@cynodia/axiom-core 0.5.2-alpha.1 → 0.6.1-alpha.1

package/README.md

@@ -21,13 +21,13 @@ builders, `Presentation`, `Theme`, `resolvePresentationMap`, `validateGraph`,
 ## Installation
 
 ```bash
-npm install @cynodia/axiom-core@alpha
+npm install @cynodia/axiom-core
 ```
 
 Most applications should install the facade package instead, which re-exports this one:
 
 ```bash
-npm install @cynodia/axiom@alpha
+npm install @cynodia/axiom
 ```
 
 

package/dist/authority.d.ts

@@ -0,0 +1,63 @@
+import type { Expression } from './expressions.js';
+import type { NodeId } from './ids.js';
+import type { ActionDef, ConstraintDef, StateDef, TransitionConstraintDef } from './nodes.js';
+import type { AnyNode } from './types.js';
+/**
+ * Who may commit a canonical mutation.
+ *
+ * Authority and persistence are separate concerns. Authority says *who decides* a value;
+ * persistence says *where a decided value survives*. A server-authoritative state may be
+ * held only in memory, and a client-authoritative state may be persisted to local storage.
+ */
+export type Authority = 'client' | 'server';
+export declare const AUTHORITIES: readonly Authority[];
+/**
+ * The scope an authorization expression resolves the caller through.
+ *
+ * It is bound to a record keyed by the field ids of the graph's principal entity, so an
+ * authorization rule is written with the same `field`/`ref` vocabulary as everything else:
+ *
+ * ```ts
+ * binary('eq', field(ref(PRINCIPAL), F_USER_ROLE), literal('admin'))
+ * ```
+ *
+ * It is bound only where a server evaluates. A client never sees it.
+ */
+export declare const PRINCIPAL: NodeId;
+/**
+ * The authority of a state. Absent metadata means `client`, so every 0.5.x graph keeps
+ * executing exactly as it did.
+ */
+export declare function stateAuthority(state: StateDef): Authority;
+/** Whether the client may observe this state at all. */
+export declare function isObservable(state: StateDef): boolean;
+export interface AuthorityContext {
+    states: Map<NodeId, StateDef>;
+    actions: Map<NodeId, ActionDef>;
+    constraints: ConstraintDef[];
+    transitionConstraints: TransitionConstraintDef[];
+    principalEntityId?: NodeId;
+}
+export declare function authorityContext(nodes: readonly AnyNode[], principalEntityId?: NodeId): AuthorityContext;
+/** Every state a set of expressions reads, following derived state transitively. */
+export declare function statesReadBy(expressions: readonly Expression[], context: AuthorityContext): Set<NodeId>;
+/** The states an action writes, following `for-each`, `invoke` and declared native effects. */
+export declare function statesWrittenBy(action: ActionDef, context: AuthorityContext, visited?: Set<NodeId>): Set<NodeId>;
+/** The states an action reads: its guards, its values, its selectors, its authorization. */
+export declare function statesReadByAction(action: ActionDef, context: AuthorityContext, visited?: Set<NodeId>): Set<NodeId>;
+/**
+ * Where an action must execute.
+ *
+ * An action that writes any server-authoritative state is a **server action**: only the
+ * authority that owns the state may commit it. This is derived, never declared, so it
+ * cannot disagree with what the action actually does.
+ */
+export declare function actionAuthority(action: ActionDef, context: AuthorityContext): Authority;
+/** Actions the client must send to the authority rather than execute itself. */
+export declare function serverActionIds(context: AuthorityContext): NodeId[];
+/**
+ * Every state a server action needs in order to execute: what it writes, what it reads,
+ * and the derived state either of those depends on.
+ */
+export declare function serverStateClosure(context: AuthorityContext): Set<NodeId>;
+//# sourceMappingURL=authority.d.ts.map

package/dist/authority.js

@@ -0,0 +1,253 @@
+import { referencedIds } from './derive-edges.js';
+import { actionGuards, isMutationOperation } from './nodes.js';
+import { locationExpressions, locationRootStateId } from './location.js';
+export const AUTHORITIES = ['client', 'server'];
+/**
+ * The scope an authorization expression resolves the caller through.
+ *
+ * It is bound to a record keyed by the field ids of the graph's principal entity, so an
+ * authorization rule is written with the same `field`/`ref` vocabulary as everything else:
+ *
+ * ```ts
+ * binary('eq', field(ref(PRINCIPAL), F_USER_ROLE), literal('admin'))
+ * ```
+ *
+ * It is bound only where a server evaluates. A client never sees it.
+ */
+export const PRINCIPAL = 'axiom_principal';
+/**
+ * The authority of a state. Absent metadata means `client`, so every 0.5.x graph keeps
+ * executing exactly as it did.
+ */
+export function stateAuthority(state) {
+    return state.authority === 'server' ? 'server' : 'client';
+}
+/** Whether the client may observe this state at all. */
+export function isObservable(state) {
+    return state.serverOnly !== true;
+}
+export function authorityContext(nodes, principalEntityId) {
+    const states = new Map();
+    const actions = new Map();
+    const constraints = [];
+    const transitionConstraints = [];
+    for (const node of nodes) {
+        switch (node.kind) {
+            case 'state':
+                states.set(node.id, node);
+                break;
+            case 'action':
+                actions.set(node.id, node);
+                break;
+            case 'constraint':
+                constraints.push(node);
+                break;
+            case 'transition-constraint':
+                transitionConstraints.push(node);
+                break;
+            default:
+        }
+    }
+    return {
+        states,
+        actions,
+        constraints,
+        transitionConstraints,
+        ...(principalEntityId ? { principalEntityId } : {}),
+    };
+}
+/** Every state a set of expressions reads, following derived state transitively. */
+export function statesReadBy(expressions, context) {
+    const found = new Set();
+    const seen = new Set();
+    const walk = (expression) => {
+        for (const id of referencedIds(expression)) {
+            const state = context.states.get(id);
+            if (!state || seen.has(id)) {
+                continue;
+            }
+            seen.add(id);
+            found.add(id);
+            if (state.derivation) {
+                walk(state.derivation);
+            }
+        }
+    };
+    expressions.forEach(walk);
+    return found;
+}
+/** Every expression an operation evaluates, including those inside its locations. */
+function operationExpressions(operation) {
+    const found = [];
+    if (isMutationOperation(operation)) {
+        const target = operation.kind === 'remove' ? operation.target : operation.target;
+        found.push(...locationExpressions(target));
+        if (operation.kind !== 'remove') {
+            found.push(operation.value);
+        }
+    }
+    switch (operation.kind) {
+        case 'for-each':
+            found.push(operation.collection);
+            for (const nested of operation.operations ?? []) {
+                found.push(...operationExpressions(nested));
+            }
+            break;
+        case 'invoke':
+            found.push(...Object.values(operation.arguments ?? {}));
+            break;
+        case 'navigate':
+            found.push(...Object.values(operation.parameters ?? {}));
+            break;
+        case 'native':
+            found.push(...Object.values(operation.inputs ?? {}));
+            if (operation.resultTarget) {
+                found.push(...locationExpressions(operation.resultTarget));
+            }
+            break;
+        default:
+    }
+    return found;
+}
+/** The states an action writes, following `for-each`, `invoke` and declared native effects. */
+export function statesWrittenBy(action, context, visited = new Set()) {
+    const found = new Set();
+    if (visited.has(action.id)) {
+        return found;
+    }
+    visited.add(action.id);
+    const walk = (operations) => {
+        for (const operation of operations) {
+            if (isMutationOperation(operation)) {
+                found.add(locationRootStateId(operation.target));
+                continue;
+            }
+            switch (operation.kind) {
+                case 'for-each':
+                    walk(operation.operations ?? []);
+                    break;
+                case 'invoke': {
+                    const target = context.actions.get(operation.actionId);
+                    if (target) {
+                        for (const id of statesWrittenBy(target, context, visited)) {
+                            found.add(id);
+                        }
+                    }
+                    break;
+                }
+                case 'native':
+                    if (operation.resultTarget) {
+                        found.add(locationRootStateId(operation.resultTarget));
+                    }
+                    for (const effect of operation.declaredEffects ?? []) {
+                        if (effect.kind === 'writes-state') {
+                            found.add(effect.stateId);
+                        }
+                    }
+                    break;
+                default:
+            }
+        }
+    };
+    walk(action.operations ?? []);
+    return found;
+}
+/** The states an action reads: its guards, its values, its selectors, its authorization. */
+export function statesReadByAction(action, context, visited = new Set()) {
+    if (visited.has(action.id)) {
+        return new Set();
+    }
+    visited.add(action.id);
+    const expressions = [
+        ...actionGuards(action).map((guard) => guard.condition),
+        ...(action.postconditions ?? []),
+        ...(action.authorization ? [action.authorization] : []),
+    ];
+    for (const operation of action.operations ?? []) {
+        expressions.push(...operationExpressions(operation));
+    }
+    const found = statesReadBy(expressions, context);
+    for (const operation of action.operations ?? []) {
+        if (operation.kind === 'invoke') {
+            const target = context.actions.get(operation.actionId);
+            if (target) {
+                for (const id of statesReadByAction(target, context, visited)) {
+                    found.add(id);
+                }
+            }
+        }
+    }
+    return found;
+}
+/**
+ * Where an action must execute.
+ *
+ * An action that writes any server-authoritative state is a **server action**: only the
+ * authority that owns the state may commit it. This is derived, never declared, so it
+ * cannot disagree with what the action actually does.
+ */
+export function actionAuthority(action, context) {
+    for (const stateId of statesWrittenBy(action, context)) {
+        const state = context.states.get(stateId);
+        if (state && stateAuthority(state) === 'server') {
+            return 'server';
+        }
+    }
+    return 'client';
+}
+/** Actions the client must send to the authority rather than execute itself. */
+export function serverActionIds(context) {
+    return [...context.actions.values()]
+        .filter((action) => actionAuthority(action, context) === 'server')
+        .map((action) => action.id);
+}
+/**
+ * Every state a server action needs in order to execute: what it writes, what it reads,
+ * and the derived state either of those depends on.
+ */
+export function serverStateClosure(context) {
+    const needed = new Set();
+    for (const state of context.states.values()) {
+        if (stateAuthority(state) === 'server') {
+            needed.add(state.id);
+        }
+    }
+    for (const action of context.actions.values()) {
+        if (actionAuthority(action, context) !== 'server') {
+            continue;
+        }
+        for (const id of statesWrittenBy(action, context)) {
+            needed.add(id);
+        }
+        for (const id of statesReadByAction(action, context)) {
+            needed.add(id);
+        }
+    }
+    // Constraints and transition rules that govern what the server commits are evaluated
+    // there, so whatever they read has to be present too.
+    const ruleExpressions = [
+        ...context.constraints.map((constraint) => constraint.expression),
+        ...context.transitionConstraints.map((constraint) => constraint.expression),
+    ];
+    for (const id of statesReadBy(ruleExpressions, context)) {
+        needed.add(id);
+    }
+    // Derived state is only meaningful if what it derives from is present as well.
+    let growing = true;
+    while (growing) {
+        growing = false;
+        for (const id of [...needed]) {
+            const state = context.states.get(id);
+            if (!state?.derivation) {
+                continue;
+            }
+            for (const dependency of statesReadBy([state.derivation], context)) {
+                if (!needed.has(dependency)) {
+                    needed.add(dependency);
+                    growing = true;
+                }
+            }
+        }
+    }
+    return needed;
+}

package/dist/diagnostics.d.ts

@@ -65,5 +65,12 @@ export declare const VALIDATION_CODES: {
     readonly formInputMissingLabel: "FORM_INPUT_MISSING_LABEL";
     readonly invalidHeadingStructure: "INVALID_HEADING_STRUCTURE";
     readonly opaquePresentation: "OPAQUE_PRESENTATION";
+    readonly clientWriteToServerState: "CLIENT_WRITE_TO_SERVER_STATE";
+    readonly serverDependsOnClientState: "SERVER_DEPENDS_ON_CLIENT_STATE";
+    readonly authorizationWithoutPrincipal: "AUTHORIZATION_WITHOUT_PRINCIPAL";
+    readonly principalReferenceOnClient: "PRINCIPAL_REFERENCE_ON_CLIENT";
+    readonly serverOnlyStateObserved: "SERVER_ONLY_STATE_OBSERVED";
+    readonly invalidPrincipalEntity: "INVALID_PRINCIPAL_ENTITY";
+    readonly missingActionArgument: "MISSING_ACTION_ARGUMENT";
 };
 //# sourceMappingURL=diagnostics.d.ts.map

package/dist/diagnostics.js

@@ -50,4 +50,13 @@ export const VALIDATION_CODES = {
     formInputMissingLabel: 'FORM_INPUT_MISSING_LABEL',
     invalidHeadingStructure: 'INVALID_HEADING_STRUCTURE',
     opaquePresentation: 'OPAQUE_PRESENTATION',
+    // Authority. A graph that cannot execute safely across the trust boundary is rejected
+    // rather than left to fail at run time.
+    clientWriteToServerState: 'CLIENT_WRITE_TO_SERVER_STATE',
+    serverDependsOnClientState: 'SERVER_DEPENDS_ON_CLIENT_STATE',
+    authorizationWithoutPrincipal: 'AUTHORIZATION_WITHOUT_PRINCIPAL',
+    principalReferenceOnClient: 'PRINCIPAL_REFERENCE_ON_CLIENT',
+    serverOnlyStateObserved: 'SERVER_ONLY_STATE_OBSERVED',
+    invalidPrincipalEntity: 'INVALID_PRINCIPAL_ENTITY',
+    missingActionArgument: 'MISSING_ACTION_ARGUMENT',
 };

package/dist/graph.d.ts

@@ -39,6 +39,12 @@ export declare class ApplicationGraph {
     get theme(): Theme;
     /** Exactly what the application declared, before defaults were filled in. */
     get declaredTheme(): ThemeInput | undefined;
+    /**
+     * The entity an authorization expression reads the caller through, bound to `PRINCIPAL`
+     * when the authority evaluates the rule.
+     */
+    get principalEntityId(): NodeId | undefined;
+    setPrincipalEntity(entityId: NodeId | undefined): void;
     setTheme(theme: ThemeInput | undefined): void;
     addNode<T extends AnyNode>(node: NodeInput<T>): NodeId;
     getNode<T extends AnyNode = AnyNode>(id: NodeId): T | undefined;

package/dist/graph.js

@@ -23,7 +23,7 @@ export class ApplicationGraph {
     /** Bumped by every change, so the derived edge index can never serve stale data. */
     revision = 0;
     semanticIndex;
-    constructor(id, name, version = '0.5.2') {
+    constructor(id, name, version = '0.6.1') {
         this.data = { id, name, version, nodes: {}, edges: {} };
     }
     get id() {
@@ -46,6 +46,22 @@ export class ApplicationGraph {
     get declaredTheme() {
         return this.data.theme ? structuredClone(this.data.theme) : undefined;
     }
+    /**
+     * The entity an authorization expression reads the caller through, bound to `PRINCIPAL`
+     * when the authority evaluates the rule.
+     */
+    get principalEntityId() {
+        return this.data.principalEntityId;
+    }
+    setPrincipalEntity(entityId) {
+        if (entityId === undefined) {
+            delete this.data.principalEntityId;
+        }
+        else {
+            this.data.principalEntityId = entityId;
+        }
+        this.revision += 1;
+    }
     setTheme(theme) {
         if (theme === undefined) {
             delete this.data.theme;

package/dist/index.d.ts

@@ -15,6 +15,10 @@ export * from './validate-location.js';
 export * from './resolve-presentation.js';
 export * from './validate.js';
 export * from './validate-presentation.js';
+export * from './validate-authority.js';
+export * from './validate-value.js';
 export * from './derive-edges.js';
+export * from './authority.js';
 export * from './ir.js';
+export * from './server-ir.js';
 //# sourceMappingURL=index.d.ts.map

package/dist/index.js

@@ -15,5 +15,9 @@ export * from './validate-location.js';
 export * from './resolve-presentation.js';
 export * from './validate.js';
 export * from './validate-presentation.js';
+export * from './validate-authority.js';
+export * from './validate-value.js';
 export * from './derive-edges.js';
+export * from './authority.js';
 export * from './ir.js';
+export * from './server-ir.js';

package/dist/ir.d.ts

@@ -4,6 +4,7 @@ import type { FieldIndexEntry } from './graph.js';
 import type { UINode } from './ui.js';
 import type { AnyNode } from './types.js';
 import type { TypeRef } from './type-ref.js';
+import type { Authority } from './authority.js';
 import type { ResolvedPresentation } from './presentation.js';
 import type { Theme } from './theme.js';
 export interface RouteSegment {
@@ -64,6 +65,17 @@ export interface ApplicationIR {
      * renderer falls back to the iteration index.
      */
     repeatIdentityFields: Record<NodeId, FieldId>;
+    /**
+     * The authority of each state. A client runtime refuses to write a state whose authority
+     * is `server`, whatever path attempts it.
+     */
+    authority: Record<NodeId, Authority>;
+    /**
+     * Actions the client must send to the authority rather than execute itself. Their
+     * operations, guards and authorization are **absent** from this IR: a client is never
+     * given the rules it is not trusted to apply.
+     */
+    remoteActionIds: NodeId[];
     /** The application's visual identity, completed against the default theme. */
     theme: Theme;
     /**

package/dist/nodes.d.ts

@@ -3,6 +3,7 @@ import type { CollectionItemLocation, Location } from './location.js';
 import type { EdgeId, FieldId, NodeId } from './ids.js';
 import type { TypeRef } from './type-ref.js';
 import type { ConfirmationPresentation } from './presentation.js';
+import type { Authority } from './authority.js';
 export interface NodeBase {
     id: NodeId;
     name?: string;
@@ -102,6 +103,21 @@ export interface StateDef extends NodeBase {
      * is governed exactly as before.
      */
     ephemeral?: boolean;
+    /**
+     * Who may commit a canonical mutation to this state. Absent, it is `'client'`, so every
+     * 0.5.x graph keeps executing exactly as it did.
+     *
+     * A client MUST NOT commit a mutation to `'server'` state through any path: an action
+     * that writes it executes on the authority, and an input bound into it is a validation
+     * error. Authority is separate from `persistence` — one says who decides a value, the
+     * other where a decided value survives.
+     */
+    authority?: Authority;
+    /**
+     * Marks server-authoritative state the client may not observe at all. Such a state is
+     * excluded from the client IR entirely rather than merely being unwritable.
+     */
+    serverOnly?: boolean;
     persistence?: StatePersistence;
 }
 export interface ActionParameter {
@@ -144,6 +160,15 @@ export interface ActionDef extends NodeBase {
     destructive?: boolean;
     requiresConfirmation?: boolean;
     confirmationMessage?: string;
+    /**
+     * Whether the caller may invoke this action at all, evaluated **on the authority** with
+     * the caller bound to `PRINCIPAL`.
+     *
+     * It is checked before any guard and before any transaction opens, and it is stripped
+     * from the client IR — a client never learns the rule and can never satisfy it by
+     * claiming to. `requiresConfirmation` is UX and is not an authorization mechanism.
+     */
+    authorization?: Expression;
     /** What the confirmation says, when a plain message is not enough. */
     confirmation?: ConfirmationPresentation;
 }

package/dist/resolve-presentation.js

@@ -1,4 +1,4 @@
-import { isUINode, uiChildIds } from './ui.js';
+import { formSubmitActionId, isUINode, uiChildIds } from './ui.js';
 import { TEXT_ROLE_HEADING_LEVELS, normalizeDensity, normalizeLayout, normalizePadding, normalizeRole, } from './presentation.js';
 import { DEFAULT_THEME } from './theme.js';
 /**
@@ -249,7 +249,10 @@ function semanticLayer(node, index) {
     const layer = { origin: 'inferred' };
     const formId = index.formOf.get(node.id);
     const form = formId ? index.nodes.get(formId) : undefined;
-    if (form && form.kind === 'form' && form.submitActionId === node.actionId) {
+    const submitActionId = form && form.kind === 'form'
+        ? formSubmitActionId(form, (id) => index.nodes.get(id))
+        : undefined;
+    if (submitActionId !== undefined && submitActionId === node.actionId) {
         layer.role = 'primary';
         layer.emphasis = 'strong';
         layer.uxRole = 'primary-action';

package/dist/server-ir.d.ts

@@ -0,0 +1,46 @@
+import type { FieldId, NodeId } from './ids.js';
+import type { ActionDef, ConstraintDef, EntityDef, StateDef, TransitionConstraintDef } from './nodes.js';
+import type { FieldIndexEntry } from './graph.js';
+/**
+ * The contract version a Server IR conforms to. A runtime that does not recognize the
+ * value MUST refuse the IR rather than interpret it partially.
+ */
+export declare const SERVER_IR_CONTRACT = "axiom.server.v1";
+export type ServerIRContract = typeof SERVER_IR_CONTRACT;
+/**
+ * The normalized form an authority executes: everything required to decide a mutation, and
+ * nothing else.
+ *
+ * It is deliberately **not** the client IR. It carries no UI nodes, no presentation, no
+ * theme and no routes, because none of that decides anything. It does carry the rules a
+ * client must never be trusted with — authorization expressions, guards, constraints — and
+ * the state the client may not observe.
+ *
+ * It is plain JSON: serializable, deterministic, free of closures and of anything specific
+ * to a language or a host. A conforming runtime in another language executing the same
+ * serialized IR must reach the same semantic result, which is what the conformance suite
+ * exists to check.
+ */
+export interface ServerIR {
+    contract: ServerIRContract;
+    id: string;
+    name: string;
+    version: string;
+    entities: EntityDef[];
+    /** Field lookup, pre-indexed so a runtime re-derives nothing. */
+    fields: Record<FieldId, FieldIndexEntry>;
+    /** Authoritative state, plus whatever authoritative execution reads. */
+    states: StateDef[];
+    /** Only the actions this authority executes, fully specified. */
+    actions: Record<NodeId, ActionDef>;
+    constraints: ConstraintDef[];
+    transitionConstraints: TransitionConstraintDef[];
+    /**
+     * The entity whose fields an authorization expression reads through `PRINCIPAL`. Absent
+     * when the application declares no authorization.
+     */
+    principalEntityId?: NodeId;
+    /** The states a client is permitted to observe, in declaration order. */
+    observableStateIds: NodeId[];
+}
+//# sourceMappingURL=server-ir.d.ts.map

package/dist/server-ir.js

@@ -0,0 +1,5 @@
+/**
+ * The contract version a Server IR conforms to. A runtime that does not recognize the
+ * value MUST refuse the IR rather than interpret it partially.
+ */
+export const SERVER_IR_CONTRACT = 'axiom.server.v1';

package/dist/types.d.ts

@@ -20,6 +20,11 @@ export interface ApplicationGraphData {
     edges: Record<string, GraphEdge>;
     /** Visual identity. Presentation only: a theme can never change behaviour. */
     theme?: ThemeInput;
+    /**
+     * The entity whose fields an authorization expression reads through `PRINCIPAL`. It
+     * describes a caller, and is never stored as application state.
+     */
+    principalEntityId?: NodeId;
     metadata?: Record<string, unknown>;
 }
 //# sourceMappingURL=types.d.ts.map

package/dist/ui.d.ts

@@ -198,6 +198,18 @@ export declare function isUINode(node: {
  * content that never appears at the same time.
  */
 export declare function primaryChildIds(node: UINode): NodeId[];
+/**
+ * The action a form submits, however it was declared.
+ *
+ * A form may name the action directly (`submitActionId`) or name a declared button that
+ * invokes it (`submitButtonId`). Every layer — execution, validation, presentation
+ * inference, `AgentAPI` — must resolve it the same way, or a form's primary action means
+ * one thing to the renderer and another to an agent.
+ */
+export declare function formSubmitActionId(form: FormNode, lookup: (id: NodeId) => {
+    kind: string;
+    actionId?: NodeId;
+} | undefined): NodeId | undefined;
 /** Child ids declared by a UI node, in render order. */
 export declare function uiChildIds(node: UINode): NodeId[];
 //# sourceMappingURL=ui.d.ts.map

package/dist/ui.js

@@ -32,6 +32,24 @@ export function primaryChildIds(node) {
             return uiChildIds(node);
     }
 }
+/**
+ * The action a form submits, however it was declared.
+ *
+ * A form may name the action directly (`submitActionId`) or name a declared button that
+ * invokes it (`submitButtonId`). Every layer — execution, validation, presentation
+ * inference, `AgentAPI` — must resolve it the same way, or a form's primary action means
+ * one thing to the renderer and another to an agent.
+ */
+export function formSubmitActionId(form, lookup) {
+    if (form.submitActionId) {
+        return form.submitActionId;
+    }
+    if (!form.submitButtonId) {
+        return undefined;
+    }
+    const button = lookup(form.submitButtonId);
+    return button?.kind === 'button' ? button.actionId : undefined;
+}
 /** Child ids declared by a UI node, in render order. */
 export function uiChildIds(node) {
     switch (node.kind) {

package/dist/validate-authority.d.ts

@@ -0,0 +1,16 @@
+import type { ValidationIssue } from './diagnostics.js';
+import type { NodeId } from './ids.js';
+import type { AnyNode } from './types.js';
+/**
+ * Validation of the authority boundary.
+ *
+ * These are errors, not advice. A graph in which a client could commit server-authoritative
+ * state, or in which an authority would have to read state it does not own, cannot execute
+ * correctly — and the point of the boundary is that its correctness does not depend on an
+ * author remembering where to bind an input.
+ */
+export declare function validateAuthority(nodes: readonly AnyNode[], principalEntityId: NodeId | undefined): {
+    errors: ValidationIssue[];
+    warnings: ValidationIssue[];
+};
+//# sourceMappingURL=validate-authority.d.ts.map

package/dist/validate-authority.js

@@ -0,0 +1,192 @@
+import { PRINCIPAL, actionAuthority, authorityContext, stateAuthority, statesReadByAction } from './authority.js';
+import { referencedIds } from './derive-edges.js';
+import { VALIDATION_CODES } from './diagnostics.js';
+import { locationRootStateId } from './location.js';
+import { isUINode } from './ui.js';
+/**
+ * Validation of the authority boundary.
+ *
+ * These are errors, not advice. A graph in which a client could commit server-authoritative
+ * state, or in which an authority would have to read state it does not own, cannot execute
+ * correctly — and the point of the boundary is that its correctness does not depend on an
+ * author remembering where to bind an input.
+ */
+export function validateAuthority(nodes, principalEntityId) {
+    const errors = [];
+    const warnings = [];
+    const context = authorityContext(nodes, principalEntityId);
+    const entities = new Set(nodes.filter((node) => node.kind === 'entity').map((node) => node.id));
+    const hasServerState = [...context.states.values()].some((state) => stateAuthority(state) === 'server');
+    const authorizedActions = [...context.actions.values()].filter((action) => action.authorization);
+    if (principalEntityId !== undefined && !entities.has(principalEntityId)) {
+        errors.push({
+            code: VALIDATION_CODES.invalidPrincipalEntity,
+            message: `The principal entity ${principalEntityId} is not an entity`,
+            details: { principalEntityId },
+        });
+    }
+    for (const action of authorizedActions) {
+        if (principalEntityId === undefined) {
+            errors.push({
+                code: VALIDATION_CODES.authorizationWithoutPrincipal,
+                message: `${action.name ?? action.id} declares authorization, but the graph declares no principal entity to read the caller through`,
+                nodeId: action.id,
+            });
+        }
+    }
+    // A client write can never reach server-authoritative state. An input binding is the one
+    // path that would otherwise slip through, because it looks like presentation.
+    for (const node of nodes) {
+        if (!isUINode(node) || node.kind !== 'input') {
+            continue;
+        }
+        const rootStateId = locationRootStateId(node.binding.location);
+        const state = context.states.get(rootStateId);
+        if (state && stateAuthority(state) === 'server') {
+            errors.push({
+                code: VALIDATION_CODES.clientWriteToServerState,
+                message: `Input ${node.name ?? node.id} writes ${rootStateId}, which is server-authoritative; bind it to a draft and commit through an action instead`,
+                nodeId: node.id,
+                details: { stateId: rootStateId },
+            });
+        }
+        if (state?.serverOnly) {
+            errors.push({
+                code: VALIDATION_CODES.serverOnlyStateObserved,
+                message: `Input ${node.name ?? node.id} reads ${rootStateId}, which the client may not observe`,
+                nodeId: node.id,
+                details: { stateId: rootStateId },
+            });
+        }
+    }
+    // A server action cannot read state the authority does not own. A draft on the client is
+    // exactly the case: it must arrive as an argument, not be read across the boundary.
+    for (const action of context.actions.values()) {
+        if (actionAuthority(action, context) !== 'server') {
+            continue;
+        }
+        for (const stateId of statesReadByAction(action, context)) {
+            const state = context.states.get(stateId);
+            if (state && stateAuthority(state) === 'client') {
+                errors.push({
+                    code: VALIDATION_CODES.serverDependsOnClientState,
+                    message: `${action.name ?? action.id} executes on the authority but reads ${stateId}, which is client-authoritative; pass the value as an action parameter instead`,
+                    nodeId: action.id,
+                    details: { stateId, authority: 'server' },
+                });
+            }
+        }
+    }
+    // Server-authoritative state may not derive from client state either: the authority
+    // would have nothing to compute it from.
+    for (const state of context.states.values()) {
+        if (stateAuthority(state) !== 'server' || !state.derivation) {
+            continue;
+        }
+        for (const id of referencedIds(state.derivation)) {
+            const source = context.states.get(id);
+            if (source && stateAuthority(source) === 'client') {
+                errors.push({
+                    code: VALIDATION_CODES.serverDependsOnClientState,
+                    message: `${state.name ?? state.id} is server-authoritative but derives from ${id}, which is client-authoritative`,
+                    nodeId: state.id,
+                    details: { stateId: id },
+                });
+            }
+        }
+    }
+    // The client may not observe server-only state, however indirectly.
+    for (const state of context.states.values()) {
+        if (!state.derivation || stateAuthority(state) === 'server') {
+            continue;
+        }
+        for (const id of referencedIds(state.derivation)) {
+            if (context.states.get(id)?.serverOnly) {
+                errors.push({
+                    code: VALIDATION_CODES.serverOnlyStateObserved,
+                    message: `${state.name ?? state.id} is observable by the client but derives from ${id}, which is server-only`,
+                    nodeId: state.id,
+                    details: { stateId: id },
+                });
+            }
+        }
+    }
+    for (const node of nodes) {
+        if (!isUINode(node)) {
+            continue;
+        }
+        const expressions = [
+            ...(node.visibleWhen ? [node.visibleWhen] : []),
+            ...(node.kind === 'text' && typeof node.value !== 'string' ? [node.value] : []),
+            ...(node.kind === 'repeat' ? [node.source] : []),
+            ...(node.kind === 'field-display' ? [node.source] : []),
+            ...(node.kind === 'form' ? [node.target] : []),
+            ...(node.kind === 'conditional' ? [node.condition] : []),
+        ];
+        for (const expression of expressions) {
+            for (const id of referencedIds(expression)) {
+                if (context.states.get(id)?.serverOnly) {
+                    errors.push({
+                        code: VALIDATION_CODES.serverOnlyStateObserved,
+                        message: `${node.name ?? node.id} reads ${id}, which the client may not observe`,
+                        nodeId: node.id,
+                        details: { stateId: id },
+                    });
+                }
+            }
+        }
+    }
+    // The principal exists only where an authority evaluates. Reading it anywhere a client
+    // evaluates would be a rule the client could simply not apply.
+    reportPrincipalOnClient(nodes, context, errors);
+    if (hasServerState && authorizedActions.length === 0) {
+        warnings.push({
+            code: VALIDATION_CODES.authorizationWithoutPrincipal,
+            message: 'This application has server-authoritative state but no action declares authorization, so every caller may invoke every action',
+            details: { serverActions: [...context.actions.values()].filter((a) => actionAuthority(a, context) === 'server').length },
+        });
+    }
+    return { errors, warnings };
+}
+/** `PRINCIPAL` is bound only by an authority; anywhere else it cannot resolve. */
+function reportPrincipalOnClient(nodes, context, errors) {
+    const report = (nodeId, where) => {
+        errors.push({
+            code: VALIDATION_CODES.principalReferenceOnClient,
+            message: `${where} reads the caller through PRINCIPAL, which only an authority binds`,
+            nodeId,
+            details: { scope: PRINCIPAL },
+        });
+    };
+    for (const state of context.states.values()) {
+        if (state.derivation && referencedIds(state.derivation).includes(PRINCIPAL)) {
+            report(state.id, `Derived state ${state.name ?? state.id}`);
+        }
+    }
+    for (const node of nodes) {
+        if (!isUINode(node)) {
+            continue;
+        }
+        const expressions = [
+            ...(node.visibleWhen ? [node.visibleWhen] : []),
+            ...(node.kind === 'text' && typeof node.value !== 'string' ? [node.value] : []),
+            ...(node.kind === 'repeat' ? [node.source] : []),
+            ...(node.kind === 'conditional' ? [node.condition] : []),
+        ];
+        if (expressions.some((expression) => referencedIds(expression).includes(PRINCIPAL))) {
+            report(node.id, `${node.kind} ${node.name ?? node.id}`);
+        }
+    }
+    // An action that only the client executes cannot check an authorization rule either.
+    for (const action of context.actions.values()) {
+        if (!action.authorization || actionAuthority(action, context) === 'server') {
+            continue;
+        }
+        errors.push({
+            code: VALIDATION_CODES.principalReferenceOnClient,
+            message: `${action.name ?? action.id} declares authorization but writes no server-authoritative state, so nothing authoritative would ever evaluate it`,
+            nodeId: action.id,
+            details: { scope: PRINCIPAL },
+        });
+    }
+}

package/dist/validate-presentation.js

@@ -2,7 +2,7 @@ import { VALIDATION_CODES } from './diagnostics.js';
 import { ACTION_UX_ROLES, ALIGNMENTS, BOUNDED_SIZES, CONTROL_VARIANTS, DENSITIES, DEVICE_CLASSES, EMPHASIS_LEVELS, ICON_NAMES, JUSTIFICATIONS, LAYOUT_KINDS, PRESENTATION_ROLES, SIZING_VALUES, SPACING_TOKENS, SURFACE_ROLES, TEXT_ROLES, TREATMENTS, HEADING_LEVELS, UX_ROLES, VALUE_FORMAT_KINDS, } from './presentation.js';
 import { isDestructiveAction } from './resolve-presentation.js';
 import { APPEARANCES, RADIUS_TOKENS, SEMANTIC_COLOR_ROLES } from './theme.js';
-import { isUINode, primaryChildIds, uiChildIds } from './ui.js';
+import { formSubmitActionId, isUINode, primaryChildIds, uiChildIds } from './ui.js';
 /** More than this many controls side by side stops being a group and becomes a wall. */
 const HORIZONTAL_ACTION_LIMIT = 5;
 /** Below this a non-wrapping row is not yet a responsive problem. */
@@ -666,8 +666,11 @@ function checkPrimaryActions(bag, index, resolved) {
             continue;
         }
         const primary = new Set();
-        if (isForm && node.kind === 'form' && node.submitActionId) {
-            primary.add(node.submitActionId);
+        if (isForm && node.kind === 'form') {
+            const submitActionId = formSubmitActionId(node, (id) => index.nodes.get(id));
+            if (submitActionId) {
+                primary.add(submitActionId);
+            }
         }
         for (const child of descendants(index, node.id)) {
             if (child.kind === 'button' && resolved[child.id]?.uxRole === 'primary-action') {

package/dist/validate-value.d.ts

@@ -0,0 +1,24 @@
+import type { ValidationIssue } from './diagnostics.js';
+import type { NodeId } from './ids.js';
+import type { EntityDef } from './nodes.js';
+import type { TypeRef } from './type-ref.js';
+/**
+ * Checks a value against a declared `TypeRef`, recursively.
+ *
+ * One implementation serves two purposes that must not drift apart: seed data checked at
+ * authoring time, and **untrusted input checked at the authority boundary**. Network data
+ * is untyped, and TypeScript proves nothing about it, so the same walk that catches a
+ * mistyped `initialValue` is what rejects a hostile argument.
+ *
+ * Entity records are keyed by `FieldId`. A record keyed by field *name* is reported as
+ * unknown fields plus missing required ones, rather than surfacing later as absent data.
+ */
+export interface ValueCheckOptions {
+    /** Where in the value the walk currently is, for diagnostics. */
+    path: string;
+    getEntity(id: NodeId): EntityDef | undefined;
+    /** When true, a missing required field is allowed — a draft is incomplete by definition. */
+    allowIncomplete?: boolean;
+}
+export declare function validateValueAgainstType(value: unknown, type: TypeRef, options: ValueCheckOptions): ValidationIssue[];
+//# sourceMappingURL=validate-value.d.ts.map

package/dist/validate-value.js

@@ -0,0 +1,100 @@
+import { VALIDATION_CODES } from './diagnostics.js';
+function describeType(type) {
+    switch (type.kind) {
+        case 'primitive':
+            return type.primitive;
+        case 'entity':
+            return `a ${type.entityId} record`;
+        case 'collection':
+            return `a collection of ${describeType(type.itemType)}`;
+        case 'optional':
+            return `${describeType(type.valueType)} or nothing`;
+        case 'enum':
+            return `one of ${type.values.join(', ')}`;
+        default:
+            return 'an unknown type';
+    }
+}
+function describeActual(value) {
+    return value === null ? 'null' : Array.isArray(value) ? 'a collection' : typeof value;
+}
+export function validateValueAgainstType(value, type, options) {
+    const problems = [];
+    const { path } = options;
+    const report = (code, message, extra = {}) => {
+        problems.push({ code, message, path, ...extra });
+    };
+    if (type.kind === 'optional') {
+        if (value === null || value === undefined) {
+            return problems;
+        }
+        return validateValueAgainstType(value, type.valueType, options);
+    }
+    if (value === undefined || value === null) {
+        report(VALIDATION_CODES.initialValueTypeMismatch, `${path} is ${value === undefined ? 'missing' : 'null'} but is declared as ${describeType(type)}`, { details: { expected: describeType(type), actual: describeActual(value) } });
+        return problems;
+    }
+    switch (type.kind) {
+        case 'primitive': {
+            const expected = type.primitive === 'number' ? 'number' : type.primitive === 'boolean' ? 'boolean' : 'string';
+            if (typeof value !== expected) {
+                report(VALIDATION_CODES.initialValueTypeMismatch, `${path} should be a ${type.primitive} but is ${describeActual(value)}`, { details: { expected: type.primitive, actual: describeActual(value), value } });
+                return problems;
+            }
+            // `NaN` and the infinities are numbers to JavaScript and nothing to a domain model.
+            if (type.primitive === 'number' && !Number.isFinite(value)) {
+                report(VALIDATION_CODES.initialValueTypeMismatch, `${path} should be a finite number but is ${String(value)}`, { details: { expected: 'a finite number', value: String(value) } });
+            }
+            return problems;
+        }
+        case 'enum': {
+            if (typeof value !== 'string' || !type.values.includes(value)) {
+                report(VALIDATION_CODES.initialValueTypeMismatch, `${path} should be one of ${type.values.join(', ')} but is ${JSON.stringify(value)}`, { details: { expected: type.values, value } });
+            }
+            return problems;
+        }
+        case 'collection': {
+            if (!Array.isArray(value)) {
+                report(VALIDATION_CODES.initialValueTypeMismatch, `${path} should be a collection but is ${describeActual(value)}`, { details: { expected: describeType(type), actual: describeActual(value) } });
+                return problems;
+            }
+            value.forEach((item, index) => {
+                problems.push(...validateValueAgainstType(item, type.itemType, { ...options, path: `${path}[${index}]` }));
+            });
+            return problems;
+        }
+        case 'entity': {
+            const entity = options.getEntity(type.entityId);
+            if (!entity) {
+                return problems;
+            }
+            if (typeof value !== 'object' || Array.isArray(value)) {
+                report(VALIDATION_CODES.initialValueInvalidEntity, `${path} should be a ${entity.name ?? entity.id} record but is ${describeActual(value)}`, { details: { entityId: entity.id, actual: describeActual(value) } });
+                return problems;
+            }
+            const record = value;
+            const declared = new Map(entity.fields.map((field) => [String(field.id), field]));
+            for (const key of Object.keys(record)) {
+                if (!declared.has(key)) {
+                    report(VALIDATION_CODES.initialValueUnknownField, `${path}.${key} is not a field of ${entity.name ?? entity.id}. Records are keyed by field id, not by field name.`, { details: { entityId: entity.id, key, expected: [...declared.keys()] } });
+                }
+            }
+            for (const field of entity.fields) {
+                const present = Object.prototype.hasOwnProperty.call(record, String(field.id));
+                if (!present) {
+                    if (field.required && field.valueType.kind !== 'optional' && !options.allowIncomplete) {
+                        report(VALIDATION_CODES.initialValueMissingRequiredField, `${path} is missing required field ${field.name ?? field.id}`, { fieldId: field.id, details: { entityId: entity.id, fieldId: field.id } });
+                    }
+                    continue;
+                }
+                problems.push(...validateValueAgainstType(record[String(field.id)], field.valueType, {
+                    ...options,
+                    path: `${path}.${field.id}`,
+                }));
+            }
+            return problems;
+        }
+        default:
+            return problems;
+    }
+}

package/dist/validate.js

@@ -9,6 +9,9 @@ import { locationExpressions } from './location.js';
 import { validateLocation } from './validate-location.js';
 import { resolvePresentationMap } from './resolve-presentation.js';
 import { validatePresentation } from './validate-presentation.js';
+import { validateAuthority } from './validate-authority.js';
+import { validateValueAgainstType } from './validate-value.js';
+import { PRINCIPAL } from './authority.js';
 /**
  * Verifies referential integrity of an application graph. An invalid graph must never
  * be executed, so every reference — nodes, fields, edges, expressions, UI children —
@@ -35,7 +38,9 @@ export function validateGraph(graph) {
         }
         nodes.set(node.id, node);
     }
-    // Only these ids can be resolved by a `ref` expression at runtime.
+    // Only these ids can be resolved by a `ref` expression at runtime. The principal is
+    // bound by an authority; `validateAuthority` rejects reading it anywhere else.
+    context.scopes.add(PRINCIPAL);
     for (const node of nodes.values()) {
         if (node.kind === 'state' || node.kind === 'entity' || node.kind === 'repeat') {
             context.scopes.add(node.id);
@@ -83,6 +88,11 @@ export function validateGraph(graph) {
     const presentation = validatePresentation(allNodes, graph.declaredTheme, resolvePresentationMap(allNodes, graph.theme));
     errors.push(...presentation.errors);
     warnings.push(...presentation.warnings);
+    // The authority boundary. A graph that could let a client commit server state, or that
+    // would make an authority read state it does not own, cannot execute safely.
+    const authority = validateAuthority(allNodes, graph.principalEntityId);
+    errors.push(...authority.errors);
+    warnings.push(...authority.warnings);
     return { valid: errors.length === 0, errors, warnings };
 }
 function validateNode(node, context) {
@@ -160,78 +170,19 @@ function validateState(state, context) {
  * than one that surfaces later as a mysteriously empty UI.
  */
 function validateValue(value, type, path, state, context) {
-    const report = (code, message, extra = {}) => {
-        context.errors.push({ code, message, nodeId: state.id, path, ...extra });
-    };
-    const actual = (candidate) => candidate === null ? 'null' : Array.isArray(candidate) ? 'a collection' : typeof candidate;
-    if (type.kind === 'optional') {
-        if (value === null || value === undefined) {
-            return;
-        }
-        validateValue(value, type.valueType, path, state, context);
-        return;
-    }
-    if (value === undefined || value === null) {
-        report(VALIDATION_CODES.initialValueTypeMismatch, `${path} is ${value === undefined ? 'missing' : 'null'} but is declared as ${describeType(type)}`, { details: { expected: describeType(type), actual: actual(value) } });
-        return;
-    }
-    switch (type.kind) {
-        case 'primitive': {
-            const expected = type.primitive === 'number' ? 'number' : type.primitive === 'boolean' ? 'boolean' : 'string';
-            if (typeof value !== expected) {
-                report(VALIDATION_CODES.initialValueTypeMismatch, `${path} should be a ${type.primitive} but is ${actual(value)}`, { details: { expected: type.primitive, actual: actual(value), value } });
-            }
-            return;
-        }
-        case 'enum': {
-            if (typeof value !== 'string' || !type.values.includes(value)) {
-                report(VALIDATION_CODES.initialValueTypeMismatch, `${path} should be one of ${type.values.join(', ')} but is ${JSON.stringify(value)}`, { details: { expected: type.values, value } });
-            }
-            return;
-        }
-        case 'collection': {
-            if (!Array.isArray(value)) {
-                report(VALIDATION_CODES.initialValueTypeMismatch, `${path} should be a collection but is ${actual(value)}`, { details: { expected: describeType(type), actual: actual(value) } });
-                return;
-            }
-            value.forEach((item, index) => {
-                validateValue(item, type.itemType, `${path}[${index}]`, state, context);
-            });
-            return;
-        }
-        case 'entity': {
-            const entity = context.semantics.getEntity(type.entityId);
-            if (!entity) {
-                return;
-            }
-            if (typeof value !== 'object' || Array.isArray(value)) {
-                report(VALIDATION_CODES.initialValueInvalidEntity, `${path} should be a ${entity.name ?? entity.id} record but is ${actual(value)}`, { details: { entityId: entity.id, actual: actual(value) } });
-                return;
-            }
-            const record = value;
-            const declared = new Map(entity.fields.map((field) => [String(field.id), field]));
-            for (const key of Object.keys(record)) {
-                if (!declared.has(key)) {
-                    report(VALIDATION_CODES.initialValueUnknownField, `${path}.${key} is not a field of ${entity.name ?? entity.id}. Records are keyed by field id, not by field name.`, { details: { entityId: entity.id, key, expected: [...declared.keys()] } });
-                }
-            }
-            for (const field of entity.fields) {
-                const present = Object.prototype.hasOwnProperty.call(record, String(field.id));
-                if (!present) {
-                    // A draft holds work in progress, so it is allowed to be incomplete.
-                    if (field.required && field.valueType.kind !== 'optional' && !state.draft) {
-                        report(VALIDATION_CODES.initialValueMissingRequiredField, `${path} is missing required field ${field.name ?? field.id}`, { fieldId: field.id, details: { entityId: entity.id, fieldId: field.id } });
-                    }
-                    continue;
-                }
-                validateValue(record[String(field.id)], field.valueType, `${path}.${field.id}`, state, context);
-            }
-            return;
-        }
-        default:
+    const problems = validateValueAgainstType(value, type, {
+        path,
+        getEntity: (id) => context.semantics.getEntity(id),
+        allowIncomplete: state.draft === true,
+    });
+    for (const problem of problems) {
+        context.errors.push({ ...problem, nodeId: state.id });
     }
 }
 function validateAction(action, context) {
+    if (action.authorization) {
+        validateExpression(action.authorization, action.id, context, new Set());
+    }
     const local = emptyScope(new Set((action.parameters ?? []).map((parameter) => parameter.id)));
     for (const parameter of action.parameters ?? []) {
         if (parameter.valueType) {
@@ -498,6 +449,13 @@ function validateUiNode(node, context) {
             if (node.submitActionId) {
                 requireKind(node.submitActionId, 'action', node.id, context, VALIDATION_CODES.invalidActionRef);
             }
+            if (!node.submitButtonId && node.submitActionId) {
+                // A generated submit button carries no arguments, so an action needing any of them
+                // could never be satisfied. Silent omission is what produced ARGUMENT_TYPE_MISMATCH
+                // at run time; it is rejected here instead.
+                requireArguments(node.submitActionId, {}, node.id, context, `Form ${node.id} submits ${node.submitActionId}, whose generated button cannot supply arguments;` +
+                    ' declare a submit button with submitButtonId and give it');
+            }
             if (node.submitButtonId) {
                 const button = context.nodes.get(node.submitButtonId);
                 if (button?.kind !== 'button') {
@@ -546,6 +504,7 @@ function validateUiNode(node, context) {
             return;
         case 'button': {
             requireKind(node.actionId, 'action', node.id, context, VALIDATION_CODES.invalidActionRef);
+            requireArguments(node.actionId, node.arguments ?? {}, node.id, context, `Button ${node.id}`);
             if (typeof node.label !== 'string') {
                 validateExpression(node.label, node.id, context, new Set());
             }
@@ -571,6 +530,28 @@ function validateUiNode(node, context) {
         default:
     }
 }
+/**
+ * Every required parameter of an action must have an argument. A missing one is statically
+ * knowable, and would otherwise surface as a refusal at invocation time — on the authority,
+ * for a remote action.
+ */
+function requireArguments(actionId, args, ownerId, context, where) {
+    const action = context.nodes.get(actionId);
+    if (action?.kind !== 'action') {
+        return;
+    }
+    const missing = (action.parameters ?? [])
+        .filter((parameter) => parameter.required && !(String(parameter.id) in args))
+        .map((parameter) => String(parameter.id));
+    if (missing.length > 0) {
+        context.errors.push({
+            code: VALIDATION_CODES.missingActionArgument,
+            message: `${where} ${missing.length === 1 ? 'no argument for' : 'no arguments for'} ${missing.join(', ')}`,
+            nodeId: ownerId,
+            details: { actionId, missing },
+        });
+    }
+}
 /** Every UI node beneath this one, for checks that must know what a subtree contains. */
 function uiDescendants(id, context) {
     const found = new Set();

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@cynodia/axiom-core",
-  "version": "0.5.2-alpha.1",
+  "version": "0.6.1-alpha.1",
   "description": "Application Graph, semantic types, locations and validation for Axiom.",
   "license": "MIT",
   "author": "AskTech AS",