@cynodia/axiom-runtime 0.6.1-alpha.1 → 0.6.2-alpha.1

package/dist/runtime-types.d.ts

@@ -6,14 +6,52 @@
  * stripped from that bundle. Keeping these local also means the gateway pulls in nothing
  * else at all.
  */
+/**
+ * Structurally identical to `NodeId` in `@cynodia/axiom-core`, and it must stay that way:
+ * the brand exists only at compile time, so declaring the same shape here makes the two the
+ * same type without an import the browser bundle cannot carry.
+ * `packages/runtime/test/host.test.ts` fails if the two declarations drift apart.
+ */
 export type NodeId = string & {
-    readonly __brand?: 'NodeId';
+    readonly __brand: 'NodeId';
 };
 export interface RuntimeDiagnostic {
+    /**
+     * A code from `RUNTIME_DIAGNOSTIC_CODES` or `SERVER_DIAGNOSTIC_CODES`, but typed as a
+     * string here on purpose: a diagnostic arriving over the wire is untrusted input, and a
+     * gateway cannot promise it is one of ours. Match on it; do not switch exhaustively.
+     */
     code: string;
     message: string;
     severity: 'error' | 'warning';
     details?: Record<string, unknown>;
-    [key: string]: unknown;
+    nodeId?: NodeId;
+    actionId?: NodeId;
+    constraintId?: NodeId;
+    stateId?: NodeId;
+    transactionId?: string;
+}
+/**
+ * How a client runtime reaches an authority.
+ *
+ * It lives here, beside the browser-safe gateway, rather than in `runtime.ts`, so that the
+ * gateway a page is given and the gateway the runtime accepts are the **same type**. When
+ * they were declared separately, `createHttpRemoteGateway()` did not typecheck as one and
+ * every consumer needed a cast — for a value the framework hands them itself.
+ */
+export interface RemoteGateway {
+    invoke(request: {
+        actionId: NodeId;
+        arguments: Record<string, unknown>;
+        requestId: string;
+    }): Promise<{
+        ok: boolean;
+        diagnostics: RuntimeDiagnostic[];
+        changes: Record<NodeId, unknown>;
+    }>;
+    /** The authoritative values of every observable state. */
+    snapshot?(): Promise<{
+        states: Record<NodeId, unknown>;
+    }>;
 }
 //# sourceMappingURL=runtime-types.d.ts.map

package/dist/runtime.d.ts

@@ -1,3 +1,4 @@
+import type { RemoteGateway } from './runtime-types.js';
 import type { ApplicationIR, CompiledRoute, Expression, FieldId, Location, NodeId } from '@cynodia/axiom-core';
 import type { DomElement, HostEnvironment } from './dom.js';
 import type { MutationLogEntry } from './mutation/mutation-engine.js';
@@ -72,21 +73,7 @@ export interface ActionResult {
  * is dispatched and answered later, so `invokeAction` returns `pending` and the outcome
  * arrives through the same diagnostic lifecycle a local refusal uses.
  */
-export interface RemoteGateway {
-    invoke(request: {
-        actionId: NodeId;
-        arguments: Record<string, unknown>;
-        requestId: string;
-    }): Promise<{
-        ok: boolean;
-        diagnostics: RuntimeDiagnostic[];
-        changes: Record<NodeId, unknown>;
-    }>;
-    /** The authoritative values of every observable state. */
-    snapshot?(): Promise<{
-        states: Record<NodeId, unknown>;
-    }>;
-}
+export type { RemoteGateway } from './runtime-types.js';
 /**
  * The outcome of an action's most recent invocation.
  *

package/dist/runtime.js

@@ -1045,10 +1045,14 @@ export function createAxiomRuntime(options) {
             .invoke({ actionId: action.id, arguments: args, requestId })
             .then((answer) => {
             applyAuthoritative(answer.changes ?? {});
-            answer.diagnostics.forEach(report);
-            recordOutcome(action.id, answer.ok ? 'ok' : 'failed', answer.ok ? [] : answer.diagnostics);
+            // A diagnostic from an authority is untrusted input: its `code` is a string until it
+            // matches something we know. It is carried through unchanged, because a client that
+            // rewrote a refusal would be inventing one.
+            const reported = answer.diagnostics;
+            reported.forEach(report);
+            recordOutcome(action.id, answer.ok ? 'ok' : 'failed', answer.ok ? [] : reported);
             renderApplication();
-            return { ok: answer.ok, diagnostics: answer.diagnostics };
+            return { ok: answer.ok, diagnostics: reported };
         })
             .catch((error) => {
             // A transport failure becomes a structured diagnostic, not an escaping exception.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@cynodia/axiom-runtime",
-  "version": "0.6.1-alpha.1",
+  "version": "0.6.2-alpha.1",
   "description": "Domain-independent runtime that executes an Axiom application graph.",
   "license": "MIT",
   "author": "AskTech AS",
@@ -31,7 +31,7 @@
     }
   },
   "dependencies": {
-    "@cynodia/axiom-core": "0.6.1-alpha.1"
+    "@cynodia/axiom-core": "0.6.2-alpha.1"
   },
   "scripts": {
     "build": "tsc -b tsconfig.json tsconfig.test.json",