@kortexya/reasoninglayer 1.24.0 → 1.26.0

package/dist/index.d.cts

@@ -109,7 +109,7 @@ type JsonValue$1 = string | number | boolean | null | JsonValue$1[] | object;
  * This is the single source of truth for the version constant.
  * The `scripts/release.sh` script updates this value alongside `package.json`.
  */
-declare const SDK_VERSION = "1.24.0";
+declare const SDK_VERSION = "1.26.0";
 /**
  * Authentication mode for the SDK.
  *
@@ -2532,8 +2532,17 @@ interface BeliefDto$1 {
      */
     sort_id?: string | null;
 }
-/** Binary operator for expressions */
-type BinaryOperatorDto$1 = "Add" | "Subtract" | "Multiply" | "Divide";
+/**
+ * Binary operator for expressions.
+ *
+ * The full algebra the domain's `BinaryOperator` carries, not a subset of it.
+ * Four arithmetic operators were declared here while the engine had fourteen,
+ * and OSFQL `DERIVE` builds function bodies with every one of them
+ * (`osfql/executor.rs`, `ir_expression_to_function_expr`) — so a definition
+ * created that way could not be expressed in this shape, and a read that
+ * answered in this shape had to either drop it or lie about it (#235).
+ */
+type BinaryOperatorDto$1 = "Add" | "Subtract" | "Multiply" | "Divide" | "Modulo" | "LessThan" | "LessThanOrEqual" | "GreaterThan" | "GreaterThanOrEqual" | "Equal" | "NotEqual" | "And" | "Or";
 /** Request to bind a sort to a SQL table. */
 interface BindSortRequest$1 {
     /** Column mappings: feature name to column spec. */
@@ -2646,7 +2655,7 @@ interface BindingSummaryDto$1 {
      * uniqueness constraint backs it or an operator ticked it, and those two
      * have opposite durability.
      */
-    key_provenance: KeyProvenanceDto;
+    key_provenance: KeyProvenanceDto$1;
     /** Sort ID (UUID string). */
     sort_id: string;
     /**
@@ -5574,6 +5583,22 @@ interface CondResponse$1 {
     condition_succeeded: boolean;
     success: boolean;
 }
+/**
+ * One `WHEN cond THEN value` branch of a conditional expression.
+ *
+ * The domain carries these as an unnamed `(Expression, Expression)` pair.
+ * A two-element JSON array would round-trip just as well and read as nothing
+ * at all, so the wire shape names both halves.
+ */
+interface ConditionalBranchDto$1 {
+    /**
+     * The value of the whole conditional when this is the first branch whose
+     * condition is `true`.
+     */
+    then: ExpressionDto$1;
+    /** The condition, evaluated in source order against the clause's bindings. */
+    when: ExpressionDto$1;
+}
 interface ConditionalIndependenceRequest$1 {
     /** Conditioning set */
     conditioning_set: string[];
@@ -8053,7 +8078,7 @@ interface DiscoveredFeatureDto$1 {
      * rebuild of the source: a uniqueness constraint does, a graph's internal
      * record id does not.
      */
-    identifier_provenance?: null | KeyProvenanceDto;
+    identifier_provenance?: null | KeyProvenanceDto$1;
     /** Whether the field is a primary key/identifier */
     is_identifier: boolean;
     /** Whether the field is a relation */
@@ -10694,7 +10719,16 @@ type ExpressionDto$1 = {
 } | {
     /** Arithmetic/logical expression */
     left: ExpressionDto$1;
-    /** Binary operator for expressions */
+    /**
+     * Binary operator for expressions.
+     *
+     * The full algebra the domain's `BinaryOperator` carries, not a subset of it.
+     * Four arithmetic operators were declared here while the engine had fourteen,
+     * and OSFQL `DERIVE` builds function bodies with every one of them
+     * (`osfql/executor.rs`, `ir_expression_to_function_expr`) — so a definition
+     * created that way could not be expressed in this shape, and a read that
+     * answered in this shape had to either drop it or lie about it (#235).
+     */
     op: BinaryOperatorDto$1;
     /** Arithmetic/logical expression */
     right: ExpressionDto$1;
@@ -10703,6 +10737,16 @@ type ExpressionDto$1 = {
     arguments: ExpressionDto$1[];
     function_name: string;
     type: "FunctionCall";
+} | {
+    /** Unary operator for expressions. */
+    op: UnaryOperatorDto$1;
+    /** Arithmetic/logical expression */
+    operand: ExpressionDto$1;
+    type: "UnaryOp";
+} | {
+    branches: ConditionalBranchDto$1[];
+    default?: null | ExpressionDto$1;
+    type: "Conditional";
 };
 /** Extended agent state DTO with full cognitive state. */
 interface ExtendedAgentStateDto$1 {
@@ -11417,7 +11461,23 @@ type FeatureTypeDto$1 = "string" | "integer" | "real" | "boolean" | "reference"
  * - null
  * - array of FeatureValueDto
  */
-type FeatureValueDto$1 = string | number | boolean | null | FeatureValueDto$1[];
+type FeatureValueDto$1 = {
+    term_id: string;
+    var_name: string;
+} | {
+    /**
+     * Feature value in a Ψ-term (untagged union). Can be:
+     * - UUID string (term reference)
+     * - string value
+     * - integer (i64)
+     * - number (f64)
+     * - boolean
+     * - null
+     * - array of FeatureValueDto
+     */
+    literal: FeatureValueDto$1;
+    term_id: string;
+} | string | number | boolean | null | FeatureValueDto$1[];
 /** Request to finalize a live oversight session. */
 interface FinalizeSessionRequest {
     /** Optional execution log (for full provenance) */
@@ -12099,10 +12159,49 @@ type FunctionBodyDto$1 = {
     program: string;
     type: "Neural";
 };
+/** One thing that calls a function. */
+interface FunctionCallerDto {
+    /** Where the reference lives. */
+    kind: FunctionCallerKind$1;
+    /**
+     * The calling function's name, or the rule conclusion's display, so a
+     * refusal names something the caller can find.
+     */
+    name: string;
+    /**
+     * Term id of the calling rule's conclusion, or of the `function_call`
+     * goal term when no rule holds it. Absent for a function caller, which is
+     * identified by name.
+     * @format uuid
+     */
+    term_id?: string | null;
+}
+/** What names a function — where the reference lives. */
+type FunctionCallerKind$1 = "function" | "rule";
+/**
+ * What `DELETE /api/v1/functions/{name}` does about the things that CALL the
+ * function.
+ *
+ * A function is reachable by name from two places: another registered
+ * function's clause body (`FunctionCall`), and a rule's `function_call` goal.
+ * Removing it underneath either leaves the caller naming something that no
+ * longer resolves, and the failure surfaces at evaluation time — which is
+ * exactly what "no route at all, recover with a tenant wipe" already produced
+ * and what this route exists to stop being the default.
+ */
+type FunctionCallersDisposition$1 = "refuse" | "orphan";
 /** A single clause in a function definition */
 interface FunctionClauseDto$1 {
     /** Function body - what to compute */
     body: FunctionBodyDto$1;
+    /**
+     * The clause's guard, if it has one.
+     *
+     * Omitted rather than serialized as `null` when absent, so what
+     * `GET /api/v1/functions/{name}` emits is byte-for-byte a body
+     * `register` and `PUT` accept (#235). An explicit `"guard": null` is
+     * still accepted on the way in.
+     */
     guard?: null | GuardDto;
     parameters: PatternDto$1[];
 }
@@ -12118,6 +12217,26 @@ interface FunctionDraftDto$1 {
 }
 /** Execution kind for a registered function. */
 type FunctionKindDto$1 = "Classic" | "Neural";
+/**
+ * Why a registered function cannot be replaced, in the same terms the
+ * mutation route would answer with.
+ *
+ * Mirrors `RuleNotWithdrawableDto`: the read tells a client what the write
+ * would say, so a UI can present the function without offering an edit that
+ * is going to be refused.
+ */
+interface FunctionNotReplaceableDto$1 {
+    /**
+     * The stable machine-readable discriminator `PUT` and `DELETE` carry —
+     * currently `function_plugin_owned`.
+     */
+    code: string;
+    /**
+     * The refusal in words, naming the lifecycle operation that DOES remove
+     * the function.
+     */
+    reason: string;
+}
 /**
  * Typed signature summary for a single registered function.
  *
@@ -12189,6 +12308,36 @@ type FunctionValueDto$1 = {
 } | {
     type: "Uninstantiated";
 };
+/**
+ * What withdrawing a registered function removed.
+ *
+ * A function is carried twice — the durable `meta.function` carrier Ψ-term
+ * that is the source of truth, and the evaluator's own registry used for
+ * dispatch — so both are reported. Forgetting either leaves it half-alive.
+ */
+interface FunctionWithdrawalReport$1 {
+    /**
+     * Everything that still names the function, left calling something that
+     * no longer resolves. Empty on the ordinary withdrawal; non-empty only
+     * under `?callers=orphan`, which is the disposition that permits it.
+     */
+    callers_orphaned?: FunctionCallerDto[];
+    /**
+     * Whether the durable `meta.function` carrier Ψ-term was deleted. `false`
+     * means the function is gone from this process but its carrier survives,
+     * so a restart would bring it back — the operator's cue to retry.
+     */
+    carrier_deleted: boolean;
+    /** Whether it left the in-process registry and the evaluator. */
+    deregistered: boolean;
+    /**
+     * Its stable id, as the registration reported it.
+     * @format uuid
+     */
+    function_id: string;
+    /** The function that was withdrawn. */
+    name: string;
+}
 /**
  * Request: render the LIFE-function definitions in the tenant's
  * term store.
@@ -13099,6 +13248,87 @@ interface GetFactsResponse$1 {
     /** List of facts */
     facts: PsiTermDto$1[];
 }
+/**
+ * Response of `GET /api/v1/functions/{name}` — the registered definition.
+ *
+ * # Why the clauses come back in the register shape
+ *
+ * `PUT /api/v1/functions/{name}` reports what it displaced — `previous`,
+ * `current`, `arity_changed`, every caller — and all of that describes the
+ * change AFTER it happened. Nothing let a caller see what they were about to
+ * overwrite, so a client editing one clause of a three-clause function had to
+ * re-author the other two from memory (#235).
+ *
+ * [`Self::clauses`] is therefore the exact payload
+ * `PUT /api/v1/functions/{name}` and `POST /api/v1/functions/register` accept:
+ * a read-modify-write is an edit, not a re-authoring, and needs no
+ * translation layer that could drop a body variant on the way through.
+ *
+ * # And why `clauses` is optional
+ *
+ * The clause shape is total over every construct the engine can currently
+ * build — that is what widening `BinaryOperatorDto` and `ExpressionDto` was
+ * for. It is NOT total over the domain's `Value`, which carries Ψ-terms,
+ * lists, geometries and more that no function producer emits.
+ *
+ * If one ever appears, the read declines to describe it rather than
+ * degrading it to `Uninstantiated`: `clauses` is absent,
+ * [`Self::unrepresentable`] names what stopped it, and the signature fields
+ * still answer. A wrong definition presented as a right one is the failure
+ * this route exists to prevent, and a `PUT` of it would destroy the real one.
+ */
+interface GetFunctionResponse$1 {
+    /**
+     * The number of named arguments it accepts.
+     * @min 0
+     */
+    arity: number;
+    /**
+     * Everything that calls this function, by the same scan `DELETE` refuses
+     * on and `PUT` reports.
+     *
+     * Read before offering an edit: a replacement that changes the arity
+     * keeps every one of these resolvable and makes every one of them wrong.
+     */
+    callers?: FunctionCallerDto[];
+    /**
+     * The pattern-matched clauses, tried in order — in the shape
+     * `register` and `PUT` accept.
+     *
+     * Absent only when the definition holds a construct this shape cannot
+     * express, in which case [`Self::unrepresentable`] says which.
+     */
+    clauses?: FunctionClauseDto$1[] | null;
+    /**
+     * Its stable id, as the registration reported it.
+     * @format uuid
+     */
+    function_id: string;
+    /** Whether it is classical or neural/fuzzy. */
+    kind: FunctionKindDto$1;
+    /** The function's name — the key `POST /functions/evaluate` takes. */
+    name: string;
+    /**
+     * When [`Self::replaceable`] is false, the refusal a `PUT` would produce
+     * — the same `code` and the same prose. Absent otherwise.
+     */
+    not_replaceable?: null | FunctionNotReplaceableDto$1;
+    /**
+     * Whether `PUT`/`DELETE` on this function will act rather than refuse.
+     *
+     * Read through the same admission the mutation routes run, so the read
+     * and the refusal cannot disagree. The engine stays the authority: a
+     * state change between this read and the write can still refuse.
+     */
+    replaceable: boolean;
+    /**
+     * What stopped the definition being expressed in the register shape.
+     *
+     * Absent — not empty — on the ordinary read. Present with `clauses`
+     * absent, never both.
+     */
+    unrepresentable?: string | null;
+}
 /** Request to read the fuzzy subsumption degree `sub ⊑· sup` */
 interface GetFuzzySubsumptionRequest {
     /**
@@ -16231,7 +16461,7 @@ type KbChangeDto$1 = {
  * *do the term ids survive a rebuild of the source?* — are readable without
  * inferring anything from a column's name.
  */
-interface KeyProvenanceDto {
+interface KeyProvenanceDto$1 {
     /**
      * Which side settled the key: `discovery`, `client`, `nobody` (a keyless
      * binding), or `unrecorded`.
@@ -23193,6 +23423,92 @@ interface RepairHintDto {
     /** The feature or predicate the hint applies to. */
     target: string;
 }
+/**
+ * Request body of `PUT /api/v1/functions/{name}` — the definition that
+ * replaces the one registered under the path name.
+ *
+ * # Why it accepts the register payload verbatim
+ *
+ * `POST /functions/register` takes `{tenant_id, name, arity, clauses}`, and
+ * that is the payload a client already has in hand when it decides to replace
+ * something. Sending it to `PUT` is the obvious move, and under
+ * `deny_unknown_fields` it would answer `422 unknown field 'tenant_id'` —
+ * technically correct and unhelpful, since the caller's actual question is
+ * about the two `name`s (#234).
+ *
+ * So both are declared, and each is handled explicitly rather than dropped:
+ *
+ * * `tenant_id` is **accepted and ignored**, exactly as `register_function`
+ *   ignores it — the tenant comes from the authenticated principal, and
+ *   trusting a body field would let a caller write into another tenant.
+ * * `name`, when present, **must equal the path's**. A mismatch is refused
+ *   with both names rather than silently applying the clauses to whichever
+ *   one the route happened to read.
+ *
+ * A *declared* field that is deliberately ignored is a different thing from
+ * an *undeclared* key that is silently dropped. The first is a documented
+ * contract; the second is the defect this issue is about.
+ */
+interface ReplaceFunctionRequest {
+    /**
+     * The number of named arguments the replacement accepts.
+     * @min 0
+     */
+    arity: number;
+    /** The replacement's pattern-matched clauses, tried in order. */
+    clauses: FunctionClauseDto$1[];
+    /**
+     * The function's name. Optional, and when present it must equal the
+     * path's — this route replaces a definition, it does not rename one.
+     *
+     * A rename would keep every caller's reference pointing at the OLD name,
+     * which no longer resolves; that is a withdrawal plus a registration, and
+     * the caller should say so.
+     */
+    name?: string | null;
+    /**
+     * Accepted so the `register` payload works verbatim, and **ignored**: the
+     * tenant is the authenticated principal's, never a body field.
+     * @format uuid
+     */
+    tenant_id?: string | null;
+}
+/**
+ * Response of `PUT /api/v1/functions/{name}`.
+ *
+ * # Why the previous signature is reported
+ *
+ * A function's identity is its NAME, so a replacement keeps every caller's
+ * reference valid — which is what makes an arity change dangerous rather than
+ * merely breaking: a caller passing the old number of arguments keeps
+ * resolving and starts failing at evaluation time with an arity error. The
+ * response names the change so a client can say so.
+ */
+interface ReplaceFunctionResponse$1 {
+    /**
+     * `true` when the arity changed. Every caller's reference stays valid and
+     * every call passing the old count now fails at evaluation time.
+     */
+    arity_changed: boolean;
+    /**
+     * Everything that calls this function. Reported rather than refused: the
+     * replacement keeps the name resolvable, so a caller is not orphaned —
+     * but one written against the old signature may no longer be correct.
+     */
+    callers?: FunctionCallerDto[];
+    /** What the replacement looks like. */
+    current: FunctionSummaryDto$1;
+    /**
+     * The replacement's id. A fresh registration mints a new one, so this
+     * differs from the previous definition's.
+     * @format uuid
+     */
+    function_id: string;
+    /** The function's name — unchanged by the replacement, by construction. */
+    name: string;
+    /** What the replaced definition looked like. */
+    previous: FunctionSummaryDto$1;
+}
 /**
  * Response of `PUT /api/v1/inference/rules/{id}`.
  *
@@ -24909,12 +25225,63 @@ interface RuleEntryDto$1 {
     certainty?: number | null;
     /** The head (consequent) of the rule. */
     head: PsiTermDto$1;
+    /**
+     * When [`Self::withdrawable`] is false, the refusal a withdrawal attempt
+     * would produce — the same prose, and the same `code`, the mutation route
+     * answers with.
+     *
+     * Absent for a withdrawable rule.
+     */
+    not_withdrawable?: null | RuleNotWithdrawableDto;
+    /**
+     * Where this rule came from, from the reading tenant's point of view.
+     *
+     * The listing deliberately returns the PLUGIN-MERGED rule set and admits
+     * the reserved system tenant's rules, because they fire in every tenant's
+     * proof — so three of the withdrawal route's five refusal classes describe
+     * rules that appear here (#232 §1).
+     */
+    origin: RuleOriginDto;
     /**
      * Rule term ID.
      * @format uuid
      */
     rule_id: string;
+    /**
+     * Whether `DELETE`/`PUT` on this rule will act rather than refuse.
+     *
+     * Derived from the same walk the mutation routes run, so the listing and
+     * the refusal cannot disagree. The engine stays the authority: a caller
+     * may still be refused by a state change between this read and the write.
+     */
+    withdrawable: boolean;
+}
+/**
+ * Why a listed rule cannot be withdrawn, in the same terms the mutation route
+ * would answer with.
+ */
+interface RuleNotWithdrawableDto {
+    /**
+     * The stable machine-readable discriminator the `DELETE` would carry —
+     * `rule_system_owned`, `rule_plugin_owned` or `rule_bootstrap`.
+     */
+    code: string;
+    /**
+     * The refusal in words, naming the lifecycle operation that DOES withdraw
+     * this rule.
+     */
+    reason: string;
 }
+/**
+ * Where a listed rule came from.
+ *
+ * The client-facing projection of the engine's provenance walk. A UI keys the
+ * row's actions on this rather than on `_plugin_id` — the underscore-prefixed
+ * provenance meta-feature the marketplace stamps on a plugin's clauses, which
+ * is documented as invisible to domain queries and cannot tell a system-wide
+ * plugin from a tenant-scoped one, nor see a bootstrap rule at all.
+ */
+type RuleOriginDto = "tenant" | "system_plugin" | "tenant_plugin" | "bootstrap";
 /** Response with rule store info */
 interface RuleStoreResponse$1 {
     /** @min 0 */
@@ -30065,6 +30432,8 @@ interface UiAffinityDoc {
 }
 /** Complete hierarchy of UI component sorts */
 type UiSort$1 = "app" | "page" | "dashboard" | "grid" | "flex" | "stack" | "box" | "card" | "divider" | "spacer" | "navbar" | "sidebar" | "tabs" | "tab_panel" | "breadcrumbs" | "menu" | "menu_item" | "link" | "router" | "route" | "data_table" | "column" | "list" | "list_item" | "tree" | "tree_node" | "chart" | "stat" | "badge" | "avatar" | "icon" | "image" | "video" | "text" | "heading" | "paragraph" | "code" | "markdown" | "label" | "form" | "form_field" | "input" | "textarea" | "select" | "option" | "checkbox" | "radio" | "radio_group" | "toggle" | "slider" | "date_picker" | "time_picker" | "date_range_picker" | "file_upload" | "color_picker" | "autocomplete" | "search_input" | "button" | "button_group" | "icon_button" | "fab" | "dropdown_button" | "modal" | "dialog" | "drawer" | "popover" | "tooltip" | "toast" | "alert" | "progress" | "spinner" | "skeleton" | "accordion" | "accordion_item" | "collapsible" | "carousel" | "drag_drop_zone" | "draggable" | "drop_target" | "resizable" | "sortable_list" | "command_palette" | "wizard" | "wizard_step" | "timeline" | "timeline_item" | "kanban_board" | "kanban_column" | "kanban_card" | "calendar" | "rich_text_editor" | "conditional" | "for_each" | "show" | "suspense" | "error_boundary" | "portal" | "data_source" | "computed" | "state" | "effect" | "on_event" | "on_click" | "on_submit" | "on_change" | "sequence" | "navigate" | "api_call" | "set_state" | "show_toast" | "open_modal" | "close_modal" | "animate" | "transition" | "keyframes" | "auth_provider" | "protected_route" | "login_form" | "logout_button" | "user_profile" | "permission_gate" | "session_timeout" | "i18n_provider" | "trans" | "language_switcher" | "locale_date" | "locale_number" | "locale_currency" | "bidi" | "responsive" | "show_on_breakpoint" | "hide_on_breakpoint" | "container_query" | "aspect_ratio" | "theme_provider" | "theme_toggle" | "css_var" | "styled" | "color_scheme" | "screen_reader_only" | "skip_link" | "focus_trap" | "live_region" | "keyboard_nav" | "accessible_label" | "focus_ring" | "virtual_list" | "virtual_grid" | "virtual_table" | "infinite_scroll" | "lazy_load" | "code_split" | "prefetch" | "offline_indicator" | "sync_status" | "cache_control" | "background_sync" | "install_prompt" | "update_available" | "undo_provider" | "undo_button" | "redo_button" | "history_browser" | "snapshot" | "restore_point" | "hotkey" | "shortcut_hint" | "key_combo" | "shortcut_scope" | "global_search" | "search_results" | "search_highlight" | "search_filters" | "recent_searches" | "copy_button" | "paste_handler" | "share_button" | "qr_code" | "export_button" | "print_button" | "print_only" | "screen_only" | "pdf_preview" | "presence_indicator" | "cursor_overlay" | "typing_indicator" | "conflict_resolver" | "realtime_diff" | "notification_center" | "push_notification" | "inbox" | "unread_badge" | "notification_settings" | "debug_panel" | "state_inspector" | "perf_monitor" | "network_inspector" | "error_reporter" | "position" | "layer" | "overlay" | "fixed" | "sticky" | "form_state_provider" | "field_error" | "validation_schema" | "async_validator" | "cross_field_validation" | "pagination" | "cursor_pagination" | "load_more" | "page_size_selector" | "search_params" | "route_params" | "deep_link" | "url_state" | "query_binding" | "scroll_container" | "scroll_snap" | "scroll_lock" | "scroll_restore" | "scroll_to" | "scroll_spy" | "selection_provider" | "selectable" | "selection_actions" | "range_selection" | "gesture_handler" | "swipe_action" | "pinch_zoom" | "long_press" | "pan_gesture" | "multi_touch" | "file_download" | "file_preview" | "file_progress" | "file_browser" | "drop_zone" | "image_cropper" | "animation_controller" | "animation_timeline" | "spring" | "motion_value" | "animate_presence" | "stagger" | "focus_scope" | "focus_manager" | "auto_focus" | "restore_focus" | "merge_conflict" | "conflict_resolution" | "version_indicator" | "tenant_provider" | "tenant_switcher" | "tenant_branding" | "audit_log" | "activity_feed" | "change_history" | "feature_gate" | "feature_provider" | "beta_badge" | "experiment" | "variant" | "experiment_provider" | "analytics" | "page_view" | "click_tracker" | "event_tracker" | "rate_limit_indicator" | "maintenance_mode" | "system_status" | "scheduled_downtime" | "document_head" | "meta_tag" | "document_title" | "open_graph" | "structured_data" | "video_call" | "audio_call" | "screen_share" | "media_stream" | "camera_capture" | "audio_recorder" | "canvas2_d" | "web_g_l" | "drawing_canvas" | "signature_pad" | "geolocation" | "device_orientation" | "camera" | "barcode_scanner" | "local_storage_binding" | "session_storage_binding" | "indexed_db_binding";
+/** Unary operator for expressions. */
+type UnaryOperatorDto$1 = "Not" | "Negate";
 interface UncertainEdgeDto$1 {
     /** Possible directions */
     possible_directions: [string, string][];
@@ -32224,20 +32593,71 @@ type FeatureTargetDto = TaggedFeatureValueDto | string;
  * Do NOT use with term CRUD or query endpoints — use {@link ValueDto} instead.
  *
  * The backend Rust type is `FeatureValueDto` in `dto/homoiconic.rs` with
- * `#[serde(untagged)]`. Variant ordering:
- * 1. TermRef (UUID string)
- * 2. TermRefs/List (array of FeatureValueDto)
- * 3. String
- * 4. Integer (i64)
- * 5. Real (f64)
- * 6. Boolean
- * 7. Null (uninstantiated)
+ * `#[serde(untagged)]`. Variant ordering — **load-bearing**, because an
+ * untagged union tries its variants in declaration order and an object with
+ * extra keys still matches an earlier variant that ignores them:
+ * 1. Variable (`{term_id, var_name}`)
+ * 2. Literal (`{term_id, literal}`)
+ * 3. TermRef (`{term_id}`)
+ * 4. TermRefs/List (array of FeatureValueDto)
+ * 5. String
+ * 6. Integer (i64)
+ * 7. Real (f64)
+ * 8. Boolean
+ * 9. Null (uninstantiated)
  *
  * **Ambiguity note**: UUID strings and regular strings are both `string` in TypeScript.
  * The backend distinguishes them by UUID format. The SDK provides
  * `discriminateFeatureValue()` in `utils/discrimination.ts` for response parsing.
  */
-type FeatureValueDto = string | number | boolean | null | FeatureValueDto[];
+type FeatureValueDto = VariableFeatureValue | LiteralFeatureValue | TermRefFeatureValue | string | number | boolean | null | FeatureValueDto[];
+/**
+ * A feature bound to a LOGIC VARIABLE, carrying the name the rule author wrote.
+ *
+ * @remarks
+ * A variable and a reference to a stored term are both `Value::Reference` in
+ * the engine, so both used to arrive as a bare {@link TermRefFeatureValue} —
+ * nothing in a rule's features said that `name` was bound to `?N` rather than
+ * to a term, and the name existed only inside the `display` prose (#232 §2).
+ *
+ * `termId` is the variable term's, so **two features bound to the same variable
+ * carry the same id**. That is how a client reads the coreference which makes
+ * `senior(name: ?N) WHEN person(name: ?N)` a join rather than two independent
+ * patterns.
+ */
+interface VariableFeatureValue {
+    /** The variable term's UUID. Shared by every feature bound to it. */
+    term_id: string;
+    /** The variable's name as authored, e.g. `?N`. */
+    var_name: string;
+}
+/**
+ * A feature bound to an INTERNED LITERAL WRAPPER, carrying the scalar it holds.
+ *
+ * @remarks
+ * The engine interns a guard's bound as a term — `65` becomes an
+ * `integer_type` Ψ-term — so reading it used to cost one `GET /terms/{id}` per
+ * guard, and the summary that exists to save that round trip named the
+ * wrapper's SORT rather than its value (#232 §4).
+ */
+interface LiteralFeatureValue {
+    /** The wrapper term's UUID. */
+    term_id: string;
+    /** The scalar the wrapper holds. */
+    literal: FeatureValueDto;
+}
+/**
+ * A reference to another term, with nothing said about what it is.
+ *
+ * @remarks
+ * What a reference falls back to when it is neither a named variable nor an
+ * interned literal — an ordinary stored term, or an anonymous variable, which
+ * carries no name to report.
+ */
+interface TermRefFeatureValue {
+    /** The referenced term's UUID. */
+    term_id: string;
+}
 
 type values_BellShape = BellShape;
 type values_BooleanValue = BooleanValue;
@@ -32253,6 +32673,7 @@ type values_GaussianProductShape = GaussianProductShape;
 type values_GaussianShape = GaussianShape;
 type values_IntegerValue = IntegerValue;
 type values_ListValue = ListValue;
+type values_LiteralFeatureValue = LiteralFeatureValue;
 type values_PiShapeShape = PiShapeShape;
 type values_PiecewiseLinearShape = PiecewiseLinearShape;
 type values_RealValue = RealValue;
@@ -32266,13 +32687,15 @@ type values_SortIdValue = SortIdValue;
 type values_SpikeShape = SpikeShape;
 type values_StringValue = StringValue;
 type values_TaggedFeatureValueDto = TaggedFeatureValueDto;
+type values_TermRefFeatureValue = TermRefFeatureValue;
 type values_TrapezoidalShape = TrapezoidalShape;
 type values_TriangularShape = TriangularShape;
 type values_UninstantiatedValue = UninstantiatedValue;
 type values_ValueDto = ValueDto;
+type values_VariableFeatureValue = VariableFeatureValue;
 type values_ZShapeShape = ZShapeShape;
 declare namespace values {
-  export type { values_BellShape as BellShape, values_BooleanValue as BooleanValue, values_CauchyShape as CauchyShape, values_CosineShape as CosineShape, values_CyclicGaussianShape as CyclicGaussianShape, values_FeatureTargetDto as FeatureTargetDto, values_FeatureValueDto as FeatureValueDto, values_FuzzyNumberValue as FuzzyNumberValue, values_FuzzyScalarValue as FuzzyScalarValue, values_FuzzyShapeDto as FuzzyShapeDto, values_GaussianProductShape as GaussianProductShape, values_GaussianShape as GaussianShape, values_IntegerValue as IntegerValue, values_ListValue as ListValue, values_PiShapeShape as PiShapeShape, values_PiecewiseLinearShape as PiecewiseLinearShape, values_RealValue as RealValue, values_ReferenceValue as ReferenceValue, values_SShapeShape as SShapeShape, values_SetValue as SetValue, values_SigmoidDifferenceShape as SigmoidDifferenceShape, values_SigmoidProductShape as SigmoidProductShape, values_SigmoidShape as SigmoidShape, values_SortIdValue as SortIdValue, values_SpikeShape as SpikeShape, values_StringValue as StringValue, values_TaggedFeatureValueDto as TaggedFeatureValueDto, values_TrapezoidalShape as TrapezoidalShape, values_TriangularShape as TriangularShape, values_UninstantiatedValue as UninstantiatedValue, values_ValueDto as ValueDto, values_ZShapeShape as ZShapeShape };
+  export type { values_BellShape as BellShape, values_BooleanValue as BooleanValue, values_CauchyShape as CauchyShape, values_CosineShape as CosineShape, values_CyclicGaussianShape as CyclicGaussianShape, values_FeatureTargetDto as FeatureTargetDto, values_FeatureValueDto as FeatureValueDto, values_FuzzyNumberValue as FuzzyNumberValue, values_FuzzyScalarValue as FuzzyScalarValue, values_FuzzyShapeDto as FuzzyShapeDto, values_GaussianProductShape as GaussianProductShape, values_GaussianShape as GaussianShape, values_IntegerValue as IntegerValue, values_ListValue as ListValue, values_LiteralFeatureValue as LiteralFeatureValue, values_PiShapeShape as PiShapeShape, values_PiecewiseLinearShape as PiecewiseLinearShape, values_RealValue as RealValue, values_ReferenceValue as ReferenceValue, values_SShapeShape as SShapeShape, values_SetValue as SetValue, values_SigmoidDifferenceShape as SigmoidDifferenceShape, values_SigmoidProductShape as SigmoidProductShape, values_SigmoidShape as SigmoidShape, values_SortIdValue as SortIdValue, values_SpikeShape as SpikeShape, values_StringValue as StringValue, values_TaggedFeatureValueDto as TaggedFeatureValueDto, values_TermRefFeatureValue as TermRefFeatureValue, values_TrapezoidalShape as TrapezoidalShape, values_TriangularShape as TriangularShape, values_UninstantiatedValue as UninstantiatedValue, values_ValueDto as ValueDto, values_VariableFeatureValue as VariableFeatureValue, values_ZShapeShape as ZShapeShape };
 }
 
 /**
@@ -33871,6 +34294,11 @@ interface FindBySortRequest {
     sortName?: string | null;
     /** Optional filter for feature-based filtering. */
     filter?: Record<string, string> | null;
+    /**
+     * Cap on the number of terms returned, applied after the filter. Omit (or
+     * pass 0) for no cap.
+     */
+    limit?: number | null;
 }
 /**
  * Request to validate a term against its sort's type witnesses.
@@ -35367,6 +35795,58 @@ interface RuleEntryDto {
     body: PsiTermDto[];
     /** Optional certainty/confidence for the rule. */
     certainty?: number | null;
+    /**
+     * Where this rule came from, from the reading tenant's point of view.
+     *
+     * @remarks
+     * The listing deliberately returns the PLUGIN-MERGED rule set and admits the
+     * reserved system tenant's rules, because they fire in every tenant's proof
+     * — so three of the withdrawal route's five refusal classes describe rules
+     * that appear here.
+     */
+    origin: RuleOrigin;
+    /**
+     * Whether `deleteRule` / `replaceRule` will act on this rule rather than
+     * refuse.
+     *
+     * @remarks
+     * Derived from the same walk the mutation routes run, so the listing and the
+     * refusal cannot disagree. The engine stays the authority: a caller may
+     * still be refused by a state change between this read and the write.
+     */
+    withdrawable: boolean;
+    /**
+     * When {@link RuleEntryDto.withdrawable} is false, the refusal a withdrawal
+     * would produce — the same `code` and prose the mutation route answers with.
+     * Absent for a withdrawable rule.
+     */
+    notWithdrawable?: RuleNotWithdrawable;
+}
+/**
+ * Where a listed rule came from.
+ *
+ * @remarks
+ * A UI keys a row's actions on this rather than on `_plugin_id` — the
+ * underscore-prefixed provenance meta-feature the marketplace stamps on a
+ * plugin's clauses, which is documented as invisible to domain queries, cannot
+ * tell a system-wide plugin from a tenant-scoped one, and sees nothing at all
+ * for a bootstrap rule.
+ *
+ * - `tenant` — authored in this tenant. The only withdrawable origin.
+ * - `system_plugin` — a system-wide plugin's rule, firing in every tenant's proof.
+ * - `tenant_plugin` — contributed by a plugin installed in this tenant.
+ * - `bootstrap` — engine machinery (an Allen relation, a handler mapping).
+ */
+type RuleOrigin = 'tenant' | 'system_plugin' | 'tenant_plugin' | 'bootstrap';
+/** Why a listed rule cannot be withdrawn, in the mutation route's own terms. */
+interface RuleNotWithdrawable {
+    /**
+     * The stable discriminator the `DELETE` would carry — `rule_system_owned`,
+     * `rule_plugin_owned` or `rule_bootstrap`.
+     */
+    code: string;
+    /** The refusal in words, naming the lifecycle operation that DOES withdraw it. */
+    reason: string;
 }
 /** Response listing all rules for a tenant. */
 interface GetRulesResponse {
@@ -35796,6 +36276,8 @@ type inference_RuleDerivationsDisposition = RuleDerivationsDisposition;
 type inference_RuleDraftClarificationQuestionDto = RuleDraftClarificationQuestionDto;
 type inference_RuleDraftDto = RuleDraftDto;
 type inference_RuleEntryDto = RuleEntryDto;
+type inference_RuleNotWithdrawable = RuleNotWithdrawable;
+type inference_RuleOrigin = RuleOrigin;
 type inference_RuleTermDraftDto = RuleTermDraftDto;
 type inference_RuleWithdrawalReport = RuleWithdrawalReport;
 type inference_SolutionDto = SolutionDto;
@@ -35803,7 +36285,7 @@ type inference_TaggedDerivedFact = TaggedDerivedFact;
 type inference_TaggedForwardChainRequest = TaggedForwardChainRequest;
 type inference_TaggedForwardChainResponse = TaggedForwardChainResponse;
 declare namespace inference {
-  export type { inference_AddFactRequest as AddFactRequest, inference_AddFactResponse as AddFactResponse, inference_AddRuleRequest as AddRuleRequest, inference_AddRuleResponse as AddRuleResponse, inference_AllenRelation as AllenRelation, inference_BackwardChainRequest as BackwardChainRequest, inference_BackwardChainResponse as BackwardChainResponse, inference_BayesianEffectDto as BayesianEffectDto, inference_BayesianPredictRequest as BayesianPredictRequest, inference_BayesianPredictResponse as BayesianPredictResponse, inference_BindingDto as BindingDto, inference_BulkAddFactsRequest as BulkAddFactsRequest, inference_BulkAddFactsResponse as BulkAddFactsResponse, inference_BulkAddRulesRequest as BulkAddRulesRequest, inference_BulkAddRulesResponse as BulkAddRulesResponse, inference_BulkFuzzyProveRequest as BulkFuzzyProveRequest, inference_BulkFuzzyProveResponse as BulkFuzzyProveResponse, inference_ClearFactsResponse as ClearFactsResponse, inference_ConstraintInputDto as ConstraintInputDto, inference_CreateGoalRequest as CreateGoalRequest, inference_CreateGoalResponse as CreateGoalResponse, inference_DeleteGoalResponse as DeleteGoalResponse, inference_DraftRulesRequest as DraftRulesRequest, inference_DraftRulesResponse as DraftRulesResponse, inference_FactConfidenceEntry as FactConfidenceEntry, inference_ForwardChainRequest as ForwardChainRequest, inference_ForwardChainResponse as ForwardChainResponse, inference_FuzzyProveRequest as FuzzyProveRequest, inference_FuzzyProveResponse as FuzzyProveResponse, inference_GetFactsResponse as GetFactsResponse, inference_GetRulesResponse as GetRulesResponse, inference_GoalDto as GoalDto, inference_GoalSummaryDto as GoalSummaryDto, inference_GuardOp as GuardOp, inference_HomoiconicSubstitutionDto as HomoiconicSubstitutionDto, inference_ListGoalsResponse as ListGoalsResponse, inference_LiteralInputDto as LiteralInputDto, inference_MetaSortsResponse as MetaSortsResponse, inference_NafProveRequest as NafProveRequest, inference_NafProveResponse as NafProveResponse, inference_ProofDto as ProofDto, inference_ProvenanceTagDto as ProvenanceTagDto, inference_ReplaceRuleResponse as ReplaceRuleResponse, inference_RuleAggregatorDto as RuleAggregatorDto, inference_RuleCertificationDelta as RuleCertificationDelta, inference_RuleDerivationsDisposition as RuleDerivationsDisposition, inference_RuleDraftClarificationQuestionDto as RuleDraftClarificationQuestionDto, inference_RuleDraftDto as RuleDraftDto, inference_RuleEntryDto as RuleEntryDto, inference_RuleTermDraftDto as RuleTermDraftDto, inference_RuleWithdrawalReport as RuleWithdrawalReport, inference_SolutionDto as SolutionDto, inference_TaggedDerivedFact as TaggedDerivedFact, inference_TaggedForwardChainRequest as TaggedForwardChainRequest, inference_TaggedForwardChainResponse as TaggedForwardChainResponse };
+  export type { inference_AddFactRequest as AddFactRequest, inference_AddFactResponse as AddFactResponse, inference_AddRuleRequest as AddRuleRequest, inference_AddRuleResponse as AddRuleResponse, inference_AllenRelation as AllenRelation, inference_BackwardChainRequest as BackwardChainRequest, inference_BackwardChainResponse as BackwardChainResponse, inference_BayesianEffectDto as BayesianEffectDto, inference_BayesianPredictRequest as BayesianPredictRequest, inference_BayesianPredictResponse as BayesianPredictResponse, inference_BindingDto as BindingDto, inference_BulkAddFactsRequest as BulkAddFactsRequest, inference_BulkAddFactsResponse as BulkAddFactsResponse, inference_BulkAddRulesRequest as BulkAddRulesRequest, inference_BulkAddRulesResponse as BulkAddRulesResponse, inference_BulkFuzzyProveRequest as BulkFuzzyProveRequest, inference_BulkFuzzyProveResponse as BulkFuzzyProveResponse, inference_ClearFactsResponse as ClearFactsResponse, inference_ConstraintInputDto as ConstraintInputDto, inference_CreateGoalRequest as CreateGoalRequest, inference_CreateGoalResponse as CreateGoalResponse, inference_DeleteGoalResponse as DeleteGoalResponse, inference_DraftRulesRequest as DraftRulesRequest, inference_DraftRulesResponse as DraftRulesResponse, inference_FactConfidenceEntry as FactConfidenceEntry, inference_ForwardChainRequest as ForwardChainRequest, inference_ForwardChainResponse as ForwardChainResponse, inference_FuzzyProveRequest as FuzzyProveRequest, inference_FuzzyProveResponse as FuzzyProveResponse, inference_GetFactsResponse as GetFactsResponse, inference_GetRulesResponse as GetRulesResponse, inference_GoalDto as GoalDto, inference_GoalSummaryDto as GoalSummaryDto, inference_GuardOp as GuardOp, inference_HomoiconicSubstitutionDto as HomoiconicSubstitutionDto, inference_ListGoalsResponse as ListGoalsResponse, inference_LiteralInputDto as LiteralInputDto, inference_MetaSortsResponse as MetaSortsResponse, inference_NafProveRequest as NafProveRequest, inference_NafProveResponse as NafProveResponse, inference_ProofDto as ProofDto, inference_ProvenanceTagDto as ProvenanceTagDto, inference_ReplaceRuleResponse as ReplaceRuleResponse, inference_RuleAggregatorDto as RuleAggregatorDto, inference_RuleCertificationDelta as RuleCertificationDelta, inference_RuleDerivationsDisposition as RuleDerivationsDisposition, inference_RuleDraftClarificationQuestionDto as RuleDraftClarificationQuestionDto, inference_RuleDraftDto as RuleDraftDto, inference_RuleEntryDto as RuleEntryDto, inference_RuleNotWithdrawable as RuleNotWithdrawable, inference_RuleOrigin as RuleOrigin, inference_RuleTermDraftDto as RuleTermDraftDto, inference_RuleWithdrawalReport as RuleWithdrawalReport, inference_SolutionDto as SolutionDto, inference_TaggedDerivedFact as TaggedDerivedFact, inference_TaggedForwardChainRequest as TaggedForwardChainRequest, inference_TaggedForwardChainResponse as TaggedForwardChainResponse };
 }
 
 /**
@@ -51132,12 +51614,25 @@ interface StructuredIngestionStatsDto {
     entitiesCreated: number;
     /** Number of entities extracted (from pipeline). */
     entitiesExtracted: number;
+    /**
+     * Number of records the source reported as available for the ingested
+     * tables, before any cap or collapse. Compared with `recordsProcessed` a cap
+     * hit is visible; compared with `termsCreated`, a partial ingest is.
+     */
+    recordsAvailable: number;
     /** Number of source records processed. */
     recordsProcessed: number;
     /** Number of relations created. */
     relationsCreated: number;
     /** Number of relations discovered. */
     relationsDiscovered: number;
+    /**
+     * Number of rows that collapsed onto a key value another row already
+     * produced in the same run — the bound-key upsert merged them into one term.
+     * Zero when the bound key identifies rows uniquely; named in `warnings` when
+     * it is not.
+     */
+    rowsCollapsed: number;
     /** Number of sorts created (from pipeline). */
     sortsCreated: number;
     /** Number of types/tables discovered. */
@@ -56015,6 +56510,19 @@ declare class PreferencesClient {
 declare class Functions<SecurityDataType = unknown> {
     http: HttpClient<SecurityDataType>;
     constructor(http: HttpClient<SecurityDataType>);
+    /**
+     * @description # The disposition is the caller's `?callers=refuse` (the default) refuses while anything calls the function and names every caller; `?callers=orphan` withdraws it anyway and reports the callers left naming something that no longer resolves. A withdrawal that silently orphans its callers is the state the missing route already produced. # Authorization Requires `X-Tenant-Id`. The function store is tenant-keyed, so another tenant's function is `404` rather than forbidden. Every request is captured by the audit middleware.
+     *
+     * @tags functions
+     * @name DeleteFunction
+     * @summary Withdraw a registered function.
+     * @request DELETE:/api/v1/functions/{name}
+     * @secure
+     */
+    deleteFunction: (name: string, query?: {
+        /** What to do about the things that call this function. */
+        callers?: FunctionCallersDisposition$1;
+    }, params?: RequestParams) => Promise<HttpResponse<FunctionWithdrawalReport$1, void>>;
     /**
      * @description Never writes to the KB — returns a validated draft for human review.
      *
@@ -56035,6 +56543,16 @@ declare class Functions<SecurityDataType = unknown> {
      * @secure
      */
     evaluateFunction: (data: EvaluateFunctionRequest$1, params?: RequestParams) => Promise<HttpResponse<EvaluateFunctionResponse$1, void>>;
+    /**
+     * @description # Why this route had to exist `/api/v1/functions` had five routes and none of them returned a definition: the listing answers summaries (`name`, `arity`, `clauses_count`, `kind`), and `GET /api/v1/functions/{name}` was a `405`. So `PUT` replaced a definition its caller could not see — a client fixing one clause of a three-clause function had to remember the other two or lose them, and the route made a partial edit look like a whole one (#235). # The clauses come back in the shape `PUT` takes [`GetFunctionResponse::clauses`] is the exact `clauses` payload `POST /functions/register` and `PUT /functions/{name}` accept, so a read-modify-write needs no translation layer that could drop a body variant on the way through. Making that true meant widening the request shape: `BinaryOperatorDto` carried four of the domain's thirteen operators and `ExpressionDto` was missing `UnaryOp` and `Conditional`, while OSFQL `DERIVE` builds function bodies with every one of them. A read in the old shape would have had to drop a `CASE WHEN` or lie about a `%`. # Reading is not changing A plugin-contributed function is refused by `DELETE` and `PUT` and **returned** by this route, with `replaceable: false` and the refusal the mutation would answer with. The listing already admits it exists; refusing to describe it would leave a client unable to show what the plugin contributed while still showing its name. The refusal is read from the same walk the mutation routes run, so the two cannot disagree. # Authorization Requires `X-Tenant-Id`. The function store is tenant-keyed, so another tenant's function is `404` rather than forbidden — saying anything else would confirm the name exists somewhere.
+     *
+     * @tags functions
+     * @name GetFunction
+     * @summary Read one registered function's definition.
+     * @request GET:/api/v1/functions/{name}
+     * @secure
+     */
+    getFunction: (name: string, params?: RequestParams) => Promise<HttpResponse<GetFunctionResponse$1, void>>;
     /**
      * @description This is the discovery counterpart to `register_function`/`evaluate_function`: it projects the tenant's slice of the function sub-lattice into a list of typed signatures (name + arity + clause count) without evaluating anything. The tenant is taken from the authenticated principal (never a body field), honouring the tenancy-scoping invariant.
      *
@@ -56055,12 +56573,47 @@ declare class Functions<SecurityDataType = unknown> {
      * @secure
      */
     registerFunction: (data: RegisterFunctionRequest$1, params?: RequestParams) => Promise<HttpResponse<RegisterFunctionResponse$1, void>>;
+    /**
+     * @description # Why this is not `POST /functions/register` Registration already replaces by name — silently, reporting nothing about what it displaced. `PUT` is the operation that says so: it refuses when nothing is registered under the name (that is registration's job), and answers with the previous signature, the new one, whether the arity moved, and everything that calls the function. # The arity is the hazard A function's identity is its NAME, so a replacement keeps every caller's reference valid — nothing dangles. That is exactly why an arity change is dangerous rather than merely breaking: every call still resolves, and one passing the old number of arguments starts failing at evaluation time. Reported, not refused: the caller may be replacing the function precisely because its signature was wrong. # Authorization Identical to `DELETE`: tenant-keyed, plugin-owned functions refused, audited.
+     *
+     * @tags functions
+     * @name ReplaceFunction
+     * @summary Replace a registered function's definition.
+     * @request PUT:/api/v1/functions/{name}
+     * @secure
+     */
+    replaceFunction: (name: string, data: ReplaceFunctionRequest, params?: RequestParams) => Promise<HttpResponse<ReplaceFunctionResponse$1, void>>;
 }
 
 /**
  * Binary operator for expressions within function bodies.
+ *
+ * @remarks
+ * The whole algebra the engine carries, not the arithmetic corner of it. Four
+ * operators were declared here while the engine had thirteen, and OSFQL
+ * `DERIVE` builds function bodies with every one of them — so a definition
+ * created that way could not be expressed in this shape, and a read that
+ * answered in this shape had to drop it or lie about it (backend #235).
  */
-type BinaryOperatorDto = 'Add' | 'Subtract' | 'Multiply' | 'Divide';
+type BinaryOperatorDto = 'Add' | 'Subtract' | 'Multiply' | 'Divide' | 'Modulo' | 'LessThan' | 'LessThanOrEqual' | 'GreaterThan' | 'GreaterThanOrEqual' | 'Equal' | 'NotEqual' | 'And' | 'Or';
+/** Unary operator for expressions within function bodies. */
+type UnaryOperatorDto = 'Not' | 'Negate';
+/**
+ * One `WHEN cond THEN value` branch of a {@link ExpressionDto} `Conditional`.
+ *
+ * @remarks
+ * The engine carries these as an unnamed pair; the wire names both halves,
+ * because a two-element array round-trips as well and reads as nothing.
+ */
+interface ConditionalBranchDto {
+    /** The condition, evaluated in source order against the clause's bindings. */
+    when: ExpressionDto;
+    /**
+     * The value of the whole conditional when this is the first branch whose
+     * condition holds.
+     */
+    then: ExpressionDto;
+}
 /**
  * Value type for LIFE-style function literals.
  *
@@ -56104,6 +56657,16 @@ type ExpressionDto = {
     type: 'FunctionCall';
     functionName: string;
     arguments: ExpressionDto[];
+} | {
+    type: 'UnaryOp';
+    op: UnaryOperatorDto;
+    operand: ExpressionDto;
+} | {
+    type: 'Conditional';
+    /** Branches, tried in order; the first whose `when` holds supplies the value. */
+    branches: ConditionalBranchDto[];
+    /** The value when no branch holds. `null` when the conditional has none. */
+    default?: ExpressionDto | null;
 };
 /**
  * Function body — what a clause computes.
@@ -56396,27 +56959,231 @@ type DraftFunctionResponse = {
     /** Non-fatal issues the user should see (e.g., unknown function references). */
     warnings: string[];
 };
+/** What a withdrawal does about the things that CALL the function. */
+type FunctionCallersDisposition = 'refuse' | 'orphan';
+/** Where a reference to a function lives. */
+type FunctionCallerKind = 'function' | 'rule';
+/**
+ * One thing that calls a function.
+ *
+ * @remarks
+ * A function is reachable by name from exactly two places: another registered
+ * function's clause body, and a rule's `function_call` goal. Both are scanned
+ * before a withdrawal, because removing the function underneath either leaves
+ * the caller naming something that no longer resolves — and the failure
+ * surfaces at evaluation time.
+ */
+interface FunctionCaller {
+    /** Where the reference lives. */
+    kind: FunctionCallerKind;
+    /**
+     * The calling function's name, or a label for the calling rule — so a
+     * refusal names something the caller can find.
+     */
+    name: string;
+    /**
+     * Term id of the calling rule's conclusion, or of the `function_call` goal
+     * when no rule holds it. Absent for a function caller, which is identified
+     * by name.
+     */
+    termId?: string;
+}
+/**
+ * What withdrawing a registered function removed.
+ *
+ * @remarks
+ * A function is carried TWICE — the durable `meta.function` carrier Ψ-term
+ * that is the source of truth, and the evaluator's own registry used for
+ * dispatch — so both are reported. Forgetting either leaves it half-alive:
+ * still evaluable, or back after a restart.
+ */
+interface FunctionWithdrawalReport {
+    /** The function that was withdrawn. */
+    name: string;
+    /** Its stable id, as the registration reported it. */
+    functionId: string;
+    /**
+     * Whether the durable carrier was deleted. `false` means the function is
+     * gone from this process but its carrier survives, so a restart would bring
+     * it back — the cue to retry.
+     */
+    carrierDeleted: boolean;
+    /** Whether it left the in-process registry and the evaluator. */
+    deregistered: boolean;
+    /**
+     * Everything still naming the function, left calling what no longer
+     * resolves. Empty on the ordinary withdrawal; non-empty only under
+     * `callers: 'orphan'`.
+     */
+    callersOrphaned: FunctionCaller[];
+}
+/**
+ * Why a registered function cannot be replaced, in the terms the mutation
+ * route would answer with.
+ *
+ * @remarks
+ * The read tells a client what the write would say, so a surface can present
+ * the function without offering an edit that is going to be refused.
+ */
+interface FunctionNotReplaceableDto {
+    /**
+     * The stable machine-readable discriminator `PUT` and `DELETE` carry —
+     * currently `'function_plugin_owned'`.
+     */
+    code: string;
+    /** The refusal in words, naming the lifecycle operation that DOES remove it. */
+    reason: string;
+}
+/**
+ * The signature half of a read definition — everything that answers whether or
+ * not the clauses could be expressed.
+ */
+interface FunctionDefinitionSignature {
+    /** The function's name — the key `POST /functions/evaluate` takes. */
+    name: string;
+    /** Its stable id, as the registration reported it. */
+    functionId: string;
+    /** The number of named arguments it accepts. */
+    arity: number;
+    /** Whether it is classical or neural/fuzzy. */
+    kind: FunctionKindDto;
+    /**
+     * Whether `PUT`/`DELETE` on this function will act rather than refuse.
+     *
+     * Read through the same admission the mutation routes run, so the read and
+     * the refusal cannot disagree. The engine stays the authority: a state
+     * change between this read and the write can still refuse.
+     */
+    replaceable: boolean;
+    /** The refusal a `PUT` would produce. Absent while `replaceable` is true. */
+    notReplaceable?: FunctionNotReplaceableDto;
+    /**
+     * Everything that calls this function, by the same scan `DELETE` refuses on
+     * and `PUT` reports.
+     *
+     * Read before offering an edit: a replacement that changes the arity keeps
+     * every one of these resolvable and makes every one of them wrong. Empty
+     * when nothing calls it.
+     */
+    callers: FunctionCaller[];
+}
+/**
+ * One registered function's definition, as `GET /functions/{name}` answers it.
+ *
+ * @remarks
+ * ## The clauses come back in the shape `PUT` takes
+ *
+ * The `clauses` of a readable definition are the exact payload
+ * {@link FunctionsClient.registerFunction} and
+ * {@link FunctionsClient.replaceFunction} accept, so a read-modify-write is an
+ * edit rather than a re-authoring. That is the point of the route: `PUT`
+ * replaces the WHOLE definition, so before it a client fixing one clause of a
+ * three-clause function had to remember the other two or lose them.
+ *
+ * ## Withheld is not empty, and the type says so
+ *
+ * `clauses: []` is a function with no clauses. A definition holding a
+ * construct the register shape cannot express comes back with no `clauses` at
+ * all and an `unrepresentable` reason — the engine declines to describe it
+ * rather than degrading it, because a `PUT` of a degraded read would destroy
+ * the real definition.
+ *
+ * The two are modelled as a union rather than two optional fields, so a client
+ * cannot read `clauses` without first ruling the withheld case out:
+ *
+ * ```typescript
+ * const definition = await client.functions.getFunction('scale');
+ * if (definition.clauses === undefined) {
+ *   console.warn(`cannot edit scale: ${definition.unrepresentable}`);
+ * } else {
+ *   await client.functions.replaceFunction('scale', {
+ *     arity: definition.arity,
+ *     clauses: [...definition.clauses, extraClause],
+ *   });
+ * }
+ * ```
+ *
+ * ## Reading is not changing
+ *
+ * A plugin-contributed function is refused by `DELETE`/`PUT` and RETURNED
+ * here, with `replaceable: false` and the refusal the mutation would give.
+ */
+type GetFunctionResponse = FunctionDefinitionSignature & ({
+    /**
+     * The pattern-matched clauses, tried in order — in the shape
+     * `register` and `PUT` accept.
+     */
+    clauses: FunctionClauseDto[];
+    unrepresentable?: undefined;
+} | {
+    clauses?: undefined;
+    /**
+     * What stopped the definition being expressed in the register shape.
+     * Present only with the clauses absent, never alongside them.
+     */
+    unrepresentable: string;
+});
+/** Result of replacing a registered function's definition. */
+interface ReplaceFunctionResponse {
+    /** The function's name — unchanged by the replacement, by construction. */
+    name: string;
+    /**
+     * The replacement's id. A fresh registration mints a new one, so it differs
+     * from the previous definition's.
+     */
+    functionId: string;
+    /** What the replaced definition looked like. */
+    previous: FunctionSummaryDto;
+    /** What the replacement looks like. */
+    current: FunctionSummaryDto;
+    /**
+     * `true` when the arity changed.
+     *
+     * @remarks
+     * A function's identity is its NAME, so a replacement keeps every caller's
+     * reference valid — nothing dangles. That is exactly what makes an arity
+     * change dangerous rather than merely breaking: every call still resolves,
+     * and one passing the old argument count starts failing at evaluation time.
+     */
+    arityChanged: boolean;
+    /**
+     * Everything that calls this function. Reported rather than refused: the
+     * replacement keeps the name resolvable, so no caller is orphaned — but one
+     * written against the old signature may no longer be correct.
+     */
+    callers: FunctionCaller[];
+}
 
 type functions_AuthoringClarificationQuestionDto = AuthoringClarificationQuestionDto;
 type functions_BinaryOperatorDto = BinaryOperatorDto;
+type functions_ConditionalBranchDto = ConditionalBranchDto;
 type functions_DraftFunctionRequest = DraftFunctionRequest;
 type functions_DraftFunctionResponse = DraftFunctionResponse;
 type functions_EvaluateFunctionRequest = EvaluateFunctionRequest;
 type functions_EvaluateFunctionResponse = EvaluateFunctionResponse;
 type functions_ExpressionDto = ExpressionDto;
 type functions_FunctionBodyDto = FunctionBodyDto;
+type functions_FunctionCaller = FunctionCaller;
+type functions_FunctionCallerKind = FunctionCallerKind;
+type functions_FunctionCallersDisposition = FunctionCallersDisposition;
 type functions_FunctionClauseDto = FunctionClauseDto;
+type functions_FunctionDefinitionSignature = FunctionDefinitionSignature;
 type functions_FunctionDraftDto = FunctionDraftDto;
 type functions_FunctionGuardDto = FunctionGuardDto;
 type functions_FunctionKindDto = FunctionKindDto;
+type functions_FunctionNotReplaceableDto = FunctionNotReplaceableDto;
 type functions_FunctionSummaryDto = FunctionSummaryDto;
 type functions_FunctionValueDto = FunctionValueDto;
+type functions_FunctionWithdrawalReport = FunctionWithdrawalReport;
+type functions_GetFunctionResponse = GetFunctionResponse;
 type functions_ListFunctionsResponse = ListFunctionsResponse;
 type functions_PatternDto = PatternDto;
 type functions_RegisterFunctionRequest = RegisterFunctionRequest;
 type functions_RegisterFunctionResponse = RegisterFunctionResponse;
+type functions_ReplaceFunctionResponse = ReplaceFunctionResponse;
+type functions_UnaryOperatorDto = UnaryOperatorDto;
 declare namespace functions {
-  export type { functions_AuthoringClarificationQuestionDto as AuthoringClarificationQuestionDto, functions_BinaryOperatorDto as BinaryOperatorDto, functions_DraftFunctionRequest as DraftFunctionRequest, functions_DraftFunctionResponse as DraftFunctionResponse, functions_EvaluateFunctionRequest as EvaluateFunctionRequest, functions_EvaluateFunctionResponse as EvaluateFunctionResponse, functions_ExpressionDto as ExpressionDto, functions_FunctionBodyDto as FunctionBodyDto, functions_FunctionClauseDto as FunctionClauseDto, functions_FunctionDraftDto as FunctionDraftDto, functions_FunctionGuardDto as FunctionGuardDto, functions_FunctionKindDto as FunctionKindDto, functions_FunctionSummaryDto as FunctionSummaryDto, functions_FunctionValueDto as FunctionValueDto, functions_ListFunctionsResponse as ListFunctionsResponse, functions_PatternDto as PatternDto, functions_RegisterFunctionRequest as RegisterFunctionRequest, functions_RegisterFunctionResponse as RegisterFunctionResponse };
+  export type { functions_AuthoringClarificationQuestionDto as AuthoringClarificationQuestionDto, functions_BinaryOperatorDto as BinaryOperatorDto, functions_ConditionalBranchDto as ConditionalBranchDto, functions_DraftFunctionRequest as DraftFunctionRequest, functions_DraftFunctionResponse as DraftFunctionResponse, functions_EvaluateFunctionRequest as EvaluateFunctionRequest, functions_EvaluateFunctionResponse as EvaluateFunctionResponse, functions_ExpressionDto as ExpressionDto, functions_FunctionBodyDto as FunctionBodyDto, functions_FunctionCaller as FunctionCaller, functions_FunctionCallerKind as FunctionCallerKind, functions_FunctionCallersDisposition as FunctionCallersDisposition, functions_FunctionClauseDto as FunctionClauseDto, functions_FunctionDefinitionSignature as FunctionDefinitionSignature, functions_FunctionDraftDto as FunctionDraftDto, functions_FunctionGuardDto as FunctionGuardDto, functions_FunctionKindDto as FunctionKindDto, functions_FunctionNotReplaceableDto as FunctionNotReplaceableDto, functions_FunctionSummaryDto as FunctionSummaryDto, functions_FunctionValueDto as FunctionValueDto, functions_FunctionWithdrawalReport as FunctionWithdrawalReport, functions_GetFunctionResponse as GetFunctionResponse, functions_ListFunctionsResponse as ListFunctionsResponse, functions_PatternDto as PatternDto, functions_RegisterFunctionRequest as RegisterFunctionRequest, functions_RegisterFunctionResponse as RegisterFunctionResponse, functions_ReplaceFunctionResponse as ReplaceFunctionResponse, functions_UnaryOperatorDto as UnaryOperatorDto };
 }
 
 /**
@@ -56563,6 +57330,118 @@ declare class FunctionsClient {
      * ```
      */
     listFunctions(): Promise<ListFunctionsResponse>;
+    /**
+     * Read one registered function's definition.
+     *
+     * @param name - The registered function's name — its identity.
+     * @returns The signature, everything that calls it, whether a `PUT` would
+     *   act or refuse, and the clauses in the shape a replacement takes.
+     * @throws {ApiError} 404 if nothing is registered under that name for the
+     *   authenticated tenant. Another tenant's function is 404 too — saying
+     *   anything else would confirm the name exists somewhere.
+     *
+     * @remarks
+     * This is what makes {@link FunctionsClient.replaceFunction} an edit. `PUT`
+     * replaces the WHOLE definition, so without a read a client fixing one
+     * clause of a three-clause function had to re-author the other two from
+     * memory, and any it forgot were deleted.
+     *
+     * `clauses` and `unrepresentable` are exclusive: a definition holding a
+     * construct the register shape cannot express comes back with no clauses and
+     * a reason, because a degraded read written back would destroy the real
+     * definition. Narrow on `clauses === undefined` before using them.
+     *
+     * A plugin-contributed function is refused by `DELETE`/`PUT` and returned
+     * here, with `replaceable: false` and the refusal the mutation would give.
+     *
+     * @example
+     * ```typescript
+     * const definition = await client.functions.getFunction('scale');
+     * if (definition.clauses === undefined) {
+     *   throw new Error(`scale cannot be edited: ${definition.unrepresentable}`);
+     * }
+     * if (!definition.replaceable) {
+     *   throw new Error(definition.notReplaceable?.reason);
+     * }
+     * await client.functions.replaceFunction('scale', {
+     *   arity: definition.arity,
+     *   clauses: definition.clauses.map(tweak),
+     * });
+     * ```
+     */
+    getFunction(name: string): Promise<GetFunctionResponse>;
+    /**
+     * Withdraw a registered function.
+     *
+     * @param name - The registered function's name — its identity.
+     * @param options - `callers` decides what happens to the things that call
+     *   it. Defaults to `'refuse'`.
+     * @returns What the withdrawal removed, in each representation that held it.
+     * @throws {ApiError} 400 if something still calls the function under the
+     *   default `'refuse'` (the body carries `code: 'function_has_callers'` and
+     *   the caller list); 403 for a plugin-contributed function; 404 if nothing
+     *   is registered under that name.
+     *
+     * @remarks
+     * A function is carried twice — the durable `meta.function` carrier that is
+     * the source of truth, and the evaluator's own registry used for dispatch
+     * and recursive cross-calls — and the report names both, because forgetting
+     * either leaves it half-alive: still evaluable, or back after a restart.
+     *
+     * `'refuse'` names every caller; `'orphan'` withdraws anyway and reports the
+     * callers left naming something that no longer resolves.
+     *
+     * @example
+     * ```typescript
+     * const report = await client.functions.deleteFunction('scale', { callers: 'orphan' });
+     * for (const orphan of report.callersOrphaned) {
+     *   console.warn(`${orphan.kind} ${orphan.name} now calls a function that is gone`);
+     * }
+     * ```
+     */
+    deleteFunction(name: string, options?: {
+        callers?: FunctionCallersDisposition;
+    }): Promise<FunctionWithdrawalReport>;
+    /**
+     * Replace a registered function's definition.
+     *
+     * @param name - The registered function's name. Unchanged by the
+     *   replacement — the name IS the identity.
+     * @param request - The replacement's arity and clauses.
+     * @returns Both signatures, whether the arity moved, and everything that
+     *   calls the function.
+     * @throws {ApiError} 400 if the replacement's clauses are rejected — in
+     *   which case the registration is left exactly as it was; 403 for a
+     *   plugin-contributed function; 404 if nothing is registered under that
+     *   name (creating one is {@link FunctionsClient.registerFunction}'s job).
+     *
+     * @remarks
+     * `registerFunction` already replaces by name — silently, reporting nothing
+     * about what it displaced. This is the operation that says so.
+     *
+     * A function's identity is its NAME, so a replacement keeps every caller's
+     * reference valid: nothing dangles. That is exactly why an arity change is
+     * the dangerous edit — every call still resolves, and one passing the old
+     * argument count starts failing at evaluation time. `arityChanged` is
+     * reported rather than refused, because a caller may be replacing the
+     * function precisely because its signature was wrong.
+     *
+     * @example
+     * ```typescript
+     * const result = await client.functions.replaceFunction('scale', {
+     *   arity: 2,
+     *   clauses: [multiplyClause],
+     * });
+     * if (result.arityChanged) {
+     *   console.warn(`arity ${result.previous.arity} -> ${result.current.arity};`,
+     *     `${result.callers.length} caller(s) were written against the old one`);
+     * }
+     * ```
+     */
+    replaceFunction(name: string, request: {
+        arity: number;
+        clauses: FunctionClauseDto[];
+    }): Promise<ReplaceFunctionResponse>;
     /**
      * Draft a user-defined function from a natural-language description.
      *
@@ -58932,6 +59811,16 @@ interface ClearTenantResponse {
     inferenceStateCleared: boolean;
     /** Whether the cache was invalidated. */
     cacheInvalidated: boolean;
+    /**
+     * Number of vector-store points deleted for this tenant.
+     *
+     * @remarks
+     * Reported separately because it is the one count an erasure request cannot
+     * verify any other way: vector payloads carry the embedded text, so a wipe
+     * that left them behind would report every table emptied while the tenant's
+     * data stayed readable by similarity search.
+     */
+    vectorsDeleted: number;
     /**
      * Number of plugin-marketplace install records forgotten for this tenant.
      *
@@ -67215,11 +68104,49 @@ interface BulkBindSortsResponse {
 /**
  * Summary of a single active sort-table binding.
  */
+interface KeyProvenanceDto {
+    /**
+     * Which authority chose the key: `source_constraint`,
+     * `synthetic_record_id`, `sequence_default`, `schema_declared_identifier`,
+     * `naming_convention`, `sampled_uniqueness`, `client_supplied`, `keyless`
+     * or `unrecorded`.
+     */
+    source: string;
+    /**
+     * Which side settled it: `discovery`, `client`, `nobody` (a keyless
+     * binding), or `unrecorded`.
+     */
+    chosenBy: string;
+    /** One sentence stating what this key source means, in plain words. */
+    explanation: string;
+    /**
+     * Whether some authority guarantees the key identifies exactly one record.
+     * Absent where the question has no answer — a keyless binding, or a
+     * provenance that was never recorded.
+     */
+    guaranteedUnique?: boolean | null;
+    /**
+     * Whether term ids built from this key survive a rebuild of the source:
+     * `survives_source_rebuild` or `lifetime_scoped`. Absent for a
+     * client-supplied key, where nothing declares it.
+     */
+    durability?: string | null;
+}
+/**
+ * One active sort↔table binding.
+ */
 interface BindingSummaryDto {
     /** Number of bound features/columns. */
     featureCount: number;
     /** Primary key column names. */
     keyColumns: string[];
+    /**
+     * Where the key columns came from, and what that implies for the durability
+     * of ids derived from them. The column names cannot say it: `["title"]`
+     * looks identical whether a uniqueness constraint backs it or an operator
+     * nominated it.
+     */
+    keyProvenance: KeyProvenanceDto;
     /** Sort ID (UUID string). */
     sortId: string;
     /** External source identifier. */
@@ -67351,11 +68278,12 @@ type ontologyBridge_ImportFoundryRequest = ImportFoundryRequest;
 type ontologyBridge_ImportFoundryResponse = ImportFoundryResponse;
 type ontologyBridge_ImportOwlRequest = ImportOwlRequest;
 type ontologyBridge_ImportOwlResponse = ImportOwlResponse;
+type ontologyBridge_KeyProvenanceDto = KeyProvenanceDto;
 type ontologyBridge_ListBindingsResponse = ListBindingsResponse;
 type ontologyBridge_TranspileRequest = TranspileRequest;
 type ontologyBridge_TranspileResponse = TranspileResponse;
 declare namespace ontologyBridge {
-  export type { ontologyBridge_BindSortRequest as BindSortRequest, ontologyBridge_BindSortResponse as BindSortResponse, ontologyBridge_BindingSummaryDto as BindingSummaryDto, ontologyBridge_BulkBindError as BulkBindError, ontologyBridge_BulkBindSortsRequest as BulkBindSortsRequest, ontologyBridge_BulkBindSortsResponse as BulkBindSortsResponse, ontologyBridge_ColumnMappingDto as ColumnMappingDto, ontologyBridge_FoundryReviewItemDto as FoundryReviewItemDto, ontologyBridge_GroundedSchemaResponse as GroundedSchemaResponse, ontologyBridge_ImportFoundryRequest as ImportFoundryRequest, ontologyBridge_ImportFoundryResponse as ImportFoundryResponse, ontologyBridge_ImportOwlRequest as ImportOwlRequest, ontologyBridge_ImportOwlResponse as ImportOwlResponse, ontologyBridge_ListBindingsResponse as ListBindingsResponse, ontologyBridge_TranspileRequest as TranspileRequest, ontologyBridge_TranspileResponse as TranspileResponse };
+  export type { ontologyBridge_BindSortRequest as BindSortRequest, ontologyBridge_BindSortResponse as BindSortResponse, ontologyBridge_BindingSummaryDto as BindingSummaryDto, ontologyBridge_BulkBindError as BulkBindError, ontologyBridge_BulkBindSortsRequest as BulkBindSortsRequest, ontologyBridge_BulkBindSortsResponse as BulkBindSortsResponse, ontologyBridge_ColumnMappingDto as ColumnMappingDto, ontologyBridge_FoundryReviewItemDto as FoundryReviewItemDto, ontologyBridge_GroundedSchemaResponse as GroundedSchemaResponse, ontologyBridge_ImportFoundryRequest as ImportFoundryRequest, ontologyBridge_ImportFoundryResponse as ImportFoundryResponse, ontologyBridge_ImportOwlRequest as ImportOwlRequest, ontologyBridge_ImportOwlResponse as ImportOwlResponse, ontologyBridge_KeyProvenanceDto as KeyProvenanceDto, ontologyBridge_ListBindingsResponse as ListBindingsResponse, ontologyBridge_TranspileRequest as TranspileRequest, ontologyBridge_TranspileResponse as TranspileResponse };
 }
 
 /**