug, `duplicate-key`, on every
+write that could make one, and the recipe names that refusal. A Mutation recipe shares the Query
+recipes' ids, and every call names its authority: `mutate(recipe, input, { as })`,
+`step.mutate(id, recipe, input, { as: 'executor' })`. The closure form,
+`defineMutation<Schema>()((domain) => ({ id, build, project? }))`, is deprecated.
+
+## Guards
+
+A Mutation guards its write on a range: a Class handle after `where`, `union` and `orderBy`, or a
+canonical v7 Query. `mutation.expect.none(range)`, `expect.exists(range)`,
+`expect.count(range, n | { atLeast?, atMost? })` or `expect.unchanged(range, ids)`. The Kernel
+decides the guard with the Mutation, on the range's Classes and `where`, and for `unchanged` its
+`orderBy`. A read (`first`, `exists`, `count`…) and a rendered set (`with`, `pick`) are refused:
+their verb, size or rendering would not reach the guard. Each verb takes `{ name }` last, and a
+refusal carries the failed precondition's name as `failure.precondition`.
+
+A guard states what the Schema cannot: a condition across Nodes at commit, a count that no
+cardinality states (at most 100 Tasks in a Project), an unchanged list. What the Schema declares is
+never a guard: a key (`unique`), a cardinality, the endpoints an Edge accepts, a state machine's
+transitions. The Kernel checks those on every write, where a guard costs a read and holds only for
+the Mutations that carry it. Closing a Project is its state machine's transition; that none of its
+Tasks is open is a guard:
+
+```ts
+export const closeProject = defineMutation<typeof schema>()('project.close', {
+  build: (input: { readonly project: NodeId }, { Project, Task }, mutation) => {
+    mutation.expect.none(
+      Task.where((t) => [t.project.is(input.project), t.status.eq('open')]),
+      { name: 'open-tasks' },
+    )
+    mutation.transition({
+      node: input.project,
+      class: Project,
+      property: 'status',
+      from: 'open',
+      event: 'close',
+    })
+  },
+  reject: (failure, input, { error }) => {
+    if (failure.code !== 'MUTATION_PRECONDITION_FAILED' || failure.precondition !== 'open-tasks') {
+      throw failure
+    }
+    throw error('OPEN_TASKS', { project: input.project })
+  },
+  errors: { OPEN_TASKS: openTasks },
+})
+```
+
+## Query V6
+
+Query V6 definitions keep their meaning and are deprecated. See
+[Query V6 and the move to v7](legacy/query-v6.md).

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@astrale-os/sdk",
-  "version": "0.6.0-beta.41",
+  "version": "0.6.0-beta.43",
   "description": "Schema-first SDK for defining, composing, and deploying Astrale domains",
   "keywords": [
     "astrale",
@@ -258,11 +258,11 @@
     "registry": "https://registry.npmjs.org/"
   },
   "dependencies": {
-    "@astrale-os/kernel-client": "1.0.0-beta.19",
-    "@astrale-os/kernel-core": "1.0.0-beta.16",
-    "@astrale-os/kernel-dsl": "1.0.0-beta.9",
-    "@astrale-os/kernel-protocol": "1.0.0-beta.16",
-    "@astrale-os/kernel-server": "1.0.0-beta.16",
+    "@astrale-os/kernel-client": "1.0.0-beta.27",
+    "@astrale-os/kernel-core": "1.0.0-beta.24",
+    "@astrale-os/kernel-dsl": "1.0.0-beta.17",
+    "@astrale-os/kernel-protocol": "1.0.0-beta.24",
+    "@astrale-os/kernel-server": "1.0.0-beta.24",
     "@lucide/icons": "1.34.0",
     "@typescript/native-preview": "7.0.0-dev.20260707.2",
     "cross-spawn": "7.0.6",
@@ -339,13 +339,14 @@
     "e2e": "node __e2e__/flagship/runner.mjs",
     "typecheck": "tsgo --noEmit && pnpm run typecheck:workers && pnpm run typecheck:specs && pnpm run typecheck:types && pnpm run typecheck:tests && pnpm run typecheck:e2e && pnpm run typecheck:knowledge",
     "typecheck:workers": "tsgo --noEmit -p tsconfig.workers.json",
-    "typecheck:specs": "tsgo --noEmit -p src/application/query/.spec/tsconfig.json && tsgo --noEmit -p src/platform/schema/.spec/tsconfig.json && tsgo --noEmit -p src/application/mutation/.spec/tsconfig.json && tsgo --noEmit -p src/tooling/cli/.spec/tsconfig.json",
+    "typecheck:specs": "tsgo --noEmit -p src/application/query/.spec/tsconfig.json && tsgo --noEmit -p src/application/query/legacy/v6/.spec/tsconfig.json && tsgo --noEmit -p src/platform/schema/.spec/tsconfig.json && tsgo --noEmit -p src/application/mutation/.spec/tsconfig.json && tsgo --noEmit -p src/tooling/cli/.spec/tsconfig.json",
     "typecheck:types": "tsgo --noEmit -p __tests__/tsconfig.types.json",
     "typecheck:tests": "tsgo --noEmit -p tsconfig.test.json",
     "typecheck:e2e": "tsgo --noEmit -p __e2e__/flagship/fixtures/tsconfig.v1.json && tsgo --noEmit -p __e2e__/flagship/fixtures/tsconfig.json",
     "typecheck:knowledge": "tsgo --noEmit -p knowledge/cli/tsconfig.json",
+    "typecheck:budgets": "node scripts/type-budget/run.mjs",
     "test": "pnpm run test:checks && pnpm run test:file && pnpm run test:scripts",
-    "test:checks": "pnpm run check:knowledge && pnpm run check:linter-policy && pnpm run check:issues && pnpm run test:node-server-v1",
+    "test:checks": "pnpm run check:knowledge && pnpm run check:linter-policy && pnpm run check:kernel-schema && pnpm run check:issues && pnpm run test:node-server-v1",
     "test:file": "vitest run --config __tests__/vitest.config.ts",
     "test:scripts": "node --test scripts/*.test.mjs actions/domain/*.test.mjs",
     "test:node-server-v1": "vitest run --config __tests__/vitest.node-server-v1.config.ts",
@@ -358,10 +359,12 @@
     "format:check": "pnpm exec oxfmt --check .",
     "check:knowledge": "node knowledge/cli/main.mjs check knowledge && bash knowledge/cli/test.sh",
     "check:linter-policy": "node scripts/sync-domain-policy.mjs --check",
+    "check:kernel-schema": "node scripts/sync-kernel-schema.mjs --check",
     "check:issues": "issues/.cli/issues check && node --test issues/.cli/history.test.mjs && node --test issues/.cli/view-server.test.mjs && node --test issues/.view/contract.test.mjs",
     "qualify:publications": "node scripts/qualify-publications.mjs",
     "qualify": "node scripts/qualify.mjs",
     "sync:linter-policy": "node scripts/sync-domain-policy.mjs",
+    "sync:kernel-schema": "node scripts/sync-kernel-schema.mjs",
     "setup": "bash scripts/setup/setup.sh",
     "setup:codex": "AGENT_HARNESSES=codex bash scripts/setup/setup.sh",
     "setup:claude": "AGENT_HARNESSES=claude bash scripts/setup/setup.sh",