@cynodia/axiom-core 0.13.0-alpha.1 → 0.14.0-alpha.1

package/dist/diagnostics.d.ts

@@ -133,6 +133,13 @@ export declare const VALIDATION_CODES: {
     readonly duplicateReadPolicy: "DUPLICATE_READ_POLICY";
     /** A `QueryDef.filter` that is not a boolean expression, or reads outside `rowScopeId` / parameters / `PRINCIPAL`. */
     readonly invalidQueryPredicate: "INVALID_QUERY_PREDICATE";
+    /**
+     * A `QueryDef` clause or a `ReadPolicyDef` predicate references a `StateDef`. A query
+     * executes on the `DataProvider`, which binds no authority state; the reference would
+     * evaluate to nothing at run time (spec13.1 F2). Bind a runtime-varying value through a
+     * query parameter instead.
+     */
+    readonly queryStateRefNotAllowed: "QUERY_STATE_REF_NOT_ALLOWED";
     /** A `QuerySortKey` whose projected key is not an orderable type. */
     readonly invalidQuerySort: "INVALID_QUERY_SORT";
     /** A projected field that is not on the projection entity, or whose value type is incompatible. */
@@ -149,6 +156,36 @@ export declare const VALIDATION_CODES: {
     readonly invalidQueryOperation: "INVALID_QUERY_OPERATION";
     /** A `provider-record` location whose entity does not resolve, or whose identity field is not that entity's identity. */
     readonly invalidProviderRecordLocation: "INVALID_PROVIDER_RECORD_LOCATION";
+    /** `WorkflowDef.entry` does not name a step of that workflow. */
+    readonly workflowEntryNotFound: "WORKFLOW_ENTRY_NOT_FOUND";
+    /** A control-flow edge (`next`/`onError`/`then`/`else`/`onTimeout`) names a step that does not exist. */
+    readonly workflowStepNotFound: "WORKFLOW_STEP_NOT_FOUND";
+    /** Two steps in one workflow share an id, or a step id collides with a graph node id. */
+    readonly workflowDuplicateStepId: "WORKFLOW_DUPLICATE_STEP_ID";
+    /** A step whose `type` is outside `WORKFLOW_STEP_TYPES`, or whose shape is invalid for its type. */
+    readonly workflowInvalidStep: "WORKFLOW_INVALID_STEP";
+    /** The workflow control-flow graph contains a cycle (retries are runtime policy, not a cycle). */
+    readonly workflowCycleNotAllowed: "WORKFLOW_CYCLE_NOT_ALLOWED";
+    /** An `action` step references an `action` that does not exist. */
+    readonly workflowActionNotFound: "WORKFLOW_ACTION_NOT_FOUND";
+    /** A `wait-event` step references an `event` that does not exist. */
+    readonly workflowEventNotFound: "WORKFLOW_EVENT_NOT_FOUND";
+    /** A `bind` / expression names a `WorkflowBinding` the workflow does not declare, or reads one before its producer. */
+    readonly workflowBindingNotFound: "WORKFLOW_BINDING_NOT_FOUND";
+    /** Two steps declare themselves the producer of the same binding, or a `bind` assigns a binding twice. */
+    readonly workflowDuplicateBinding: "WORKFLOW_DUPLICATE_BINDING";
+    /** A `WorkflowRetryPolicy` with a non-positive `maxAttempts`/`initialDelaySeconds`, a `backoffMultiplier` < 1, or `maxDelaySeconds` < `initialDelaySeconds`. */
+    readonly workflowInvalidRetryPolicy: "WORKFLOW_INVALID_RETRY_POLICY";
+    /** A `timer` step with neither `after` nor `at`, both, or a non-positive `after.seconds`. */
+    readonly workflowInvalidTimer: "WORKFLOW_INVALID_TIMER";
+    /** A step unreachable from `entry` (spec14 §122 — an authoring mistake, not a warning). */
+    readonly workflowUnreachableStep: "WORKFLOW_UNREACHABLE_STEP";
+    /** A control-flow path that can neither reach `complete`/`fail` nor end in an intentional durable wait (spec14 §123). */
+    readonly workflowNoTerminal: "WORKFLOW_NO_TERMINAL";
+    /** A workflow expression references an id outside the workflow expression scope (inputs / bindings / EVENT / PRINCIPAL). */
+    readonly workflowExpressionScope: "WORKFLOW_EXPRESSION_SCOPE";
+    /** A workflow expression reads a nondeterministic builtin (`now`/`uuid`/`random`) outside captured-time semantics. */
+    readonly workflowNondeterministic: "WORKFLOW_NONDETERMINISTIC";
     /** A `MigrationDef` whose `fromSchema`/`toSchema` are not consecutive positive integers, or a migration whose `fromSchema` is at or beyond `graph.schemaVersion`. */
     readonly invalidMigrationVersion: "INVALID_MIGRATION_VERSION";
     /** No contiguous `MigrationDef` chain connects schema 1 to `graph.schemaVersion` — a step is missing (spec11 §13). */

package/dist/diagnostics.js

@@ -125,6 +125,13 @@ export const VALIDATION_CODES = {
     duplicateReadPolicy: 'DUPLICATE_READ_POLICY',
     /** A `QueryDef.filter` that is not a boolean expression, or reads outside `rowScopeId` / parameters / `PRINCIPAL`. */
     invalidQueryPredicate: 'INVALID_QUERY_PREDICATE',
+    /**
+     * A `QueryDef` clause or a `ReadPolicyDef` predicate references a `StateDef`. A query
+     * executes on the `DataProvider`, which binds no authority state; the reference would
+     * evaluate to nothing at run time (spec13.1 F2). Bind a runtime-varying value through a
+     * query parameter instead.
+     */
+    queryStateRefNotAllowed: 'QUERY_STATE_REF_NOT_ALLOWED',
     /** A `QuerySortKey` whose projected key is not an orderable type. */
     invalidQuerySort: 'INVALID_QUERY_SORT',
     /** A projected field that is not on the projection entity, or whose value type is incompatible. */
@@ -141,6 +148,38 @@ export const VALIDATION_CODES = {
     invalidQueryOperation: 'INVALID_QUERY_OPERATION',
     /** A `provider-record` location whose entity does not resolve, or whose identity field is not that entity's identity. */
     invalidProviderRecordLocation: 'INVALID_PROVIDER_RECORD_LOCATION',
+    // Durable workflows (0.14, spec14 §124). `validateGraph` rejects an internally
+    // inconsistent `WorkflowDef` before it can be compiled or executed.
+    /** `WorkflowDef.entry` does not name a step of that workflow. */
+    workflowEntryNotFound: 'WORKFLOW_ENTRY_NOT_FOUND',
+    /** A control-flow edge (`next`/`onError`/`then`/`else`/`onTimeout`) names a step that does not exist. */
+    workflowStepNotFound: 'WORKFLOW_STEP_NOT_FOUND',
+    /** Two steps in one workflow share an id, or a step id collides with a graph node id. */
+    workflowDuplicateStepId: 'WORKFLOW_DUPLICATE_STEP_ID',
+    /** A step whose `type` is outside `WORKFLOW_STEP_TYPES`, or whose shape is invalid for its type. */
+    workflowInvalidStep: 'WORKFLOW_INVALID_STEP',
+    /** The workflow control-flow graph contains a cycle (retries are runtime policy, not a cycle). */
+    workflowCycleNotAllowed: 'WORKFLOW_CYCLE_NOT_ALLOWED',
+    /** An `action` step references an `action` that does not exist. */
+    workflowActionNotFound: 'WORKFLOW_ACTION_NOT_FOUND',
+    /** A `wait-event` step references an `event` that does not exist. */
+    workflowEventNotFound: 'WORKFLOW_EVENT_NOT_FOUND',
+    /** A `bind` / expression names a `WorkflowBinding` the workflow does not declare, or reads one before its producer. */
+    workflowBindingNotFound: 'WORKFLOW_BINDING_NOT_FOUND',
+    /** Two steps declare themselves the producer of the same binding, or a `bind` assigns a binding twice. */
+    workflowDuplicateBinding: 'WORKFLOW_DUPLICATE_BINDING',
+    /** A `WorkflowRetryPolicy` with a non-positive `maxAttempts`/`initialDelaySeconds`, a `backoffMultiplier` < 1, or `maxDelaySeconds` < `initialDelaySeconds`. */
+    workflowInvalidRetryPolicy: 'WORKFLOW_INVALID_RETRY_POLICY',
+    /** A `timer` step with neither `after` nor `at`, both, or a non-positive `after.seconds`. */
+    workflowInvalidTimer: 'WORKFLOW_INVALID_TIMER',
+    /** A step unreachable from `entry` (spec14 §122 — an authoring mistake, not a warning). */
+    workflowUnreachableStep: 'WORKFLOW_UNREACHABLE_STEP',
+    /** A control-flow path that can neither reach `complete`/`fail` nor end in an intentional durable wait (spec14 §123). */
+    workflowNoTerminal: 'WORKFLOW_NO_TERMINAL',
+    /** A workflow expression references an id outside the workflow expression scope (inputs / bindings / EVENT / PRINCIPAL). */
+    workflowExpressionScope: 'WORKFLOW_EXPRESSION_SCOPE',
+    /** A workflow expression reads a nondeterministic builtin (`now`/`uuid`/`random`) outside captured-time semantics. */
+    workflowNondeterministic: 'WORKFLOW_NONDETERMINISTIC',
     // Schema evolution & semantic migrations (0.11). `validateGraph` rejects an internally
     // inconsistent migration declaration before any persisted data is touched (spec11 §77, §78).
     /** A `MigrationDef` whose `fromSchema`/`toSchema` are not consecutive positive integers, or a migration whose `fromSchema` is at or beyond `graph.schemaVersion`. */

package/dist/graph.js

@@ -23,7 +23,7 @@ export class ApplicationGraph {
     /** Bumped by every change, so the derived edge index can never serve stale data. */
     revision = 0;
     semanticIndex;
-    constructor(id, name, version = '0.13.0') {
+    constructor(id, name, version = '0.14.0') {
         this.data = { id, name, version, nodes: {}, edges: {} };
     }
     get id() {

package/dist/index.d.ts

@@ -15,6 +15,7 @@ export * from './subscriptions.js';
 export * from './storage.js';
 export * from './query.js';
 export * from './live-query.js';
+export * from './workflows.js';
 export * from './relationships.js';
 export * from './read-policy.js';
 export * from './migration.js';

package/dist/index.js

@@ -15,6 +15,7 @@ export * from './subscriptions.js';
 export * from './storage.js';
 export * from './query.js';
 export * from './live-query.js';
+export * from './workflows.js';
 export * from './relationships.js';
 export * from './read-policy.js';
 export * from './migration.js';

package/dist/live-query.d.ts

@@ -72,9 +72,24 @@ export declare function applyDelta(rows: unknown[], delta: LiveQueryDelta, ident
 export interface QueryDependencySet {
     entityIds: Set<string>;
     stateIds: Set<string>;
+    /**
+     * `StateDef` ids a `QueryDef` clause (or the effective `ReadPolicy` predicate) references
+     * — which the provider cannot bind, so the query is not validly executable (spec13.1 F2).
+     * Never a real dependency; a query with any of these is not live-capable.
+     */
+    unsupportedStateRefs: Set<string>;
     /** A dependency that is not statically enumerable — re-evaluate on every commit (spec13 §29). */
     broad: boolean;
 }
+/**
+ * The `StateDef` ids referenced by a `QueryDef`'s clauses outside the query's legal
+ * execution scope (`rowScopeId`, parameters, relationship binds, `PRINCIPAL`, nested
+ * iteration scopes). A query executes on the `DataProvider`, which binds no authority
+ * state, so any such reference would evaluate to nothing — it is a validation error
+ * (spec13.1 F2, §76). `includePolicy` also walks a `ReadPolicyDef` predicate, whose runtime
+ * scope is likewise state-free.
+ */
+export declare function queryStateReferences(query: QueryDef, knownStateIds: ReadonlySet<string>, policy?: ReadPolicyDef): string[];
 /**
  * Conservative static dependencies of a live `QueryDef` (spec13 §26-§31). Includes the
  * source entity, every entity a used / source-touching relationship reaches, and every
@@ -109,11 +124,12 @@ export type LiveCapability = {
 /** Builtins whose value is not a pure function of committed state (spec13 §145, §146). */
 export declare const LIVE_QUERY_NONDETERMINISTIC_BUILTINS: readonly string[];
 /**
- * Classify a `QueryDef`'s live capability (spec13 §145, §146, §148, §149). A query whose
- * filter / sort / projection / group / aggregate reads a nondeterministic builtin
- * (`now`, `uuid`) is `not-live-capable`; an aggregate / grouped query, or one whose source
- * entity has no identity field, is `live-capable-reset-only` (whole-result resets only);
- * otherwise `live-capable` (incremental `insert`/`remove`/`update`/`move`).
+ * Classify a `QueryDef`'s live capability (spec13 §145, §146, §148, §149; spec13.1 §78). A
+ * query whose clause references a `StateDef` (when `knownStateIds` is supplied) is
+ * `not-live-capable` — it is not validly executable (F2). A query that reads a
+ * nondeterministic builtin (`now`, `uuid`) is `not-live-capable`; an aggregate / grouped
+ * query, or one whose source entity has no identity field, is `live-capable-reset-only`;
+ * otherwise `live-capable`.
  */
-export declare function queryLiveCapability(query: QueryDef, sourceIdentityFieldId: string | undefined): LiveCapability;
+export declare function queryLiveCapability(query: QueryDef, sourceIdentityFieldId: string | undefined, knownStateIds?: ReadonlySet<string>): LiveCapability;
 //# sourceMappingURL=live-query.d.ts.map

package/dist/live-query.js

@@ -182,6 +182,61 @@ export function applyDelta(rows, delta, identityFieldId) {
     }
     return result;
 }
+/**
+ * The `StateDef` ids referenced by a `QueryDef`'s clauses outside the query's legal
+ * execution scope (`rowScopeId`, parameters, relationship binds, `PRINCIPAL`, nested
+ * iteration scopes). A query executes on the `DataProvider`, which binds no authority
+ * state, so any such reference would evaluate to nothing — it is a validation error
+ * (spec13.1 F2, §76). `includePolicy` also walks a `ReadPolicyDef` predicate, whose runtime
+ * scope is likewise state-free.
+ */
+export function queryStateReferences(query, knownStateIds, policy) {
+    const found = new Set();
+    const localScopes = new Set([
+        String(query.rowScopeId),
+        ...(query.parameters ?? []).map((p) => String(p.id)),
+        'PRINCIPAL',
+    ]);
+    for (const use of query.relationships ?? []) {
+        if (use.bindAs)
+            localScopes.add(String(use.bindAs));
+    }
+    if (policy)
+        localScopes.add(String(policy.rowScopeId));
+    const scan = (expression) => {
+        if (!expression)
+            return;
+        walkExpression(expression, (node) => {
+            if (node.kind === 'filter' ||
+                node.kind === 'find' ||
+                node.kind === 'map' ||
+                node.kind === 'sort' ||
+                node.kind === 'every' ||
+                node.kind === 'some') {
+                const scopeId = node.scopeId;
+                if (scopeId)
+                    localScopes.add(String(scopeId));
+            }
+            if (node.kind === 'ref') {
+                const id = String(node.targetId);
+                if (!localScopes.has(id) && knownStateIds.has(id))
+                    found.add(id);
+            }
+        });
+    };
+    scan(query.filter);
+    for (const key of query.sort ?? [])
+        scan(key.key);
+    for (const field of query.projection?.fields ?? [])
+        scan(field.value);
+    for (const expression of query.groupBy ?? [])
+        scan(expression);
+    for (const aggregate of query.aggregate ?? [])
+        scan(aggregate.key);
+    if (policy)
+        scan(policy.predicate);
+    return [...found];
+}
 /**
  * Conservative static dependencies of a live `QueryDef` (spec13 §26-§31). Includes the
  * source entity, every entity a used / source-touching relationship reaches, and every
@@ -192,6 +247,7 @@ export function applyDelta(rows, delta, identityFieldId) {
 export function queryDependencies(query, policy, relationships, knownStateIds) {
     const entityIds = new Set([String(query.source)]);
     const stateIds = new Set();
+    const unsupportedStateRefs = new Set(queryStateReferences(query, knownStateIds, policy));
     let broad = false;
     const localScopes = new Set([
         String(query.rowScopeId),
@@ -202,6 +258,8 @@ export function queryDependencies(query, policy, relationships, knownStateIds) {
         if (use.bindAs)
             localScopes.add(String(use.bindAs));
     }
+    if (policy)
+        localScopes.add(String(policy.rowScopeId));
     const scan = (expression) => {
         if (!expression)
             return;
@@ -220,6 +278,10 @@ export function queryDependencies(query, policy, relationships, knownStateIds) {
                 const id = String(node.targetId);
                 if (localScopes.has(id))
                     return;
+                // A `StateDef` ref is not a real dependency — the query cannot bind it (spec13.1 F2);
+                // it is collected in `unsupportedStateRefs` above, not here.
+                if (unsupportedStateRefs.has(id))
+                    return;
                 if (knownStateIds.has(id))
                     stateIds.add(id);
                 else
@@ -236,12 +298,8 @@ export function queryDependencies(query, policy, relationships, knownStateIds) {
         scan(expression);
     for (const aggregate of query.aggregate ?? [])
         scan(aggregate.key);
-    if (policy) {
-        // The policy predicate binds a candidate row to its own scope and the caller to
-        // PRINCIPAL — neither is a StateDef dependency (spec 0.10 §56).
-        localScopes.add(String(policy.rowScopeId));
+    if (policy)
         scan(policy.predicate);
-    }
     for (const relationship of relationships) {
         if (String(relationship.from.entityId) === String(query.source) ||
             (query.relationships ?? []).some((use) => String(use.relationshipId) === String(relationship.id))) {
@@ -251,7 +309,7 @@ export function queryDependencies(query, policy, relationships, knownStateIds) {
     }
     if (policy)
         entityIds.add(String(policy.entityId));
-    return { entityIds, stateIds, broad };
+    return { entityIds, stateIds, unsupportedStateRefs, broad };
 }
 /** Conservative "may this commit have changed the query's result?" (spec13 §27, §63, §64). */
 export function commitAffectsQuery(changeset, deps) {
@@ -279,13 +337,23 @@ function usesNondeterministic(expression) {
     return found;
 }
 /**
- * Classify a `QueryDef`'s live capability (spec13 §145, §146, §148, §149). A query whose
- * filter / sort / projection / group / aggregate reads a nondeterministic builtin
- * (`now`, `uuid`) is `not-live-capable`; an aggregate / grouped query, or one whose source
- * entity has no identity field, is `live-capable-reset-only` (whole-result resets only);
- * otherwise `live-capable` (incremental `insert`/`remove`/`update`/`move`).
+ * Classify a `QueryDef`'s live capability (spec13 §145, §146, §148, §149; spec13.1 §78). A
+ * query whose clause references a `StateDef` (when `knownStateIds` is supplied) is
+ * `not-live-capable` — it is not validly executable (F2). A query that reads a
+ * nondeterministic builtin (`now`, `uuid`) is `not-live-capable`; an aggregate / grouped
+ * query, or one whose source entity has no identity field, is `live-capable-reset-only`;
+ * otherwise `live-capable`.
  */
-export function queryLiveCapability(query, sourceIdentityFieldId) {
+export function queryLiveCapability(query, sourceIdentityFieldId, knownStateIds) {
+    if (knownStateIds) {
+        const stateRefs = queryStateReferences(query, knownStateIds);
+        if (stateRefs.length > 0) {
+            return {
+                capability: 'not-live-capable',
+                reason: `query expression references a StateDef (${stateRefs.join(', ')}), which QueryDef execution scope does not bind`,
+            };
+        }
+    }
     const expressions = [
         query.filter,
         ...(query.sort ?? []).map((k) => k.key),

package/dist/semantic-identity.js

@@ -65,6 +65,7 @@ const EXECUTABLE_KINDS = [
     'transition-constraint',
     'storage',
     'relationship',
+    'workflow',
 ];
 /** Keys removed everywhere in the tree — human metadata, never executable meaning. */
 const NON_SEMANTIC_KEYS = new Set(['name', 'description', 'label', 'metadata', AUTHORING_METADATA_KEY]);

package/dist/server-ir.d.ts

@@ -11,6 +11,7 @@ import type { QueryDef } from './query.js';
 import type { RelationshipDef } from './relationships.js';
 import type { ReadPolicyDef } from './read-policy.js';
 import type { MigrationDef } from './migration.js';
+import type { WorkflowDef } from './workflows.js';
 /**
  * The contracts a Server IR may declare. A runtime that does not recognize the value MUST
  * refuse the IR rather than interpret it partially.
@@ -26,7 +27,7 @@ import type { MigrationDef } from './migration.js';
  * Every existing application therefore still compiles to a byte-identical
  * `axiom.server.v1` document, and the frozen conformance fixtures stay frozen.
  */
-export declare const SERVER_IR_CONTRACTS: readonly ["axiom.server.v1", "axiom.server.v2", "axiom.server.v3", "axiom.server.v4", "axiom.server.v5", "axiom.server.v6", "axiom.server.v7"];
+export declare const SERVER_IR_CONTRACTS: readonly ["axiom.server.v1", "axiom.server.v2", "axiom.server.v3", "axiom.server.v4", "axiom.server.v5", "axiom.server.v6", "axiom.server.v7", "axiom.server.v8"];
 export type ServerIRContract = (typeof SERVER_IR_CONTRACTS)[number];
 /** The oldest contract, and the one a document declares unless it needs more. */
 export declare const SERVER_IR_CONTRACT: ServerIRContract;
@@ -108,8 +109,18 @@ export declare function usesExternalIOVocabulary(ir: {
  */
 export declare function usesMigrationVocabulary(ir: {
     migrations?: readonly unknown[];
+    workflows?: readonly unknown[];
     schemaVersion?: number;
 }): boolean;
+/**
+ * Whether a document carries 0.14 durable-workflow vocabulary. A pre-v8 runtime has no
+ * `WorkflowDef` execution model at all, so any `WorkflowDef` present requires
+ * `axiom.server.v8` — computed from the document, never asserted by hand, so a graph that
+ * declares no workflow compiles to the byte-identical v1–v7 document it always did.
+ */
+export declare function usesWorkflowVocabulary(ir: {
+    workflows?: readonly unknown[];
+}): boolean;
 /**
  * Whether a document uses 0.10's semantic data-access vocabulary — a `QueryDef`, a
  * `RelationshipDef`, a `ReadPolicyDef`, or a `query` operation inside an action. A v5
@@ -139,6 +150,7 @@ export declare function serverIRExpressions(ir: {
     queries?: readonly QueryDef[];
     readPolicies?: readonly ReadPolicyDef[];
     migrations?: readonly MigrationDef[];
+    workflows?: readonly WorkflowDef[];
 }): Expression[];
 /**
  * The normalized form an authority executes: everything required to decide a mutation, and
@@ -237,5 +249,7 @@ export interface ServerIR {
      * `Expression` transform leaves, never SQL, a callback or a provider handle (spec11 §88).
      */
     migrations?: MigrationDef[];
+    /** Durable workflow definitions (spec14, `axiom.server.v8`). */
+    workflows?: WorkflowDef[];
 }
 //# sourceMappingURL=server-ir.d.ts.map

package/dist/server-ir.js

@@ -1,6 +1,7 @@
 import { walkExpression } from './expressions.js';
 import { queryExpressions } from './query.js';
 import { migrationExpressions } from './migration.js';
+import { workflowExpressions } from './workflows.js';
 /**
  * The contracts a Server IR may declare. A runtime that does not recognize the value MUST
  * refuse the IR rather than interpret it partially.
@@ -24,11 +25,12 @@ export const SERVER_IR_CONTRACTS = [
     'axiom.server.v5',
     'axiom.server.v6',
     'axiom.server.v7',
+    'axiom.server.v8',
 ];
 /** The oldest contract, and the one a document declares unless it needs more. */
 export const SERVER_IR_CONTRACT = 'axiom.server.v1';
 /** The newest contract this implementation produces and executes. */
-export const SERVER_IR_LATEST_CONTRACT = 'axiom.server.v7';
+export const SERVER_IR_LATEST_CONTRACT = 'axiom.server.v8';
 /** Operation kinds no contract before `axiom.server.v5` contains. */
 export const SERVER_IR_V5_OPERATION_KINDS = [
     'blob-metadata',
@@ -133,6 +135,15 @@ export function usesExternalIOVocabulary(ir) {
 export function usesMigrationVocabulary(ir) {
     return (ir.migrations?.length ?? 0) > 0 || (ir.schemaVersion ?? 1) > 1;
 }
+/**
+ * Whether a document carries 0.14 durable-workflow vocabulary. A pre-v8 runtime has no
+ * `WorkflowDef` execution model at all, so any `WorkflowDef` present requires
+ * `axiom.server.v8` — computed from the document, never asserted by hand, so a graph that
+ * declares no workflow compiles to the byte-identical v1–v7 document it always did.
+ */
+export function usesWorkflowVocabulary(ir) {
+    return (ir.workflows?.length ?? 0) > 0;
+}
 /**
  * Whether a document uses 0.10's semantic data-access vocabulary — a `QueryDef`, a
  * `RelationshipDef`, a `ReadPolicyDef`, or a `query` operation inside an action. A v5
@@ -200,6 +211,9 @@ export function serverIRExpressions(ir) {
     for (const migration of ir.migrations ?? []) {
         found.push(...migrationExpressions(migration));
     }
+    for (const workflow of ir.workflows ?? []) {
+        found.push(...workflowExpressions(workflow));
+    }
     return found;
 }
 function actionExpressions(action) {

package/dist/types.d.ts

@@ -11,11 +11,12 @@ import type { QueryDef } from './query.js';
 import type { RelationshipDef } from './relationships.js';
 import type { ReadPolicyDef } from './read-policy.js';
 import type { MigrationDef } from './migration.js';
-export type SemanticNodeKind = 'entity' | 'state' | 'action' | 'constraint' | 'transition-constraint' | 'route' | 'expression' | 'integration' | 'integration-operation' | 'event' | 'trigger' | 'subscription' | 'storage' | 'query' | 'relationship' | 'read-policy' | 'migration';
+import type { WorkflowDef } from './workflows.js';
+export type SemanticNodeKind = 'entity' | 'state' | 'action' | 'constraint' | 'transition-constraint' | 'route' | 'expression' | 'integration' | 'integration-operation' | 'event' | 'trigger' | 'subscription' | 'storage' | 'query' | 'relationship' | 'read-policy' | 'migration' | 'workflow';
 /** Every semantic node kind, enumerated so tests can walk them. */
 export declare const SEMANTIC_NODE_KINDS: readonly SemanticNodeKind[];
 export type NodeKind = SemanticNodeKind | UINodeKind;
-export type AnyNode = EntityDef | StateDef | ActionDef | ConstraintDef | TransitionConstraintDef | RouteDef | ExpressionDef | IntegrationDef | IntegrationOperationDef | EventDef | TriggerDef | SubscriptionDef | StorageDef | QueryDef | RelationshipDef | ReadPolicyDef | MigrationDef | UINode;
+export type AnyNode = EntityDef | StateDef | ActionDef | ConstraintDef | TransitionConstraintDef | RouteDef | ExpressionDef | IntegrationDef | IntegrationOperationDef | EventDef | TriggerDef | SubscriptionDef | StorageDef | QueryDef | RelationshipDef | ReadPolicyDef | MigrationDef | WorkflowDef | UINode;
 export type NodeOfKind<K extends NodeKind> = Extract<AnyNode, {
     kind: K;
 }>;

package/dist/types.js

@@ -17,4 +17,5 @@ export const SEMANTIC_NODE_KINDS = [
     'relationship',
     'read-policy',
     'migration',
+    'workflow',
 ];

package/dist/validate.js

@@ -1,9 +1,11 @@
-import { AGGREGATE_FUNCTIONS, BUILTIN_FUNCTIONS, expressionDefsIn } from './expressions.js';
+import { AGGREGATE_FUNCTIONS, BUILTIN_FUNCTIONS, expressionDefsIn, walkExpression } from './expressions.js';
 import { VALIDATION_CODES } from './diagnostics.js';
 import { EDGE_KINDS, actionGuards, isMutationOperation } from './nodes.js';
 import { SUBSCRIPTION_BACKPRESSURE_POLICIES, subscriptionBackpressure, subscriptionQueueLimit, } from './subscriptions.js';
 import { BLOB_REF_FIELDS } from './storage.js';
 import { queryPaginationStrategy, sortKeyDirection } from './query.js';
+import { queryStateReferences } from './live-query.js';
+import { WORKFLOW_EVENT_SCOPE, WORKFLOW_PRINCIPAL_SCOPE, WORKFLOW_STEP_TYPES, workflowHasCycle, workflowReachableSteps, workflowStepById, workflowStepExpressions, workflowStepSuccessors, } from './workflows.js';
 import { relationshipIsToOne } from './relationships.js';
 import { validateMigrations } from './validate-migration.js';
 import { collectionType, entityType } from './type-ref.js';
@@ -171,6 +173,9 @@ function validateNode(node, context) {
         case 'read-policy':
             validateReadPolicy(node, context);
             return;
+        case 'workflow':
+            validateWorkflow(node, context);
+            return;
         case 'migration':
             // A `MigrationDef` is validated by the graph-level `validateMigrations` pass, which
             // needs every migration and `graph.schemaVersion` at once — chain contiguity and
@@ -854,6 +859,24 @@ function validateReadPolicy(policy, context) {
             nodeId: policy.id,
         });
     }
+    // A read policy predicate is AND-ed into a query filter and evaluated by the data
+    // provider, in the same state-free scope as the query itself (spec13.1 F2, §82).
+    for (const [id, node] of context.nodes) {
+        if (node.kind !== 'state')
+            continue;
+        let referenced = false;
+        walkExpression(policy.predicate, (expr) => {
+            if (expr.kind === 'ref' && expr.targetId === id && expr.targetId !== policy.rowScopeId)
+                referenced = true;
+        });
+        if (referenced) {
+            context.errors.push({
+                code: VALIDATION_CODES.queryStateRefNotAllowed,
+                message: `Read policy ${policy.id} references StateDef ${String(id)}; a policy predicate runs on the data provider and cannot bind authority state.`,
+                nodeId: policy.id,
+            });
+        }
+    }
 }
 /** Builds the single-row scope a read policy or a query filter is evaluated in. */
 function policyRowScope(rowScopeId, entityId, ownerId, context, entity) {
@@ -875,6 +898,252 @@ function policyRowScope(rowScopeId, entityId, ownerId, context, entity) {
  * endpoints consistent with the declared cardinality. Axiom never *infers* a link, so this
  * is where an inconsistent explicit one is caught.
  */
+/**
+ * A `WorkflowDef`'s structural soundness (spec14 §121-§125). Every failure is a structured
+ * diagnostic — never a thrown `TypeError` on a malformed step.
+ */
+function validateWorkflow(workflow, context) {
+    const steps = Array.isArray(workflow.steps) ? workflow.steps : [];
+    const stepIds = new Set();
+    for (const step of steps) {
+        if (!step || typeof step !== 'object' || typeof step.id !== 'string') {
+            context.errors.push({
+                code: VALIDATION_CODES.workflowInvalidStep,
+                message: `Workflow ${workflow.id} has a step with no id`,
+                nodeId: workflow.id,
+            });
+            continue;
+        }
+        const id = String(step.id);
+        if (stepIds.has(id) || context.nodes.has(step.id)) {
+            context.errors.push({
+                code: VALIDATION_CODES.workflowDuplicateStepId,
+                message: `Workflow ${workflow.id} step id ${id} is declared twice, or collides with a graph node`,
+                nodeId: workflow.id,
+            });
+        }
+        stepIds.add(id);
+        if (!WORKFLOW_STEP_TYPES.includes(step.type)) {
+            context.errors.push({
+                code: VALIDATION_CODES.workflowInvalidStep,
+                message: `Workflow ${workflow.id} step ${id} has an unknown type ${String(step.type)}`,
+                nodeId: workflow.id,
+            });
+        }
+    }
+    if (!workflow.entry || !stepIds.has(String(workflow.entry))) {
+        context.errors.push({
+            code: VALIDATION_CODES.workflowEntryNotFound,
+            message: `Workflow ${workflow.id} entry ${String(workflow.entry)} is not one of its steps`,
+            nodeId: workflow.id,
+        });
+    }
+    const edge = (target, from) => {
+        if (target !== undefined && !stepIds.has(String(target))) {
+            context.errors.push({
+                code: VALIDATION_CODES.workflowStepNotFound,
+                message: `Workflow ${workflow.id} step ${from} points at ${String(target)}, which is not a step`,
+                nodeId: workflow.id,
+            });
+        }
+    };
+    // Bindings: declared once, produced by exactly one declared step.
+    const declaredBindings = new Map();
+    for (const binding of workflow.bindings ?? []) {
+        const bid = String(binding.id);
+        if (declaredBindings.has(bid)) {
+            context.errors.push({
+                code: VALIDATION_CODES.workflowDuplicateBinding,
+                message: `Workflow ${workflow.id} declares binding ${bid} twice`,
+                nodeId: workflow.id,
+            });
+        }
+        declaredBindings.set(bid, binding);
+        if (!stepIds.has(String(binding.producedBy))) {
+            context.errors.push({
+                code: VALIDATION_CODES.workflowStepNotFound,
+                message: `Workflow ${workflow.id} binding ${bid} is producedBy ${String(binding.producedBy)}, which is not a step`,
+                nodeId: workflow.id,
+            });
+        }
+        validateTypeRef(binding.valueType, workflow.id, context);
+    }
+    const inputIds = new Set((workflow.inputs ?? []).map((input) => String(input.id)));
+    for (const input of workflow.inputs ?? [])
+        validateTypeRef(input.valueType, workflow.id, context);
+    const boundBy = new Map(); // bindingId -> step id that binds it
+    for (const step of steps) {
+        if (!step || typeof step.id !== 'string')
+            continue;
+        const from = String(step.id);
+        const eventScopeOk = step.type === 'wait-event';
+        // Control-flow edges resolve.
+        if (step.type === 'action') {
+            edge(step.next, from);
+            edge(step.onError, from);
+            requireKind(step.action, 'action', workflow.id, context, VALIDATION_CODES.workflowActionNotFound);
+            if (step.retry)
+                validateWorkflowRetry(step.retry, workflow.id, from, context);
+        }
+        else if (step.type === 'wait-event') {
+            edge(step.next, from);
+            edge(step.onTimeout, from);
+            requireKind(step.event, 'event', workflow.id, context, VALIDATION_CODES.workflowEventNotFound);
+            if (step.timeout && !(step.timeout.seconds > 0)) {
+                context.errors.push({
+                    code: VALIDATION_CODES.workflowInvalidTimer,
+                    message: `Workflow ${workflow.id} step ${from} has a non-positive timeout`,
+                    nodeId: workflow.id,
+                });
+            }
+            for (const bindingId of Object.keys(step.bind ?? {})) {
+                if (!declaredBindings.has(bindingId)) {
+                    context.errors.push({
+                        code: VALIDATION_CODES.workflowBindingNotFound,
+                        message: `Workflow ${workflow.id} step ${from} binds ${bindingId}, which is not a declared WorkflowBinding`,
+                        nodeId: workflow.id,
+                    });
+                }
+                else if (String(declaredBindings.get(bindingId).producedBy) !== from) {
+                    context.errors.push({
+                        code: VALIDATION_CODES.workflowDuplicateBinding,
+                        message: `Workflow ${workflow.id} step ${from} binds ${bindingId}, but its declared producer is ${String(declaredBindings.get(bindingId).producedBy)}`,
+                        nodeId: workflow.id,
+                    });
+                }
+                if (boundBy.has(bindingId)) {
+                    context.errors.push({
+                        code: VALIDATION_CODES.workflowDuplicateBinding,
+                        message: `Workflow ${workflow.id} binding ${bindingId} is assigned by more than one step`,
+                        nodeId: workflow.id,
+                    });
+                }
+                boundBy.set(bindingId, from);
+            }
+        }
+        else if (step.type === 'timer') {
+            edge(step.next, from);
+            const hasAfter = step.after !== undefined;
+            const hasAt = step.at !== undefined;
+            if (hasAfter === hasAt) {
+                context.errors.push({
+                    code: VALIDATION_CODES.workflowInvalidTimer,
+                    message: `Workflow ${workflow.id} timer ${from} must declare exactly one of after / at`,
+                    nodeId: workflow.id,
+                });
+            }
+            else if (hasAfter && !(step.after.seconds > 0)) {
+                context.errors.push({
+                    code: VALIDATION_CODES.workflowInvalidTimer,
+                    message: `Workflow ${workflow.id} timer ${from} has a non-positive after.seconds`,
+                    nodeId: workflow.id,
+                });
+            }
+        }
+        else if (step.type === 'branch') {
+            edge(step.then, from);
+            edge(step.else, from);
+        }
+        // Expression scope — inputs / bindings / (EVENT inside wait-event) / PRINCIPAL only.
+        for (const expression of workflowStepExpressions(step)) {
+            validateWorkflowExpression(expression, workflow.id, from, inputIds, declaredBindings, eventScopeOk, context);
+        }
+    }
+    // Reachability + acyclicity + terminal reachability.
+    const reachable = workflowReachableSteps(workflow);
+    for (const step of steps) {
+        if (typeof step.id === 'string' && !reachable.has(String(step.id))) {
+            context.errors.push({
+                code: VALIDATION_CODES.workflowUnreachableStep,
+                message: `Workflow ${workflow.id} step ${String(step.id)} is unreachable from entry`,
+                nodeId: workflow.id,
+            });
+        }
+    }
+    if (stepIds.has(String(workflow.entry)) && workflowHasCycle(workflow)) {
+        context.errors.push({
+            code: VALIDATION_CODES.workflowCycleNotAllowed,
+            message: `Workflow ${workflow.id} has a control-flow cycle; retries are runtime policy, not graph edges`,
+            nodeId: workflow.id,
+        });
+    }
+    // Every reachable non-terminal step must be able to reach a terminal step (or an
+    // intentional wait-event with no timeout is an acceptable "may never resolve" leaf).
+    if (stepIds.has(String(workflow.entry)) && !workflowHasCycle(workflow)) {
+        const canTerminate = new Map();
+        const reaches = (id, seen) => {
+            if (canTerminate.has(id))
+                return canTerminate.get(id);
+            if (seen.has(id))
+                return false;
+            seen.add(id);
+            const step = workflowStepById(workflow, id);
+            if (!step)
+                return false;
+            if (step.type === 'complete' || step.type === 'fail') {
+                canTerminate.set(id, true);
+                return true;
+            }
+            if (step.type === 'wait-event' && !step.timeout) {
+                // An unbounded wait is an intentional durable leaf (spec14 §123).
+                const ok = workflowStepSuccessors(step).some((n) => reaches(String(n), new Set(seen)));
+                canTerminate.set(id, ok || true);
+                return true;
+            }
+            const ok = workflowStepSuccessors(step).some((n) => reaches(String(n), new Set(seen)));
+            canTerminate.set(id, ok);
+            return ok;
+        };
+        for (const id of reachable) {
+            if (!reaches(id, new Set())) {
+                context.errors.push({
+                    code: VALIDATION_CODES.workflowNoTerminal,
+                    message: `Workflow ${workflow.id} step ${id} cannot reach complete or fail`,
+                    nodeId: workflow.id,
+                });
+            }
+        }
+    }
+}
+function validateWorkflowRetry(retry, workflowId, stepId, context) {
+    const bad = !(retry.maxAttempts >= 1) ||
+        !(retry.initialDelaySeconds >= 0) ||
+        !(retry.backoffMultiplier >= 1) ||
+        !(retry.maxDelaySeconds >= retry.initialDelaySeconds);
+    if (bad) {
+        context.errors.push({
+            code: VALIDATION_CODES.workflowInvalidRetryPolicy,
+            message: `Workflow ${workflowId} step ${stepId} has an invalid retry policy`,
+            nodeId: workflowId,
+        });
+    }
+}
+const WORKFLOW_NONDETERMINISTIC_BUILTINS = new Set(['now', 'uuid', 'random']);
+function validateWorkflowExpression(expression, workflowId, stepId, inputIds, bindings, eventScopeOk, context) {
+    walkExpression(expression, (node) => {
+        if (node.kind === 'ref') {
+            const id = String(node.targetId);
+            const inScope = inputIds.has(id) ||
+                bindings.has(id) ||
+                id === WORKFLOW_PRINCIPAL_SCOPE ||
+                (eventScopeOk && id === WORKFLOW_EVENT_SCOPE);
+            if (!inScope) {
+                context.errors.push({
+                    code: VALIDATION_CODES.workflowExpressionScope,
+                    message: `Workflow ${workflowId} step ${stepId} references ${id}, which is outside workflow expression scope (inputs / bindings${eventScopeOk ? ' / EVENT' : ''} / PRINCIPAL)`,
+                    nodeId: workflowId,
+                });
+            }
+        }
+        if (node.kind === 'call' && WORKFLOW_NONDETERMINISTIC_BUILTINS.has(node.function)) {
+            context.errors.push({
+                code: VALIDATION_CODES.workflowNondeterministic,
+                message: `Workflow ${workflowId} step ${stepId} calls ${node.function}; workflow expressions must be deterministic`,
+                nodeId: workflowId,
+            });
+        }
+    });
+}
 function validateRelationship(relationship, context) {
     const fromEntity = requireRelationshipEndpoint(relationship.from, relationship.id, context);
     const toEntity = requireRelationshipEndpoint(relationship.to, relationship.id, context);
@@ -998,6 +1267,18 @@ function validateQuery(query, context) {
             scope.types.set(use.bindAs, relationshipIsToOne(relationship) ? target : collectionType(target));
         }
     }
+    // A QueryDef executes on the DataProvider, which binds no authority state. A `ref` to a
+    // `StateDef` in any clause would evaluate to nothing at run time, so every layer — this
+    // validator, the compiler, dependency analysis, live-capability, AgentAPI and the runtime
+    // — must reject it rather than one accepting what the others cannot execute (spec13.1 F2).
+    const knownStateIds = new Set([...context.nodes.values()].filter((node) => node.kind === 'state').map((node) => String(node.id)));
+    for (const stateId of queryStateReferences(query, knownStateIds)) {
+        context.errors.push({
+            code: VALIDATION_CODES.queryStateRefNotAllowed,
+            message: `Query ${query.id} references StateDef ${stateId}; a QueryDef clause runs on the data provider and cannot bind authority state. Pass a runtime-varying value as a query parameter instead.`,
+            nodeId: query.id,
+        });
+    }
     if (query.filter) {
         validateExpression(query.filter, query.id, context, scope);
         if (isKnownNonBoolean(inferExpressionType(query.filter, context.semantics, scope.types))) {

package/dist/workflows.d.ts

@@ -0,0 +1,131 @@
+/**
+ * Durable workflows (spec14).
+ *
+ * A `WorkflowDef` is a **long-running semantic computation with a durable control
+ * position** — not a background promise, a persisted callback, a job-queue entry, a cron
+ * task or a mutable JSON blob. The graph owns the orchestration meaning; the runtime owns
+ * scheduling, persistence, retries, leases, fencing, crash recovery and physical execution.
+ *
+ * The node is portable plain data: a closed step vocabulary, `Expression` trees for every
+ * leaf, and no JavaScript body of any kind (spec14 §7, §8). It compiles into
+ * `axiom.server.v8` and is inspectable through `AgentAPI.analyzeWorkflow`.
+ */
+import type { Expression } from './expressions.js';
+import type { NodeId } from './ids.js';
+import type { NodeBase } from './nodes.js';
+import type { TypeRef } from './type-ref.js';
+/** The matched event payload — resolvable only inside a `wait-event` step's `where` / `bind`. */
+export declare const WORKFLOW_EVENT_SCOPE: "EVENT";
+/** The workflow's bound principal. */
+export declare const WORKFLOW_PRINCIPAL_SCOPE: "PRINCIPAL";
+export interface WorkflowInput {
+    id: NodeId;
+    valueType: TypeRef;
+    required?: boolean;
+}
+/**
+ * A typed, durable, **single-assignment** value produced after start. Exactly one step
+ * (`producedBy`) assigns it; every other step may only read it. There is deliberately no
+ * mutable workflow blob (spec14 §26-§28).
+ */
+export interface WorkflowBinding {
+    id: NodeId;
+    valueType: TypeRef;
+    /** The step id whose activation assigns this binding (a `wait-event` step). */
+    producedBy: NodeId;
+}
+/** Portable relative time. No cron, no ISO-8601 parsing in the graph (spec14 §44, §84). */
+export interface WorkflowDuration {
+    seconds: number;
+}
+/** Portable retry policy for an `action` step (spec14 §38). */
+export interface WorkflowRetryPolicy {
+    maxAttempts: number;
+    initialDelaySeconds: number;
+    backoffMultiplier: number;
+    maxDelaySeconds: number;
+}
+export declare const WORKFLOW_STEP_TYPES: readonly ["action", "wait-event", "timer", "branch", "complete", "fail"];
+export type WorkflowStepType = (typeof WORKFLOW_STEP_TYPES)[number];
+/** Invoke a canonical `ActionDef` under the workflow principal (spec14 §29-§43). */
+export interface WorkflowActionStep {
+    type: 'action';
+    id: NodeId;
+    action: NodeId;
+    /** Argument expressions, in workflow expression scope (inputs / bindings / PRINCIPAL). */
+    arguments?: Record<string, Expression>;
+    next: NodeId;
+    /** Where a terminal action failure routes; absent ⇒ the workflow fails. */
+    onError?: NodeId;
+    retry?: WorkflowRetryPolicy;
+}
+/** Wait for a matching canonical `EventDef` occurrence (spec14 §50-§66). */
+export interface WorkflowWaitEventStep {
+    type: 'wait-event';
+    id: NodeId;
+    event: NodeId;
+    /** Deterministic boolean correlation over `ref(EVENT)` / inputs / bindings. */
+    where?: Expression;
+    /** Assigns declared `WorkflowBinding`s from the matched event (`bindingId -> Expression`). */
+    bind?: Record<string, Expression>;
+    next: NodeId;
+    timeout?: WorkflowDuration;
+    onTimeout?: NodeId;
+}
+/** Wait until a durable time (spec14 §44-§49). Exactly one of `after` / `at`. */
+export interface WorkflowTimerStep {
+    type: 'timer';
+    id: NodeId;
+    after?: WorkflowDuration;
+    /** An expression over inputs resolving to an epoch-ms number, captured once on activation. */
+    at?: Expression;
+    next: NodeId;
+}
+/** Deterministic edge choice over durable workflow context (spec14 §67-§70). */
+export interface WorkflowBranchStep {
+    type: 'branch';
+    id: NodeId;
+    when: Expression;
+    then: NodeId;
+    else: NodeId;
+}
+/** Terminal → `completed` (spec14 §71, §72). */
+export interface WorkflowCompleteStep {
+    type: 'complete';
+    id: NodeId;
+    output?: Record<string, Expression>;
+}
+/** Terminal → `failed` (spec14 §73). */
+export interface WorkflowFailStep {
+    type: 'fail';
+    id: NodeId;
+    error?: Record<string, Expression>;
+}
+export type WorkflowStep = WorkflowActionStep | WorkflowWaitEventStep | WorkflowTimerStep | WorkflowBranchStep | WorkflowCompleteStep | WorkflowFailStep;
+export interface WorkflowDef extends NodeBase {
+    kind: 'workflow';
+    inputs?: WorkflowInput[];
+    bindings?: WorkflowBinding[];
+    entry: NodeId;
+    steps: WorkflowStep[];
+}
+export declare function workflowStepById(workflow: WorkflowDef, stepId: NodeId | string): WorkflowStep | undefined;
+/** Every step id a step can hand control to (control-flow successors). */
+export declare function workflowStepSuccessors(step: WorkflowStep): NodeId[];
+export declare function workflowIsTerminalStep(step: WorkflowStep): boolean;
+/** Every `Expression` embedded in a step — the leaves dependency / scope analysis walks. */
+export declare function workflowStepExpressions(step: WorkflowStep): Expression[];
+/** Every `Expression` in a workflow — inputs carry none, so this is the step leaves. */
+export declare function workflowExpressions(workflow: WorkflowDef): Expression[];
+/** The `ActionDef` ids a workflow invokes. */
+export declare function workflowActionIds(workflow: WorkflowDef): NodeId[];
+/** The `EventDef` ids a workflow waits on. */
+export declare function workflowEventIds(workflow: WorkflowDef): NodeId[];
+/**
+ * Step ids reachable from `entry` by control flow (spec14 §122). A step not in this set is
+ * unreachable and an authoring mistake.
+ */
+export declare function workflowReachableSteps(workflow: WorkflowDef): Set<string>;
+/** Whether the control-flow graph has a cycle (retries are runtime policy, not a cycle — §11). */
+export declare function workflowHasCycle(workflow: WorkflowDef): boolean;
+//# sourceMappingURL=workflows.d.ts.map

package/dist/workflows.js

@@ -0,0 +1,121 @@
+/**
+ * Durable workflows (spec14).
+ *
+ * A `WorkflowDef` is a **long-running semantic computation with a durable control
+ * position** — not a background promise, a persisted callback, a job-queue entry, a cron
+ * task or a mutable JSON blob. The graph owns the orchestration meaning; the runtime owns
+ * scheduling, persistence, retries, leases, fencing, crash recovery and physical execution.
+ *
+ * The node is portable plain data: a closed step vocabulary, `Expression` trees for every
+ * leaf, and no JavaScript body of any kind (spec14 §7, §8). It compiles into
+ * `axiom.server.v8` and is inspectable through `AgentAPI.analyzeWorkflow`.
+ */
+// ------------------------------------------------------------------- reserved scope ids
+/** The matched event payload — resolvable only inside a `wait-event` step's `where` / `bind`. */
+export const WORKFLOW_EVENT_SCOPE = 'EVENT';
+/** The workflow's bound principal. */
+export const WORKFLOW_PRINCIPAL_SCOPE = 'PRINCIPAL';
+// -------------------------------------------------------------------------------- steps
+export const WORKFLOW_STEP_TYPES = [
+    'action',
+    'wait-event',
+    'timer',
+    'branch',
+    'complete',
+    'fail',
+];
+// ---------------------------------------------------------------------------- accessors
+export function workflowStepById(workflow, stepId) {
+    return workflow.steps.find((step) => String(step.id) === String(stepId));
+}
+/** Every step id a step can hand control to (control-flow successors). */
+export function workflowStepSuccessors(step) {
+    switch (step.type) {
+        case 'action':
+            return step.onError ? [step.next, step.onError] : [step.next];
+        case 'wait-event':
+            return step.onTimeout ? [step.next, step.onTimeout] : [step.next];
+        case 'timer':
+            return [step.next];
+        case 'branch':
+            return [step.then, step.else];
+        case 'complete':
+        case 'fail':
+            return [];
+    }
+}
+export function workflowIsTerminalStep(step) {
+    return step.type === 'complete' || step.type === 'fail';
+}
+/** Every `Expression` embedded in a step — the leaves dependency / scope analysis walks. */
+export function workflowStepExpressions(step) {
+    switch (step.type) {
+        case 'action':
+            return Object.values(step.arguments ?? {});
+        case 'wait-event':
+            return [...(step.where ? [step.where] : []), ...Object.values(step.bind ?? {})];
+        case 'timer':
+            return step.at ? [step.at] : [];
+        case 'branch':
+            return [step.when];
+        case 'complete':
+            return Object.values(step.output ?? {});
+        case 'fail':
+            return Object.values(step.error ?? {});
+    }
+}
+/** Every `Expression` in a workflow — inputs carry none, so this is the step leaves. */
+export function workflowExpressions(workflow) {
+    return workflow.steps.flatMap(workflowStepExpressions);
+}
+/** The `ActionDef` ids a workflow invokes. */
+export function workflowActionIds(workflow) {
+    return workflow.steps.filter((s) => s.type === 'action').map((s) => s.action);
+}
+/** The `EventDef` ids a workflow waits on. */
+export function workflowEventIds(workflow) {
+    return workflow.steps.filter((s) => s.type === 'wait-event').map((s) => s.event);
+}
+/**
+ * Step ids reachable from `entry` by control flow (spec14 §122). A step not in this set is
+ * unreachable and an authoring mistake.
+ */
+export function workflowReachableSteps(workflow) {
+    const seen = new Set();
+    const stack = [String(workflow.entry)];
+    while (stack.length > 0) {
+        const id = stack.pop();
+        if (seen.has(id))
+            continue;
+        const step = workflowStepById(workflow, id);
+        if (!step)
+            continue;
+        seen.add(id);
+        for (const next of workflowStepSuccessors(step))
+            stack.push(String(next));
+    }
+    return seen;
+}
+/** Whether the control-flow graph has a cycle (retries are runtime policy, not a cycle — §11). */
+export function workflowHasCycle(workflow) {
+    const WHITE = 0;
+    const GREY = 1;
+    const BLACK = 2;
+    const colour = new Map();
+    const visit = (id) => {
+        const step = workflowStepById(workflow, id);
+        if (!step)
+            return false;
+        colour.set(id, GREY);
+        for (const next of workflowStepSuccessors(step)) {
+            const c = colour.get(String(next)) ?? WHITE;
+            if (c === GREY)
+                return true;
+            if (c === WHITE && visit(String(next)))
+                return true;
+        }
+        colour.set(id, BLACK);
+        return false;
+    };
+    return visit(String(workflow.entry));
+}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@cynodia/axiom-core",
-  "version": "0.13.0-alpha.1",
+  "version": "0.14.0-alpha.1",
   "description": "Application Graph, semantic types, locations and validation for Axiom.",
   "license": "MIT",
   "author": "AskTech AS",