@astrale-os/sdk 0.6.0-beta.43 → 0.6.0-beta.44

package/dist/tooling/linter/policy/generated.js

@@ -1,7 +1,7 @@
 /** Generated from the validated Domain knowledge catalog. Regenerate with pnpm sync:linter-policy. */
-export const domainPolicyDigest = 'a19a3c4efe61d16a2e4a32aff4c9ec6f4686852dc6e4caea4f858252d0ec3758';
+export const domainPolicyDigest = '29e28297047ecdd98b0d0a35d5ce2fbeaea0a7693d3aa2fd4b2a2a0c6cd2756d';
 export const domainPolicySource = Object.freeze({
-    rules: "id\tscope\tkind\tseverity\tmessage\tverification\texample\nOWN-SEMANTIC\townership\tarchitecture\terror\tEvery semantic fact, rule, representation, transition, and failure meaning has exactly one owner\tInventory declarations by meaning and report each duplicate authority or ownerless concept\tsemantic-owner.md\nMOD-SUBMODULE\tmodules\tstructure\terror\tEvery semantic source file lives in a dedicated semantic submodule or its registered layer facade\tClassify every layer-root source file and report files outside the registered facade or public index\tsemantic-owner.md\nMOD-REQUIRED\tmodules\tstructure\terror\tEvery required layer and root file declared by the injected layout exists\tCompare admitted project entries with required layout entries and report each missing path\trequired-layout.md\nMOD-GOVERNED\tmodules\tstructure\terror\tEvery source file admitted by the Domain compilation scope belongs to a declared layer or supported root\tClassify admitted source paths after declared workspace and tooling delegation and report each unowned path\tgoverned-source.md\nROOT-FACADE\troots\tstructure\terror\tEvery registered layer facade is exposed through a curated public index\tInspect each layer index and facade and report private-owner behavior or misplaced facade declarations\tpackage-facade.md\nROOT-COMPOSE\troots\tstructure\terror\tPackage roots compose only policy-backed Schema, Runtime, frontend deployment, native Routes, Provider-backed Integrations, and supported package journeys\tInspect declared composition and package roots and report behavior, provider protocol logic, recursive barrels, or unsupported exports\tcomposition-root.md\nROOT-PACKAGE\troots\tevidence\terror\tEvery public Schema package subpath maps one admitted source entrypoint to its deterministic published declaration and JavaScript targets\tCompare source and publish exports and reject missing duplicate non-Schema locally linked generated or Kernel-leaking package artifacts\tmulti-domain-package.md\nDEP-ALLOWLIST\tdependencies\tdependency\terror\tEvery direct cross-layer import and its runtime or type-only kind appears in the dependency allowlist and dependencies between distinct layers are acyclic\tResolve source imports, reject every absent or kind-mismatched edge, and detect cycles after excluding evidence edges\tsemantic-owner.md\nIMP-FACADE\timports\tdependency\terror\tEvery cross-submodule import uses the semantic owner's facade and every foreign Domain import uses its public package facade\tResolve imports and report private deep paths outside the importing submodule\tcross-domain.md\nIMP-SDK-BOUNDARY\timports\tdependency\terror\tDomain source imports Kernel Core and DSL authoring values only through semantic SDK subpaths\tInspect every static and literal dynamic import and report module specifiers rooted at @astrale-os/kernel-core or @astrale-os/kernel-dsl\tsdk-boundary.md\nIMP-LAYER-ALIAS\timports\tdependency\terror\tEvery local import crossing a layer or semantic-submodule boundary uses the registered # layer alias\tResolve relative imports and report each one whose target leaves the importing semantic submodule\tlayer-aliases.md\nIMP-ALIAS-CFG\timports\tdependency\terror\tPackage and TypeScript resolution exactly implement each active layer-facade and semantic-submodule alias\tCompare active and required layers with the injected alias registry and report missing, undeclared, or drifted mappings\talias-configuration.md\nIMP-STATIC\timports\tdependency\terror\tProduction dependency edges use analyzable static ESM declarations or literal import calls\tReject require calls, import-equals declarations, nonliteral import calls, and unresolved static dependency forms\tstatic-imports.md\nTYP-OWNER\ttypes\tarchitecture\terror\tEvery type and reusable expected error is colocated with the semantic concept that defines its meaning\tTrace each declaration to its semantic authority and report catch-all or remotely owned values\texpected-failure.md\nERR-EXPECTED\terrors\tdataflow\terror\tBoundaries map only declared expected failures and propagate unexpected defects\tInspect catches and result mappings and report broad fallback, swallowed defects, or mappings without a declared source failure\texpected-failure.md\nTST-NO-PROD-IMP\ttests\tdependency\terror\tProduction source imports no root or colocated Test artifact\tResolve production imports and report targets under Root Tests, __tests__, or test, spec, bench, and perf source files\ttest-import-boundary.md\nABS-EARNED\tabstractions\tarchitecture\terror\tAn invariant or real boundary earns an abstraction; reuse alone requires two independent consumers and no duplicated semantic behavior\tIdentify the invariant, boundary, or independent consumers for each abstraction and report reuse wrappers that duplicate an owner's semantics\tsemantic-owner.md\nABS-NO-REPO\tabstractions\tarchitecture\terror\tDomain source places no collection-shaped persistence facade between business code and canonical Query or Mutation definitions\tInspect persistence-facing contracts and report abstractions that replace graph identity, traversal, observation, or atomic change semantics\tsemantic-owner.md\nABS-CANON-GRAPH\tabstractions\tdeclaration\terror\tDomain source declares no alternate Query or Mutation language, AST, compiler, planner, or wire representation\tInspect graph-related declarations and report semantics not identical to canonical Kernel Query or Mutation values\tsemantic-owner.md\nTRUST-ADMIT-ONCE\ttrust\tdataflow\terror\tEvery untrusted value is admitted or translated exactly once at its owning boundary\tTrace values from each external boundary and report missing admission or repeated structural validation\texpected-failure.md\nQLT-EXHAUSTIVE\tquality\tbehavior\terror\tEvery closed alternative is handled exhaustively and no required failure becomes placeholder success\tTrace closed unions and failure paths and report permissive defaults, placeholder success, or catch-and-continue behavior\texpected-failure.md\nQLT-CANON-VALUES\tquality\tdataflow\terror\tNo unchecked cast fabricates a canonical Kernel identity, QueryAST, MutationAST, or admitted schema value\tScan casts to canonical values and require an owning constructor or decoder for each\tsemantic-owner.md\nQLT-DEF-IDS\tquality\tdeclaration\terror\tEvery top-level Query and Mutation definition has a stable literal ID unique in its owning namespace\tExtract top-level definition IDs and report missing, dynamic, malformed, or duplicate values\tdefinition-identities.md\nQLT-TYPED-COORD\tquality\tdeclaration\terror\tQueries and Mutations derive graph coordinates from resolved DSL definitions instead of raw string or structural reconstruction\tReject raw PropertyKey calls and structural ClassPath objects; require canonical resolved Classes Properties and keys at graph boundaries\ttyped-coordinates.md\nNODE-INHERITED\tnodes\tdeclaration\terror\tNo Node Class redeclares name, description, createdAt, or updatedAt inherited from Named, Descriptable, and Timestamped\tScan Node Class Properties and report each inherited field redeclaration\tsemantic-owner.md\nDOM-PUBLIC-DEPS\tdomains\tdependency\terror\tEvery directly referenced foreign-Domain graph declaration has one exact Schema dependency\tResolve foreign Schema, Query, and Mutation graph references and report each package without one exact declared Schema dependency\tcross-domain.md\nDOM-CALL-DECLARED\tdomains\tdependency\terror\tCross-Domain calls use exact declared public Schema dependencies and typed invocation; Integrations are optional consumer-owned boundaries\tTrace remote invocations and reject undeclared targets, private imports, forged references, and missing exact Domain Function requirements\tremote-domain-call.md\nDOM-ATOMICITY\tdomains\tbehavior\terror\tA cross-Domain change claims atomicity only when it is one MutationAST on one graph; calls combined with other effects are Workflow steps\tTrace atomicity and effect claims and report multiple commits, service boundaries, or foreign calls combined in a Action\tcross-domain.md\nSCH-SUBMODULE\tschema\tstructure\terror\tEvery Schema source path belongs to the registered facade, one canonical shared declaration kind, or one business-module facade or canonical declaration kind\tClassify admitted Schema source paths including shared and module-owned errors directories and report flat files or source-bearing directories outside the canonical Schema vocabulary\tschema-facade.md\nSCH-ONE-DECL\tschema\tdeclaration\terror\tEvery Schema declaration leaf file exports exactly one locally authored declaration of its directory kind and every declaration-kind index is a curated facade\tInspect runtime exports in Classes, Functions, Policies, States, and Views; resolve canonical SDK constructor origins and report zero, several, re-exported, aggregated, wrong-kind, or index-owned values\tdeclaration-file.md\nSCH-DECL-ONLY\tschema\tdeclaration\terror\tSchema performs no handler execution, Query execution, Mutation submission, Integration call, Workflow step, or Provider call\tResolve Schema imports and call graphs and require zero excluded operations\tpublication-callables.md\nSCH-EXACT-TYPES\tschema\tdeclaration\terror\tSchema authoring values preserve their exact inferred DSL types instead of widening to generic builder contracts\tScan Schema declarations and action returns for explicit generic builder authoring annotations\tschema-facade.md\nSCH-ICON-REQUIRED\tschema\tdeclaration\terror\tEvery Node Class must explicitly declare one admitted SVG icon\tInspect each SDK nodeClass and Node-kind defineClass declaration and report statically proven missing icon values while preserving opaque configurations as indeterminate\tclass-icon.md\nSCH-ICON-NEUTRAL\tschema\tdeclaration\twarning\tEvery neutral Node Class icon should be replaced with a meaningful icon\tInspect each SDK nodeClass and Node-kind defineClass declaration and report explicit classIcon.neutral or exact neutral SVG values\tclass-icon.md\nSCH-POLICY-AUTH\tschema\tdeclaration\terror\tCallable authority and existential Node scope are declared explicitly through Policy and Action implementations add no private authorization rule\tTrace callable admission and existential Node binders; report hidden authority or an ambiguous Node extent\tpolicy.md\nSCH-POLICY-NAME\tschema\tdeclaration\twarning\tEvery Policy is named as the sentence its subject completes, in the Domain's words: each business hop to the object in order, the object last\tRead each Policy name against its match and report a permission prefix such as can or may, a graph mechanics word such as source, target, sub, super, subject, object, or caller, or a business hop of the match the name omits\tpolicy.md\nSCH-STATE-SOURCE\tschema\tdeclaration\terror\tEvery persisted StateMachine vocabulary originates from an exported authority in the same Schema business module rather than a copied literal set\tResolve exact StateMachine and stateProperty origins; report same-owner copied literals and reject cross-module association\tarticle-schema.md\nSCH-STATE-RELATION\tschema\tdeclaration\terror\tEvery StateMachine is one exported static immutable finite relation without parallel vocabulary authorities\tInspect Schema module machines and exported sibling values for split or copied topology\tarticle-status.md\nSCH-STATE-PURE\tschema\tdeclaration\terror\tStateMachine topology contains no behavior, effects, guards, clocks, retry, recovery, or orchestration\tInspect files that declare StateMachine authorities for behavioral exports, boundary imports, and effectful calls\tstate-pure.md\nSCH-EDGE-KEY-ORDER\tschema\tdeclaration\terror\tA Policy edge in role form lists the source's role first\tResolve the Edge Class's declaration and report ends whose first key is another role than the source's; an unresolved Class or a spread or computed key proves nothing\tpolicy-edge.md\nRUL-SYNC\trules\tbehavior\terror\tEvery Rule is synchronous and returns no Promise, continuation, generator, or asynchronous iterator\tInspect Rule signatures and result types and reject asynchronous forms\tnormalization.md\nRUL-PURE\trules\tbehavior\terror\tRules perform no I/O and depend on no graph executor or Domain execution boundary\tResolve imports and effect origins, permitting pure standard value transformations while reporting conclusive I/O and Domain execution dependencies\tpublish-eligibility.md\nRUL-EXPL-FACTS\trules\tbehavior\terror\tEvery clock value, random value, identity, limit, and environmental observation used by a Rule is an explicit input\tTrace every value source and report reads from ambient state, globals, process state, or hidden singletons\ttime-facts.md\nRUL-CLOSED-DEC\trules\tbehavior\terror\tEvery expected business alternative is represented by a closed decision value rather than thrown control flow\tInspect Rule branches and report expected alternatives represented by exceptions or open optional fields\tpublish-eligibility.md\nQRY-CANON\tqueries\tdataflow\terror\tQuery V6: Every graph request produced by a Query definition is one canonical QueryAST built through Kernel Query APIs\tTrace request construction and reject every non-canonical graph document\tv6-filtered-query.md\nQRY-CONTRACT\tqueries\tdataflow\terror\tA Query owns its input, observation, optional business projection, pagination, and expected failures\tInspect each Query definition and report a required concern owned elsewhere or omitted\trecipe-errors.md\nQRY-SINGLE\tqueries\tdataflow\terror\tQuery V6: Every authored single Query definition declares exactly one build callback and at most one project callback\tInspect definition properties and canonical roots; report opaque helper origins as ambiguity rather than assuming cardinality\tv6-single-query.md\nQRY-COMPOSE-TYPED\tqueries\tdataflow\terror\tQuery V6: A composite Query constructs one closed QueryPlan containing only typed single-Query leaves, symbolic output references, and explicit result composition\tInspect plan construction, report unresolved call origins as ambiguity, and reject nested composites, raw sessions, graph clients, result-time callbacks, arbitrary promises, or Domain effects\tv6-dependent-query.md\nQRY-COMPOSE-STABLE\tqueries\tdeclaration\terror\tQuery V6: Every composite Query leaf has a stable semantic literal ID unique within its definition\tInspect declared Query leaves and reject dynamic, malformed, or duplicate leaf identifiers\tv6-dependent-query.md\nQRY-COLL-FANOUT\tqueries\tdataflow\twarning\tQuery V6: Three or more independent same-kind complete-Class collection leaves use one explicit query.union group\tInfer collection kind from canonical definition types and print the direct named replacement plus logical and physical plan counts\tv6-collection-union.md\nQRY-PROJECT-PURE\tqueries\tdataflow\terror\tEvery Query project or output callback is synchronous and performs only pure value transformation\tInspect project and output callback syntax and call graphs and report asynchronous continuation, I/O, mutation, nondeterminism, hidden query execution, or effects\tprojection.md\nQRY-SNAPSHOT\tqueries\tdataflow\terror\tA recipe of several reads or steps, a composite, or a paginated Query makes no point-in-time graph snapshot claim beyond one Kernel invocation\tReject shared-snapshot claims across recipe facets, steps or split reads, composite leaves, unions or continuations and route stronger consistency to an explicit Kernel facility\tsteps.md\nQRY-RECIPE-CLOCK\tqueries\tdataflow\terror\tA recipe's build and output read no clock: a recipe that depends on the time takes now in its input\tInspect build, each of its steps, and output written inline, their callbacks included, and report Date.now, Date, performance.now, process.hrtime or process.uptime called, new Date() without arguments, or Temporal.Now\trecipe.md\nQRY-RECIPE-ROWS\tqueries\tdataflow\twarning\tA recipe's bounds multiply to at most 10,000 rows\tCount each read's rows as a call counts them, from constant bounds only, and report a recipe past 10,000 rows with its count\trecipe.md\nQRY-RECIPE-FALSY\tqueries\tdataflow\twarning\tA condition entry that compares with a value that may be false or 0 tests the value with !== undefined, or states that false or 0 means no filter: gated on the value itself, the entry is falsy and skipped\tInspect the condition entries of build and its steps wherever falsy entries are skipped: what a where, is, some, none, every, atLeast, atMost or exactly callback returns, and the arguments of and and or. Report an entry A && B, or A ? B : a falsy literal, whose B passes the value A reads to eq, in, gt, gte, lt, lte, between, startsWith, atMost or exactly when the type of A admits false or a number\tfiltered-query.md\nMUT-PLAN-REQ\tmutations\tdependency\terror\tEvery identity operation and foreign Mutation plan declares the exact Kernel Function and foreign Class authority it uses\tInspect SDK MutationAST builders and Kernel Provision or Register calls and match every foreign Class operation and identity syscall invocation to Domain requirements\tprovision-plan.md\nMUT-LOCAL-ALIAS\tmutations\tdeclaration\terror\tEvery literal Mutation createNode alias is a canonical local binding accepted by the Kernel\tInspect statically resolved createNode as values and reject invalid local binding literals before runtime\tatomic-mutation.md\nMUT-CANON\tmutations\tdataflow\terror\tEvery Mutation definition builds one synchronous change through the canonical builder and constructs no alternate or nested graph document\tInspect every definition build callback and reject missing, asynchronous, alternate, or nested Mutation construction\tatomic-mutation.md\nMUT-CONTRACT\tmutations\tdataflow\terror\tA Mutation owns its input, preconditions, operations, optional business projection, and expected failures\tInspect each definition and report required mutation semantics owned elsewhere or omitted\tcreate-aggregate.md\nMUT-PRECONDS\tmutations\tdataflow\terror\tRules decide eligibility and every live graph condition required for safety is encoded as a precondition in the same MutationAST\tMap decisions to preconditions and report duplicated eligibility or safety enforced only by an earlier observation\tconditional-update.md\nMUT-FRAGMENTS\tmutations\tdataflow\terror\tReusable fragments receive the callback-scoped MutationBuilder and contribute only to the same MutationAST\tResolve fragment signatures and calls and reject escaped builders, opaque documents, or nested MutationAST construction\tmutation-fragments.md\nMUT-PURE\tmutations\tdataflow\terror\tMutation definitions perform no session call, external effect, retry, compensation, or second submission\tScan definition call graphs and require zero excluded operations\tedge-change.md\nMUT-MULTI-WFL\tmutations\tdataflow\terror\tA change requiring several MutationAST values is a Workflow and is never exposed as one atomic Mutation\tTrace multi-commit changes and report definitions or names claiming single-mutation atomicity\tdelete-node.md\nMUT-STATE-INITIAL\tmutations\tdataflow\terror\tEvery StateMachine-backed node is created from its machine's initial state\tResolve machine-backed Property initializers and require the canonical machine.initial value rather than a copied state literal\tstate-transition.md\nMUT-STATE-ATOMIC\tmutations\tdataflow\terror\tEvery persisted machine-state change consumes one allowed decision and commits its stale-state precondition and update in the same MutationAST\tInspect machine-backed writes and require transition with the canonical Schema module machine and one allowed decision; reject direct target writes and split precondition updates\tstate-transition.md\nFNC-ONE-IMPL\tfunctions\tbehavior\terror\tEvery registered handler binding resolves to exactly one implementation owned by one semantic Functions submodule\tResolve the handler registry and report non-Action owners or duplicate registrations; SDK typing owns callable exhaustiveness\tsynchronous-result.md\nFNC-ONE-EFFECT\tfunctions\tbehavior\terror\tEvery Action performs at most one effect, as its terminal operation; the Queries and read-only calls it needs precede that effect\tTrace every path and report two effects, an operation after the effect, or hidden orchestration\tmutation-operation.md\nFNC-OP-KINDS\tfunctions\tbehavior\terror\tA semantic asynchronous operation is one Query, Mutation, Integration call, dependency invocation, or canonical Kernel operation; a Query or a call that changes no state is an observation, every other operation is an effect\tClassify every awaited operation including dependency and Kernel calls as an observation or an effect; report undeclared kinds and hidden multiple effects\tintegration-operation.md\nFNC-BOUNDARIES\tfunctions\tbehavior\terror\tHandlers use self-default kernel and graph capabilities, query and mutate under the authority as names, explicit-authority direct dependencies, and optional declared Integrations; explicit Kernel and graph authority modes are available\tInspect context use, authority selection, dependencies, imports and failure mapping; reject raw unbound graph executors, foreign handler imports, implicit authority changes and swallowed defects\tremote-integration.md\nFNC-BINARY-RESULT\tfunctions\tbehavior\terror\tA binary Action returns detached buffered bytes or streaming bytes with admitted media type status and application headers without collecting or value-framing a provider stream\tExercise buffered and streaming results through their native route; verify exact bytes status headers cancellation and invalid output rejection\tnative-byte-response.md\nFNC-MULTISTEP\tfunctions\tbehavior\terror\tEvery Workflow definition contains at least two effect sites that cannot commit together\tInventory effect sites in the definition and report fewer than two or effects one Mutation could commit; early exit, rejection, and recovery paths may execute fewer\tpublication-workflow.md\nFNC-STEP-EFFECTS\tfunctions\tbehavior\terror\tEvery semantic asynchronous operation runs inside a named step: step.run, or the durable step.query and step.mutate shorthands\tTrace operations and report each one outside a named step\tpublication-workflow.md\nFNC-STEP-IDS\tfunctions\tbehavior\terror\tEvery step identifier is a stable non-empty kebab-case literal unique within its Workflow\tExtract step identifiers and reject dynamic, malformed, empty, or duplicate values\tpublication-workflow.md\nFNC-NO-NEST\tfunctions\tbehavior\terror\tNo step.run callback starts another step, whether step.run, step.query or step.mutate, directly or through a reachable helper\tInspect callback call graphs and report every nested step path\tpublication-workflow.md\nFNC-INT-TYPES\tfunctions\tdeclaration\terror\tWorkflow Integration requirements derive from declared Integration definitions and the SDK projects their clients\tReject Workflow-owned operation interfaces and require its definition generic to reference the declared Integration registry\tcross-domain-workflow.md\nFNC-STEP-READS\tfunctions\tbehavior\terror\tA durable step reads nothing before its effect: the effect builds its request and guards only from the Workflow input and earlier step results, so a retried step resends the same request\tIn a durable Workflow, report a step.run callback, inline or a named local function, whose read precedes an effect or builds its arguments unless the two take exclusive branches, where a local helper's operations run where the step calls it, a read is a Query or a raw Kernel read and an effect is a Mutation or a call its types prove durable; a call of unprovable kind is not counted\tpublication-workflow.md\nFNC-EFFECT-STEP\tfunctions\tbehavior\twarning\tEvery step makes at most one effect, so a step that fails leaves no committed effect the Workflow cannot see\tIn a durable Workflow, report a step.run callback, inline or a named local function, where one run can make two effects, counting an effect a local helper runs on each of its calls and an effect in a loop or an iterating Array callback as several, and effects in exclusive branches of the step's body as one run each, where an effect is a Mutation or a call its types prove durable; a call of unprovable kind is not counted\tpublication-workflow.md\nFNC-STEP-RETRY\tfunctions\tbehavior\twarning\tEvery effect a durable step repeats when it is retried survives the repetition: Mutations, durable calls and keyed Integration operations carry the step key, and any other effect is idempotent\tIn a durable Workflow, report a step.run callback, inline or a named local function, that invokes a callable its types prove not durable, invokes an untyped Path, written as a string or typed as one, or calls global fetch\tpublication-workflow.md\nFNC-REPLAY-VALUES\tfunctions\tbehavior\twarning\tCode of a durable Workflow outside its steps reads no value that differs on replay: the clock and randomness are read inside a step\tIn a durable Workflow, report a read of the global clock or randomness, Date.now, new Date() or Date() without argument, Math.random, crypto.randomUUID, crypto.getRandomValues or performance.now, in the run's own body, in a function it invokes immediately or an iterating Array callback there, including the arguments of a step call; a step callback and any other nested function are not inspected\tpublication-workflow.md\nFNC-STATE-CODEC\tfunctions\tbehavior\terror\tEvery step result and inter-step value is undefined or portable JSON data\tInspect step values and report actions, clients, symbols, bigint, cycles, or class instances\tpublication-workflow.md\nFNC-RECOVERY\tfunctions\tbehavior\terror\tWhen compensation or unknown-outcome branches exist, they are explicit and rely only on declared operation semantics\tInspect existing recovery branches and report guessed outcomes or compensation without exact evidence\tpublication-workflow.md\nFNC-XDOM-DECLARED\tfunctions\tbehavior\terror\tActions and Workflows invoke direct declared Domain dependencies through explicit-authority dependency invokers or canonical typed kernel.invoke references and import no foreign handler\tResolve handler imports, direct dependency aliases, explicit caller/self authority, selectors, and typed references; reject foreign imports, implicit or chained authority, undeclared aliases and forged references, and report opaque bindings as indeterminate\tcross-domain-workflow.md\nFNC-XDOM-REQ\tfunctions\tbehavior\terror\tEvery selected remote callable has one exact Domain Function requirement including its defining Class and static or instance kind\tCompare each statically selected remote callable with exact Domain Function requirements; report missing requirements and mark opaque selectors or requirement lists indeterminate\tcross-domain-workflow.md\nINT-BOUNDARY\tintegrations\tarchitecture\terror\tEvery Integration represents required behavior across an external, remote-Domain, substitution, process, or trust boundary\tIdentify the boundary for every contract and report behavior that can remain ordinary local Domain code\tpayment-authorization.md\nINT-NEUTRAL\tintegrations\tdeclaration\terror\tEvery Integration owns provider-neutral requests, evidence, correlation, idempotency, trust, and expected failure semantics needed by consumers\tInspect consumers and contracts and report provider fields or missing stable boundary semantics\tid-allocation.md\nINT-PURE\tintegrations\tdependency\terror\tIntegrations remain provider- and execution-boundary-neutral and import no concrete client, credential, configuration, Provider, Action, or Workflow\tResolve runtime and provider imports and report every conclusive concrete or execution-boundary dependency\tdocument-signing.md\nINT-ABILITY-NAME\tintegrations\tstructure\terror\tIntegration submodules are named by required ability and never mirror Schema entities mechanically\tCompare Integration and Schema submodules and report a contract without an independent boundary ability\tobject-storage.md\nRTE-RECIPE\troutes\tdeclaration\terror\tEvery native HTTP Route targets exactly one admitted Action or Workflow recipe\tResolve every route target and report forged missing or several recipes\taction-route.md\nRTE-MAPPING\troutes\tdataflow\terror\tEvery callable input field and instance receiver is mapped exactly once from path query header method or body input\tCompile each route against its resolved callable and reject incomplete ambiguous or unknown mappings\tinstance-route.md\nRTE-CREDENTIAL\troutes\tdataflow\terror\tEvery external credential source is explicit and is never also mapped as callable input\tCompile credential and input mappings and reject duplicate reserved or implicit authority sources\tcredential-route.md\nRTE-ONE-FILE\troutes\tstructure\terror\tEvery Route declaration has one business-intent kebab-case file and Routes composition contains no inline declaration\tInventory route declarations and report generic grouped or inline ownership\tapplication-routes.md\nPRV-INT-IMPL\tproviders\tarchitecture\terror\tEvery Provider implements one or more declared Integrations across a named external or remote-Domain boundary\tIdentify the boundary and implemented contracts and report a Provider without both\tpayment-provider.md\nPRV-BOUNDARY-NAME\tproviders\tstructure\terror\tProvider submodules are named by external system, protocol, or trust boundary rather than Domain entity\tInspect every submodule name and report one justified only by Schema vocabulary\tobject-storage-provider.md\nPRV-ADMIT-RESULT\tproviders\tdataflow\terror\tEvery boundary value is admitted before Integration evidence and recognized boundary failures become stable Integration failures\tTrace input and failure paths and report missing admission, leaked boundary errors, broad mapping, or swallowed defects\twebhook-admission.md\nPRV-NO-DOMAIN\tproviders\tdependency\terror\tProviders perform no local Domain graph operation, business decision, local Action call, or Workflow orchestration\tResolve Provider imports and call graphs and require zero excluded operations\tboundary-composition.md\nPRV-XDOM-TYPED\tproviders\tdependency\terror\tRemote-Domain Providers pass SDK-derived typed callable references to the caller-bound invocation capability without never casts\tInspect Provider execution invoke calls and reject references not constructed through SDK reference, opaque or fabricated references, and never-cast arguments\tremote-domain.md\nPRV-XDOM-REQ\tproviders\tdependency\terror\tEvery statically resolved remote-Domain Provider invocation has one exact Domain Function requirement\tMatch each invocation-bound public callable reference to the same foreign facade and Function selector under Domain requirements; preserve opaque references or composition as indeterminate\tremote-domain.md\nPRV-XDOM-PUBLIC\tproviders\tdependency\terror\tA remote-Domain Provider uses the remote public facade and invokes at most one public callable per Integration operation\tResolve receiver and facade origins for each remote operation and report private access, missing Integration ownership, unrelated calls, or several public invocations\tremote-domain.md\nVIW-PROJECTION\tviews\tdeclaration\terror\tEvery View converts public Domain values or named Query observations into UI props and connects each action to a named bounded Mutation or public callable contract\tInspect View outputs and actions and report behavior without a Schema, Query, UI, Mutation, Rule, or public callable owner\tdetail-view.md\nVIW-SCHEMA-DECL\tviews\tdeclaration\terror\tSchema owns every DSL View declaration and Views declares no Domain schema construct\tScan View declarations and reject Classes, Properties, Policies, Methods, Actions, or DSL Views\tarticle-list.md\nVIW-NO-COMPOSE\tviews\tdeclaration\terror\tThe Domain definition owns frontend deployment composition and Views never calls defineFrontend\tResolve direct imported defineFrontend calls in Views and report SDK constructor calls while ignoring unrelated local functions\tfrontend-composition.md\nVIW-DEPS\tviews\tdependency\terror\tViews import only Schema and its StateMachines, pure Rules, named Queries, bounded named Mutations, UI, shell-react primitives, public callable contracts, and presentation libraries\tInspect resolved imports and report dependencies or raw graph APIs outside the allowlist\tnavigation.md\nVIW-ACTIONS\tviews\tdataflow\terror\tEvery View action executes a named caller-authorized atomic Mutation or invokes a public callable; presentation state is never authorization evidence\tTrace action and authority paths and report inline or raw graph documents, elevated or effectful Mutation use, private Action imports, direct Integration calls, or authority derived from presentation\tform-actions.md\nUI-PRES-DEPS\tui\tdependency\terror\tEvery UI import is a sibling UI module or an external library used only for presentation\tInspect resolved imports and used APIs and report Domain, I/O, persistence, authorization, routing, or provider behavior\tstatus-panel.md\nUI-NO-DOMAIN\tui\tdependency\terror\tUI imports no Domain layer or Domain package facade\tResolve the UI import graph and require zero Domain paths\tresult-list.md\nUI-PURE\tui\tbehavior\terror\tUI performs no I/O, graph access, storage, authorization, business validation, provider call, routing, or Domain result mapping\tInspect components and hooks and report the exact excluded call or branch\tconfirmation-dialog.md\nUI-CALLBACKS\tui\tdataflow\terror\tUI accepts presentation props and forwards intent through callbacks without constructing Domain commands\tInspect props and event handlers and report Domain identities, command construction, or business decisions\tform.md\nUTL-DOM-AGNOSTIC\tutils\tarchitecture\terror\tEvery Utils export is Domain-agnostic and contains no Domain declaration, identity, decision, graph definition, or Workflow step\tInspect signatures and implementations and report the exact Domain concept or business behavior\tresult.md\nUTL-REUSED\tutils\tarchitecture\terror\tEvery Utils extension serves two independent semantic consumers or one package-wide execution boundary\tList direct consumers and report an extension satisfying neither condition\tjson-codec.md\nUTL-PUBLIC-DEPS\tutils\tdependency\terror\tUtils imports only public Kernel, DSL, SDK, standard-library, and sibling Utils modules\tResolve the Utils import graph and reject Domain layers, Providers, or private package paths\tjson-codec.md\nUTL-LIGHTWEIGHT\tutils\tarchitecture\terror\tUtils is private and owns no durable engine, planner, compiler, Repository, service locator, or dependency container\tInspect package exports and declarations and report public exposure or any forbidden framework machinery\tresult.md\nSCR-OPERATOR\tscripts\tbehavior\terror\tEvery root Script implements a supported operator workflow with declared inputs, outcomes, failures, and proof\tInspect each Script contract and report disposable tasks or missing operator semantics\tbackup.md\nSCR-PUBLIC-DEPS\tscripts\tbehavior\terror\tScripts import only dependency-DAG-authorized public facades, standard libraries, and operator libraries and define no Domain behavior\tResolve imports and inspect branches and report private paths, business decisions, graph definitions, or callable behavior\tupgrade.md\nSCR-TEST-DRIVERS\tscripts\tbehavior\terror\tDisposable setup, fixtures, resets, and scenario drivers live under tests/scripts rather than root Scripts\tClassify every Script by supported operator contract and report evidence-only programs at the root\trestore.md\nTST-SYS-OWNER\ttests\tevidence\terror\tRoot Tests owns cross-layer journeys, environments, harnesses, scenarios, seeds, fixtures, and disposable scripts\tInventory evidence support code and report cross-layer artifacts outside Tests or production semantics inside Tests\tinterruption-scenario.md\nTST-COLOCATED\ttests\tevidence\terror\tEvery semantic production submodule owns focused evidence in its local __tests__ directory\tJoin production submodules to focused test directories and report missing owners\tfocused-rule.md\n",
+    rules: "id\tscope\tkind\tseverity\tmessage\tverification\texample\nOWN-SEMANTIC\townership\tarchitecture\terror\tEvery semantic fact, rule, representation, transition, and failure meaning has exactly one owner\tInventory declarations by meaning and report each duplicate authority or ownerless concept\tsemantic-owner.md\nMOD-SUBMODULE\tmodules\tstructure\terror\tEvery semantic source file lives in a dedicated semantic submodule or its registered layer facade\tClassify every layer-root source file and report files outside the registered facade or public index\tsemantic-owner.md\nMOD-REQUIRED\tmodules\tstructure\terror\tEvery required layer and root file declared by the injected layout exists\tCompare admitted project entries with required layout entries and report each missing path\trequired-layout.md\nMOD-GOVERNED\tmodules\tstructure\terror\tEvery source file admitted by the Domain compilation scope belongs to a declared layer or supported root\tClassify admitted source paths after declared workspace and tooling delegation and report each unowned path\tgoverned-source.md\nROOT-FACADE\troots\tstructure\terror\tEvery registered layer facade is exposed through a curated public index\tInspect each layer index and facade and report private-owner behavior or misplaced facade declarations\tpackage-facade.md\nROOT-COMPOSE\troots\tstructure\terror\tPackage roots compose only policy-backed Schema, Runtime, frontend deployment, native Routes, Provider-backed Integrations, and supported package journeys\tInspect declared composition and package roots and report behavior, provider protocol logic, recursive barrels, or unsupported exports\tcomposition-root.md\nROOT-PACKAGE\troots\tevidence\terror\tEvery public Schema package subpath maps one admitted source entrypoint to its deterministic published declaration and JavaScript targets\tCompare source and publish exports and reject missing duplicate non-Schema locally linked generated or Kernel-leaking package artifacts\tmulti-domain-package.md\nDEP-ALLOWLIST\tdependencies\tdependency\terror\tEvery direct cross-layer import and its runtime or type-only kind appears in the dependency allowlist and dependencies between distinct layers are acyclic\tResolve source imports, reject every absent or kind-mismatched edge, and detect cycles after excluding evidence edges\tsemantic-owner.md\nIMP-FACADE\timports\tdependency\terror\tEvery cross-submodule import uses the semantic owner's facade and every foreign Domain import uses its public package facade\tResolve imports and report private deep paths outside the importing submodule\tcross-domain.md\nIMP-SDK-BOUNDARY\timports\tdependency\terror\tDomain source imports Kernel Core and DSL authoring values only through semantic SDK subpaths\tInspect every static and literal dynamic import and report module specifiers rooted at @astrale-os/kernel-core or @astrale-os/kernel-dsl\tsdk-boundary.md\nIMP-LAYER-ALIAS\timports\tdependency\terror\tEvery local import crossing a layer or semantic-submodule boundary uses the registered # layer alias\tResolve relative imports and report each one whose target leaves the importing semantic submodule\tlayer-aliases.md\nIMP-ALIAS-CFG\timports\tdependency\terror\tPackage and TypeScript resolution exactly implement each active layer-facade and semantic-submodule alias\tCompare active and required layers with the injected alias registry and report missing, undeclared, or drifted mappings\talias-configuration.md\nIMP-STATIC\timports\tdependency\terror\tProduction dependency edges use analyzable static ESM declarations or literal import calls\tReject require calls, import-equals declarations, nonliteral import calls, and unresolved static dependency forms\tstatic-imports.md\nTYP-OWNER\ttypes\tarchitecture\terror\tEvery type and reusable expected error is colocated with the semantic concept that defines its meaning\tTrace each declaration to its semantic authority and report catch-all or remotely owned values\texpected-failure.md\nERR-EXPECTED\terrors\tdataflow\terror\tBoundaries map only declared expected failures and propagate unexpected defects\tInspect catches and result mappings and report broad fallback, swallowed defects, or mappings without a declared source failure\texpected-failure.md\nTST-NO-PROD-IMP\ttests\tdependency\terror\tProduction source imports no root or colocated Test artifact\tResolve production imports and report targets under Root Tests, __tests__, or test, spec, bench, and perf source files\ttest-import-boundary.md\nABS-EARNED\tabstractions\tarchitecture\terror\tAn invariant or real boundary earns an abstraction; reuse alone requires two independent consumers and no duplicated semantic behavior\tIdentify the invariant, boundary, or independent consumers for each abstraction and report reuse wrappers that duplicate an owner's semantics\tsemantic-owner.md\nABS-NO-REPO\tabstractions\tarchitecture\terror\tDomain source places no collection-shaped persistence facade between business code and canonical Query or Mutation definitions\tInspect persistence-facing contracts and report abstractions that replace graph identity, traversal, observation, or atomic change semantics\tsemantic-owner.md\nABS-CANON-GRAPH\tabstractions\tdeclaration\terror\tDomain source declares no alternate Query or Mutation language, AST, compiler, planner, or wire representation\tInspect graph-related declarations and report semantics not identical to canonical Kernel Query or Mutation values\tsemantic-owner.md\nTRUST-ADMIT-ONCE\ttrust\tdataflow\terror\tEvery untrusted value is admitted or translated exactly once at its owning boundary\tTrace values from each external boundary and report missing admission or repeated structural validation\texpected-failure.md\nQLT-EXHAUSTIVE\tquality\tbehavior\terror\tEvery closed alternative is handled exhaustively and no required failure becomes placeholder success\tTrace closed unions and failure paths and report permissive defaults, placeholder success, or catch-and-continue behavior\texpected-failure.md\nQLT-CANON-VALUES\tquality\tdataflow\terror\tNo unchecked cast fabricates a canonical Kernel identity, QueryAST, MutationAST, or admitted schema value\tScan casts to canonical values and require an owning constructor or decoder for each\tsemantic-owner.md\nQLT-DEF-IDS\tquality\tdeclaration\terror\tEvery top-level Query and Mutation definition has a stable literal ID unique in its owning namespace\tExtract top-level definition IDs and report missing, dynamic, malformed, or duplicate values\tdefinition-identities.md\nQLT-TYPED-COORD\tquality\tdeclaration\terror\tQueries and Mutations derive graph coordinates from resolved DSL definitions instead of raw string or structural reconstruction\tReject raw PropertyKey calls and structural ClassPath objects; require canonical resolved Classes Properties and keys at graph boundaries\ttyped-coordinates.md\nNODE-INHERITED\tnodes\tdeclaration\terror\tNo Node Class redeclares name, description, createdAt, or updatedAt inherited from Named, Descriptable, and Timestamped\tScan Node Class Properties and report each inherited field redeclaration\tsemantic-owner.md\nDOM-PUBLIC-DEPS\tdomains\tdependency\terror\tEvery directly referenced foreign-Domain graph declaration has one exact Schema dependency\tResolve foreign Schema, Query, and Mutation graph references and report each package without one exact declared Schema dependency\tcross-domain.md\nDOM-CALL-DECLARED\tdomains\tdependency\terror\tCross-Domain calls use exact declared public Schema dependencies and typed invocation; Integrations are optional consumer-owned boundaries\tTrace remote invocations and reject undeclared targets, private imports, forged references, and missing exact Domain Function requirements\tremote-domain-call.md\nDOM-ATOMICITY\tdomains\tbehavior\terror\tA cross-Domain change claims atomicity only when it is one MutationAST on one graph; calls combined with other effects are Workflow steps\tTrace atomicity and effect claims and report multiple commits, service boundaries, or foreign calls combined in a Action\tcross-domain.md\nSCH-SUBMODULE\tschema\tstructure\terror\tEvery Schema source path belongs to the registered facade, one canonical shared declaration kind, or one business-module facade or canonical declaration kind\tClassify admitted Schema source paths including shared and module-owned errors directories and report flat files or source-bearing directories outside the canonical Schema vocabulary\tschema-facade.md\nSCH-ONE-DECL\tschema\tdeclaration\terror\tEvery Schema declaration leaf file exports exactly one locally authored declaration of its directory kind and every declaration-kind index is a curated facade\tInspect runtime exports in Classes, Functions, Policies, States, and Views; resolve canonical SDK constructor origins and report zero, several, re-exported, aggregated, wrong-kind, or index-owned values\tdeclaration-file.md\nSCH-DECL-ONLY\tschema\tdeclaration\terror\tSchema performs no handler execution, Query execution, Mutation submission, Integration call, Workflow step, or Provider call\tResolve Schema imports and call graphs and require zero excluded operations\tpublication-callables.md\nSCH-EXACT-TYPES\tschema\tdeclaration\terror\tSchema authoring values preserve their exact inferred DSL types instead of widening to generic builder contracts\tScan Schema declarations and action returns for explicit generic builder authoring annotations\tschema-facade.md\nSCH-ICON-REQUIRED\tschema\tdeclaration\terror\tEvery Node Class must explicitly declare one admitted SVG icon\tInspect each SDK nodeClass and Node-kind defineClass declaration and report statically proven missing icon values while preserving opaque configurations as indeterminate\tclass-icon.md\nSCH-ICON-NEUTRAL\tschema\tdeclaration\twarning\tEvery neutral Node Class icon should be replaced with a meaningful icon\tInspect each SDK nodeClass and Node-kind defineClass declaration and report explicit classIcon.neutral or exact neutral SVG values\tclass-icon.md\nSCH-POLICY-AUTH\tschema\tdeclaration\terror\tCallable authority and existential Node scope are declared explicitly through Policy and Action implementations add no private authorization rule\tTrace callable admission and existential Node binders; report hidden authority or an ambiguous Node extent\tpolicy.md\nSCH-POLICY-NAME\tschema\tdeclaration\twarning\tEvery Policy is named as the sentence its subject completes, in the Domain's words: each business hop to the object in order, the object last\tRead each Policy name against its match and report a permission prefix such as can or may, a graph mechanics word such as source, target, sub, super, subject, object, or caller, or a business hop of the match the name omits\tpolicy.md\nSCH-STATE-SOURCE\tschema\tdeclaration\terror\tEvery persisted StateMachine vocabulary originates from an exported authority in the same Schema business module rather than a copied literal set\tResolve exact StateMachine and stateProperty origins; report same-owner copied literals and reject cross-module association\tarticle-schema.md\nSCH-STATE-RELATION\tschema\tdeclaration\terror\tEvery StateMachine is one exported static immutable finite relation without parallel vocabulary authorities\tInspect Schema module machines and exported sibling values for split or copied topology\tarticle-status.md\nSCH-STATE-PURE\tschema\tdeclaration\terror\tStateMachine topology contains no behavior, effects, guards, clocks, retry, recovery, or orchestration\tInspect files that declare StateMachine authorities for behavioral exports, boundary imports, and effectful calls\tstate-pure.md\nSCH-EDGE-KEY-ORDER\tschema\tdeclaration\terror\tA Policy edge in role form lists the source's role first\tResolve the Edge Class's declaration and report ends whose first key is another role than the source's; an unresolved Class or a spread or computed key proves nothing\tpolicy-edge.md\nRUL-SYNC\trules\tbehavior\terror\tEvery Rule is synchronous and returns no Promise, continuation, generator, or asynchronous iterator\tInspect Rule signatures and result types and reject asynchronous forms\tnormalization.md\nRUL-PURE\trules\tbehavior\terror\tRules perform no I/O and depend on no graph executor or Domain execution boundary\tResolve imports and effect origins, permitting pure standard value transformations while reporting conclusive I/O and Domain execution dependencies\tpublish-eligibility.md\nRUL-EXPL-FACTS\trules\tbehavior\terror\tEvery clock value, random value, identity, limit, and environmental observation used by a Rule is an explicit input\tTrace every value source and report reads from ambient state, globals, process state, or hidden singletons\ttime-facts.md\nRUL-CLOSED-DEC\trules\tbehavior\terror\tEvery expected business alternative is represented by a closed decision value rather than thrown control flow\tInspect Rule branches and report expected alternatives represented by exceptions or open optional fields\tpublish-eligibility.md\nQRY-CANON\tqueries\tdataflow\terror\tQuery V6: Every graph request produced by a Query definition is one canonical QueryAST built through Kernel Query APIs\tTrace request construction and reject every non-canonical graph document\tv6-filtered-query.md\nQRY-CONTRACT\tqueries\tdataflow\terror\tA Query owns its input, observation, optional business projection, pagination, and expected failures\tInspect each Query definition and report a required concern owned elsewhere or omitted\tquery-errors.md\nQRY-SINGLE\tqueries\tdataflow\terror\tQuery V6: Every authored single Query definition declares exactly one build callback and at most one project callback\tInspect definition properties and canonical roots; report opaque helper origins as ambiguity rather than assuming cardinality\tv6-single-query.md\nQRY-COMPOSE-TYPED\tqueries\tdataflow\terror\tQuery V6: A composite Query constructs one closed QueryPlan containing only typed single-Query leaves, symbolic output references, and explicit result composition\tInspect plan construction, report unresolved call origins as ambiguity, and reject nested composites, raw sessions, graph clients, result-time callbacks, arbitrary promises, or Domain effects\tv6-dependent-query.md\nQRY-COMPOSE-STABLE\tqueries\tdeclaration\terror\tQuery V6: Every composite Query leaf has a stable semantic literal ID unique within its definition\tInspect declared Query leaves and reject dynamic, malformed, or duplicate leaf identifiers\tv6-dependent-query.md\nQRY-COLL-FANOUT\tqueries\tdataflow\twarning\tQuery V6: Three or more independent same-kind complete-Class collection leaves use one explicit query.union group\tInfer collection kind from canonical definition types and print the direct named replacement plus logical and physical plan counts\tv6-collection-union.md\nQRY-PROJECT-PURE\tqueries\tdataflow\terror\tEvery Query project or output callback is synchronous and performs only pure value transformation\tInspect project and output callback syntax and call graphs and report asynchronous continuation, I/O, mutation, nondeterminism, hidden query execution, or effects\tprojection.md\nQRY-SNAPSHOT\tqueries\tdataflow\terror\tA Query of several reads or steps, a composite, or a paginated Query makes no point-in-time graph snapshot claim beyond one Kernel invocation\tReject shared-snapshot claims across a Query's facets, steps or split reads, composite leaves, unions or continuations and route stronger consistency to an explicit Kernel facility\tsteps.md\nQRY-CLOCK\tqueries\tdataflow\terror\tA Query's build and output read no clock: a Query that depends on the time takes now in its input\tInspect build, each of its steps, and output written inline, their callbacks included, and report Date.now, Date, performance.now, process.hrtime or process.uptime called, new Date() without arguments, or Temporal.Now\tdefined-query.md\nQRY-ROWS\tqueries\tdataflow\twarning\tA Query's bounds multiply to at most 10,000 rows\tCount each read's rows as a call counts them, from constant bounds only, and report a Query past 10,000 rows with its count\tdefined-query.md\nQRY-FALSY\tqueries\tdataflow\twarning\tA condition entry that compares with a value that may be false or 0 tests the value with !== undefined, or states that false or 0 means no filter: gated on the value itself, the entry is falsy and skipped\tInspect the condition entries of build and its steps wherever falsy entries are skipped: what a where, is, some, none, every, atLeast, atMost or exactly callback returns, and the arguments of and and or. Report an entry A && B, or A ? B : a falsy literal, whose B passes the value A reads to eq, in, gt, gte, lt, lte, between, startsWith, atMost or exactly when the type of A admits false or a number\tfiltered-query.md\nMUT-PLAN-REQ\tmutations\tdependency\terror\tEvery identity operation and foreign Mutation plan declares the exact Kernel Function and foreign Class authority it uses\tInspect SDK MutationAST builders and Kernel Provision or Register calls and match every foreign Class operation and identity syscall invocation to Domain requirements\tprovision-plan.md\nMUT-LOCAL-ALIAS\tmutations\tdeclaration\terror\tEvery literal Mutation createNode alias is a canonical local binding accepted by the Kernel\tInspect statically resolved createNode as values and reject invalid local binding literals before runtime\tatomic-mutation.md\nMUT-CANON\tmutations\tdataflow\terror\tEvery Mutation definition builds one synchronous change through the canonical builder and constructs no alternate or nested graph document\tInspect every definition build callback and reject missing, asynchronous, alternate, or nested Mutation construction\tatomic-mutation.md\nMUT-CONTRACT\tmutations\tdataflow\terror\tA Mutation owns its input, preconditions, operations, optional business projection, and expected failures\tInspect each definition and report required mutation semantics owned elsewhere or omitted\tcreate-aggregate.md\nMUT-PRECONDS\tmutations\tdataflow\terror\tRules decide eligibility and every live graph condition required for safety is encoded as a precondition in the same MutationAST\tMap decisions to preconditions and report duplicated eligibility or safety enforced only by an earlier observation\tconditional-update.md\nMUT-FRAGMENTS\tmutations\tdataflow\terror\tReusable fragments receive the callback-scoped MutationBuilder and contribute only to the same MutationAST\tResolve fragment signatures and calls and reject escaped builders, opaque documents, or nested MutationAST construction\tmutation-fragments.md\nMUT-PURE\tmutations\tdataflow\terror\tMutation definitions perform no session call, external effect, retry, compensation, or second submission\tScan definition call graphs and require zero excluded operations\tedge-change.md\nMUT-MULTI-WFL\tmutations\tdataflow\terror\tA change requiring several MutationAST values is a Workflow and is never exposed as one atomic Mutation\tTrace multi-commit changes and report definitions or names claiming single-mutation atomicity\tdelete-node.md\nMUT-STATE-INITIAL\tmutations\tdataflow\terror\tEvery StateMachine-backed node is created from its machine's initial state\tResolve machine-backed Property initializers and require the canonical machine.initial value rather than a copied state literal\tstate-transition.md\nMUT-STATE-ATOMIC\tmutations\tdataflow\terror\tEvery persisted machine-state change consumes one allowed decision and commits its stale-state precondition and update in the same MutationAST\tInspect machine-backed writes and require transition with the canonical Schema module machine and one allowed decision; reject direct target writes and split precondition updates\tstate-transition.md\nFNC-ONE-IMPL\tfunctions\tbehavior\terror\tEvery registered handler binding resolves to exactly one implementation owned by one semantic Functions submodule\tResolve the handler registry and report non-Action owners or duplicate registrations; SDK typing owns callable exhaustiveness\tsynchronous-result.md\nFNC-ONE-EFFECT\tfunctions\tbehavior\terror\tEvery Action performs at most one effect, as its terminal operation; the Queries and read-only calls it needs precede that effect\tTrace every path and report two effects, an operation after the effect, or hidden orchestration\tmutation-operation.md\nFNC-OP-KINDS\tfunctions\tbehavior\terror\tA semantic asynchronous operation is one Query, Mutation, Integration call, dependency invocation, or canonical Kernel operation; a Query or a call that changes no state is an observation, every other operation is an effect\tClassify every awaited operation including dependency and Kernel calls as an observation or an effect; report undeclared kinds and hidden multiple effects\tintegration-operation.md\nFNC-BOUNDARIES\tfunctions\tbehavior\terror\tHandlers use self-default kernel and graph capabilities, query and mutate under the authority as names, explicit-authority direct dependencies, and optional declared Integrations; explicit Kernel and graph authority modes are available\tInspect context use, authority selection, dependencies, imports and failure mapping; reject raw unbound graph executors, foreign handler imports, implicit authority changes and swallowed defects\tremote-integration.md\nFNC-BINARY-RESULT\tfunctions\tbehavior\terror\tA binary Action returns detached buffered bytes or streaming bytes with admitted media type status and application headers without collecting or value-framing a provider stream\tExercise buffered and streaming results through their native route; verify exact bytes status headers cancellation and invalid output rejection\tnative-byte-response.md\nFNC-MULTISTEP\tfunctions\tbehavior\terror\tEvery Workflow definition contains at least two effect sites that cannot commit together\tInventory effect sites in the definition and report fewer than two or effects one Mutation could commit; early exit, rejection, and recovery paths may execute fewer\tpublication-workflow.md\nFNC-STEP-EFFECTS\tfunctions\tbehavior\terror\tEvery semantic asynchronous operation runs inside a named step: step.run, or the durable step.query and step.mutate shorthands\tTrace operations and report each one outside a named step\tpublication-workflow.md\nFNC-STEP-IDS\tfunctions\tbehavior\terror\tEvery step identifier is a stable non-empty kebab-case literal unique within its Workflow\tExtract step identifiers and reject dynamic, malformed, empty, or duplicate values\tpublication-workflow.md\nFNC-NO-NEST\tfunctions\tbehavior\terror\tNo step.run callback starts another step, whether step.run, step.query or step.mutate, directly or through a reachable helper\tInspect callback call graphs and report every nested step path\tpublication-workflow.md\nFNC-INT-TYPES\tfunctions\tdeclaration\terror\tWorkflow Integration requirements derive from declared Integration definitions and the SDK projects their clients\tReject Workflow-owned operation interfaces and require its definition generic to reference the declared Integration registry\tcross-domain-workflow.md\nFNC-STEP-READS\tfunctions\tbehavior\terror\tA durable step reads nothing before its effect: the effect builds its request and guards only from the Workflow input and earlier step results, so a retried step resends the same request\tIn a durable Workflow, report a step.run callback, inline or a named local function, whose read precedes an effect or builds its arguments unless the two take exclusive branches, where a local helper's operations run where the step calls it, a read is a Query or a raw Kernel read and an effect is a Mutation or a call its types prove durable; a call of unprovable kind is not counted\tpublication-workflow.md\nFNC-EFFECT-STEP\tfunctions\tbehavior\twarning\tEvery step makes at most one effect, so a step that fails leaves no committed effect the Workflow cannot see\tIn a durable Workflow, report a step.run callback, inline or a named local function, where one run can make two effects, counting an effect a local helper runs on each of its calls and an effect in a loop or an iterating Array callback as several, and effects in exclusive branches of the step's body as one run each, where an effect is a Mutation or a call its types prove durable; a call of unprovable kind is not counted\tpublication-workflow.md\nFNC-STEP-RETRY\tfunctions\tbehavior\twarning\tEvery effect a durable step repeats when it is retried survives the repetition: Mutations, durable calls and keyed Integration operations carry the step key, and any other effect is idempotent\tIn a durable Workflow, report a step.run callback, inline or a named local function, that invokes a callable its types prove not durable, invokes an untyped Path, written as a string or typed as one, or calls global fetch\tpublication-workflow.md\nFNC-REPLAY-VALUES\tfunctions\tbehavior\twarning\tCode of a durable Workflow outside its steps reads no value that differs on replay: the clock and randomness are read inside a step\tIn a durable Workflow, report a read of the global clock or randomness, Date.now, new Date() or Date() without argument, Math.random, crypto.randomUUID, crypto.getRandomValues or performance.now, in the run's own body, in a function it invokes immediately or an iterating Array callback there, including the arguments of a step call; a step callback and any other nested function are not inspected\tpublication-workflow.md\nFNC-STATE-CODEC\tfunctions\tbehavior\terror\tEvery step result and inter-step value is undefined or portable JSON data\tInspect step values and report actions, clients, symbols, bigint, cycles, or class instances\tpublication-workflow.md\nFNC-RECOVERY\tfunctions\tbehavior\terror\tWhen compensation or unknown-outcome branches exist, they are explicit and rely only on declared operation semantics\tInspect existing recovery branches and report guessed outcomes or compensation without exact evidence\tpublication-workflow.md\nFNC-XDOM-DECLARED\tfunctions\tbehavior\terror\tActions and Workflows invoke direct declared Domain dependencies through explicit-authority dependency invokers or canonical typed kernel.invoke references and import no foreign handler\tResolve handler imports, direct dependency aliases, explicit caller/self authority, selectors, and typed references; reject foreign imports, implicit or chained authority, undeclared aliases and forged references, and report opaque bindings as indeterminate\tcross-domain-workflow.md\nFNC-XDOM-REQ\tfunctions\tbehavior\terror\tEvery selected remote callable has one exact Domain Function requirement including its defining Class and static or instance kind\tCompare each statically selected remote callable with exact Domain Function requirements; report missing requirements and mark opaque selectors or requirement lists indeterminate\tcross-domain-workflow.md\nINT-BOUNDARY\tintegrations\tarchitecture\terror\tEvery Integration represents required behavior across an external, remote-Domain, substitution, process, or trust boundary\tIdentify the boundary for every contract and report behavior that can remain ordinary local Domain code\tpayment-authorization.md\nINT-NEUTRAL\tintegrations\tdeclaration\terror\tEvery Integration owns provider-neutral requests, evidence, correlation, idempotency, trust, and expected failure semantics needed by consumers\tInspect consumers and contracts and report provider fields or missing stable boundary semantics\tid-allocation.md\nINT-PURE\tintegrations\tdependency\terror\tIntegrations remain provider- and execution-boundary-neutral and import no concrete client, credential, configuration, Provider, Action, or Workflow\tResolve runtime and provider imports and report every conclusive concrete or execution-boundary dependency\tdocument-signing.md\nINT-ABILITY-NAME\tintegrations\tstructure\terror\tIntegration submodules are named by required ability and never mirror Schema entities mechanically\tCompare Integration and Schema submodules and report a contract without an independent boundary ability\tobject-storage.md\nRTE-CALLABLE\troutes\tdeclaration\terror\tEvery native HTTP Route targets exactly one admitted Action or Workflow definition\tResolve every route target and report forged missing or several definitions\taction-route.md\nRTE-MAPPING\troutes\tdataflow\terror\tEvery callable input field and instance receiver is mapped exactly once from path query header method or body input\tCompile each route against its resolved callable and reject incomplete ambiguous or unknown mappings\tinstance-route.md\nRTE-CREDENTIAL\troutes\tdataflow\terror\tEvery external credential source is explicit and is never also mapped as callable input\tCompile credential and input mappings and reject duplicate reserved or implicit authority sources\tcredential-route.md\nRTE-ONE-FILE\troutes\tstructure\terror\tEvery Route declaration has one business-intent kebab-case file and Routes composition contains no inline declaration\tInventory route declarations and report generic grouped or inline ownership\tapplication-routes.md\nPRV-INT-IMPL\tproviders\tarchitecture\terror\tEvery Provider implements one or more declared Integrations across a named external or remote-Domain boundary\tIdentify the boundary and implemented contracts and report a Provider without both\tpayment-provider.md\nPRV-BOUNDARY-NAME\tproviders\tstructure\terror\tProvider submodules are named by external system, protocol, or trust boundary rather than Domain entity\tInspect every submodule name and report one justified only by Schema vocabulary\tobject-storage-provider.md\nPRV-ADMIT-RESULT\tproviders\tdataflow\terror\tEvery boundary value is admitted before Integration evidence and recognized boundary failures become stable Integration failures\tTrace input and failure paths and report missing admission, leaked boundary errors, broad mapping, or swallowed defects\twebhook-admission.md\nPRV-NO-DOMAIN\tproviders\tdependency\terror\tProviders perform no local Domain graph operation, business decision, local Action call, or Workflow orchestration\tResolve Provider imports and call graphs and require zero excluded operations\tboundary-composition.md\nPRV-XDOM-TYPED\tproviders\tdependency\terror\tRemote-Domain Providers pass SDK-derived typed callable references to the caller-bound invocation capability without never casts\tInspect Provider execution invoke calls and reject references not constructed through SDK reference, opaque or fabricated references, and never-cast arguments\tremote-domain.md\nPRV-XDOM-REQ\tproviders\tdependency\terror\tEvery statically resolved remote-Domain Provider invocation has one exact Domain Function requirement\tMatch each invocation-bound public callable reference to the same foreign facade and Function selector under Domain requirements; preserve opaque references or composition as indeterminate\tremote-domain.md\nPRV-XDOM-PUBLIC\tproviders\tdependency\terror\tA remote-Domain Provider uses the remote public facade and invokes at most one public callable per Integration operation\tResolve receiver and facade origins for each remote operation and report private access, missing Integration ownership, unrelated calls, or several public invocations\tremote-domain.md\nVIW-PROJECTION\tviews\tdeclaration\terror\tEvery View converts public Domain values or named Query observations into UI props and connects each action to a named bounded Mutation or public callable contract\tInspect View outputs and actions and report behavior without a Schema, Query, UI, Mutation, Rule, or public callable owner\tdetail-view.md\nVIW-SCHEMA-DECL\tviews\tdeclaration\terror\tSchema owns every DSL View declaration and Views declares no Domain schema construct\tScan View declarations and reject Classes, Properties, Policies, Methods, Actions, or DSL Views\tarticle-list.md\nVIW-NO-COMPOSE\tviews\tdeclaration\terror\tThe Domain definition owns frontend deployment composition and Views never calls defineFrontend\tResolve direct imported defineFrontend calls in Views and report SDK constructor calls while ignoring unrelated local functions\tfrontend-composition.md\nVIW-DEPS\tviews\tdependency\terror\tViews import only Schema and its StateMachines, pure Rules, named Queries, bounded named Mutations, UI, shell-react primitives, public callable contracts, and presentation libraries\tInspect resolved imports and report dependencies or raw graph APIs outside the allowlist\tnavigation.md\nVIW-ACTIONS\tviews\tdataflow\terror\tEvery View action executes a named caller-authorized atomic Mutation or invokes a public callable; presentation state is never authorization evidence\tTrace action and authority paths and report inline or raw graph documents, elevated or effectful Mutation use, private Action imports, direct Integration calls, or authority derived from presentation\tform-actions.md\nUI-PRES-DEPS\tui\tdependency\terror\tEvery UI import is a sibling UI module or an external library used only for presentation\tInspect resolved imports and used APIs and report Domain, I/O, persistence, authorization, routing, or provider behavior\tstatus-panel.md\nUI-NO-DOMAIN\tui\tdependency\terror\tUI imports no Domain layer or Domain package facade\tResolve the UI import graph and require zero Domain paths\tresult-list.md\nUI-PURE\tui\tbehavior\terror\tUI performs no I/O, graph access, storage, authorization, business validation, provider call, routing, or Domain result mapping\tInspect components and hooks and report the exact excluded call or branch\tconfirmation-dialog.md\nUI-CALLBACKS\tui\tdataflow\terror\tUI accepts presentation props and forwards intent through callbacks without constructing Domain commands\tInspect props and event handlers and report Domain identities, command construction, or business decisions\tform.md\nUTL-DOM-AGNOSTIC\tutils\tarchitecture\terror\tEvery Utils export is Domain-agnostic and contains no Domain declaration, identity, decision, graph definition, or Workflow step\tInspect signatures and implementations and report the exact Domain concept or business behavior\tresult.md\nUTL-REUSED\tutils\tarchitecture\terror\tEvery Utils extension serves two independent semantic consumers or one package-wide execution boundary\tList direct consumers and report an extension satisfying neither condition\tjson-codec.md\nUTL-PUBLIC-DEPS\tutils\tdependency\terror\tUtils imports only public Kernel, DSL, SDK, standard-library, and sibling Utils modules\tResolve the Utils import graph and reject Domain layers, Providers, or private package paths\tjson-codec.md\nUTL-LIGHTWEIGHT\tutils\tarchitecture\terror\tUtils is private and owns no durable engine, planner, compiler, Repository, service locator, or dependency container\tInspect package exports and declarations and report public exposure or any forbidden framework machinery\tresult.md\nSCR-OPERATOR\tscripts\tbehavior\terror\tEvery root Script implements a supported operator workflow with declared inputs, outcomes, failures, and proof\tInspect each Script contract and report disposable tasks or missing operator semantics\tbackup.md\nSCR-PUBLIC-DEPS\tscripts\tbehavior\terror\tScripts import only dependency-DAG-authorized public facades, standard libraries, and operator libraries and define no Domain behavior\tResolve imports and inspect branches and report private paths, business decisions, graph definitions, or callable behavior\tupgrade.md\nSCR-TEST-DRIVERS\tscripts\tbehavior\terror\tDisposable setup, fixtures, resets, and scenario drivers live under tests/scripts rather than root Scripts\tClassify every Script by supported operator contract and report evidence-only programs at the root\trestore.md\nTST-SYS-OWNER\ttests\tevidence\terror\tRoot Tests owns cross-layer journeys, environments, harnesses, scenarios, seeds, fixtures, and disposable scripts\tInventory evidence support code and report cross-layer artifacts outside Tests or production semantics inside Tests\tinterruption-scenario.md\nTST-COLOCATED\ttests\tevidence\terror\tEvery semantic production submodule owns focused evidence in its local __tests__ directory\tJoin production submodules to focused test directories and report missing owners\tfocused-rule.md\n",
     layers: frozenRows([
         {
             id: 'schema',
@@ -166,7 +166,7 @@ export const domainPolicySource = Object.freeze({
             source: 'routes',
             target: 'functions',
             kind: 'runtime',
-            condition: 'Routes target admitted Action and Workflow recipes',
+            condition: 'Routes target admitted Action and Workflow definitions',
         },
         {
             source: 'providers',

package/dist/tooling/linter/requirements/registry.js

@@ -118,9 +118,9 @@ export const domainRuleRequirements = Object.freeze([
     row('QRY-COLL-FANOUT', DATAFLOW),
     row('QRY-PROJECT-PURE', DATAFLOW),
     row('QRY-SNAPSHOT', DATAFLOW),
-    row('QRY-RECIPE-CLOCK', DATAFLOW),
-    row('QRY-RECIPE-ROWS', DATAFLOW),
-    row('QRY-RECIPE-FALSY', DATAFLOW),
+    row('QRY-CLOCK', DATAFLOW),
+    row('QRY-ROWS', DATAFLOW),
+    row('QRY-FALSY', DATAFLOW),
     row('MUT-PLAN-REQ', DATAFLOW),
     row('MUT-LOCAL-ALIAS', DECLARATION),
     row('MUT-CANON', DATAFLOW),
@@ -153,7 +153,7 @@ export const domainRuleRequirements = Object.freeze([
     row('INT-NEUTRAL', DECLARATION),
     row('INT-PURE', DEPENDENCY),
     row('INT-ABILITY-NAME', STRUCTURE),
-    row('RTE-RECIPE', DECLARATION_FLOW),
+    row('RTE-CALLABLE', DECLARATION_FLOW),
     row('RTE-MAPPING', DATAFLOW),
     row('RTE-CREDENTIAL', DATAFLOW),
     row('RTE-ONE-FILE', STRUCTURE),

package/docs/durable-workflows.md

@@ -48,8 +48,8 @@ export const remind = defineWorkflow<typeof schema>()(
 | `input`, `self`, `domain` | As for any Workflow; `self` is the receiver of an instance Method. |
 | `execution` | Attested facts: `id`, `function {id, version}`, `kernel`, `initiator {principal, caller}`, `receiver`. Data, never authority. |
 | `step.run(step, execute)` | Runs `execute` once and journals its portable output; a replay returns the journaled output. `execute` receives the capabilities of an Action, acting as the executor alone: `kernel`, `graph`, `query`, `mutate`, `dependencies` and `integrations`. `step` is the Step's id, or `{ id, retry, timeoutMs }` (see [Retry budgets and timeouts](#retry-budgets-and-timeouts)). |
-| `step.query(step, recipe, input, { as: 'executor' })` | One journaled [Query recipe](queries.md), read as the executor; a replay returns the result of its first run. A Query V6 definition takes `step.query(step, query, input?)`. |
-| `step.mutate(step, recipe, input, { as: 'executor' })` | One journaled [Mutation recipe](queries.md#mutation-recipes), written as the executor; a replay returns the result of its first commit. A Mutation of the closure form takes `step.mutate(step, mutation, input)`. |
+| `step.query(step, query, input, { as: 'executor' })` | One journaled [Query](queries.md), read as the executor; a replay returns the result of its first run. A Query V6 definition takes `step.query(step, query, input?)`. |
+| `step.mutate(step, mutation, input, { as: 'executor' })` | One journaled [defined Mutation](queries.md#defining-a-mutation), written as the executor; a replay returns the result of its first commit. A Mutation of the closure form takes `step.mutate(step, mutation, input)`. |
 | `step.parallel(declare)` | Runs the Steps `declare` declares together, in one round trip to the engine; see [Parallel Steps](#parallel-steps). |
 | `sleep(ms)` | Durable timer, kept by the engine even while the Domain is down. |
 | `awaitSignal(name)` | Waits for the value `Execution.signal({ name, value })` delivers once under `name`, sent before or during the wait. |
@@ -302,18 +302,18 @@ details: { step: 'archive', refusal: { code: 2002, reason: 'AUTH_INVALID' } }
 `code` is the Kernel error code; `reason`, when the Kernel gave one, its reason code. A refusal
 behind another error, as its `cause`, counts as well; any other failure leaves `refusal` out.
 
-A recipe read that fails in `step.query` throws its `QueryError` into the Workflow at once, from the
+A Query read that fails in `step.query` throws its `QueryError` into the Workflow at once, from the
 journal on a replay: what it met will not change on a retry. A read the Kernel refused is the
-exception, a failed attempt like any refusal. Uncaught, the outcome names the query's code and
-recipe, never its details:
+exception, a failed attempt like any refusal. Uncaught, the outcome names the `QueryError`'s code
+and the Query's id, never its details:
 
 ```ts
-details: { step: 'invoice', query: { code: 'NOT_FOUND', recipe: 'billing.invoice.find' } }
+details: { step: 'invoice', query: { code: 'NOT_FOUND', id: 'billing.invoice.find' } }
 ```
 
-A recipe whose relation crosses a dependency's Class the Domain does not require fails its Step
+A Query whose relation crosses a dependency's Class the Domain does not require fails its Step
 the same way, with the `TypeError` that names the requirement it needs. Uncaught, the outcome's
-message carries that requirement, and `query` names the recipe alone.
+message carries that requirement, and `query` names the Query's id alone.
 
 A failed Execution is never resumed: a new attempt is a new Execution, under a new key, so its Steps
 run their effects again under new keys.

package/docs/handler-dependencies.md

@@ -8,7 +8,7 @@ select `caller` or `self` explicitly.
 | --- | --- | --- |
 | `kernel` | Executing Domain | `.caller`, `.self` |
 | `graph` | Executing Domain | `.caller`, `.self` |
-| `query`, `mutate` | None for a recipe; executing Domain for a V6 Query, and for a Mutation without `as` | `{ as: 'executor' }`, `{ as: 'caller' }`; a V6 Query through `graph` |
+| `query`, `mutate` | None for a Query v7 or a defined Mutation; executing Domain for a V6 Query, and for a Mutation without `as` | `{ as: 'executor' }`, `{ as: 'caller' }`; a V6 Query through `graph` |
 | `dependencies.alias` | Explicit selection required | `.caller.invoke`, `.self.invoke` |
 
 `self` executes as the Domain. `caller` executes with the Domain as principal on behalf of the one

package/docs/legacy/query-v6.md

@@ -2,11 +2,11 @@
 
 Query V6 is the Query form that builds a `QueryAST` with `Query.from(…)` inside a definition
 projected from the Domain. Its definitions keep their names, types and behaviour, and are
-deprecated in favour of [Query v7 recipes](../queries.md). Two places read with V6 only:
+deprecated in favour of [Query v7](../queries.md). Two places read with V6 only:
 
 - a maintenance or repair session, where Query v7 is not served, so a migration reads with V6;
 - a Host whose Kernel does not serve Query v7 and the Class of each row; [the Query
-  guide](../queries.md) says what a recipe raises there.
+  guide](../queries.md) says what a Query v7 raises there.
 
 ## What V6 looks like
 
@@ -27,7 +27,7 @@ const tasks = await query(openTasks)
 ```
 
 - `defineQuery<Schema>()` applied to one projector from the Domain makes a V6 definition. Applied
-  to an id and a spec, it makes a v7 recipe.
+  to an id and a spec, it makes a Query v7.
 - `query(definition, input?)` reads as the installed Domain; a V6 call takes no `as`.
 - `page.size` is 256 when omitted. `pagination: { maximumPages }` follows every page and runs
   `project` over the completed chain.
@@ -53,10 +53,10 @@ const tasks = await query(openTasks)
 | `project(result)` | `output(results, input, { error, is })` |
 | `defineCompositeQuery` and dependent leaves | A record of facets, or `steps(first, (earlier) => next, …)` |
 | `defineCollectionQuery`, `query.union` | `.all({ max })`, `d.A.union(d.B)` |
-| `query(definition, input)` | `query(recipe, input, { as: 'executor' \| 'caller' })` |
-| `step.query(step, definition, input)` | `step.query(step, recipe, input, { as: 'executor' })` |
+| `query(definition, input)` | `query(query, input, { as: 'executor' \| 'caller' })` |
+| `step.query(step, definition, input)` | `step.query(step, query, input, { as: 'executor' })` |
 | `expect.query({ query, equals })` | `expect.none`, `expect.exists`, `expect.count`, `expect.unchanged` |
 
-A V6 read that v7 cannot express is bridged inside the recipe; see
+A V6 read that v7 cannot express is bridged inside the Query v7; see
 [Beyond v7](../queries.md#beyond-v7). A V6 definition moves to v7 once every Host it runs against
 serves Query v7 and the Class of each row.

package/docs/queries.md

@@ -1,23 +1,23 @@
 # Queries
 
-A Query recipe is a typed business observation over the graph. Its guarantees:
+A Query is a typed business observation over the graph. Its guarantees:
 
 - **Typed by the Domain.** Handles, conditions, rows and answers are typed from the Domain's
   Schema. A Class, Property or relation the Domain cannot name does not compile.
 - **Bounded before it reads.** Every verb carries its bound. Before anything is sent, the SDK
-  refuses a recipe past its bounds, and a relation that crosses a dependency Class the Domain does
+  refuses a Query past its bounds, and a relation that crosses a dependency Class the Domain does
   not declare.
 - **One snapshot per read.** Each read is one Kernel invocation at its own snapshot. Facets,
-  steps and pages of one recipe share none. A read whose root lists more than 32,768 ids in
+  steps and pages of one Query share none. A read whose root lists more than 32,768 ids in
   `id.in` is the exception: the SDK sends it in consecutive parts, each at its own snapshot, and
   merges their rows in the Kernel's order.
-- **Authority-neutral.** A recipe names no authority; each call names the authority it reads
+- **Authority-neutral.** A Query names no authority; each call names the authority it reads
   under.
 - **One error per refusal.** A read the SDK or the Kernel refuses raises one `QueryError` by code.
   A network failure, and a refusal that says when to retry, pass as they came. Business refusals
-  are the recipe's declared errors.
+  are the Query's declared errors.
 
-A recipe reads on a Host whose Kernel serves Query v7 and the Class of each row. A Kernel that
+A Query reads on a Host whose Kernel serves Query v7 and the Class of each row. A Kernel that
 refuses Query v7 by name raises `QueryError` `UNSUPPORTED` with `feature: 'v7'`; a Runtime that
 does not name that refusal answers `REFUSED`, with `kernelCode: 'INTERNAL_ERROR'`. An answer that
 leaves out a row's Class raises `UNSUPPORTED` with `feature: 'classes'`. Query v7 is not served
@@ -86,7 +86,7 @@ relations with `with`, and ends with the verb that says how much it reads:
 | `first()` | The first row, or `undefined` | |
 | `first(n)` | Up to `n` rows | |
 | `first(n, { more: true })` | `{ rows, more }`, reading `n + 1` rows | |
-| `page({ max })` | `{ rows, next? }`; only as a recipe's single read | |
+| `page({ max })` | `{ rows, next? }`; only as a Query's single read | |
 | `all({ max })` | Every row | Past `max`: `TOO_MANY`. |
 | `exists(id?)` | `boolean` | |
 | `count({ upTo })` | `{ count, more }`; `more` says the count reached `upTo` | |
@@ -163,7 +163,7 @@ and `withEdge()`, which adds the Edge's Class and Properties to each row under `
 
 `.with((a) => ({ name: read }))` adds each relation's answer to the row under the name given. A
 name a row already carries does not compile, and neither does a `.with` that reads another root:
-read it as a facet of the recipe.
+read it as a facet of the Query.
 
 ### Rows
 
@@ -183,9 +183,9 @@ and both ends' rows under their roles. `edgeKey(row)` gives the `{ source, targe
 Mutation or a guard names an Edge by. An Edge root's `get()`, `find()` and `exists()` take no id,
 and its `first(n)` takes no `{ more }`.
 
-## Recipes
+## Defining a Query
 
-`defineQuery<Schema>()(id, { build, output?, errors? })` defines a recipe. Its id is unique in the
+`defineQuery<Schema>()(id, { build, output?, errors? })` defines a Query. Its id is unique in the
 Domain: dot-separated segments of lowercase letters, digits and `-`.
 
 `build` returns one read, or a record of facets read together:
@@ -204,7 +204,7 @@ Reads that wait for others are chained with `steps`, `build`'s third parameter.
 `steps(first, (earlier) => next, …)` takes two to eight steps and reads them in order. The first
 is a record of facets; each next one is a function of the merged results of the steps before it,
 and returns a record of facets none of them read. A facet name read again does not compile, and
-throws a `TypeError` before the step reads. A recipe whose reads wait for none returns them
+throws a `TypeError` before the step reads. A Query whose reads wait for none returns them
 without `steps`. These steps order the reads of one call: they are not a Workflow's durable
 Steps, and nothing of them is journaled or replayed.
 
@@ -220,18 +220,18 @@ build: (id: NodeId, { Article, Comment }, steps) =>
   })),
 ```
 
-`output(results, input, { error, is })` maps the results to the recipe's answer. It is
-synchronous and pure, and returns portable JSON. Without it, the recipe answers what `build` read.
+`output(results, input, { error, is })` maps the results to the Query's answer. It is
+synchronous and pure, and returns portable JSON. Without it, the Query answers what `build` read.
 `is(row, classKey)` narrows a row to a Class or its subclasses. An expected case is a union in the
 output, not an error.
 
-## Calling a recipe
+## Calling a Query
 
-An Action calls `query(recipe, input, { as })`, where `as` is `executor` (the authority the handler
+An Action calls `query(query, input, { as })`, where `as` is `executor` (the authority the handler
 executes with) or `caller` (the incoming caller). An `auth: 'anonymous'` callable reads as
-`executor` only. A recipe with no input is called with `undefined`.
+`executor` only. A Query with no input is called with `undefined`.
 
-A page recipe, whose single read is `.page({ max })`, takes the page size and the cursor at the
+A page Query, whose single read is `.page({ max })`, takes the page size and the cursor at the
 call and answers `{ rows, next? }`; its `output` keeps `rows` and `next`. `size` is a whole number
 from 1 to `max`, `max` when omitted; any other value throws a `TypeError`:
 
@@ -247,12 +247,12 @@ A durable Workflow reads in a Step, as its executor:
 journaled, and a replay returns it. A `QueryError` other than `REFUSED`, or the `TypeError` of an
 undeclared crossing (S12), fails the Step at once, and a replay throws it again. A `REFUSED` read
 is a failed attempt like any Kernel refusal: a permanent one exhausts the Step at once, and a
-stale snapshot spends no attempt. An inline Workflow calls `query(recipe, input, { as })` from its
+stale snapshot spends no attempt. An inline Workflow calls `query(query, input, { as })` from its
 context, as an Action does, inside a named `step.run`.
 
 ## Errors
 
-A read that cannot be answered raises `QueryError`, with the recipe's id, a code and the details
+A read that cannot be answered raises `QueryError`, with the Query's id, a code and the details
 of that code:
 
 | Code | When | Details |
@@ -260,9 +260,9 @@ of that code:
 | `NOT_FOUND` | A root `get` found nothing. | `class`; `target` when the read named one |
 | `NOT_READABLE` | `get` or `find` met a fact the reader may not read. | `class`; `id`, a Node's id or an Edge's key |
 | `INTEGRITY` | A relation's `get` found none, or a second row came where one is allowed. | `relation`; `parent` for a relation; `found: 0 \| 2` |
-| `TOO_MANY` | Past a verb's `max`, a verb bound of 83,332, the recipe's 100,000 rows or its 32 reads. | `limit: 'max' \| 'rows' \| 'reads'`; `bound` |
+| `TOO_MANY` | Past a verb's `max`, a verb bound of 83,332, the Query's 100,000 rows or its 32 reads. | `limit: 'max' \| 'rows' \| 'reads'`; `bound` |
 | `REFUSED` | The Kernel refused the read. | `kernelCode`; `retryable`, whether a retry may succeed |
-| `INPUT_INVALID` | The SDK or the Kernel refused the query the recipe built, before reading anything. | `kernelCode`, `phase` and `path` when the Kernel names them; `limit: 'in'` for an `in` past 16 values |
+| `INPUT_INVALID` | The SDK or the Kernel refused the document the Query built, before reading anything. | `kernelCode`, `phase` and `path` when the Kernel names them; `limit: 'in'` for an `in` past 16 values |
 | `OUTDATED` | The Host's Registry does not match the Domain's build. | `kernelCode: 'QUERY_EXPECTATION_MISMATCH'` |
 | `UNSUPPORTED` | The Kernel does not serve Query v7, or its answer leaves out a row's Class. | `feature: 'v7' \| 'classes'` |
 
@@ -290,35 +290,35 @@ export const articleAuthor = defineQuery<typeof schema>()('publishing.article.au
 })
 ```
 
-A Function lets a recipe's error reach its own caller by declaring it again:
+A Function lets a Query's error reach its own caller by declaring it again:
 `{ errors: { ...articleAuthor.errors } }`.
 
 ## Bounds and checks
 
 Before a step sends anything, the SDK checks:
 
-- **Bounds (S11).** A recipe makes at most 32 reads and reads at most 100,000 rows, counted from
+- **Bounds (S11).** A Query makes at most 32 reads and reads at most 100,000 rows, counted from
   its verbs' bounds and its relations per parent row. A verb's bound is at most 83,332. Past one,
   the read raises `TOO_MANY`. An `in` takes at most 16 values; past them, it raises
   `INPUT_INVALID`. Fewer than 2 or more than 8 steps do not compile, and `steps` throws a
   `TypeError` when `build` calls it.
 - **Requirements (S12).** A relation that crosses a Class of a direct dependency needs `read` and
   `traverse` on that Class in the Domain's `requirements({ classes })`. A requirement on a parent
-  covers its children. Otherwise the call throws a `TypeError` naming the recipe, the relation and
+  covers its children. Otherwise the call throws a `TypeError` naming the Query, the relation and
   the requirement to add. Roots, Kernel Classes and the Domain's own Classes need nothing. A
   relation an empty list folds away is checked as if the list were not empty. A condition the
   input leaves unbuilt, such as a falsy `where` entry or an `undefined` facet, is not checked.
 
-`checkRecipe(recipe, sampleInput, { domain })` from `@astrale-os/sdk/testing` runs both checks in
+`checkQuery(query, sampleInput, { domain })` from `@astrale-os/sdk/testing` runs both checks in
 a test, without a Kernel, on the first step it builds for its sample input. Give it an input that
 builds every optional condition, and test later steps through a call. Given the Domain's
 definition it checks S12; given the Schema alone it skips S12.
 
-The Domain linter also reads recipes:
+The Domain linter also reads Queries:
 
-- `QRY-RECIPE-CLOCK` refuses a clock read in `build` or `output`. Take now in the input.
-- `QRY-RECIPE-ROWS` warns when a recipe's constant bounds multiply past 10,000 rows.
-- `QRY-RECIPE-FALSY` warns on a condition entry `x && p.eq(x)` or `x ? p.eq(x) : undefined`
+- `QRY-CLOCK` refuses a clock read in `build` or `output`. Take now in the input.
+- `QRY-ROWS` warns when a Query's constant bounds multiply past 10,000 rows.
+- `QRY-FALSY` warns on a condition entry `x && p.eq(x)` or `x ? p.eq(x) : undefined`
   whose `x` may be `false` or `0`, wherever falsy entries are skipped. Write
   `x !== undefined && p.eq(x)` to compare whenever `x` is set, or say that `false` or `0` means no
   filter: `x ? p.eq(true) : undefined` for a flag, `x !== undefined && x !== 0 && p.gte(x)` for a
@@ -326,19 +326,19 @@ The Domain linter also reads recipes:
 
 ## Beyond v7
 
-What v7 cannot express is bridged inside the recipe, with a step or in `output`. A bridge's bound
-and steps count toward the recipe's bounds, and its callers never see it. When the Kernel serves
+What v7 cannot express is bridged inside the Query, with a step or in `output`. A bridge's bound
+and steps count toward the Query's bounds, and its callers never see it. When the Kernel serves
 the construct, the bridge moves into the read and the output type does not change. Beyond a long
 root `id.in`, the SDK never splits a read behind its author.
 
-| The business asks | Bridge inside the recipe |
+| The business asks | Bridge inside the Query |
 | --- | --- |
 | A value compared with a parent's | A first step reads the parent and the next compares with its value; or read both and filter in `output`. |
 | Two parts of a pattern meeting at one Node | Read both with `.with`, compare in `output`. |
 | Ancestors, a sub-tree at any depth | One step per level reads the next with `id.in`, up to 8 steps. |
 | Sums, averages, groups | Read the values with `all({ max })`, compute in `output`. |
 | Case-insensitive search, locale sorting | A normalized Property the Domain writes, or filter and sort in `output`. |
-| Several unrelated lists | Facets of one recipe, each read at its own snapshot. |
+| Several unrelated lists | Facets of one Query, each read at its own snapshot. |
 
 A filter in `output` runs after the Kernel applied the verb's bound.
 
@@ -360,7 +360,7 @@ export const recentArticles = defineQuery<typeof schema>()('publishing.article.r
 })
 ```
 
-## Mutation recipes
+## Defining a Mutation
 
 A Mutation takes the same form, over the same handles:
 `defineMutation<Schema>()(id, { build, output?, reject?, errors? })`. `build(input, d, mutation)`
@@ -386,12 +386,12 @@ export const createWorkspace = defineMutation<typeof schema>()('workspace.create
 await mutate(createWorkspace, { slug }, { as: 'caller' })
 ```
 
-`output(result, input)` maps the committed `MutationResult`, which the recipe answers without it.
+`output(result, input)` maps the committed `MutationResult`, which the Mutation answers without it.
 `reject(failure, input, { error, is })` maps an expected refusal to the same output, or raises a
 declared error: here the Kernel refuses a second Workspace with the slug, `duplicate-key`, on every
-write that could make one, and the recipe names that refusal. A Mutation recipe shares the Query
-recipes' ids, and every call names its authority: `mutate(recipe, input, { as })`,
-`step.mutate(id, recipe, input, { as: 'executor' })`. The closure form,
+write that could make one, and the Mutation names that refusal. A defined Mutation's id shares
+the Queries' namespace, and every call names its authority: `mutate(mutation, input, { as })`,
+`step.mutate(id, mutation, input, { as: 'executor' })`. The closure form,
 `defineMutation<Schema>()((domain) => ({ id, build, project? }))`, is deprecated.
 
 ## Guards

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@astrale-os/sdk",
-  "version": "0.6.0-beta.43",
+  "version": "0.6.0-beta.44",
   "description": "Schema-first SDK for defining, composing, and deploying Astrale domains",
   "keywords": [
     "astrale",
@@ -258,11 +258,11 @@
     "registry": "https://registry.npmjs.org/"
   },
   "dependencies": {
-    "@astrale-os/kernel-client": "1.0.0-beta.27",
-    "@astrale-os/kernel-core": "1.0.0-beta.24",
-    "@astrale-os/kernel-dsl": "1.0.0-beta.17",
-    "@astrale-os/kernel-protocol": "1.0.0-beta.24",
-    "@astrale-os/kernel-server": "1.0.0-beta.24",
+    "@astrale-os/kernel-client": "1.0.0-beta.29",
+    "@astrale-os/kernel-core": "1.0.0-beta.26",
+    "@astrale-os/kernel-dsl": "1.0.0-beta.18",
+    "@astrale-os/kernel-protocol": "1.0.0-beta.26",
+    "@astrale-os/kernel-server": "1.0.0-beta.26",
     "@lucide/icons": "1.34.0",
     "@typescript/native-preview": "7.0.0-dev.20260707.2",
     "cross-spawn": "7.0.6",

package/dist/application/query/recipe/define.d.ts

@@ -1,44 +0,0 @@
-/**
- * `defineQuery<Schema>()`: one name for both forms. A string id first defines a v7 recipe; a
- * function first defines a V6 Query, which stays in `legacy/v6`. A recipe is inert: its id and
- * the errors it declares are public, and what it reads is kept for the runtime (WP-S3).
- */
-import type { schema } from '../../../platform/schema/index.js';
-import type { SingleQueryProjector } from '../legacy/v6/define.js';
-import type { Recipe, RecipeDefinitions } from './recipe.js';
-/** A recipe id: lowercase segments of letters, digits and hyphens, joined by dots. */
-export declare const RECIPE_ID: RegExp;
-export declare const MAXIMUM_RECIPE_ID = 128;
-type Callback = (...parameters: never[]) => unknown;
-/** What a recipe reads and answers: its `build`, of `(input, d, steps)`, and its `output`. */
-export interface RecipeSpec {
-    readonly build: Callback;
-    readonly output?: Callback;
-}
-/** The build and the output of a v7 recipe; `undefined` for anything else. */
-export declare function recipeSpecOf(recipe: unknown): RecipeSpec | undefined;
-/** A recipe of the Domain's namespace, a Query's or a Mutation's: its id, and its errors. */
-export type NamedRecipe = Pick<Recipe, 'id' | 'errors'>;
-/**
- * Keep the errors a recipe declares, a Query's or a Mutation's, and collect it into the
- * collections open: a Mutation recipe shares its Domain's recipe ids and error definitions.
- */
-export declare function collectRecipe(recipe: NamedRecipe): void;
-/**
- * Collect into `recipes` each recipe defined while `load` runs: a build collects the recipes that
- * loading its Domain defines, and checks them with `admitRecipes`. A module an earlier load of
- * the same process evaluated defines nothing again, so its recipes were checked with that load.
- */
-export declare function collectRecipes<T>(recipes: NamedRecipe[], load: () => Promise<T>): Promise<T>;
-/**
- * Refuse two recipes of one Domain under one id: a refusal and a call name a recipe by its id.
- * Refuse two that declare one code with different definitions: a Function that spreads both
- * recipes' errors keeps one of them, and would redact the other recipe's error.
- */
-export declare function admitRecipes(recipes: readonly NamedRecipe[]): void;
-/**
- * Define a recipe: `defineQuery<Schema>()('services.service.owner', { build, output?, errors? })`.
- * The V6 form, `defineQuery<Schema>()((domain) => ({ id, build, project? }))`, stays.
- */
-export declare function defineQuery<Schema extends schema.DomainSchema>(): SingleQueryProjector<Schema> & RecipeDefinitions<Schema>;
-export {};