@githolon/runtime 0.110.0

package/src/protocol/nomos/runtime/v2/sealing_desk_pb.js

@@ -0,0 +1,149 @@
+// @generated by protoc-gen-es v2.13.0 with parameter "target=js+dts,import_extension=js"
+// @generated from file nomos/runtime/v2/sealing_desk.proto (package nomos.runtime.v2, syntax proto3)
+/* eslint-disable */
+
+import { enumDesc, fileDesc, messageDesc, tsEnum } from "@bufbuild/protobuf/codegenv2";
+
+/**
+ * Describes the file nomos/runtime/v2/sealing_desk.proto.
+ */
+export const file_nomos_runtime_v2_sealing_desk = /*@__PURE__*/
+  fileDesc("CiNub21vcy9ydW50aW1lL3YyL3NlYWxpbmdfZGVzay5wcm90bxIQbm9tb3MucnVudGltZS52MiKAAQoQU2VhbEZpZWxkUmVxdWVzdBIRCglzY29wZV9rZXkYASABKAwSDQoFc2NvcGUYAiABKAkSDQoFZXBvY2gYAyABKAQSFQoNYWdncmVnYXRlX3NpZBgEIAEoCRIRCglmaWVsZF9zaWQYBSABKAkSEQoJcGxhaW50ZXh0GAYgASgJIiMKD1NlYWxGaWVsZFJlc3VsdBIQCghlbnZlbG9wZRgBIAEoCSIqCg5Pd25lZFJlY29yZFJlZhIMCgR0eXBlGAEgASgJEgoKAmlkGAIgASgJImcKFE93bmVkU2NvcGVLZXlSZXF1ZXN0Eg0KBXNjb3BlGAEgASgJEjUKBnJlY29yZBgCIAEoCzIgLm5vbW9zLnJ1bnRpbWUudjIuT3duZWRSZWNvcmRSZWZIAIgBAUIJCgdfcmVjb3JkIlgKFU93bmVkU2NvcGVLZXlzUmVxdWVzdBINCgVzY29wZRgBIAEoCRIwCgZyZWNvcmQYAiABKAsyIC5ub21vcy5ydW50aW1lLnYyLk93bmVkUmVjb3JkUmVmIsQCCg1Pd25lZFNjb3BlS2V5Eg0KBXNjb3BlGAEgASgJEg0KBWVwb2NoGAIgASgEEgsKA2tleRgDIAEoDBIeChFvd25lZF9rZXlfc3ViamVjdBgEIAEoCUgAiAEBEh8KEm93bmVkX2N1c3RvZHlfdXNkYRgFIAEoDEgBiAEBEhYKCXdvcmtzcGFjZRgGIAEoCUgCiAEBEhsKDmtleV9jb21taXRtZW50GAcgASgJSAOIAQESJgoZcHJpbmNpcGFsX3dyYXBwaW5nX3B1YmxpYxgIIAEoCUgEiAEBQhQKEl9vd25lZF9rZXlfc3ViamVjdEIVChNfb3duZWRfY3VzdG9keV91c2RhQgwKCl93b3Jrc3BhY2VCEQoPX2tleV9jb21taXRtZW50QhwKGl9wcmluY2lwYWxfd3JhcHBpbmdfcHVibGljIkIKEU93bmVkU2NvcGVLZXlMaXN0Ei0KBGtleXMYASADKAsyHy5ub21vcy5ydW50aW1lLnYyLk93bmVkU2NvcGVLZXkiaQoaRW5zdXJlT3duZWRJZGVudGl0eVJlcXVlc3QSDQoFc2NvcGUYASABKAkSDgoGZG9tYWluGAIgASgJEhoKDWRvbWFpbl9zaGEyNTYYAyABKAlIAIgBAUIQCg5fZG9tYWluX3NoYTI1NiIWChRPd25lZElkZW50aXR5RW5zdXJlZCJvChtQcm90ZWN0T3duZWRJZGVudGl0eVJlcXVlc3QSDQoFc2NvcGUYASABKAkSDgoGZG9tYWluGAIgASgJEhUKDWRvbWFpbl9zaGEyNTYYAyABKAkSGgoScmVjb3ZlcnlfcHJpbmNpcGFsGAQgASgJIlgKF093bmVkSWRlbnRpdHlQcm90ZWN0aW9uEg4KBnN0YXR1cxgBIAEoCRIaChJyZWNvdmVyeV9wcmluY2lwYWwYAiABKAkSEQoJdW5jaGFuZ2VkGAMgASgIIqUBCh9QcmVwYXJlT3duZWRSZWNvcmRBY3Rpb25SZXF1ZXN0EjMKBmFjdGlvbhgBIAEoDjIjLm5vbW9zLnJ1bnRpbWUudjIuT3duZWRSZWNvcmRBY3Rpb24SDQoFc2NvcGUYAiABKAkSMAoGcmVjb3JkGAMgASgLMiAubm9tb3MucnVudGltZS52Mi5Pd25lZFJlY29yZFJlZhIMCgRwZWVyGAQgASgJIpkBCgxPd25lZEtleVdyYXASGwoTcmVjaXBpZW50X3ByaW5jaXBhbBgBIAEoCRIcChRyZWNpcGllbnRfcHVibGljX2tleRgCIAEoCRIcChRlcGhlbWVyYWxfcHVibGljX2tleRgDIAEoDBISCgpjaXBoZXJ0ZXh0GAQgASgMEhIKBWVwb2NoGAUgASgESACIAQFCCAoGX2Vwb2NoIq0CChZPd25lZFJlY29yZFByZXBhcmF0aW9uEhkKEW93bmVkX2tleV9zdWJqZWN0GAEgASgJEh8KEm93bmVkX2N1c3RvZHlfdXNkYRgCIAEoDEgBiAEBEjgKBXNoYXJlGAogASgLMicubm9tb3MucnVudGltZS52Mi5Pd25lZFNoYXJlUHJlcGFyYXRpb25IABI8Cgd1bnNoYXJlGAsgASgLMikubm9tb3MucnVudGltZS52Mi5Pd25lZFVuc2hhcmVQcmVwYXJhdGlvbkgAEj4KCHRyYW5zZmVyGAwgASgLMioubm9tb3MucnVudGltZS52Mi5Pd25lZFRyYW5zZmVyUHJlcGFyYXRpb25IAEIICgZhY3Rpb25CFQoTX293bmVkX2N1c3RvZHlfdXNkYSKJAQoVT3duZWRTaGFyZVByZXBhcmF0aW9uEhEKCXJlY29yZF9pZBgBIAEoCRIMCgRwZWVyGAIgASgJEg0KBWVwb2NoGAMgASgEEhEKCXNoYXJlZF9hdBgEIAEoCRItCgV3cmFwcxgFIAMoCzIeLm5vbW9zLnJ1bnRpbWUudjIuT3duZWRLZXlXcmFwIowBChdPd25lZFVuc2hhcmVQcmVwYXJhdGlvbhIRCglyZWNvcmRfaWQYASABKAkSDAoEcGVlchgCIAEoCRINCgVlcG9jaBgDIAEoBBISCgpjaGFuZ2VkX2F0GAQgASgJEi0KBXdyYXBzGAUgAygLMh4ubm9tb3MucnVudGltZS52Mi5Pd25lZEtleVdyYXAitQEKGE93bmVkVHJhbnNmZXJQcmVwYXJhdGlvbhIRCglyZWNvcmRfaWQYASABKAkSEQoJbmV3X293bmVyGAIgASgJEhgKEHByZXZpb3VzX3JlYWRlcnMYAyADKAkSDQoFZXBvY2gYBCABKAQSEgoKY2hhbmdlZF9hdBgFIAEoCRI2Cg5oaXN0b3JpY193cmFwcxgGIAMoCzIeLm5vbW9zLnJ1bnRpbWUudjIuT3duZWRLZXlXcmFwInwKGU93bmVkQmlydGhTY29wZUtleVJlcXVlc3QSDQoFc2NvcGUYASABKAkSEQoJbmFtZXNwYWNlGAIgASgJEgsKA2tleRgDIAEoCRIwCgZyZWNvcmQYBCABKAsyIC5ub21vcy5ydW50aW1lLnYyLk93bmVkUmVjb3JkUmVmKpoBChFPd25lZFJlY29yZEFjdGlvbhIjCh9PV05FRF9SRUNPUkRfQUNUSU9OX1VOU1BFQ0lGSUVEEAASHQoZT1dORURfUkVDT1JEX0FDVElPTl9TSEFSRRABEh8KG09XTkVEX1JFQ09SRF9BQ1RJT05fVU5TSEFSRRACEiAKHE9XTkVEX1JFQ09SRF9BQ1RJT05fVFJBTlNGRVIQA2IGcHJvdG8z");
+
+/**
+ * Describes the message nomos.runtime.v2.SealFieldRequest.
+ * Use `create(SealFieldRequestSchema)` to create a new message.
+ */
+export const SealFieldRequestSchema = /*@__PURE__*/
+  messageDesc(file_nomos_runtime_v2_sealing_desk, 0);
+
+/**
+ * Describes the message nomos.runtime.v2.SealFieldResult.
+ * Use `create(SealFieldResultSchema)` to create a new message.
+ */
+export const SealFieldResultSchema = /*@__PURE__*/
+  messageDesc(file_nomos_runtime_v2_sealing_desk, 1);
+
+/**
+ * Describes the message nomos.runtime.v2.OwnedRecordRef.
+ * Use `create(OwnedRecordRefSchema)` to create a new message.
+ */
+export const OwnedRecordRefSchema = /*@__PURE__*/
+  messageDesc(file_nomos_runtime_v2_sealing_desk, 2);
+
+/**
+ * Describes the message nomos.runtime.v2.OwnedScopeKeyRequest.
+ * Use `create(OwnedScopeKeyRequestSchema)` to create a new message.
+ */
+export const OwnedScopeKeyRequestSchema = /*@__PURE__*/
+  messageDesc(file_nomos_runtime_v2_sealing_desk, 3);
+
+/**
+ * Describes the message nomos.runtime.v2.OwnedScopeKeysRequest.
+ * Use `create(OwnedScopeKeysRequestSchema)` to create a new message.
+ */
+export const OwnedScopeKeysRequestSchema = /*@__PURE__*/
+  messageDesc(file_nomos_runtime_v2_sealing_desk, 4);
+
+/**
+ * Describes the message nomos.runtime.v2.OwnedScopeKey.
+ * Use `create(OwnedScopeKeySchema)` to create a new message.
+ */
+export const OwnedScopeKeySchema = /*@__PURE__*/
+  messageDesc(file_nomos_runtime_v2_sealing_desk, 5);
+
+/**
+ * Describes the message nomos.runtime.v2.OwnedScopeKeyList.
+ * Use `create(OwnedScopeKeyListSchema)` to create a new message.
+ */
+export const OwnedScopeKeyListSchema = /*@__PURE__*/
+  messageDesc(file_nomos_runtime_v2_sealing_desk, 6);
+
+/**
+ * Describes the message nomos.runtime.v2.EnsureOwnedIdentityRequest.
+ * Use `create(EnsureOwnedIdentityRequestSchema)` to create a new message.
+ */
+export const EnsureOwnedIdentityRequestSchema = /*@__PURE__*/
+  messageDesc(file_nomos_runtime_v2_sealing_desk, 7);
+
+/**
+ * Describes the message nomos.runtime.v2.OwnedIdentityEnsured.
+ * Use `create(OwnedIdentityEnsuredSchema)` to create a new message.
+ */
+export const OwnedIdentityEnsuredSchema = /*@__PURE__*/
+  messageDesc(file_nomos_runtime_v2_sealing_desk, 8);
+
+/**
+ * Describes the message nomos.runtime.v2.ProtectOwnedIdentityRequest.
+ * Use `create(ProtectOwnedIdentityRequestSchema)` to create a new message.
+ */
+export const ProtectOwnedIdentityRequestSchema = /*@__PURE__*/
+  messageDesc(file_nomos_runtime_v2_sealing_desk, 9);
+
+/**
+ * Describes the message nomos.runtime.v2.OwnedIdentityProtection.
+ * Use `create(OwnedIdentityProtectionSchema)` to create a new message.
+ */
+export const OwnedIdentityProtectionSchema = /*@__PURE__*/
+  messageDesc(file_nomos_runtime_v2_sealing_desk, 10);
+
+/**
+ * Describes the message nomos.runtime.v2.PrepareOwnedRecordActionRequest.
+ * Use `create(PrepareOwnedRecordActionRequestSchema)` to create a new message.
+ */
+export const PrepareOwnedRecordActionRequestSchema = /*@__PURE__*/
+  messageDesc(file_nomos_runtime_v2_sealing_desk, 11);
+
+/**
+ * Describes the message nomos.runtime.v2.OwnedKeyWrap.
+ * Use `create(OwnedKeyWrapSchema)` to create a new message.
+ */
+export const OwnedKeyWrapSchema = /*@__PURE__*/
+  messageDesc(file_nomos_runtime_v2_sealing_desk, 12);
+
+/**
+ * Describes the message nomos.runtime.v2.OwnedRecordPreparation.
+ * Use `create(OwnedRecordPreparationSchema)` to create a new message.
+ */
+export const OwnedRecordPreparationSchema = /*@__PURE__*/
+  messageDesc(file_nomos_runtime_v2_sealing_desk, 13);
+
+/**
+ * Describes the message nomos.runtime.v2.OwnedSharePreparation.
+ * Use `create(OwnedSharePreparationSchema)` to create a new message.
+ */
+export const OwnedSharePreparationSchema = /*@__PURE__*/
+  messageDesc(file_nomos_runtime_v2_sealing_desk, 14);
+
+/**
+ * Describes the message nomos.runtime.v2.OwnedUnsharePreparation.
+ * Use `create(OwnedUnsharePreparationSchema)` to create a new message.
+ */
+export const OwnedUnsharePreparationSchema = /*@__PURE__*/
+  messageDesc(file_nomos_runtime_v2_sealing_desk, 15);
+
+/**
+ * Describes the message nomos.runtime.v2.OwnedTransferPreparation.
+ * Use `create(OwnedTransferPreparationSchema)` to create a new message.
+ */
+export const OwnedTransferPreparationSchema = /*@__PURE__*/
+  messageDesc(file_nomos_runtime_v2_sealing_desk, 16);
+
+/**
+ * Describes the message nomos.runtime.v2.OwnedBirthScopeKeyRequest.
+ * Use `create(OwnedBirthScopeKeyRequestSchema)` to create a new message.
+ */
+export const OwnedBirthScopeKeyRequestSchema = /*@__PURE__*/
+  messageDesc(file_nomos_runtime_v2_sealing_desk, 17);
+
+/**
+ * Describes the enum nomos.runtime.v2.OwnedRecordAction.
+ */
+export const OwnedRecordActionSchema = /*@__PURE__*/
+  enumDesc(file_nomos_runtime_v2_sealing_desk, 0);
+
+/**
+ * @generated from enum nomos.runtime.v2.OwnedRecordAction
+ */
+export const OwnedRecordAction = /*@__PURE__*/
+  tsEnum(OwnedRecordActionSchema);

package/src/remote_reception.public.d.ts

@@ -0,0 +1,97 @@
+export interface RemoteGeneratedCall {
+  readonly domain: string;
+  readonly directive: string;
+  readonly protobufType: string;
+  readonly protobufPayload: Uint8Array;
+  readonly routingCandidates: readonly string[];
+}
+
+export interface RemoteReceptionCredentials {
+  readonly principal: string;
+  readonly authorSecret: Uint8Array;
+  readonly authToken?: Uint8Array;
+}
+
+export interface RemoteReceptionOptions {
+  readonly address: string;
+  readonly fetch?: typeof globalThis.fetch;
+}
+
+export interface RemoteGeneratedRead {
+  readonly query: string;
+  readonly protobufType: string;
+  readonly protobufPayload: Uint8Array;
+}
+
+export interface RemoteQueryResult {
+  readonly protobufType: string;
+  readonly protobufPayload: Uint8Array;
+}
+
+export interface RemoteOfferOptions {
+  readonly domainHash?: string;
+}
+
+export interface RemoteOfferAdmitted {
+  readonly head: string;
+  readonly intentId: string;
+  readonly intentOut?: string;
+}
+
+export interface RemoteBirthCertificate {
+  readonly child: string;
+  readonly founder: string;
+  readonly verified: boolean;
+  readonly parentKey: Uint8Array;
+  readonly parentId: string;
+  readonly epoch: number | bigint;
+  readonly signature: Uint8Array;
+  readonly verifiedVia?: string;
+  readonly idpToken?: string;
+  readonly capturedClock?: number | bigint;
+  readonly authProviderIssuer?: string;
+  readonly authProviderJwks?: string;
+  readonly authProviderAudience?: string;
+}
+
+export interface RemoteSignedBirthCertificate extends Omit<RemoteBirthCertificate, "epoch" | "capturedClock"> {
+  readonly epoch: bigint;
+  readonly capturedClock?: bigint;
+}
+
+/** Stateless typed HTTP correspondence with a remote Nomos Peer Office. */
+export declare class RemoteReception {
+  constructor(options: RemoteReceptionOptions);
+  read(
+    workspace: string,
+    generated: RemoteGeneratedRead,
+    credentials: RemoteReceptionCredentials,
+  ): Promise<RemoteQueryResult>;
+  offer(
+    workspace: string,
+    generated: RemoteGeneratedCall,
+    credentials: RemoteReceptionCredentials,
+    options?: RemoteOfferOptions,
+  ): Promise<RemoteOfferAdmitted>;
+  readById(workspace: string, aggregateType: string, aggregateId: string,
+    credentials: RemoteReceptionCredentials): Promise<Uint8Array>;
+  readByType(workspace: string, aggregateType: string,
+    credentials: RemoteReceptionCredentials): Promise<Uint8Array>;
+  rows(
+    workspace: string,
+    query: string,
+    arguments_: Readonly<Record<string, unknown>>,
+    credentials: RemoteReceptionCredentials,
+  ): Promise<unknown>;
+  byId(
+    workspace: string,
+    aggregateId: string,
+    aggregateType: string,
+    credentials: RemoteReceptionCredentials,
+  ): Promise<unknown>;
+  signBirthCertificate(
+    workspace: string,
+    certificate: RemoteBirthCertificate,
+    signerSecret: Uint8Array,
+  ): Promise<RemoteSignedBirthCertificate>;
+}

package/src/remote_reception.ts

@@ -0,0 +1,446 @@
+import { NomosTypedOfferFailure } from "./admission_decision.ts";
+import { create, fromBinary, toBinary } from "@bufbuild/protobuf";
+import { AnySchema } from "@bufbuild/protobuf/wkt";
+import {
+  AuthoringOptionsSchema,
+  ByIdQuerySchema,
+  ByTypeQuerySchema,
+  BirthCertificateSchema,
+  CallRequestSchema,
+  DirectiveCallSchema,
+  OfferRequestSchema,
+  QueryAuthoritySchema,
+  QueryRequestSchema,
+  QueryResultFormat,
+  RowsQuerySchema,
+  SignBirthCertificateRequestSchema,
+  WorkspaceTargetSchema,
+  type BirthCertificate,
+  type CallRequest,
+  type CallResponse,
+  type OfferAdmitted,
+  type QueryRequest,
+} from "../../../adapter/proto/nomos/kernel/v1/kernel_pb.js";
+import { KernelCallRequestSchema } from "../../../adapter/proto/nomos/runtime/v2/application_desk_pb.js";
+import { CredentialUse } from "../../../adapter/proto/nomos/runtime/v2/credentials_desk_pb.js";
+import {
+  RuntimeRequestSchema,
+  RuntimeResponseSchema,
+} from "../../../adapter/proto/nomos/runtime/v2/runtime_pb.js";
+import { structToProto, valueFromProto } from "../../src/runtime/protobuf_values.ts";
+import type { ReceptionGeneratedCall } from "./application_reception.ts";
+
+const RUNTIME_REQUEST = "application/vnd.nomos.runtime-request+protobuf";
+const RUNTIME_RESPONSE = "application/vnd.nomos.runtime-response+protobuf";
+const RUNTIME_PROTOCOL = 2;
+const KERNEL_PROTOCOL = 1;
+
+export interface RemoteReceptionCredentials {
+  readonly principal: string;
+  readonly authorSecret: Uint8Array;
+  readonly authToken?: Uint8Array;
+}
+
+export interface RemoteReceptionOptions {
+  readonly address: string;
+  readonly fetch?: typeof globalThis.fetch;
+}
+
+export interface RemoteGeneratedRead {
+  readonly query: string;
+  readonly protobufType: string;
+  readonly protobufPayload: Uint8Array;
+}
+
+export interface RemoteQueryResult {
+  readonly protobufType: string;
+  readonly protobufPayload: Uint8Array;
+}
+
+export interface RemoteOfferOptions {
+  readonly domainHash?: string;
+}
+
+export interface RemoteBirthCertificate {
+  readonly child: string;
+  readonly founder: string;
+  readonly verified: boolean;
+  readonly parentKey: Uint8Array;
+  readonly parentId: string;
+  readonly epoch: number | bigint;
+  readonly signature: Uint8Array;
+  readonly verifiedVia?: string;
+  readonly idpToken?: string;
+  readonly capturedClock?: number | bigint;
+  readonly authProviderIssuer?: string;
+  readonly authProviderJwks?: string;
+  readonly authProviderAudience?: string;
+}
+
+/**
+ * The small HTTP correspondence edge of Reception.
+ *
+ * This class owns no workspace, kernel, custody, sync or retry lifecycle. It
+ * carries one exact Runtime-v2 paper to a remote Peer Office and returns that
+ * office's typed receipt. Credentials remain call-scoped because this process
+ * is merely a correspondent, not another Nomos peer.
+ */
+export class RemoteReception {
+  readonly #address: string;
+  readonly #fetch: typeof globalThis.fetch;
+  #requestId = 0n;
+
+  constructor(options: RemoteReceptionOptions) {
+    this.#address = options.address.replace(/\/+$/, "");
+    if (!/^https?:\/\//.test(this.#address)) {
+      throw new TypeError("Remote Reception requires an http(s) peer address");
+    }
+    this.#fetch = options.fetch ?? globalThis.fetch;
+    if (typeof this.#fetch !== "function") {
+      throw new TypeError("Remote Reception requires a fetch implementation");
+    }
+  }
+
+  /** Send one compiler-generated call through the target workspace's ordinary offer gate. */
+  async offer(
+    workspace: string,
+    generated: ReceptionGeneratedCall,
+    credentials: RemoteReceptionCredentials,
+    options: RemoteOfferOptions = {},
+  ): Promise<OfferAdmitted> {
+    this.#validateCredentials(credentials);
+    const call = create(CallRequestSchema, {
+      protocolVersion: KERNEL_PROTOCOL,
+      requestId: this.#kernelRequestId("offer"),
+      operation: {
+        case: "offer",
+        value: create(OfferRequestSchema, {
+          target: this.#target(workspace),
+          ...(options.domainHash === undefined ? {} : { controllerLawHash: options.domainHash }),
+          intent: {
+            case: "call",
+            value: create(DirectiveCallSchema, {
+              domain: generated.domain,
+              directive: generated.directive,
+              operation: create(AnySchema, {
+                typeUrl: generated.protobufType,
+                value: generated.protobufPayload,
+              }),
+            }),
+          },
+          authoring: create(AuthoringOptionsSchema, {
+            actor: credentials.principal,
+            authToken: credentials.authToken ?? new Uint8Array(),
+            authorSecret: credentials.authorSecret,
+            spans: true,
+          }),
+        }),
+      },
+    });
+    const response = await this.#call(workspace, call, CredentialUse.CALL_PROVIDED);
+    if (response.outcome.case === "failure") {
+      throw new Error(`${response.outcome.value.code}: ${response.outcome.value.message}`);
+    }
+    if (response.outcome.case !== "offer") {
+      throw new Error(`kernel returned '${response.outcome.case || "empty"}' for a generated offer`);
+    }
+    const outcome = response.outcome.value.outcome;
+    if (outcome.case !== "admitted") {
+      const detail = outcome.case === "refused"
+        ? outcome.value.refusal?.message ?? "target law refused the offer"
+        : outcome.case === "deadLettered"
+          ? `dead-lettered: ${outcome.value.reason}`
+          : outcome.case === "quarantined"
+            ? `quarantined: ${outcome.value.reason}`
+            : outcome.case === "blockedOnDependency"
+              ? `blocked: ${outcome.value.detail}`
+              : `unexpected offer outcome '${outcome.case || "empty"}'`;
+      throw new NomosTypedOfferFailure(response.outcome.value, detail);
+    }
+    return outcome.value;
+  }
+
+  /**
+   * Execute one compiler-generated read at the remote peer. Query meaning,
+   * readiness and authorization stay there; this correspondent owns no local
+   * interaction, custody, law preparation or replica-follow lifecycle.
+   */
+  async read(
+    workspace: string,
+    generated: RemoteGeneratedRead,
+    credentials: RemoteReceptionCredentials,
+  ): Promise<RemoteQueryResult> {
+    this.#validateCredentials(credentials);
+    const response = await this.#call(workspace, create(CallRequestSchema, {
+      protocolVersion: KERNEL_PROTOCOL,
+      requestId: this.#kernelRequestId("generated-read"),
+      operation: { case: "query", value: create(QueryRequestSchema, {
+        target: this.#target(workspace),
+        authority: create(QueryAuthoritySchema, {
+          authToken: credentials.authToken ?? new Uint8Array(),
+          authorSecret: credentials.authorSecret,
+          principalClaim: credentials.principal,
+        }),
+        resultFormat: QueryResultFormat.APPLICATION_PROTOBUF,
+        query: { case: "rows", value: create(RowsQuerySchema, {
+          id: generated.query,
+          principal: credentials.principal,
+          applicationArguments: create(AnySchema, {
+            typeUrl: generated.protobufType, value: generated.protobufPayload,
+          }),
+        }) },
+      }) },
+    }), CredentialUse.CALL_PROVIDED);
+    if (response.outcome.case === "failure") {
+      throw new Error(`${response.outcome.value.code}: ${response.outcome.value.message}`);
+    }
+    if (response.outcome.case !== "query" || response.outcome.value.result.case !== "applicationResult") {
+      throw new Error("Remote Reception did not return generated query result bytes");
+    }
+    const result = response.outcome.value.result.value;
+    return { protobufType: result.typeUrl, protobufPayload: result.value };
+  }
+
+  /**
+   * Temporary fixed-framework read used while the remaining framework queries
+   * gain generated result messages. Application/domain reads do not use this.
+   */
+  async rows(
+    workspace: string,
+    query: string,
+    arguments_: Readonly<Record<string, unknown>>,
+    credentials: RemoteReceptionCredentials,
+  ): Promise<unknown> {
+    this.#validateCredentials(credentials);
+    const call = create(CallRequestSchema, {
+      protocolVersion: KERNEL_PROTOCOL,
+      requestId: this.#kernelRequestId("query"),
+      operation: {
+        case: "query",
+        value: create(QueryRequestSchema, {
+          target: this.#target(workspace),
+          authority: create(QueryAuthoritySchema, {
+            authToken: credentials.authToken ?? new Uint8Array(),
+            authorSecret: credentials.authorSecret,
+          }),
+          resultFormat: QueryResultFormat.LEGACY_VALUE,
+          query: {
+            case: "rows",
+            value: create(RowsQuerySchema, {
+              id: query,
+              arguments: structToProto(arguments_),
+              principal: credentials.principal,
+            }),
+          },
+        }),
+      },
+    });
+    const response = await this.#call(workspace, call, CredentialUse.CALL_PROVIDED);
+    if (response.outcome.case === "failure") {
+      throw new Error(`${response.outcome.value.code}: ${response.outcome.value.message}`);
+    }
+    if (response.outcome.case !== "query") {
+      throw new Error(`kernel returned '${response.outcome.case || "empty"}' for a framework query`);
+    }
+    if (response.outcome.value.result.case !== "value") {
+      throw new Error(
+        `kernel returned '${response.outcome.value.result.case || "empty"}' for a legacy framework query`,
+      );
+    }
+    return valueFromProto(response.outcome.value.result.value);
+  }
+
+  /** Canonical aggregate bytes for the generated collection's own decoder. */
+  readById(workspace: string, aggregateType: string, aggregateId: string,
+    credentials: RemoteReceptionCredentials): Promise<Uint8Array> {
+    return this.#readUsda(workspace, { case: "byId", value: create(ByIdQuerySchema, {
+      aggregateType, aggregateId, principal: credentials.principal,
+    }) }, credentials);
+  }
+
+  /** Canonical aggregate bytes for a generated collection, not a host-parsed business schema. */
+  readByType(workspace: string, aggregateType: string,
+    credentials: RemoteReceptionCredentials): Promise<Uint8Array> {
+    return this.#readUsda(workspace, { case: "byType", value: create(ByTypeQuerySchema, {
+      aggregateType, principal: credentials.principal,
+    }) }, credentials);
+  }
+
+  async #readUsda(workspace: string, query: QueryRequest["query"],
+    credentials: RemoteReceptionCredentials): Promise<Uint8Array> {
+    this.#validateCredentials(credentials);
+    const response = await this.#call(workspace, create(CallRequestSchema, {
+      protocolVersion: KERNEL_PROTOCOL, requestId: this.#kernelRequestId("generated-collection"),
+      operation: { case: "query", value: create(QueryRequestSchema, {
+        target: this.#target(workspace), resultFormat: QueryResultFormat.NOMINAL_USDA, query,
+        authority: create(QueryAuthoritySchema, {
+          authToken: credentials.authToken ?? new Uint8Array(), authorSecret: credentials.authorSecret,
+          principalClaim: credentials.principal,
+        }),
+      }) },
+    }), CredentialUse.CALL_PROVIDED);
+    if (response.outcome.case === "failure") {
+      throw new Error(`${response.outcome.value.code}: ${response.outcome.value.message}`);
+    }
+    if (response.outcome.case !== "query" || response.outcome.value.result.case !== "resultUsda") {
+      throw new Error("Remote Reception did not return canonical aggregate bytes");
+    }
+    return response.outcome.value.result.value;
+  }
+
+  /** Fixed-framework aggregate lookup; generated application reads use their generated result messages. */
+  async byId(
+    workspace: string,
+    aggregateId: string,
+    aggregateType: string,
+    credentials: RemoteReceptionCredentials,
+  ): Promise<unknown> {
+    this.#validateCredentials(credentials);
+    const call = create(CallRequestSchema, {
+      protocolVersion: KERNEL_PROTOCOL,
+      requestId: this.#kernelRequestId("query-by-id"),
+      operation: {
+        case: "query",
+        value: create(QueryRequestSchema, {
+          target: this.#target(workspace),
+          authority: create(QueryAuthoritySchema, {
+            authToken: credentials.authToken ?? new Uint8Array(),
+            authorSecret: credentials.authorSecret,
+          }),
+          resultFormat: QueryResultFormat.LEGACY_VALUE,
+          query: {
+            case: "byId",
+            value: create(ByIdQuerySchema, {
+              aggregateId,
+              aggregateType,
+            }),
+          },
+        }),
+      },
+    });
+    const response = await this.#call(workspace, call, CredentialUse.CALL_PROVIDED);
+    if (response.outcome.case === "failure") {
+      throw new Error(`${response.outcome.value.code}: ${response.outcome.value.message}`);
+    }
+    if (response.outcome.case !== "query") {
+      throw new Error(`kernel returned '${response.outcome.case || "empty"}' for a framework lookup`);
+    }
+    if (response.outcome.value.result.case !== "value") {
+      throw new Error(
+        `kernel returned '${response.outcome.value.result.case || "empty"}' for a legacy framework lookup`,
+      );
+    }
+    return valueFromProto(response.outcome.value.result.value);
+  }
+
+  /** Ask the target kernel to sign its canonical birth-certificate message. */
+  async signBirthCertificate(
+    workspace: string,
+    certificate: RemoteBirthCertificate,
+    signerSecret: Uint8Array,
+  ): Promise<BirthCertificate> {
+    if (signerSecret.byteLength !== 32) {
+      throw new TypeError("birth-certificate signing requires one 32-byte device key");
+    }
+    const { epoch, capturedClock, ...certificateFields } = certificate;
+    const call = create(CallRequestSchema, {
+      protocolVersion: KERNEL_PROTOCOL,
+      requestId: this.#kernelRequestId("sign-birth-certificate"),
+      operation: {
+        case: "signBirthCertificate",
+        value: create(SignBirthCertificateRequestSchema, {
+          certificate: create(BirthCertificateSchema, {
+            ...certificateFields,
+            epoch: BigInt(epoch),
+            ...(capturedClock === undefined
+              ? {}
+              : { capturedClock: BigInt(capturedClock) }),
+          }),
+          signerSecret,
+        }),
+      },
+    });
+    const response = await this.#call(workspace, call, CredentialUse.NONE);
+    if (response.outcome.case === "failure") {
+      throw new Error(`${response.outcome.value.code}: ${response.outcome.value.message}`);
+    }
+    if (response.outcome.case !== "signBirthCertificate") {
+      throw new Error(
+        `kernel returned '${response.outcome.case || "empty"}' for birth-certificate signing`,
+      );
+    }
+    if (!response.outcome.value.certificate) {
+      throw new Error("kernel returned no signed birth certificate");
+    }
+    return response.outcome.value.certificate;
+  }
+
+  async #call(
+    workspace: string,
+    call: CallRequest,
+    credentialUse: CredentialUse,
+  ): Promise<CallResponse> {
+    if (!workspace || /[\s/]/.test(workspace)) {
+      throw new TypeError(`invalid workspace '${workspace}'`);
+    }
+    const requestId = ++this.#requestId;
+    const session = `remote-reception:${workspace}`;
+    const paper = toBinary(RuntimeRequestSchema, create(RuntimeRequestSchema, {
+      protocolVersion: RUNTIME_PROTOCOL,
+      requestId,
+      target: { workspace, session },
+      command: {
+        case: "kernelCall",
+        value: create(KernelCallRequestSchema, { session, request: call, credentialUse }),
+      },
+    }));
+    const response = await this.#fetch(
+      `${this.#address}/v2/workspaces/${encodeURIComponent(workspace)}/runtime`,
+      {
+        method: "POST",
+        headers: { accept: RUNTIME_RESPONSE, "content-type": RUNTIME_REQUEST },
+        body: paper,
+      },
+    );
+    if (!response.ok) {
+      throw new Error(`Remote Reception returned HTTP ${response.status}: ${(await response.text()).slice(0, 500)}`);
+    }
+    const contentType = response.headers.get("content-type") ?? "";
+    if (!contentType.includes(RUNTIME_RESPONSE)) {
+      throw new Error(`Remote Reception returned '${contentType || "no content type"}'`);
+    }
+    const runtime = fromBinary(RuntimeResponseSchema, new Uint8Array(await response.arrayBuffer()));
+    if (runtime.protocolVersion !== RUNTIME_PROTOCOL || runtime.requestId !== requestId) {
+      throw new Error("Remote Reception returned an unrelated Runtime-v2 receipt");
+    }
+    if (runtime.outcome.case === "failure") {
+      throw new Error(`${runtime.outcome.value.code}: ${runtime.outcome.value.message}`);
+    }
+    if (runtime.outcome.case === "blocked") {
+      throw new Error(`Remote Reception blocked on '${runtime.outcome.value.reason.case || "unknown"}'`);
+    }
+    if (runtime.outcome.case !== "kernelCall") {
+      throw new Error(`Remote Reception returned '${runtime.outcome.case || "empty"}' for a kernel paper`);
+    }
+    return runtime.outcome.value;
+  }
+
+  #target(workspace: string) {
+    return create(WorkspaceTargetSchema, {
+      repo: `/work/ws/${workspace}`,
+      workspace,
+      branch: "main",
+    });
+  }
+
+  #kernelRequestId(operation: string): string {
+    return `remote-reception:${operation}:${this.#requestId + 1n}`;
+  }
+
+  #validateCredentials(credentials: RemoteReceptionCredentials): void {
+    if (!credentials.principal.trim()) throw new TypeError("Remote Reception requires a principal");
+    if (credentials.authorSecret.byteLength !== 32) {
+      throw new TypeError("Remote Reception requires one 32-byte device key");
+    }
+  }
+}