@glubean/sdk 0.3.1 → 0.4.0

package/dist/contract-core.d.ts

@@ -77,9 +77,6 @@ type ContractNamespace = {
  */
 export declare function bootstrap<Needs, Params = void>(ref: ContractCaseRef<Needs, unknown>, spec: Bootstrap<Params, NoInfer<Needs>>): BootstrapAttachment<Needs, Params>;
 export declare const contract: ContractNamespace;
-/**
- * Protocol-agnostic flow builder. See contract-flow.md v9 §4.1.
- */
 export declare function flow(idOrMeta: string | FlowMeta): FlowBuilder<unknown>;
 /**
  * Core flow execution helper. Implements the Rule 1 / Rule 2 teardown
@@ -108,6 +105,21 @@ export declare function normalizeFlow<State>(runtime: RuntimeFlowProjection<Stat
  * losing projection data.
  */
 export declare function extractMappings(fn: (state: any) => any): FieldMapping[];
+/**
+ * Run a single-selector lens `fn: (state) => state.a.b.c` through the strict
+ * tracing Proxy and return the read path (root segment dropped), e.g.
+ * `s => s.lookup.status` → `["lookup", "status"]`.
+ *
+ * Used by the condition/switch predicate builders (contract-flow-condition.ts)
+ * to capture a predicate's read path at construction time. The strict Proxy
+ * enforces purity (method calls / `new` / arithmetic-via-coercion throw
+ * `LensPurityError`); callers add a source-level single-selector gate on top
+ * to also reject ternaries / free-variable reads the Proxy can't see.
+ *
+ * Throws `LensPurityError` if the lens does not resolve to a single traced
+ * value (e.g. returns an object literal, a constant, or `undefined`).
+ */
+export declare function extractSelectorPath(fn: (state: any) => any): string[];
 /**
  * Extract FieldMappings from `out: (state, response) => newState`.
  * Same purity contract as `extractMappings`.

package/dist/contract-core.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"contract-core.d.ts","sourceRoot":"","sources":["../src/contract-core.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;GAmBG;AAEH,OAAO,KAAK,EAAQ,WAAW,EAAE,MAAM,YAAY,CAAC;AACpD,OAAO,KAAK,EAEV,SAAS,EACT,mBAAmB,EAEnB,eAAe,EACf,uBAAuB,EAGvB,uBAAuB,EAEvB,YAAY,EACZ,WAAW,EACX,YAAY,EACZ,QAAQ,EAKR,qBAAqB,EAEtB,MAAM,qBAAqB,CAAC;AAiG7B,oEAAoE;AACpE,wBAAgB,UAAU,CACxB,QAAQ,EAAE,MAAM,GACf,uBAAuB,CAAC,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,CAAC,GAAG,SAAS,CAE9D;AAED;;;;;;;GAOG;AACH,wBAAgB,uBAAuB,IAAI,MAAM,EAAE,CAElD;AAED;;;;;;;;;;GAUG;AACH,wBAAgB,8BAA8B,CAAC,QAAQ,EAAE,MAAM,GAAG,IAAI,CAIrE;AAED;;;;;;;GAOG;AACH,wBAAgB,gCAAgC,IAAI,IAAI,CAIvD;AAaD;;;;;GAKG;AACH,iBAAS,QAAQ,CACf,IAAI,EACJ,cAAc,GAAG,OAAO,EACxB,WAAW,GAAG,OAAO,EACrB,WAAW,GAAG,OAAO,EACrB,QAAQ,GAAG,OAAO,EAElB,QAAQ,EAAE,MAAM,EAChB,OAAO,EAAE,uBAAuB,CAAC,IAAI,EAAE,cAAc,EAAE,WAAW,EAAE,WAAW,EAAE,QAAQ,CAAC,GACzF,IAAI,CA2BN;AAqfD,KAAK,iBAAiB,GAAG;IACvB,QAAQ,EAAE,OAAO,QAAQ,CAAC;IAC1B,IAAI,EAAE,OAAO,IAAI,CAAC;IAClB,SAAS,EAAE,OAAO,SAAS,CAAC;IAC5B,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC;CAC7B,CAAC;AAEF;;;;;;;;;GASG;AACH,wBAAgB,SAAS,CAAC,KAAK,EAAE,MAAM,GAAG,IAAI,EAC5C,GAAG,EAAE,eAAe,CAAC,KAAK,EAAE,OAAO,CAAC,EACpC,IAAI,EAAE,SAAS,CAAC,MAAM,EAAE,OAAO,CAAC,KAAK,CAAC,CAAC,GACtC,mBAAmB,CAAC,KAAK,EAAE,MAAM,CAAC,CAEpC;AAED,eAAO,MAAM,QAAQ,EAAE,iBAItB,CAAC;AAMF;;GAEG;AACH,wBAAgB,IAAI,CAAC,QAAQ,EAAE,MAAM,GAAG,QAAQ,GAAG,WAAW,CAAC,OAAO,CAAC,CA0KtE;AAyBD;;;GAGG;AACH,wBAAsB,OAAO,CAAC,KAAK,EACjC,YAAY,EAAE,YAAY,CAAC,KAAK,CAAC,EACjC,GAAG,EAAE,WAAW,GACf,OAAO,CAAC,IAAI,CAAC,CAsHf;AAMD;;;;;;;GAOG;AACH,wBAAgB,aAAa,CAAC,KAAK,EACjC,OAAO,EAAE,qBAAqB,CAAC,KAAK,CAAC,GAAG;IAAE,EAAE,EAAE,MAAM,CAAA;CAAE,GACrD,uBAAuB,CAsEzB;AAED;;;;;;;;;GASG;AACH,wBAAgB,eAAe,CAAC,EAAE,EAAE,CAAC,KAAK,EAAE,GAAG,KAAK,GAAG,GAAG,YAAY,EAAE,CAIvE;AAED;;;GAGG;AACH,wBAAgB,kBAAkB,CAChC,EAAE,EAAE,CAAC,KAAK,EAAE,GAAG,EAAE,QAAQ,EAAE,GAAG,KAAK,GAAG,GACrC,YAAY,EAAE,CAMhB;AAkED;;;;GAIG;AACH,qBAAa,eAAgB,SAAQ,KAAK;IACxC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;gBACf,IAAI,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM;CAY5C;AAiDD;;;;;;;;GAQG;AACH,wBAAgB,cAAc,CAC5B,EAAE,EAAE,CAAC,KAAK,EAAE,GAAG,KAAK,GAAG,GACtB;IAAE,KAAK,EAAE,MAAM,EAAE,CAAC;IAAC,MAAM,EAAE,MAAM,EAAE,CAAA;CAAE,CAavC"}
+{"version":3,"file":"contract-core.d.ts","sourceRoot":"","sources":["../src/contract-core.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;GAmBG;AAEH,OAAO,KAAK,EAAQ,WAAW,EAAE,MAAM,YAAY,CAAC;AACpD,OAAO,KAAK,EAEV,SAAS,EACT,mBAAmB,EAEnB,eAAe,EACf,uBAAuB,EAGvB,uBAAuB,EAEvB,YAAY,EACZ,WAAW,EACX,YAAY,EAEZ,QAAQ,EAMR,qBAAqB,EAEtB,MAAM,qBAAqB,CAAC;AAgH7B,oEAAoE;AACpE,wBAAgB,UAAU,CACxB,QAAQ,EAAE,MAAM,GACf,uBAAuB,CAAC,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,CAAC,GAAG,SAAS,CAE9D;AAED;;;;;;;GAOG;AACH,wBAAgB,uBAAuB,IAAI,MAAM,EAAE,CAElD;AAED;;;;;;;;;;GAUG;AACH,wBAAgB,8BAA8B,CAAC,QAAQ,EAAE,MAAM,GAAG,IAAI,CAIrE;AAED;;;;;;;GAOG;AACH,wBAAgB,gCAAgC,IAAI,IAAI,CAIvD;AAaD;;;;;GAKG;AACH,iBAAS,QAAQ,CACf,IAAI,EACJ,cAAc,GAAG,OAAO,EACxB,WAAW,GAAG,OAAO,EACrB,WAAW,GAAG,OAAO,EACrB,QAAQ,GAAG,OAAO,EAElB,QAAQ,EAAE,MAAM,EAChB,OAAO,EAAE,uBAAuB,CAAC,IAAI,EAAE,cAAc,EAAE,WAAW,EAAE,WAAW,EAAE,QAAQ,CAAC,GACzF,IAAI,CA2BN;AAqfD,KAAK,iBAAiB,GAAG;IACvB,QAAQ,EAAE,OAAO,QAAQ,CAAC;IAC1B,IAAI,EAAE,OAAO,IAAI,CAAC;IAClB,SAAS,EAAE,OAAO,SAAS,CAAC;IAC5B,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC;CAC7B,CAAC;AAEF;;;;;;;;;GASG;AACH,wBAAgB,SAAS,CAAC,KAAK,EAAE,MAAM,GAAG,IAAI,EAC5C,GAAG,EAAE,eAAe,CAAC,KAAK,EAAE,OAAO,CAAC,EACpC,IAAI,EAAE,SAAS,CAAC,MAAM,EAAE,OAAO,CAAC,KAAK,CAAC,CAAC,GACtC,mBAAmB,CAAC,KAAK,EAAE,MAAM,CAAC,CAEpC;AAED,eAAO,MAAM,QAAQ,EAAE,iBAItB,CAAC;AA0NF,wBAAgB,IAAI,CAAC,QAAQ,EAAE,MAAM,GAAG,QAAQ,GAAG,WAAW,CAAC,OAAO,CAAC,CAkKtE;AAoDD;;;GAGG;AACH,wBAAsB,OAAO,CAAC,KAAK,EACjC,YAAY,EAAE,YAAY,CAAC,KAAK,CAAC,EACjC,GAAG,EAAE,WAAW,GACf,OAAO,CAAC,IAAI,CAAC,CAqIf;AAMD;;;;;;;GAOG;AACH,wBAAgB,aAAa,CAAC,KAAK,EACjC,OAAO,EAAE,qBAAqB,CAAC,KAAK,CAAC,GAAG;IAAE,EAAE,EAAE,MAAM,CAAA;CAAE,GACrD,uBAAuB,CAoFzB;AAED;;;;;;;;;GASG;AACH,wBAAgB,eAAe,CAAC,EAAE,EAAE,CAAC,KAAK,EAAE,GAAG,KAAK,GAAG,GAAG,YAAY,EAAE,CAIvE;AAED;;;;;;;;;;;;;GAaG;AACH,wBAAgB,mBAAmB,CAAC,EAAE,EAAE,CAAC,KAAK,EAAE,GAAG,KAAK,GAAG,GAAG,MAAM,EAAE,CAUrE;AAED;;;GAGG;AACH,wBAAgB,kBAAkB,CAChC,EAAE,EAAE,CAAC,KAAK,EAAE,GAAG,EAAE,QAAQ,EAAE,GAAG,KAAK,GAAG,GACrC,YAAY,EAAE,CAMhB;AAkED;;;;GAIG;AACH,qBAAa,eAAgB,SAAQ,KAAK;IACxC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;gBACf,IAAI,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM;CAY5C;AAiDD;;;;;;;;GAQG;AACH,wBAAgB,cAAc,CAC5B,EAAE,EAAE,CAAC,KAAK,EAAE,GAAG,KAAK,GAAG,GACtB;IAAE,KAAK,EAAE,MAAM,EAAE,CAAC;IAAC,MAAM,EAAE,MAAM,EAAE,CAAA;CAAE,CAavC"}

package/dist/contract-core.js

@@ -19,6 +19,7 @@
  *   - `internal/40-discovery/proposals/contract-flow.md` v9
  */
 import { registerTest } from "./internal.js";
+import { selectBranchSteps, extractBranchStep, predicateScope, assertSelectorSource, assertSwitchCaseValues, assertL2Predicate, } from "./contract-flow-condition.js";
 import { getBootstrap, registerBootstrap } from "./bootstrap-registry.js";
 import { getExplicitInput, getBootstrapInput, isForceStandalone, } from "./runner-input-channel.js";
 /**
@@ -570,6 +571,166 @@ export const contract = {
 /**
  * Protocol-agnostic flow builder. See contract-flow.md v9 §4.1.
  */
+// =============================================================================
+// Branch desugar helpers (condition / switchOn / switchCond → one "branch" step)
+//
+// Shared by both FlowBuilder (top-level steps) and FlowFragmentBuilder (branch
+// sub-steps). Each `then`/`else`/`default`/case callback is run against a fresh
+// step sink whose accumulated RuntimeFlowStep[] becomes that branch's steps.
+// =============================================================================
+/** Build a contract-call runtime step (adapter lookup + flow-safety validation). */
+function buildContractCallStep(flowId, ref, bindings) {
+    const adapter = _adapters.get(ref.protocol);
+    if (!adapter) {
+        throw new Error(`contract.flow(${JSON.stringify(flowId)}).step: unknown protocol "${ref.protocol}". ` +
+            `Did you forget to import a contract plugin package (e.g. "@glubean/grpc")?`);
+    }
+    if (!adapter.executeCaseInFlow) {
+        throw new Error(`contract.flow(${JSON.stringify(flowId)}).step: adapter for "${ref.protocol}" ` +
+            `does not implement executeCaseInFlow — this protocol cannot appear in a flow.`);
+    }
+    // v10: flow-safety validation fires at step-declaration time (not .case()).
+    const contractRef = ref.contract;
+    adapter.validateCaseForFlow?.(contractRef._spec, ref.caseKey, ref.contractId);
+    return {
+        kind: "contract-call",
+        name: bindings?.name,
+        ref,
+        caseKey: ref.caseKey,
+        contract: ref.contract,
+        bindings: bindings
+            ? {
+                in: bindings.in,
+                out: bindings.out,
+                ...(bindings.accept ? { accept: bindings.accept } : {}),
+            }
+            : undefined,
+    };
+}
+/** Module-private key holding a fragment sink's accumulated step list. */
+const FRAGMENT_STEPS = Symbol("glubean.fragment-steps");
+/**
+ * Run a branch-body callback and return the steps of the fragment it RETURNS
+ * (not a closure-shared array). Because the sink is persistent/immutable (each
+ * method returns a NEW sink carrying `[...prev, step]`), the executed steps are
+ * exactly the chain that produced the returned, type-checked fragment. A block
+ * body that mutates then returns an earlier sink — e.g.
+ * `(b) => { b.compute(reshape); return b; }` — yields that earlier sink's
+ * (shorter) step list, so runtime matches what the type system saw. This keeps
+ * the `NoExtraKeys` / invariant convergence guarantees honest.
+ */
+function collectFragmentSteps(flowId, fn) {
+    const result = fn(makeStepSink(flowId, []));
+    const out = result?.[FRAGMENT_STEPS];
+    if (!Array.isArray(out)) {
+        throw new Error(`flow "${flowId}": a branch body must return the fragment builder ` +
+            `(e.g. \`(b) => b.compute(...)\` or \`(b) => b\`); it returned a non-builder value`);
+    }
+    return out;
+}
+/**
+ * A persistent (immutable) FlowFragmentBuilder over a steps array. Every method
+ * returns a NEW sink carrying `[...steps, newStep]` — it never mutates `steps`.
+ * The accumulated list is read back (by `collectFragmentSteps`) via the
+ * module-private `FRAGMENT_STEPS` key, so only the RETURNED fragment's steps
+ * run. The phantom invariant brand exists only in the type.
+ */
+function makeStepSink(flowId, steps) {
+    const extend = (step) => makeStepSink(flowId, [...steps, step]);
+    // Typed `any` so methods can return sinks; the public type is the cast below.
+    const sink = {
+        step(ref, bindings) {
+            return extend(buildContractCallStep(flowId, ref, bindings));
+        },
+        compute(fn) {
+            return extend({ kind: "compute", fn });
+        },
+        condition(spec, thenB, elseB) {
+            return extend(buildConditionStep(flowId, "L2", spec, thenB, elseB));
+        },
+        conditionFn(spec, thenB, elseB) {
+            return extend(buildConditionStep(flowId, "L1", spec, thenB, elseB));
+        },
+        conditionAsync(spec, thenB, elseB) {
+            return extend(buildConditionStep(flowId, "L0", spec, thenB, elseB));
+        },
+        switchOn(lens) {
+            return (cases, deflt) => extend(buildSwitchOnStep(flowId, lens, cases, deflt));
+        },
+        switchCond(cases, deflt) {
+            return extend(buildSwitchCondStep(flowId, cases, deflt));
+        },
+    };
+    // Non-enumerable, frozen step list snapshot for this sink.
+    Object.defineProperty(sink, FRAGMENT_STEPS, {
+        value: Object.freeze(steps),
+        enumerable: false,
+    });
+    return sink;
+}
+/**
+ * condition / conditionFn / conditionAsync → predicate-mode branch (1 case +
+ * default). L2 builds a declarative `BranchPredicate` via `predicateScope`;
+ * L1/L0 wrap the opaque fn and REQUIRE a message (type-level + this runtime
+ * guard, so `as any` / JS callers can't produce an unlabeled opaque gate).
+ */
+function buildConditionStep(flowId, tier, spec, thenB, elseB) {
+    const thenSteps = collectFragmentSteps(flowId, thenB);
+    const elseSteps = elseB ? collectFragmentSteps(flowId, elseB) : [];
+    let predicate;
+    let message;
+    if (tier === "L2") {
+        predicate = spec.predicate(predicateScope());
+        assertL2Predicate(predicate, "condition"); // runtime brand: reject forged/opaque/non-JSON trees
+        message = spec.message;
+    }
+    else {
+        if (typeof spec.message !== "string" || spec.message.length === 0) {
+            throw new LensPurityError(tier === "L1" ? "conditionFn" : "conditionAsync", `opaque (${tier}) predicate requires a non-empty \`message\` — the projection marks ` +
+                `this branch as an opaque/dynamic gate and the message is its only human-facing label`);
+        }
+        message = spec.message;
+        predicate = { kind: "opaque", sync: tier === "L1", fn: spec.predicate };
+    }
+    return {
+        kind: "branch",
+        mode: "predicate",
+        cases: [{ ...(message ? { message } : {}), predicate, steps: thenSteps }],
+        default: elseSteps,
+    };
+}
+/** switchCond → predicate-mode branch (N cases + default), each case a declarative predicate. */
+function buildSwitchCondStep(flowId, cases, deflt) {
+    return {
+        kind: "branch",
+        mode: "predicate",
+        cases: cases.map((c) => {
+            const predicate = c.when(predicateScope());
+            assertL2Predicate(predicate, "switchCond"); // switch is always L2 — reject forged/opaque trees
+            return { predicate, steps: collectFragmentSteps(flowId, c.then) };
+        }),
+        default: collectFragmentSteps(flowId, deflt),
+    };
+}
+/**
+ * switchOn → value-mode branch. The subject lens runs the same P0 source gate +
+ * strict-Proxy path extraction as `w.when` (so the decision-table projection
+ * can't lie), values must be unique + finite, and the lens is normalized to
+ * `(ctx, s)` for uniform runtime evaluation (it is evaluated exactly once).
+ */
+function buildSwitchOnStep(flowId, lens, cases, deflt) {
+    void flowId;
+    assertSelectorSource(lens);
+    const path = extractSelectorPath(lens);
+    assertSwitchCaseValues(cases.map((c) => c.value));
+    return {
+        kind: "branch",
+        mode: "value",
+        subject: { lens: (_ctx, s) => lens(s), path },
+        cases: cases.map((c) => ({ value: c.value, steps: collectFragmentSteps(flowId, c.then) })),
+        default: collectFragmentSteps(flowId, deflt),
+    };
+}
 export function flow(idOrMeta) {
     const meta = typeof idOrMeta === "string"
         ? { id: idOrMeta }
@@ -594,34 +755,7 @@ export function flow(idOrMeta) {
             return builder;
         },
         step(ref, bindings) {
-            const adapter = _adapters.get(ref.protocol);
-            if (!adapter) {
-                throw new Error(`contract.flow(${JSON.stringify(meta.id)}).step: unknown protocol "${ref.protocol}". ` +
-                    `Did you forget to import a contract plugin package (e.g. "@glubean/grpc")?`);
-            }
-            if (!adapter.executeCaseInFlow) {
-                throw new Error(`contract.flow(${JSON.stringify(meta.id)}).step: adapter for "${ref.protocol}" ` +
-                    `does not implement executeCaseInFlow — this protocol cannot appear in a flow.`);
-            }
-            // v10: flow-safety validation fires here (at step-declaration time),
-            // not at .case() time. The ref itself is pure; only when it enters a
-            // flow do we enforce adapter-specific rules like HTTP's "function-
-            // valued body/params/headers can't resolve in flow mode". This lets
-            // contract.bootstrap(ref) attach to the same ref (where function-
-            // valued fields legitimately receive resolvedInput).
-            const contractRef = ref.contract;
-            adapter.validateCaseForFlow?.(contractRef._spec, ref.caseKey, ref.contractId);
-            const step = {
-                kind: "contract-call",
-                name: bindings?.name,
-                ref,
-                caseKey: ref.caseKey,
-                contract: ref.contract,
-                bindings: bindings
-                    ? { in: bindings.in, out: bindings.out }
-                    : undefined,
-            };
-            steps.push(step);
+            steps.push(buildContractCallStep(meta.id, ref, bindings));
             return builder;
         },
         compute(fn) {
@@ -632,6 +766,28 @@ export function flow(idOrMeta) {
             steps.push(step);
             return builder;
         },
+        condition(spec, thenB, elseB) {
+            steps.push(buildConditionStep(meta.id, "L2", spec, thenB, elseB));
+            return builder;
+        },
+        conditionFn(spec, thenB, elseB) {
+            steps.push(buildConditionStep(meta.id, "L1", spec, thenB, elseB));
+            return builder;
+        },
+        conditionAsync(spec, thenB, elseB) {
+            steps.push(buildConditionStep(meta.id, "L0", spec, thenB, elseB));
+            return builder;
+        },
+        switchOn(lens) {
+            return (cases, deflt) => {
+                steps.push(buildSwitchOnStep(meta.id, lens, cases, deflt));
+                return builder;
+            };
+        },
+        switchCond(cases, deflt) {
+            steps.push(buildSwitchCondStep(meta.id, cases, deflt));
+            return builder;
+        },
         build() {
             return finalize();
         },
@@ -720,6 +876,32 @@ function stepProjectionToRegistry(step) {
             writes: step.writes,
         };
     }
+    if (step.kind === "branch") {
+        if (step.mode === "value") {
+            return {
+                kind: "branch",
+                mode: "value",
+                name: step.name,
+                subjectPath: step.subjectPath,
+                cases: step.cases.map((c) => ({
+                    value: c.value,
+                    steps: c.steps.map(stepProjectionToRegistry),
+                })),
+                default: step.default.map(stepProjectionToRegistry),
+            };
+        }
+        return {
+            kind: "branch",
+            mode: "predicate",
+            name: step.name,
+            cases: step.cases.map((c) => ({
+                message: c.message,
+                predicate: c.predicate,
+                steps: c.steps.map(stepProjectionToRegistry),
+            })),
+            default: step.default.map(stepProjectionToRegistry),
+        };
+    }
     return {
         kind: "contract-call",
         name: step.name,
@@ -729,6 +911,7 @@ function stepProjectionToRegistry(step) {
         target: step.target,
         inputs: step.inputs,
         outputs: step.outputs,
+        ...(step.accept ? { accept: step.accept } : {}),
     };
 }
 /**
@@ -742,81 +925,96 @@ export async function runFlow(flowContract, ctx) {
         ? await runtime.setup(ctx)
         : undefined;
     try {
-        for (const step of runtime.steps) {
-            if (step.kind === "compute") {
-                // Compute: synchronous pure function. Enforce both syntactic and
-                // value-level async rejection.
-                if (step.fn.constructor?.name === "AsyncFunction") {
-                    throw new Error(`flow "${runtime.id}" compute step "${step.name ?? "<unnamed>"}": ` +
-                        `async functions are not allowed — compute must be synchronous and I/O-free`);
+        // Recursive step executor. `state` is the closure-level committed cell —
+        // branch sub-steps read and write the same `state`, so a taken branch can
+        // observe and mutate flow state exactly like a top-level step. Non-taken
+        // branches never run (and so never touch state). Branches nest via recursion.
+        const runSteps = async (steps) => {
+            for (const step of steps) {
+                if (step.kind === "branch") {
+                    // Evaluate selector/predicates against the current committed state,
+                    // then execute only the matched case's sub-steps (or default).
+                    const taken = await selectBranchSteps(step, state, ctx);
+                    await runSteps(taken);
+                    continue;
                 }
-                const result = step.fn(state);
-                if (result && typeof result.then === "function") {
-                    throw new Error(`flow "${runtime.id}" compute step "${step.name ?? "<unnamed>"}": ` +
-                        `returned a thenable (Promise or Promise-like) — compute must not return async values. ` +
-                        `If you need async initialization, use flow.setup() instead.`);
+                if (step.kind === "compute") {
+                    // Compute: synchronous pure function. Enforce both syntactic and
+                    // value-level async rejection.
+                    if (step.fn.constructor?.name === "AsyncFunction") {
+                        throw new Error(`flow "${runtime.id}" compute step "${step.name ?? "<unnamed>"}": ` +
+                            `async functions are not allowed — compute must be synchronous and I/O-free`);
+                    }
+                    const result = step.fn(state);
+                    if (result && typeof result.then === "function") {
+                        throw new Error(`flow "${runtime.id}" compute step "${step.name ?? "<unnamed>"}": ` +
+                            `returned a thenable (Promise or Promise-like) — compute must not return async values. ` +
+                            `If you need async initialization, use flow.setup() instead.`);
+                    }
+                    state = result;
+                    continue;
                 }
-                state = result;
-                continue;
-            }
-            // contract-call branch
-            const adapter = _adapters.get(step.ref.protocol);
-            if (!adapter) {
-                throw new Error(`flow "${runtime.id}" step "${step.name ?? step.caseKey}": ` +
-                    `no registered adapter for protocol "${step.ref.protocol}". ` +
-                    `Did you forget to import a contract plugin package?`);
-            }
-            if (!adapter.executeCaseInFlow) {
-                throw new Error(`flow "${runtime.id}" step "${step.name ?? step.caseKey}": ` +
-                    `adapter for "${step.ref.protocol}" does not implement executeCaseInFlow`);
-            }
-            // v10 Phase 2d Step 2+3 follow-up (RFR v2 / v2.1 P1): enforce `needs`
-            // schema at flow boundary, not just standalone. The conditional-tuple
-            // `step()` signature catches TS authoring shape mismatches, but runtime
-            // validation is the only line of defense against:
-            //   - `as any` / JS callers that bypass the TS check
-            //   - Zod parse / coerce / default semantics (schema can transform
-            //     the value, not just validate it)
-            //   - State drift producing invalid values at runtime despite valid
-            //     authoring types
-            // Standalone overlay path already validates via the same helper in
-            // `dispatchContract`'s test.fn closure; flow mirrors that to keep
-            // `needs` a true contract semantic rather than a TS-only boundary.
-            //
-            // Two-branch guard:
-            //   needs present + bindings.in missing  → throw (contract requires input)
-            //   needs present + bindings.in present  → validate unconditionally
-            //   needs absent                          → no guard
-            const contractSpec = step.contract._spec;
-            const caseSpec = contractSpec?.cases?.[step.caseKey];
-            const needsSchema = caseSpec?.needs;
-            const hasIn = typeof step.bindings?.in === "function";
-            if (needsSchema && !hasIn) {
-                throw new Error(`flow "${runtime.id}" step "${step.name ?? step.caseKey}": ` +
-                    `case "${step.ref.contractId}.${step.caseKey}" declares \`needs\` ` +
-                    `but the step has no \`bindings.in\`. The TypeScript conditional ` +
-                    `tuple on FlowBuilder.step() usually prevents this at compile time; ` +
-                    `this runtime check catches \`as any\` / JS bypass. Provide an ` +
-                    `\`in: (state) => <logical input>\` binding or remove the \`needs\` ` +
-                    `schema from the case.`);
-            }
-            let resolvedInputs = step.bindings?.in?.(state);
-            if (needsSchema) {
-                resolvedInputs = validateNeedsOutput(needsSchema, resolvedInputs, {
-                    testId: `${step.ref.contractId}.${step.caseKey}`,
-                    source: "flow",
+                // contract-call branch
+                const adapter = _adapters.get(step.ref.protocol);
+                if (!adapter) {
+                    throw new Error(`flow "${runtime.id}" step "${step.name ?? step.caseKey}": ` +
+                        `no registered adapter for protocol "${step.ref.protocol}". ` +
+                        `Did you forget to import a contract plugin package?`);
+                }
+                if (!adapter.executeCaseInFlow) {
+                    throw new Error(`flow "${runtime.id}" step "${step.name ?? step.caseKey}": ` +
+                        `adapter for "${step.ref.protocol}" does not implement executeCaseInFlow`);
+                }
+                // v10 Phase 2d Step 2+3 follow-up (RFR v2 / v2.1 P1): enforce `needs`
+                // schema at flow boundary, not just standalone. The conditional-tuple
+                // `step()` signature catches TS authoring shape mismatches, but runtime
+                // validation is the only line of defense against:
+                //   - `as any` / JS callers that bypass the TS check
+                //   - Zod parse / coerce / default semantics (schema can transform
+                //     the value, not just validate it)
+                //   - State drift producing invalid values at runtime despite valid
+                //     authoring types
+                // Standalone overlay path already validates via the same helper in
+                // `dispatchContract`'s test.fn closure; flow mirrors that to keep
+                // `needs` a true contract semantic rather than a TS-only boundary.
+                //
+                // Two-branch guard:
+                //   needs present + bindings.in missing  → throw (contract requires input)
+                //   needs present + bindings.in present  → validate unconditionally
+                //   needs absent                          → no guard
+                const contractSpec = step.contract._spec;
+                const caseSpec = contractSpec?.cases?.[step.caseKey];
+                const needsSchema = caseSpec?.needs;
+                const hasIn = typeof step.bindings?.in === "function";
+                if (needsSchema && !hasIn) {
+                    throw new Error(`flow "${runtime.id}" step "${step.name ?? step.caseKey}": ` +
+                        `case "${step.ref.contractId}.${step.caseKey}" declares \`needs\` ` +
+                        `but the step has no \`bindings.in\`. The TypeScript conditional ` +
+                        `tuple on FlowBuilder.step() usually prevents this at compile time; ` +
+                        `this runtime check catches \`as any\` / JS bypass. Provide an ` +
+                        `\`in: (state) => <logical input>\` binding or remove the \`needs\` ` +
+                        `schema from the case.`);
+                }
+                let resolvedInputs = step.bindings?.in?.(state);
+                if (needsSchema) {
+                    resolvedInputs = validateNeedsOutput(needsSchema, resolvedInputs, {
+                        testId: `${step.ref.contractId}.${step.caseKey}`,
+                        source: "flow",
+                    });
+                }
+                const response = await adapter.executeCaseInFlow({
+                    ctx,
+                    contract: step.contract,
+                    caseKey: step.caseKey,
+                    resolvedInputs,
+                    ...(step.bindings?.accept ? { accept: step.bindings.accept } : {}),
                 });
+                if (step.bindings?.out) {
+                    state = step.bindings.out(state, response);
+                }
             }
-            const response = await adapter.executeCaseInFlow({
-                ctx,
-                contract: step.contract,
-                caseKey: step.caseKey,
-                resolvedInputs,
-            });
-            if (step.bindings?.out) {
-                state = step.bindings.out(state, response);
-            }
-        }
+        };
+        await runSteps(runtime.steps);
     }
     finally {
         if (runtime.teardown) {
@@ -843,6 +1041,67 @@ export async function runFlow(flowContract, ctx) {
  * with step context so the author sees which step needs fixing.
  */
 export function normalizeFlow(runtime) {
+    // Recursive single-step normalizer. Branch sub-steps (cases + default) are
+    // normalized through the same helper, so nested branches and any lens-purity
+    // diagnostics inside them are handled identically at every depth.
+    const normalizeStep = (s, idx) => {
+        const stepLabel = s.name ??
+            (s.kind === "contract-call" ? `${s.contract._projection.id}#${s.caseKey}` : `step-${idx + 1}`);
+        if (s.kind === "branch") {
+            // Recurse over each case/default sub-step list. We re-index from 0 within
+            // the branch for labeling; the branch name (if any) carries outer context.
+            return extractBranchStep(s, (steps) => steps.map((sub, i) => normalizeStep(sub, i)));
+        }
+        if (s.kind === "compute") {
+            try {
+                const { reads, writes } = traceComputeFn(s.fn);
+                return { kind: "compute", name: s.name, reads, writes };
+            }
+            catch (err) {
+                // Wrap compute-tracer failures with the same step-context format
+                // used for lens errors, so authoring mistakes are equally easy
+                // to localize regardless of which tracer caught them.
+                throw new Error(`flow "${runtime.id}" step ${idx + 1} "${stepLabel}" (compute): ${err instanceof Error ? err.message : String(err)}`);
+            }
+        }
+        let inputs;
+        if (s.bindings?.in) {
+            try {
+                inputs = extractMappings(s.bindings.in);
+            }
+            catch (err) {
+                if (err instanceof LensPurityError) {
+                    throw new Error(`flow "${runtime.id}" step ${idx + 1} "${stepLabel}" (in lens): ${err.message}`);
+                }
+                throw err;
+            }
+        }
+        let outputs;
+        if (s.bindings?.out) {
+            try {
+                outputs = extractMappingsOut(s.bindings.out);
+            }
+            catch (err) {
+                if (err instanceof LensPurityError) {
+                    throw new Error(`flow "${runtime.id}" step ${idx + 1} "${stepLabel}" (out lens): ${err.message}`);
+                }
+                throw err;
+            }
+        }
+        return {
+            kind: "contract-call",
+            name: s.name,
+            contractId: s.contract._projection.id,
+            caseKey: s.caseKey,
+            protocol: s.ref.protocol,
+            target: s.ref.target,
+            inputs,
+            outputs,
+            ...(s.bindings?.accept
+                ? { accept: [...s.bindings.accept] }
+                : {}),
+        };
+    };
     return {
         id: runtime.id,
         protocol: "flow",
@@ -852,56 +1111,7 @@ export function normalizeFlow(runtime) {
         ...(runtime.skip !== undefined ? { skip: runtime.skip } : {}),
         ...(runtime.only !== undefined ? { only: runtime.only } : {}),
         setupDynamic: runtime.setup ? true : undefined,
-        steps: runtime.steps.map((s, idx) => {
-            const stepLabel = s.name ??
-                (s.kind === "contract-call" ? `${s.contract._projection.id}#${s.caseKey}` : `step-${idx + 1}`);
-            if (s.kind === "compute") {
-                try {
-                    const { reads, writes } = traceComputeFn(s.fn);
-                    return { kind: "compute", name: s.name, reads, writes };
-                }
-                catch (err) {
-                    // Wrap compute-tracer failures with the same step-context format
-                    // used for lens errors, so authoring mistakes are equally easy
-                    // to localize regardless of which tracer caught them.
-                    throw new Error(`flow "${runtime.id}" step ${idx + 1} "${stepLabel}" (compute): ${err instanceof Error ? err.message : String(err)}`);
-                }
-            }
-            let inputs;
-            if (s.bindings?.in) {
-                try {
-                    inputs = extractMappings(s.bindings.in);
-                }
-                catch (err) {
-                    if (err instanceof LensPurityError) {
-                        throw new Error(`flow "${runtime.id}" step ${idx + 1} "${stepLabel}" (in lens): ${err.message}`);
-                    }
-                    throw err;
-                }
-            }
-            let outputs;
-            if (s.bindings?.out) {
-                try {
-                    outputs = extractMappingsOut(s.bindings.out);
-                }
-                catch (err) {
-                    if (err instanceof LensPurityError) {
-                        throw new Error(`flow "${runtime.id}" step ${idx + 1} "${stepLabel}" (out lens): ${err.message}`);
-                    }
-                    throw err;
-                }
-            }
-            return {
-                kind: "contract-call",
-                name: s.name,
-                contractId: s.contract._projection.id,
-                caseKey: s.caseKey,
-                protocol: s.ref.protocol,
-                target: s.ref.target,
-                inputs,
-                outputs,
-            };
-        }),
+        steps: runtime.steps.map(normalizeStep),
     };
 }
 /**
@@ -919,6 +1129,28 @@ export function extractMappings(fn) {
     const result = fn(proxy);
     return collectMappings(result, []);
 }
+/**
+ * Run a single-selector lens `fn: (state) => state.a.b.c` through the strict
+ * tracing Proxy and return the read path (root segment dropped), e.g.
+ * `s => s.lookup.status` → `["lookup", "status"]`.
+ *
+ * Used by the condition/switch predicate builders (contract-flow-condition.ts)
+ * to capture a predicate's read path at construction time. The strict Proxy
+ * enforces purity (method calls / `new` / arithmetic-via-coercion throw
+ * `LensPurityError`); callers add a source-level single-selector gate on top
+ * to also reject ternaries / free-variable reads the Proxy can't see.
+ *
+ * Throws `LensPurityError` if the lens does not resolve to a single traced
+ * value (e.g. returns an object literal, a constant, or `undefined`).
+ */
+export function extractSelectorPath(fn) {
+    const result = fn(makeLensProxy("state"));
+    if (!isTracedValue(result)) {
+        throw new LensPurityError("state", "selector must read a single state path (e.g. s => s.a.b), not compute or repack a value");
+    }
+    const full = result[TRACE_MARKER]; // "state.lookup.status"
+    return full.split(".").slice(1); // drop "state" root
+}
 /**
  * Extract FieldMappings from `out: (state, response) => newState`.
  * Same purity contract as `extractMappings`.