@cynodia/axiom-core 0.16.0-alpha.1 → 0.16.0-alpha.2

package/dist/authority.js

@@ -1,5 +1,5 @@
 import { referencedIds } from './derive-edges.js';
-import { actionGuards, isMutationOperation } from './nodes.js';
+import { actionGuards, actionOperations, isMutationOperation, operationChildren } from './nodes.js';
 import { locationExpressions, locationProviderEntityId, locationRootStateId } from './location.js';
 import { queryExpressions } from './query.js';
 export const AUTHORITIES = ['client', 'server'];
@@ -121,7 +121,7 @@ function operationExpressions(operation) {
     switch (operation.kind) {
         case 'for-each':
             found.push(operation.collection);
-            for (const nested of operation.operations ?? []) {
+            for (const nested of operationChildren(operation)) {
                 found.push(...operationExpressions(nested));
             }
             break;
@@ -157,11 +157,11 @@ function operationExpressions(operation) {
 }
 /** Whether an action calls out to an integration anywhere in its top-level operations. */
 export function actionUsesIntegration(action) {
-    return (action.operations ?? []).some((operation) => operation.kind === 'integration-query' || operation.kind === 'integration-effect');
+    return actionOperations(action).some((operation) => operation.kind === 'integration-query' || operation.kind === 'integration-effect');
 }
 /** Whether an action reaches an object store anywhere in its top-level operations. */
 export function actionUsesStorage(action) {
-    return (action.operations ?? []).some((operation) => operation.kind === 'blob-metadata' ||
+    return actionOperations(action).some((operation) => operation.kind === 'blob-metadata' ||
         operation.kind === 'blob-commit' ||
         operation.kind === 'blob-delete');
 }
@@ -170,7 +170,7 @@ export function actionUsesStorage(action) {
  * data provider, so an action that reads authoritative data through a query executes there.
  */
 export function actionUsesQuery(action) {
-    return (action.operations ?? []).some((operation) => operation.kind === 'query');
+    return actionOperations(action).some((operation) => operation.kind === 'query');
 }
 /**
  * Whether an action writes a `provider-record` location anywhere in its operations
@@ -183,11 +183,11 @@ export function actionWritesProviderRecord(action) {
             return locationProviderEntityId(operation.target) !== undefined;
         }
         if (operation.kind === 'for-each') {
-            return targets(operation.operations);
+            return targets(operationChildren(operation));
         }
         return false;
     });
-    return targets(action.operations ?? []);
+    return targets(actionOperations(action));
 }
 /** The states an action writes, following `for-each`, `invoke` and declared native effects. */
 export function statesWrittenBy(action, context, visited = new Set()) {
@@ -204,7 +204,7 @@ export function statesWrittenBy(action, context, visited = new Set()) {
             }
             switch (operation.kind) {
                 case 'for-each':
-                    walk(operation.operations ?? []);
+                    walk(operationChildren(operation));
                     break;
                 case 'invoke': {
                     const target = context.actions.get(operation.actionId);
@@ -238,7 +238,7 @@ export function statesWrittenBy(action, context, visited = new Set()) {
             }
         }
     };
-    walk(action.operations ?? []);
+    walk(actionOperations(action));
     return found;
 }
 /** The states an action reads: its guards, its values, its selectors, its authorization. */
@@ -252,11 +252,11 @@ export function statesReadByAction(action, context, visited = new Set()) {
         ...(action.postconditions ?? []),
         ...(action.authorization ? [action.authorization] : []),
     ];
-    for (const operation of action.operations ?? []) {
+    for (const operation of actionOperations(action)) {
         expressions.push(...operationExpressions(operation));
     }
     const found = statesReadBy(expressions, context);
-    for (const operation of action.operations ?? []) {
+    for (const operation of actionOperations(action)) {
         if (operation.kind === 'invoke') {
             const target = context.actions.get(operation.actionId);
             if (target) {

package/dist/derive-edges.js

@@ -1,4 +1,5 @@
 import { constructedFieldIds, expressionDefsIn, expressionFieldIds, walkExpression } from './expressions.js';
+import { actionOperations, operationChildren } from './nodes.js';
 import { locationExpressions, locationFieldIds, locationRootStateId, locationSelectorFieldIds, } from './location.js';
 import { isGroupFieldId } from './group.js';
 import { isUINode } from './ui.js';
@@ -251,12 +252,22 @@ export function deriveEdges(nodes) {
         },
     }));
 }
+function isPlainObject(value) {
+    return !!value && typeof value === 'object' && !Array.isArray(value);
+}
 /**
  * The states an expression ultimately draws its members from. Following `field` and calls
  * matters: a collection reached as `coalesce(field(ref(state), lines), [])` still comes
  * from that state, and its members' fields are still reads of it.
+ *
+ * Total over malformed input (spec16pt2 §12-24): a candidate expression can be
+ * AI-generated, deserialized or hand-tampered.
  */
-function statesOf(expression, scope, states, defs = new Map()) {
+function statesOf(expressionInput, scope, states, defs = new Map()) {
+    if (!isPlainObject(expressionInput) || typeof expressionInput.kind !== 'string') {
+        return [];
+    }
+    const expression = expressionInput;
     switch (expression.kind) {
         case 'ref': {
             const bound = scope.get(expression.targetId);
@@ -364,7 +375,7 @@ function bind(scope, id, targets) {
  * projecting a field of each member is recorded as a read of that field of the state the
  * members came from.
  */
-function collectReads(expression, scope, states, found = new Map(), defs = new Map()) {
+function collectReads(expressionInput, scope, states, found = new Map(), defs = new Map()) {
     const record = (stateId, fieldId) => {
         const entry = found.get(stateId) ?? new Set();
         if (fieldId) {
@@ -372,6 +383,10 @@ function collectReads(expression, scope, states, found = new Map(), defs = new M
         }
         found.set(stateId, entry);
     };
+    if (!isPlainObject(expressionInput) || typeof expressionInput.kind !== 'string') {
+        return found;
+    }
+    const expression = expressionInput;
     switch (expression.kind) {
         case 'ref':
             for (const stateId of statesOf(expression, scope, states, defs)) {
@@ -455,7 +470,7 @@ function linkAction(action, linker) {
     for (const expression of [...(action.preconditions ?? []), ...(action.postconditions ?? [])]) {
         linker.reads(action.id, expression, linker.scope);
     }
-    linkOperations(action.id, action.operations ?? [], linker, linker.scope);
+    linkOperations(action.id, actionOperations(action), linker, linker.scope);
 }
 function linkOperations(actionId, operations, linker, scope) {
     for (const operation of operations) {
@@ -476,7 +491,7 @@ function linkOperations(actionId, operations, linker, scope) {
             case 'for-each': {
                 linker.reads(actionId, operation.collection, scope);
                 const inner = bind(scope, operation.scopeId, statesOf(operation.collection, scope, linker.states));
-                linkOperations(actionId, operation.operations, linker, inner);
+                linkOperations(actionId, operationChildren(operation), linker, inner);
                 break;
             }
             case 'invoke':

package/dist/diagnostics.d.ts

@@ -212,5 +212,9 @@ export declare const VALIDATION_CODES: {
     readonly authorizationUnknownPolicy: "AUTHORIZATION_UNKNOWN_POLICY";
     /** An `AuthorizationPolicyDef.allow` expression calls `now` / `uuid` / `random` — authorization must be deterministic (spec15 §34). */
     readonly authorizationNondeterministic: "AUTHORIZATION_NONDETERMINISTIC";
+    /** `ActionDef.operations`, or a `for-each`'s nested `operations`, is present but not an array. */
+    readonly invalidOperationCollection: "INVALID_OPERATION_COLLECTION";
+    /** An operation array entry that is not a plain object with a recognized `kind`. */
+    readonly invalidOperation: "INVALID_OPERATION";
 };
 //# sourceMappingURL=diagnostics.d.ts.map

package/dist/diagnostics.js

@@ -211,4 +211,11 @@ export const VALIDATION_CODES = {
     authorizationUnknownPolicy: 'AUTHORIZATION_UNKNOWN_POLICY',
     /** An `AuthorizationPolicyDef.allow` expression calls `now` / `uuid` / `random` — authorization must be deterministic (spec15 §34). */
     authorizationNondeterministic: 'AUTHORIZATION_NONDETERMINISTIC',
+    // Validation totality (0.16pt2, spec16pt2 §12-24). A candidate graph can be AI-generated,
+    // deserialized or hand-tampered, so `validateGraph` must reject a malformed runtime
+    // *shape* structurally — never assume TypeScript's compile-time types already hold.
+    /** `ActionDef.operations`, or a `for-each`'s nested `operations`, is present but not an array. */
+    invalidOperationCollection: 'INVALID_OPERATION_COLLECTION',
+    /** An operation array entry that is not a plain object with a recognized `kind`. */
+    invalidOperation: 'INVALID_OPERATION',
 };

package/dist/expressions.d.ts

@@ -203,15 +203,21 @@ export declare function groupItems(source: Expression): FieldExpression;
  */
 export declare function expressionRef(expressionId: NodeId, args?: Record<string, Expression>): ExpressionRefExpression;
 export declare function conditional(condition: Expression, whenTrue: Expression, whenFalse: Expression): ConditionalExpression;
-/** Visits every sub-expression, parents before children. */
-export declare function walkExpression(expression: Expression, visit: (node: Expression) => void): void;
+/**
+ * Visits every sub-expression, parents before children. Total over malformed input
+ * (spec16pt2 §12-24): a candidate expression tree can arrive from AI generation,
+ * deserialization or hand-tampering (a deleted field, a tampered array element), and this
+ * is the shared visitor most expression-derived analysis in the codebase is built on — a
+ * malformed node here simply is not visited, rather than throwing while reading `.kind`.
+ */
+export declare function walkExpression(expressionInput: unknown, visit: (node: Expression) => void): void;
 /**
  * Field ids a constructed record assigns. Only the record's own entries count: the
  * expressions that compute those values are reads, not writes.
  */
-export declare function constructedFieldIds(expression: Expression): FieldId[];
+export declare function constructedFieldIds(expression: unknown): FieldId[];
 /** Expression definitions an expression reaches directly, in tree order. */
-export declare function expressionDefsIn(expression: Expression): NodeId[];
+export declare function expressionDefsIn(expression: unknown): NodeId[];
 /** Field ids an expression reads, including nested sources and constructed records. */
-export declare function expressionFieldIds(expression: Expression): FieldId[];
+export declare function expressionFieldIds(expression: unknown): FieldId[];
 //# sourceMappingURL=expressions.d.ts.map

package/dist/expressions.js

@@ -128,8 +128,21 @@ export function expressionRef(expressionId, args) {
 export function conditional(condition, whenTrue, whenFalse) {
     return { kind: 'conditional', condition, whenTrue, whenFalse };
 }
-/** Visits every sub-expression, parents before children. */
-export function walkExpression(expression, visit) {
+function isPlainObject(value) {
+    return !!value && typeof value === 'object' && !Array.isArray(value);
+}
+/**
+ * Visits every sub-expression, parents before children. Total over malformed input
+ * (spec16pt2 §12-24): a candidate expression tree can arrive from AI generation,
+ * deserialization or hand-tampering (a deleted field, a tampered array element), and this
+ * is the shared visitor most expression-derived analysis in the codebase is built on — a
+ * malformed node here simply is not visited, rather than throwing while reading `.kind`.
+ */
+export function walkExpression(expressionInput, visit) {
+    if (!isPlainObject(expressionInput) || typeof expressionInput.kind !== 'string') {
+        return;
+    }
+    const expression = expressionInput;
     visit(expression);
     switch (expression.kind) {
         case 'field':
@@ -195,7 +208,12 @@ export function walkExpression(expression, visit) {
  * expressions that compute those values are reads, not writes.
  */
 export function constructedFieldIds(expression) {
-    return expression.kind === 'object' ? expression.entries.map((entry) => entry.fieldId) : [];
+    if (!isPlainObject(expression) || expression.kind !== 'object' || !Array.isArray(expression.entries)) {
+        return [];
+    }
+    return expression.entries
+        .filter((entry) => isPlainObject(entry) && typeof entry.fieldId === 'string')
+        .map((entry) => entry.fieldId);
 }
 /** Expression definitions an expression reaches directly, in tree order. */
 export function expressionDefsIn(expression) {

package/dist/infer.d.ts

@@ -2,7 +2,6 @@ import type { Expression } from './expressions.js';
 import type { FieldId, NodeId } from './ids.js';
 import type { EntityDef, ExpressionDef, StateDef } from './nodes.js';
 import type { FieldIndexEntry } from './graph.js';
-import type { Location } from './location.js';
 import type { TypeRef } from './type-ref.js';
 /**
  * The lookups static analysis needs. Both an authoring graph and a compiled IR can
@@ -23,10 +22,14 @@ export interface LocationCapabilities {
     readable: boolean;
     writable: boolean;
 }
-/** The type of the value a location addresses, where it can be determined statically. */
-export declare function inferLocationType(location: Location, context: SemanticContext): TypeRef | undefined;
+/**
+ * The type of the value a location addresses, where it can be determined statically.
+ * Total over malformed input (spec16pt2 §12-20): a location that cannot be understood at
+ * all has no inferrable type, rather than a thrown error.
+ */
+export declare function inferLocationType(location: unknown, context: SemanticContext): TypeRef | undefined;
 /** Derived state is readable but never writable; everything else follows its root. */
-export declare function locationCapabilities(location: Location, context: SemanticContext): LocationCapabilities;
+export declare function locationCapabilities(location: unknown, context: SemanticContext): LocationCapabilities;
 /** The member type of a collection, ignoring optionality. */
 export declare function itemTypeOf(type: TypeRef | undefined): TypeRef | undefined;
 /** Types bound by enclosing iteration scopes, keyed by scope id. */
@@ -36,7 +39,7 @@ export type ScopeTypes = ReadonlyMap<NodeId, TypeRef>;
  * determined statically — 0.4 deliberately stops short of a complete type checker, but
  * iteration scopes are tracked so that projections and aggregations can be checked.
  */
-export declare function inferExpressionType(expression: Expression, context: SemanticContext, scope?: ScopeTypes, 
+export declare function inferExpressionType(expressionInput: unknown, context: SemanticContext, scope?: ScopeTypes, 
 /** Definitions already being inferred, so a cyclic reference stops rather than recurses. */
 visiting?: ReadonlySet<NodeId>): TypeRef | undefined;
 /** The scope bindings an expression introduces for its own sub-expressions. */
@@ -49,5 +52,5 @@ export declare function isObviouslyIncompatible(target: TypeRef | undefined, val
 /** True when a type is a collection whose members are clearly not numbers. */
 export declare function isNonNumericCollection(type: TypeRef | undefined): boolean;
 /** Renders a location for people. The stored representation stays id-based. */
-export declare function formatLocation(location: Location, context: SemanticContext): string;
+export declare function formatLocation(location: unknown, context: SemanticContext): string;
 //# sourceMappingURL=infer.d.ts.map

package/dist/infer.js

@@ -1,10 +1,21 @@
+import { isPlainLocation } from './location.js';
 import { collectionType, entityType, groupType, optionalType, primitiveType } from './type-ref.js';
 import { GROUP_ITEMS_FIELD, GROUP_KEY_FIELD } from './group.js';
+function isPlainObject(value) {
+    return !!value && typeof value === 'object' && !Array.isArray(value);
+}
 function unwrap(type) {
     return type?.kind === 'optional' ? unwrap(type.valueType) : type;
 }
-/** The type of the value a location addresses, where it can be determined statically. */
+/**
+ * The type of the value a location addresses, where it can be determined statically.
+ * Total over malformed input (spec16pt2 §12-20): a location that cannot be understood at
+ * all has no inferrable type, rather than a thrown error.
+ */
 export function inferLocationType(location, context) {
+    if (!isPlainLocation(location)) {
+        return undefined;
+    }
     switch (location.kind) {
         case 'state':
             return context.getState(location.stateId)?.valueType;
@@ -46,6 +57,9 @@ export function locationCapabilities(location, context) {
     return { readable: true, writable: root.derivation === undefined };
 }
 function locationProviderRoot(location) {
+    if (!isPlainLocation(location)) {
+        return false;
+    }
     switch (location.kind) {
         case 'provider-record':
             return true;
@@ -58,6 +72,9 @@ function locationProviderRoot(location) {
     }
 }
 function rootState(location, context) {
+    if (!isPlainLocation(location)) {
+        return undefined;
+    }
     switch (location.kind) {
         case 'state':
             return context.getState(location.stateId);
@@ -89,9 +106,15 @@ function withScope(scope, id, type) {
  * determined statically — 0.4 deliberately stops short of a complete type checker, but
  * iteration scopes are tracked so that projections and aggregations can be checked.
  */
-export function inferExpressionType(expression, context, scope, 
+export function inferExpressionType(expressionInput, context, scope, 
 /** Definitions already being inferred, so a cyclic reference stops rather than recurses. */
 visiting = new Set()) {
+    // spec16pt2 §12-24 — a malformed sub-expression (a deleted field, a tampered array
+    // element) has no inferrable type, rather than a thrown error reading `.kind`.
+    if (!isPlainObject(expressionInput)) {
+        return undefined;
+    }
+    const expression = expressionInput;
     switch (expression.kind) {
         case 'literal': {
             const value = expression.value;
@@ -306,6 +329,9 @@ export function isNonNumericCollection(type) {
 }
 /** Renders a location for people. The stored representation stays id-based. */
 export function formatLocation(location, context) {
+    if (!isPlainLocation(location)) {
+        return 'unknown location';
+    }
     const name = (id) => context.getName?.(id) ?? id;
     const fieldName = (id) => context.getField(id)?.field.name ?? id;
     switch (location.kind) {
@@ -315,12 +341,18 @@ export function formatLocation(location, context) {
             return `${formatLocation(location.target, context)} → ${fieldName(location.fieldId)}`;
         case 'collection-item': {
             const parent = formatLocation(location.collection, context);
+            if (!isPlainObject(location.selector)) {
+                return `${parent} → [invalid selector]`;
+            }
             if (location.selector.kind === 'identity') {
-                const value = location.selector.value.kind === 'ref'
-                    ? name(location.selector.value.targetId)
-                    : location.selector.value.kind === 'literal'
-                        ? JSON.stringify(location.selector.value.value)
-                        : 'expression';
+                const selectorValue = location.selector.value;
+                const value = !isPlainObject(selectorValue)
+                    ? 'expression'
+                    : selectorValue.kind === 'ref'
+                        ? name(selectorValue.targetId)
+                        : selectorValue.kind === 'literal'
+                            ? JSON.stringify(selectorValue.value)
+                            : 'expression';
                 return `${parent} → [${fieldName(location.selector.fieldId)} = ${value}]`;
             }
             return `${parent} → [index]`;

package/dist/location.d.ts

@@ -71,6 +71,13 @@ export declare function providerRecordLocation(sourceEntityId: NodeId, identityF
 export declare function providerRecordFieldLocation(sourceEntityId: NodeId, identityFieldId: FieldId, identityValue: Expression, fieldId: FieldId): FieldLocation;
 /** Convenience for the common shape: one field of one item of a collection state. */
 export declare function itemFieldLocation(stateId: NodeId, identityFieldId: FieldId, identityValue: Expression, fieldId: FieldId): FieldLocation;
+/**
+ * A plain object carrying one of the four location kinds — total, never throws. A candidate
+ * `Location` can arrive from AI generation, deserialization or hand-tampering, so every
+ * traversal below checks this before reading `.kind` rather than trusting the compile-time
+ * `Location` type (spec16pt2 §12-20).
+ */
+export declare function isPlainLocation(value: unknown): value is Location;
 /**
  * The node every location is ultimately rooted in.
  *
@@ -79,19 +86,22 @@ export declare function itemFieldLocation(stateId: NodeId, identityFieldId: Fiel
  * entity id** instead. Callers that resolve the result as a state (`context.states.get`)
  * naturally get `undefined` and skip it, which is correct: nothing materialized holds the
  * record. Use `locationProviderEntityId` to detect the provider-backed case explicitly.
+ *
+ * Total over malformed input: an empty string (never a real `NodeId`) for a location that
+ * cannot be understood at all, rather than a thrown error (spec16pt2 §12-13).
  */
-export declare function locationRootStateId(location: Location): NodeId;
+export declare function locationRootStateId(location: unknown): NodeId;
 /** The source entity of the `provider-record` a location is rooted in, or `undefined` if it is state-rooted. */
-export declare function locationProviderEntityId(location: Location): NodeId | undefined;
+export declare function locationProviderEntityId(location: unknown): NodeId | undefined;
 /**
  * Expressions embedded in a location — selector values, indexes and a provider-record's
  * identity value. These are read dependencies of whatever uses the location.
  */
-export declare function locationExpressions(location: Location): Expression[];
+export declare function locationExpressions(location: unknown): Expression[];
 /** Fields a write through this location touches, outermost first. */
-export declare function locationFieldIds(location: Location): FieldId[];
+export declare function locationFieldIds(location: unknown): FieldId[];
 /** Fields a location reads in order to address itself, such as identity selectors. */
-export declare function locationSelectorFieldIds(location: Location): FieldId[];
+export declare function locationSelectorFieldIds(location: unknown): FieldId[];
 /**
  * Structural equality. Two locations that address the same position are equal even
  * though the value a selector expression produces is only known at run time.

package/dist/location.js

@@ -24,6 +24,23 @@ export function providerRecordFieldLocation(sourceEntityId, identityFieldId, ide
 export function itemFieldLocation(stateId, identityFieldId, identityValue, fieldId) {
     return fieldLocation(itemLocation(stateLocation(stateId), identitySelector(identityFieldId, identityValue)), fieldId);
 }
+function isPlainObject(value) {
+    return !!value && typeof value === 'object' && !Array.isArray(value);
+}
+const LOCATION_KINDS = ['state', 'provider-record', 'field', 'collection-item'];
+/**
+ * A plain object carrying one of the four location kinds — total, never throws. A candidate
+ * `Location` can arrive from AI generation, deserialization or hand-tampering, so every
+ * traversal below checks this before reading `.kind` rather than trusting the compile-time
+ * `Location` type (spec16pt2 §12-20).
+ */
+export function isPlainLocation(value) {
+    return isPlainObject(value) && LOCATION_KINDS.includes(value.kind);
+}
+/** A plain object carrying a recognized `CollectionSelector.kind`, guarding `.selector` access. */
+function isPlainSelector(value) {
+    return isPlainObject(value) && (value.kind === 'identity' || value.kind === 'index');
+}
 /**
  * The node every location is ultimately rooted in.
  *
@@ -32,8 +49,14 @@ export function itemFieldLocation(stateId, identityFieldId, identityValue, field
  * entity id** instead. Callers that resolve the result as a state (`context.states.get`)
  * naturally get `undefined` and skip it, which is correct: nothing materialized holds the
  * record. Use `locationProviderEntityId` to detect the provider-backed case explicitly.
+ *
+ * Total over malformed input: an empty string (never a real `NodeId`) for a location that
+ * cannot be understood at all, rather than a thrown error (spec16pt2 §12-13).
  */
 export function locationRootStateId(location) {
+    if (!isPlainLocation(location)) {
+        return '';
+    }
     switch (location.kind) {
         case 'state':
             return location.stateId;
@@ -44,11 +67,14 @@ export function locationRootStateId(location) {
         case 'collection-item':
             return locationRootStateId(location.collection);
         default:
-            throw new Error(`Unknown location kind "${location.kind}"`);
+            return '';
     }
 }
 /** The source entity of the `provider-record` a location is rooted in, or `undefined` if it is state-rooted. */
 export function locationProviderEntityId(location) {
+    if (!isPlainLocation(location)) {
+        return undefined;
+    }
     switch (location.kind) {
         case 'provider-record':
             return location.sourceEntityId;
@@ -65,6 +91,9 @@ export function locationProviderEntityId(location) {
  * identity value. These are read dependencies of whatever uses the location.
  */
 export function locationExpressions(location) {
+    if (!isPlainLocation(location)) {
+        return [];
+    }
     switch (location.kind) {
         case 'state':
             return [];
@@ -73,6 +102,9 @@ export function locationExpressions(location) {
         case 'field':
             return locationExpressions(location.target);
         case 'collection-item': {
+            if (!isPlainSelector(location.selector)) {
+                return locationExpressions(location.collection);
+            }
             const own = location.selector.kind === 'identity' ? [location.selector.value] : [location.selector.index];
             return [...locationExpressions(location.collection), ...own];
         }
@@ -82,10 +114,16 @@ export function locationExpressions(location) {
 }
 /** Fields a write through this location touches, outermost first. */
 export function locationFieldIds(location) {
+    if (!isPlainLocation(location)) {
+        return [];
+    }
     return location.kind === 'field' ? [location.fieldId, ...locationFieldIds(location.target)] : [];
 }
 /** Fields a location reads in order to address itself, such as identity selectors. */
 export function locationSelectorFieldIds(location) {
+    if (!isPlainLocation(location)) {
+        return [];
+    }
     switch (location.kind) {
         case 'state':
             return [];
@@ -96,7 +134,9 @@ export function locationSelectorFieldIds(location) {
         case 'collection-item':
             return [
                 ...locationSelectorFieldIds(location.collection),
-                ...(location.selector.kind === 'identity' ? [location.selector.fieldId] : []),
+                ...(isPlainSelector(location.selector) && location.selector.kind === 'identity'
+                    ? [location.selector.fieldId]
+                    : []),
             ];
         default:
             return [];

package/dist/nodes.d.ts

@@ -315,7 +315,34 @@ export interface ForEachOperation {
     scopeId: NodeId;
     operations: MutationOperation[];
 }
-export declare function isMutationOperation(operation: Operation): operation is MutationOperation;
+/**
+ * Total over any input (spec16pt2 §12-19): a candidate `Operation` may arrive from
+ * AI generation, deserialization or hand-tampering, so the runtime type `Operation` is not
+ * proof of runtime shape. `null`/a primitive/an array safely reports `false` rather than
+ * throwing when `.kind` is read.
+ */
+export declare function isMutationOperation(operation: unknown): operation is MutationOperation;
+/** A plain object carrying one of the closed `OPERATION_KINDS` — total, never throws. */
+export declare function isPlainOperation(operation: unknown): operation is Operation;
+/**
+ * `value.operations` if it is genuinely an array, else `[]` — no per-element filtering.
+ * Exported for `validateGraph`, the one caller that must see every raw array element,
+ * malformed or not, in order to report each one structurally (spec16pt2 §20-21).
+ */
+export declare function rawOperations(value: unknown): readonly unknown[];
+/**
+ * `ActionDef.operations`, safe over malformed input (spec16pt2 §12-13): only a genuine
+ * array of well-formed operations is ever returned — never assumed from a truthy-but-non-array
+ * value like `{}` (exactly the shape `(action.operations ?? []).some(...)` treats as an array
+ * and crashes on), and never including a malformed array *element* either, so every consumer
+ * that just wants to reason about an action's real operations can iterate the result without
+ * its own defensive check. `validateGraph` is the one caller that must see and diagnose a
+ * malformed element rather than have it silently skipped, so it walks the raw array itself
+ * (`nodes.ts` is not the place that decides what gets reported — `validate.ts` is).
+ */
+export declare function actionOperations(action: unknown): Operation[];
+/** A `for-each` operation's nested `operations`, equally total and equally filtered. */
+export declare function operationChildren(operation: unknown): MutationOperation[];
 export declare function forEach(collection: Expression, scopeId: NodeId, operations: MutationOperation[]): ForEachOperation;
 export interface InvokeOperation {
     kind: 'invoke';

package/dist/nodes.js

@@ -49,9 +49,51 @@ export const BLOB_OPERATION_KINDS = [
     'blob-commit',
     'blob-delete',
 ];
+/**
+ * Total over any input (spec16pt2 §12-19): a candidate `Operation` may arrive from
+ * AI generation, deserialization or hand-tampering, so the runtime type `Operation` is not
+ * proof of runtime shape. `null`/a primitive/an array safely reports `false` rather than
+ * throwing when `.kind` is read.
+ */
 export function isMutationOperation(operation) {
+    if (!isPlainOperation(operation)) {
+        return false;
+    }
     return operation.kind === 'set' || operation.kind === 'insert' || operation.kind === 'remove';
 }
+/** A plain object carrying one of the closed `OPERATION_KINDS` — total, never throws. */
+export function isPlainOperation(operation) {
+    return (!!operation &&
+        typeof operation === 'object' &&
+        !Array.isArray(operation) &&
+        OPERATION_KINDS.includes(operation.kind));
+}
+/**
+ * `value.operations` if it is genuinely an array, else `[]` — no per-element filtering.
+ * Exported for `validateGraph`, the one caller that must see every raw array element,
+ * malformed or not, in order to report each one structurally (spec16pt2 §20-21).
+ */
+export function rawOperations(value) {
+    const operations = value?.operations;
+    return Array.isArray(operations) ? operations : [];
+}
+/**
+ * `ActionDef.operations`, safe over malformed input (spec16pt2 §12-13): only a genuine
+ * array of well-formed operations is ever returned — never assumed from a truthy-but-non-array
+ * value like `{}` (exactly the shape `(action.operations ?? []).some(...)` treats as an array
+ * and crashes on), and never including a malformed array *element* either, so every consumer
+ * that just wants to reason about an action's real operations can iterate the result without
+ * its own defensive check. `validateGraph` is the one caller that must see and diagnose a
+ * malformed element rather than have it silently skipped, so it walks the raw array itself
+ * (`nodes.ts` is not the place that decides what gets reported — `validate.ts` is).
+ */
+export function actionOperations(action) {
+    return rawOperations(action).filter(isPlainOperation);
+}
+/** A `for-each` operation's nested `operations`, equally total and equally filtered. */
+export function operationChildren(operation) {
+    return rawOperations(operation).filter(isMutationOperation);
+}
 export function forEach(collection, scopeId, operations) {
     return { kind: 'for-each', collection, scopeId, operations };
 }

package/dist/resolve-presentation.js

@@ -1,3 +1,4 @@
+import { actionOperations } from './nodes.js';
 import { formSubmitActionId, isUINode, uiChildIds } from './ui.js';
 import { TEXT_ROLE_HEADING_LEVELS, normalizeDensity, normalizeLayout, normalizePadding, normalizeRole, } from './presentation.js';
 import { DEFAULT_THEME } from './theme.js';
@@ -269,7 +270,7 @@ function semanticLayer(node, index) {
 }
 /** Declared destructive intent, or a removal the graph performs. */
 export function isDestructiveAction(action) {
-    return action.destructive === true || (action.operations ?? []).some((op) => op.kind === 'remove');
+    return action.destructive === true || actionOperations(action).some((op) => op.kind === 'remove');
 }
 /** Boolean and temporal values read better formatted than printed raw — §32, §33. */
 function formatLayer(node, index) {

package/dist/semantic-diff.js

@@ -34,12 +34,21 @@ export const SEMANTIC_DIFF_CATEGORIES = [
     'presentation',
     'metadata',
 ];
-/** Kinds `diffSchema` already classifies in full field-level detail; excluded from the generic node loop. */
-const SCHEMA_OWNED_KINDS = new Set(['entity', 'state', 'relationship', 'read-policy']);
+/**
+ * Kinds `diffSchema` already classifies in full field-level detail; excluded from the
+ * generic node loop. `read-policy` is deliberately **not** here (spec16pt2 F3, §33, §37):
+ * `diffSchema`'s `ReadPolicyShape` only tracks which entity a policy governs — correctly,
+ * for `schemaFingerprint`'s persistence-relevant purpose — and never its `predicate`, so a
+ * rule edited from owner-only to public would otherwise produce no diff entry anywhere even
+ * though it moves `semanticFingerprint`. Routing it through the generic full-node loop
+ * instead catches exactly that, tagged `authorization`, at the cost of a redundant (never
+ * missing) second entry when `diffSchema` also reports the policy's entity moving.
+ */
+const SCHEMA_OWNED_KINDS = new Set(['entity', 'state', 'relationship']);
 const PROVIDER_KINDS = new Set(['integration', 'integration-operation', 'subscription', 'storage']);
 const PRESENTATION_KINDS = new Set([...UI_NODE_KINDS, 'route']);
 function kindCategory(kind) {
-    if (kind === 'authorization-policy')
+    if (kind === 'authorization-policy' || kind === 'read-policy')
         return 'authorization';
     if (kind === 'query')
         return 'query';
@@ -54,7 +63,21 @@ function kindCategory(kind) {
     return 'semantic';
 }
 /** Field names whose change on a node makes the change authorization-semantic too (spec16 §156). */
-const AUTHZ_FIELDS = ['authorizationPolicy', 'authorization', 'startPolicy', 'instanceAccessPolicy'];
+/**
+ * Every field whose change makes a node's diff entry authorization-relevant (spec16pt2 F3,
+ * §32-42). `readPolicyId` closes the exact alpha.1 finding: attaching, detaching or
+ * replacing the row-level policy a `QueryDef` reads through controls **who may observe**
+ * its rows, which is authorization semantics by spec16pt2 §32's own test — the field name
+ * containing "Policy" is a coincidence this list must not rely on (§41 forbids matching by
+ * substring), so each entry here is a deliberate, individually-justified addition.
+ */
+const AUTHZ_FIELDS = [
+    'authorizationPolicy',
+    'authorization',
+    'startPolicy',
+    'instanceAccessPolicy',
+    'readPolicyId',
+];
 function isPlainObject(value) {
     return !!value && typeof value === 'object' && !Array.isArray(value);
 }
@@ -99,22 +122,19 @@ export function semanticDiff(before, after) {
             if (strippedEqual) {
                 categories.add('metadata');
             }
-            else if (isPlainObject(previous) && isPlainObject(node)) {
-                const changedFields = new Set([...Object.keys(previous), ...Object.keys(node)].filter((key) => !equalJSON(previous[key], node[key])));
-                const onlyAuthzFieldsChanged = changedFields.size > 0 && [...changedFields].every((key) => AUTHZ_FIELDS.includes(key));
-                if (onlyAuthzFieldsChanged) {
-                    categories.add('authorization');
-                }
-                else {
-                    categories.add(kindCategory(kind));
-                    if ([...changedFields].some((key) => AUTHZ_FIELDS.includes(key))) {
+            else {
+                // spec16pt2 §40: categories are additive, never exclusive. An authorization-bearing
+                // field change is tagged `authorization` *in addition to* the node's own kind
+                // category — never in its place — so `QueryDef.readPolicyId` detaching reads as
+                // `[query, authorization]`, not merely `[authorization]` (F3, §34).
+                categories.add(kindCategory(kind));
+                if (isPlainObject(previous) && isPlainObject(node)) {
+                    const changedFields = [...new Set([...Object.keys(previous), ...Object.keys(node)])].filter((key) => !equalJSON(previous[key], node[key]));
+                    if (changedFields.some((key) => AUTHZ_FIELDS.includes(key))) {
                         categories.add('authorization');
                     }
                 }
             }
-            else {
-                categories.add(kindCategory(kind));
-            }
             entries.push({
                 changeKind: 'changed',
                 nodeId: id,

package/dist/server-ir.js

@@ -1,3 +1,4 @@
+import { actionOperations, operationChildren } from './nodes.js';
 import { walkExpression } from './expressions.js';
 import { queryExpressions } from './query.js';
 import { migrationExpressions } from './migration.js';
@@ -123,7 +124,7 @@ export function usesExternalIOVocabulary(ir) {
     if ((ir.subscriptions?.length ?? 0) > 0 || (ir.storages?.length ?? 0) > 0) {
         return true;
     }
-    return Object.values(ir.actions).some((action) => (action.operations ?? []).some((operation) => SERVER_IR_V5_OPERATION_KINDS.includes(operation.kind)));
+    return Object.values(ir.actions).some((action) => actionOperations(action).some((operation) => SERVER_IR_V5_OPERATION_KINDS.includes(operation.kind)));
 }
 /**
  * Whether a document uses 0.11's schema-evolution vocabulary — a `MigrationDef`, or a
@@ -221,7 +222,7 @@ export function usesQueryVocabulary(ir) {
         return true;
     }
     // A `query` operation inside an action is also v6 vocabulary.
-    return Object.values(ir.actions).some((action) => (action.operations ?? []).some((operation) => operation.kind === 'query'));
+    return Object.values(ir.actions).some((action) => actionOperations(action).some((operation) => operation.kind === 'query'));
 }
 /** The higher of two contracts, ordered by `SERVER_IR_CONTRACTS`. */
 export function maxContract(a, b) {
@@ -349,7 +350,7 @@ function actionExpressions(action) {
                     break;
                 case 'for-each':
                     found.push(operation.collection);
-                    walkOperations(operation.operations);
+                    walkOperations(operationChildren(operation));
                     break;
                 case 'invoke':
                     found.push(...Object.values(operation.arguments ?? {}));
@@ -379,6 +380,6 @@ function actionExpressions(action) {
             }
         }
     };
-    walkOperations(action.operations ?? []);
+    walkOperations(actionOperations(action));
     return found;
 }

package/dist/validate-location.d.ts

@@ -1,7 +1,6 @@
 import type { ValidationIssue } from './diagnostics.js';
 import type { NodeId } from './ids.js';
 import type { SemanticContext } from './infer.js';
-import type { Location } from './location.js';
 export interface LocationValidationOptions {
     /** Node the location belongs to, for diagnostics. */
     ownerId?: NodeId;
@@ -11,6 +10,11 @@ export interface LocationValidationOptions {
 /**
  * Structural validation of a location: does every state, field and selector it names
  * exist, do they fit together, and may it be written to?
+ *
+ * Total over malformed input (spec16pt2 §12-24): a candidate `Location` can arrive from AI
+ * generation, deserialization or hand-tampering. `walk` establishes shape before any
+ * dereference, so a `null`/primitive/malformed location is reported as one structured
+ * `ValidationIssue`, never a native exception.
  */
-export declare function validateLocation(location: Location, context: SemanticContext, options?: LocationValidationOptions): ValidationIssue[];
+export declare function validateLocation(location: unknown, context: SemanticContext, options?: LocationValidationOptions): ValidationIssue[];
 //# sourceMappingURL=validate-location.d.ts.map

package/dist/validate-location.js

@@ -1,9 +1,29 @@
 import { VALIDATION_CODES } from './diagnostics.js';
 import { inferExpressionType, inferLocationType, locationCapabilities } from './infer.js';
-import { locationRootStateId } from './location.js';
+import { isPlainLocation, locationRootStateId } from './location.js';
+function isPlainObject(value) {
+    return !!value && typeof value === 'object' && !Array.isArray(value);
+}
+/** A short, safe description of a malformed value for a diagnostic message. Never throws. */
+function describeShape(value) {
+    if (value === null)
+        return 'null';
+    if (value === undefined)
+        return 'undefined';
+    if (Array.isArray(value))
+        return 'an array';
+    if (typeof value === 'object')
+        return 'an object with no recognized "kind"';
+    return `a ${typeof value}`;
+}
 /**
  * Structural validation of a location: does every state, field and selector it names
  * exist, do they fit together, and may it be written to?
+ *
+ * Total over malformed input (spec16pt2 §12-24): a candidate `Location` can arrive from AI
+ * generation, deserialization or hand-tampering. `walk` establishes shape before any
+ * dereference, so a `null`/primitive/malformed location is reported as one structured
+ * `ValidationIssue`, never a native exception.
  */
 export function validateLocation(location, context, options = {}) {
     const problems = [];
@@ -21,6 +41,10 @@ export function validateLocation(location, context, options = {}) {
     return problems;
 }
 function walk(location, context, report) {
+    if (!isPlainLocation(location)) {
+        report(VALIDATION_CODES.unknownStateRef, `Location is not a valid location structure: expected an object with a recognized "kind", got ${describeShape(location)}`);
+        return;
+    }
     switch (location.kind) {
         case 'state': {
             if (!context.getState(location.stateId)) {
@@ -68,6 +92,10 @@ function walk(location, context, report) {
                 report(VALIDATION_CODES.selectorOnNonCollection, `An item selector was applied to a ${resolved.kind} value`);
                 return;
             }
+            if (!isPlainObject(location.selector) || (location.selector.kind !== 'identity' && location.selector.kind !== 'index')) {
+                report(VALIDATION_CODES.invalidSelectorType, `Item selector is not a valid selector structure: expected { kind: 'identity' | 'index', ... }, got ${describeShape(location.selector)}`);
+                return;
+            }
             if (location.selector.kind !== 'identity') {
                 // An index has to be a number. Type inference is partial, so this rejects only
                 // what is statically certain to be wrong.

package/dist/validate-presentation.js

@@ -1,4 +1,5 @@
 import { VALIDATION_CODES } from './diagnostics.js';
+import { actionOperations } from './nodes.js';
 import { ACTION_UX_ROLES, ALIGNMENTS, BOUNDED_SIZES, CONTROL_VARIANTS, DENSITIES, DEVICE_CLASSES, EMPHASIS_LEVELS, ICON_NAMES, JUSTIFICATIONS, LAYOUT_KINDS, PRESENTATION_ROLES, SIZING_VALUES, SPACING_TOKENS, SURFACE_ROLES, TEXT_ROLES, TREATMENTS, HEADING_LEVELS, UX_ROLES, VALUE_FORMAT_KINDS, } from './presentation.js';
 import { isDestructiveAction } from './resolve-presentation.js';
 import { APPEARANCES, RADIUS_TOKENS, SEMANTIC_COLOR_ROLES } from './theme.js';
@@ -759,7 +760,7 @@ function checkUnmarkedDestructiveActions(bag, index, actions) {
         if (!bound.has(action.id) || action.destructive === true) {
             continue;
         }
-        if ((action.operations ?? []).some((operation) => operation.kind === 'remove')) {
+        if (actionOperations(action).some((operation) => operation.kind === 'remove')) {
             bag.warnings.push({
                 code: VALIDATION_CODES.destructiveActionUnmarked,
                 message: `${action.name ?? action.id} removes data but does not declare "destructive"`,

package/dist/validate.js

@@ -1,6 +1,6 @@
 import { AGGREGATE_FUNCTIONS, BUILTIN_FUNCTIONS, expressionDefsIn, walkExpression } from './expressions.js';
 import { VALIDATION_CODES } from './diagnostics.js';
-import { EDGE_KINDS, actionGuards, isMutationOperation } from './nodes.js';
+import { EDGE_KINDS, actionGuards, isMutationOperation, isPlainOperation, rawOperations } from './nodes.js';
 import { SUBSCRIPTION_BACKPRESSURE_POLICIES, subscriptionBackpressure, subscriptionQueueLimit, } from './subscriptions.js';
 import { BLOB_REF_FIELDS } from './storage.js';
 import { queryPaginationStrategy, sortKeyDirection } from './query.js';
@@ -120,6 +120,9 @@ export function validateGraph(graph, options = {}) {
     warnings.push(...migration.warnings);
     return { valid: errors.length === 0, errors, warnings };
 }
+function isPlainObject(value) {
+    return !!value && typeof value === 'object' && !Array.isArray(value);
+}
 function validateNode(node, context) {
     if (isUINode(node)) {
         validateUiNode(node, context);
@@ -297,25 +300,64 @@ function validateAction(action, context) {
     for (const postcondition of action.postconditions ?? []) {
         validateExpression(postcondition, action.id, context, local);
     }
+    // spec16pt2 F1 — a candidate ActionDef.operations can arrive from AI generation,
+    // deserialization or hand-tampering, so its runtime shape is checked before it is ever
+    // iterated. A present-but-non-array value is a distinct, structural defect from "absent"
+    // (spec16pt2 §15): absent means no operations, non-array means the graph is malformed.
+    if (action.operations !== undefined && !Array.isArray(action.operations)) {
+        context.errors.push({
+            code: VALIDATION_CODES.invalidOperationCollection,
+            message: `Action ${action.id} declares operations as ${describeOperationShape(action.operations)}, not an array`,
+            nodeId: action.id,
+        });
+    }
     let scoped = local;
-    for (const operation of action.operations ?? []) {
+    for (const operation of rawOperations(action)) {
         scoped = validateOperation(operation, action, context, scoped);
     }
 }
+/** A short, safe description of a malformed value for a diagnostic message. Never throws. */
+function describeOperationShape(value) {
+    if (value === null)
+        return 'null';
+    if (Array.isArray(value))
+        return 'an array of the wrong shape';
+    if (typeof value === 'object')
+        return 'an object';
+    return `a ${typeof value}`;
+}
 function validateOperation(operation, action, context, local) {
+    // spec16pt2 F1/F2 — an operation entry (top-level, or nested inside a for-each) can itself
+    // be malformed: `null`, a primitive, or an object with no recognized `kind`. Establish
+    // shape before the switch below ever reads `.kind`/`.target`/`.value` (spec16pt2 §20).
+    if (!isPlainOperation(operation)) {
+        context.errors.push({
+            code: VALIDATION_CODES.invalidOperation,
+            message: `Action ${action.id} declares an operation that is ${describeOperationShape(operation)}, not a recognized operation`,
+            nodeId: action.id,
+        });
+        return local;
+    }
     switch (operation.kind) {
         case 'for-each': {
             validateExpression(operation.collection, action.id, context, local);
             requireCollection(operation.collection, action.id, context, local, 'for-each');
             const scoped = iterationScope(local, operation.scopeId, operation.collection, context, action.id);
-            if ((operation.operations ?? []).length === 0) {
+            if (operation.operations !== undefined && !Array.isArray(operation.operations)) {
+                context.errors.push({
+                    code: VALIDATION_CODES.invalidOperationCollection,
+                    message: `A for-each in ${action.id} declares operations as ${describeOperationShape(operation.operations)}, not an array`,
+                    nodeId: action.id,
+                });
+            }
+            else if (rawOperations(operation).length === 0) {
                 context.warnings.push({
                     code: VALIDATION_CODES.unsupportedOperation,
                     message: `A for-each in ${action.id} performs no mutations`,
                     nodeId: action.id,
                 });
             }
-            for (const nested of operation.operations ?? []) {
+            for (const nested of rawOperations(operation)) {
                 if (!isMutationOperation(nested)) {
                     context.errors.push({
                         code: VALIDATION_CODES.unsupportedOperation,
@@ -1954,8 +1996,20 @@ function iterationScope(scope, scopeId, source, context, ownerId) {
     }
     return { ids: new Set([...scope.ids, scopeId]), types };
 }
-function validateExpression(expression, ownerId, context, local) {
+function validateExpression(expressionInput, ownerId, context, local) {
     const scope = local instanceof Set ? emptyScope(local) : local;
+    // spec16pt2 §12-24 — a candidate expression can be malformed (a deleted/tampered field,
+    // an array-for-object mutation): establish shape before the switch below ever reads
+    // `.kind`, exactly like the operation/location totality fix above.
+    if (!isPlainObject(expressionInput) || typeof expressionInput.kind !== 'string') {
+        context.errors.push({
+            code: VALIDATION_CODES.unsupportedExpression,
+            message: `${ownerId} contains an expression that is not a recognized structure`,
+            nodeId: ownerId,
+        });
+        return;
+    }
+    const expression = expressionInput;
     switch (expression.kind) {
         case 'literal':
             return;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@cynodia/axiom-core",
-  "version": "0.16.0-alpha.1",
+  "version": "0.16.0-alpha.2",
   "description": "Application Graph, semantic types, locations and validation for Axiom.",
   "license": "MIT",
   "author": "AskTech AS",