Implement workspace evolution, migrations, and runtime continuity

Enable evolution by default for source-backed workspaces. Add stable
conformance ownership, semantic-major review, candidate typechecking,
and durable fenced cutover with explicit migrations and forward recovery.

Independently supervise package runtimes so unchanged resource owners keep
their processes and connections across cutover. Add scoped invocation
authority, resource sessions, and typed callback rebinding.

Wire opaque object references through generated bindings and RPCs. Add
canonical relationship sets, keyed maps, and ordered lists with scoped
transactional mutations, revision checks, and inverse consistency. Support
planned cascade deletion, protection, tombstones, and lifecycle foundations.

Add journaled structural edits, package/function/migration scaffolding,
managed repository creation, and resumable bottom-up dependency pin
publication. Document lifetime boundaries, revision pinning, prototype
compatibility policy, commands, and deferred work.

Validate with 210 tests, user-systemd process/connection continuity,
generated-package TypeScript checks, and Nix host/protocol checks.
TTL handoff, physical reclamation, general multi-step migrations, and
root-systemd migration isolation acceptance remain deferred.

dist/bindings.d.ts

@@ -1,11 +1,6 @@
 import { type Value } from "./camino/api_pb.js";
 import { type RuntimeHandler, type DerivedHandler } from "./index.js";
-declare const referenceBrand: unique symbol;
-export type QxObjectRef<Identity extends string> = string & {
-    readonly [referenceBrand]: {
-        readonly [K in Identity]: true;
-    };
-};
+export type { QxObjectRef } from "./references.js";
 declare const watchBrand: unique symbol;
 export type QxWatchHandle = string & {
     readonly [watchBrand]: true;
@@ -20,6 +15,15 @@ export type QxDerived<C, O> = {
     kind: "derived";
     get: QxHandler<C, O>;
 };
+export type QxSession<C> = {
+    id: string;
+    run<T>(work: (context: C) => Promise<T>): Promise<T>;
+    close(): Promise<void>;
+};
+export type QxContextLifecycle<C> = {
+    signal?: AbortSignal;
+    openSession?: () => Promise<QxSession<C>>;
+};
 export declare const qxDerived: <C, O>(get: QxHandler<C, O>) => QxDerived<C, O>;
 /** Versioned binding ABI. This mirrors the language-neutral value IR. */
 export type QxValueType = {
@@ -72,5 +76,4 @@ export declare const decodeQxValue: (type: QxValueType, value: Value | undefined
 export declare const encodeQxValue: (type: QxValueType, value: any, messages: QxMessages) => Value;
 /** The sole unchecked cast connects generated contracts to the dynamic RPC runtime. */
 export declare const bindQxHandler: <C, O>(spec: QxHandlerSpec, handler: QxHandler<C, O> | QxDerived<C, O>, messages: QxMessages) => RuntimeHandler | DerivedHandler;
-export {};
 //# sourceMappingURL=bindings.d.ts.map

dist/bindings.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"bindings.d.ts","sourceRoot":"","sources":["../src/bindings.ts"],"names":[],"mappings":"AACA,OAAO,EAAkC,KAAK,KAAK,EAAE,MAAM,oBAAoB,CAAC;AAChF,OAAO,EACgB,KAAK,cAAc,EAAE,KAAK,cAAc,EAAE,MAAM,YAAY,CAAC;AAEpF,OAAO,CAAC,MAAM,cAAc,EAAE,OAAO,MAAM,CAAC;AAC5C,MAAM,MAAM,WAAW,CAAC,QAAQ,SAAS,MAAM,IAAI,MAAM,GAAG;IAAE,QAAQ,CAAC,CAAC,cAAc,CAAC,EAAE;QAAE,QAAQ,EAAE,CAAC,IAAI,QAAQ,GAAG,IAAI;KAAE,CAAA;CAAE,CAAC;AAC9H,OAAO,CAAC,MAAM,UAAU,EAAE,OAAO,MAAM,CAAC;AACxC,MAAM,MAAM,aAAa,GAAG,MAAM,GAAG;IAAE,QAAQ,CAAC,CAAC,UAAU,CAAC,EAAE,IAAI,CAAA;CAAE,CAAC;AACrE,MAAM,MAAM,cAAc,CAAC,CAAC,IAAI;IAAE,MAAM,CAAC,KAAK,EAAE,CAAC,GAAG,KAAK,CAAC;IAAC,MAAM,CAAC,KAAK,EAAE,KAAK,GAAG,CAAC,CAAA;CAAE,CAAC;AACrF,MAAM,MAAM,YAAY,CAAC,CAAC,IAAI,CAAC,SAAS,cAAc,CAAC,MAAM,CAAC,CAAC,GAAG,CAAC,GAAG,KAAK,CAAC;AAC5E,MAAM,MAAM,SAAS,CAAC,CAAC,EAAE,CAAC,IAAI,CAAC,OAAO,EAAE,CAAC,KAAK,CAAC,GAAG,OAAO,CAAC,CAAC,CAAC,CAAC;AAC7D,MAAM,MAAM,SAAS,CAAC,CAAC,EAAE,CAAC,IAAI;IAAE,IAAI,EAAE,SAAS,CAAC;IAAC,GAAG,EAAE,SAAS,CAAC,CAAC,EAAE,CAAC,CAAC,CAAA;CAAE,CAAC;AACxE,eAAO,MAAM,SAAS,GAAI,CAAC,EAAE,CAAC,OAAO,SAAS,CAAC,CAAC,EAAE,CAAC,CAAC,KAAG,SAAS,CAAC,CAAC,EAAE,CAAC,CAA+B,CAAC;AAErG,yEAAyE;AACzE,MAAM,MAAM,WAAW,GACnB;IAAE,IAAI,EAAE,SAAS,CAAC;IAAC,IAAI,EAAE,MAAM,GAAG,cAAc,CAAA;CAAE,GAClD;IAAE,IAAI,EAAE,QAAQ,CAAC;IAAC,IAAI,EAAE,MAAM,CAAA;CAAE,GAChC;IAAE,IAAI,EAAE,SAAS,CAAC;IAAC,YAAY,EAAE,MAAM,CAAA;CAAE,GACzC;IAAE,IAAI,EAAE,YAAY,CAAC;IAAC,WAAW,EAAE,OAAO,CAAA;CAAE,GAC5C;IAAE,IAAI,EAAE,UAAU,GAAG,MAAM,CAAC;IAAC,KAAK,EAAE,WAAW,CAAA;CAAE,CAAC;AACtD,MAAM,MAAM,eAAe,GAAG;IAAE,EAAE,EAAE,MAAM,CAAC;IAAC,SAAS,EAAE,WAAW,CAAC;IAAC,UAAU,EAAE,WAAW,CAAA;CAAE,CAAC;AAC9F,MAAM,MAAM,UAAU,GAClB;IAAE,IAAI,EAAE,OAAO,CAAC;IAAC,EAAE,EAAE,MAAM,CAAC;IAAC,SAAS,EAAE,WAAW,CAAC;IAAC,UAAU,EAAE,MAAM,EAAE,CAAA;CAAE,GAC3E;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,EAAE,EAAE,MAAM,CAAC;IAAC,UAAU,EAAE,MAAM,EAAE,CAAA;CAAE,GAClD;IAAE,IAAI,EAAE,WAAW,CAAC;IAAC,EAAE,EAAE,MAAM,CAAC;IAAC,UAAU,EAAE,MAAM,CAAC,MAAM,EAAE,eAAe,CAAC,CAAA;CAAE,GAC9E;IAAE,IAAI,EAAE,aAAa,CAAC;IAAC,EAAE,EAAE,MAAM,CAAC;IAAC,SAAS,EAAE,WAAW,CAAA;CAAE,CAAC;AAChE,MAAM,MAAM,aAAa,GAAG;IAC1B,SAAS,EAAE,WAAW,CAAC;IAAC,UAAU,EAAE,WAAW,CAAC;IAAC,SAAS,CAAC,EAAE,WAAW,CAAC;IACzE,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,UAAU,CAAC,CAAC;CACnC,CAAC;AACF,MAAM,MAAM,UAAU,GAAG,MAAM,CAAC,MAAM,EAAE,cAAc,CAAC,GAAG,CAAC,CAAC,CAAC;AAG7D,eAAO,MAAM,aAAa,SAAU,WAAW,SAAS,KAAK,GAAG,SAAS,YAAY,UAAU,KAAG,GAoBjG,CAAC;AAOF,eAAO,MAAM,aAAa,SAAU,WAAW,SAAS,GAAG,YAAY,UAAU,KAAG,KAOnF,CAAC;AAiBF,uFAAuF;AACvF,eAAO,MAAM,aAAa,GAAI,CAAC,EAAE,CAAC,QAC1B,aAAa,WAAW,SAAS,CAAC,CAAC,EAAE,CAAC,CAAC,GAAG,SAAS,CAAC,CAAC,EAAE,CAAC,CAAC,YAAY,UAAU,KACpF,cAAc,GAAG,cA+BnB,CAAC"}
+{"version":3,"file":"bindings.d.ts","sourceRoot":"","sources":["../src/bindings.ts"],"names":[],"mappings":"AACA,OAAO,EAAkC,KAAK,KAAK,EAAE,MAAM,oBAAoB,CAAC;AAChF,OAAO,EACgB,KAAK,cAAc,EAAE,KAAK,cAAc,EAAE,MAAM,YAAY,CAAC;AAEpF,YAAY,EAAE,WAAW,EAAE,MAAM,iBAAiB,CAAC;AAEnD,OAAO,CAAC,MAAM,UAAU,EAAE,OAAO,MAAM,CAAC;AACxC,MAAM,MAAM,aAAa,GAAG,MAAM,GAAG;IAAE,QAAQ,CAAC,CAAC,UAAU,CAAC,EAAE,IAAI,CAAA;CAAE,CAAC;AACrE,MAAM,MAAM,cAAc,CAAC,CAAC,IAAI;IAAE,MAAM,CAAC,KAAK,EAAE,CAAC,GAAG,KAAK,CAAC;IAAC,MAAM,CAAC,KAAK,EAAE,KAAK,GAAG,CAAC,CAAA;CAAE,CAAC;AACrF,MAAM,MAAM,YAAY,CAAC,CAAC,IAAI,CAAC,SAAS,cAAc,CAAC,MAAM,CAAC,CAAC,GAAG,CAAC,GAAG,KAAK,CAAC;AAC5E,MAAM,MAAM,SAAS,CAAC,CAAC,EAAE,CAAC,IAAI,CAAC,OAAO,EAAE,CAAC,KAAK,CAAC,GAAG,OAAO,CAAC,CAAC,CAAC,CAAC;AAC7D,MAAM,MAAM,SAAS,CAAC,CAAC,EAAE,CAAC,IAAI;IAAE,IAAI,EAAE,SAAS,CAAC;IAAC,GAAG,EAAE,SAAS,CAAC,CAAC,EAAE,CAAC,CAAC,CAAA;CAAE,CAAC;AACxE,MAAM,MAAM,SAAS,CAAC,CAAC,IAAI;IAAC,EAAE,EAAE,MAAM,CAAC;IAAC,GAAG,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC,OAAO,EAAE,CAAC,KAAK,OAAO,CAAC,CAAC,CAAC,GAAG,OAAO,CAAC,CAAC,CAAC,CAAC;IAAC,KAAK,IAAI,OAAO,CAAC,IAAI,CAAC,CAAA;CAAC,CAAC;AACtH,MAAM,MAAM,kBAAkB,CAAC,CAAC,IAAI;IAAC,MAAM,CAAC,EAAE,WAAW,CAAC;IAAC,WAAW,CAAC,EAAE,MAAM,OAAO,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,CAAA;CAAC,CAAC;AACtG,eAAO,MAAM,SAAS,GAAI,CAAC,EAAE,CAAC,OAAO,SAAS,CAAC,CAAC,EAAE,CAAC,CAAC,KAAG,SAAS,CAAC,CAAC,EAAE,CAAC,CAA+B,CAAC;AAErG,yEAAyE;AACzE,MAAM,MAAM,WAAW,GACnB;IAAE,IAAI,EAAE,SAAS,CAAC;IAAC,IAAI,EAAE,MAAM,GAAG,cAAc,CAAA;CAAE,GAClD;IAAE,IAAI,EAAE,QAAQ,CAAC;IAAC,IAAI,EAAE,MAAM,CAAA;CAAE,GAChC;IAAE,IAAI,EAAE,SAAS,CAAC;IAAC,YAAY,EAAE,MAAM,CAAA;CAAE,GACzC;IAAE,IAAI,EAAE,YAAY,CAAC;IAAC,WAAW,EAAE,OAAO,CAAA;CAAE,GAC5C;IAAE,IAAI,EAAE,UAAU,GAAG,MAAM,CAAC;IAAC,KAAK,EAAE,WAAW,CAAA;CAAE,CAAC;AACtD,MAAM,MAAM,eAAe,GAAG;IAAE,EAAE,EAAE,MAAM,CAAC;IAAC,SAAS,EAAE,WAAW,CAAC;IAAC,UAAU,EAAE,WAAW,CAAA;CAAE,CAAC;AAC9F,MAAM,MAAM,UAAU,GAClB;IAAE,IAAI,EAAE,OAAO,CAAC;IAAC,EAAE,EAAE,MAAM,CAAC;IAAC,SAAS,EAAE,WAAW,CAAC;IAAC,UAAU,EAAE,MAAM,EAAE,CAAA;CAAE,GAC3E;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,EAAE,EAAE,MAAM,CAAC;IAAC,UAAU,EAAE,MAAM,EAAE,CAAA;CAAE,GAClD;IAAE,IAAI,EAAE,WAAW,CAAC;IAAC,EAAE,EAAE,MAAM,CAAC;IAAC,UAAU,EAAE,MAAM,CAAC,MAAM,EAAE,eAAe,CAAC,CAAA;CAAE,GAC9E;IAAE,IAAI,EAAE,aAAa,CAAC;IAAC,EAAE,EAAE,MAAM,CAAC;IAAC,SAAS,EAAE,WAAW,CAAA;CAAE,CAAC;AAChE,MAAM,MAAM,aAAa,GAAG;IAC1B,SAAS,EAAE,WAAW,CAAC;IAAC,UAAU,EAAE,WAAW,CAAC;IAAC,SAAS,CAAC,EAAE,WAAW,CAAC;IACzE,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,UAAU,CAAC,CAAC;CACnC,CAAC;AACF,MAAM,MAAM,UAAU,GAAG,MAAM,CAAC,MAAM,EAAE,cAAc,CAAC,GAAG,CAAC,CAAC,CAAC;AAG7D,eAAO,MAAM,aAAa,SAAU,WAAW,SAAS,KAAK,GAAG,SAAS,YAAY,UAAU,KAAG,GA8BjG,CAAC;AAOF,eAAO,MAAM,aAAa,SAAU,WAAW,SAAS,GAAG,YAAY,UAAU,KAAG,KAYnF,CAAC;AAiBF,uFAAuF;AACvF,eAAO,MAAM,aAAa,GAAI,CAAC,EAAE,CAAC,QAC1B,aAAa,WAAW,SAAS,CAAC,CAAC,EAAE,CAAC,CAAC,GAAG,SAAS,CAAC,CAAC,EAAE,CAAC,CAAC,YAAY,UAAU,KACpF,cAAc,GAAG,cAyCnB,CAAC"}

dist/bindings.js

@@ -1,6 +1,7 @@
 import { create } from "@bufbuild/protobuf";
 import { ValueSchema, ObjectValueSchema } from "./camino/api_pb.js";
 import { derived, jsToProtoValue, liveValue, protoValueToJs } from "./index.js";
+import { assertReferenceFree, referenceToWire } from "./references.js";
 export const qxDerived = (get) => ({ kind: "derived", get });
 // Conversion belongs at the binding boundary. It does not add orchestrator validation.
 export const decodeQxValue = (type, value, messages) => {
@@ -15,8 +16,19 @@ export const decodeQxValue = (type, value, messages) => {
             throw new Error("Expected QX list");
         return value.kind.value.values.map((entry) => decodeQxValue(type.value, entry, messages));
     }
-    if (type.kind === "message")
-        return requireMessage(messages, type.descriptorId).decode(value);
+    if (type.kind === "message") {
+        assertReferenceFree(protoValueToJs(value));
+        const decoded = requireMessage(messages, type.descriptorId).decode(value);
+        assertReferenceFree(decoded);
+        return decoded;
+    }
+    if (type.kind === "object-ref") {
+        if (value.kind.case !== "refValue")
+            throw new Error("Expected a declared RPC object reference");
+        return protoValueToJs(value);
+    }
+    if (value.kind.case === "refValue")
+        throw new Error("Reference supplied to a non-reference value");
     if (type.kind === "scalar") {
         if (type.name === "int64" || type.name === "uint64") {
             if (value.kind.case !== "integerValue")
@@ -44,10 +56,16 @@ export const encodeQxValue = (type, value, messages) => {
         return value === null ? jsToProtoValue(null) : encodeQxValue(type.value, value, messages);
     if (type.kind === "list")
         return jsToProtoValue(value.map((entry) => liveValue(encodeQxValue(type.value, entry, messages))));
-    if (type.kind === "message")
-        return requireMessage(messages, type.descriptorId).encode(value);
-    if (type.kind === "object-ref")
-        return jsToProtoValue({ $quixosRef: value });
+    if (type.kind === "object-ref") {
+        referenceToWire(value);
+        return jsToProtoValue(value);
+    }
+    assertReferenceFree(value);
+    if (type.kind === "message") {
+        const encoded = requireMessage(messages, type.descriptorId).encode(value);
+        assertReferenceFree(protoValueToJs(encoded));
+        return encoded;
+    }
     return jsToProtoValue(value);
 };
 const inputValue = (context, type) => {
@@ -69,7 +87,7 @@ const inputFields = (type, value, messages) => {
 };
 /** The sole unchecked cast connects generated contracts to the dynamic RPC runtime. */
 export const bindQxHandler = (spec, handler, messages) => {
-    const execute = async (raw) => {
+    const bindContext = (raw) => {
         const ports = Object.fromEntries(Object.entries(spec.ports).map(([name, port]) => {
             switch (port.kind) {
                 case "state": {
@@ -81,7 +99,9 @@ export const bindQxHandler = (spec, handler, messages) => {
                 }
                 case "edge": {
                     const edge = raw.edge(port.id);
-                    return [name, Object.fromEntries(port.primitives.map((primitive) => [primitive, edge[primitive]]))];
+                    return [name, { ...Object.fromEntries(port.primitives.map((primitive) => [primitive, edge[primitive]])),
+                            ...(port.primitives.includes("resolve") ? { collection: edge.collection } : {}),
+                            ...(port.primitives.includes("resolve") && port.primitives.includes("connect") && port.primitives.includes("disconnect") ? { replace: edge.replace } : {}) }];
                 }
                 case "interface": {
                     const target = raw.interface(port.id);
@@ -92,8 +112,16 @@ export const bindQxHandler = (spec, handler, messages) => {
                 case "constructor": return [name, { construct: (input) => raw.constructor(port.id).construct(inputFields(port.inputType, input, messages)) }];
             }
         }));
-        const context = { objectId: raw.objectId,
+        return { objectId: raw.objectId, signal: raw.signal,
+            ...(raw.openSession ? { openSession: async () => {
+                    const session = await raw.openSession();
+                    return { id: session.id, close: () => session.close(),
+                        run: (work) => session.run((next) => work(bindContext(next))) };
+                } } : {}),
             input: decodeQxValue(spec.inputType, inputValue(raw, spec.inputType), messages), ports };
+    };
+    const execute = async (raw) => {
+        const context = bindContext(raw);
         const value = await (typeof handler === "function" ? handler(context) : handler.get(context));
         return liveValue(encodeQxValue(spec.eventType ?? spec.outputType, value, messages));
     };

dist/camino/api_pb.d.ts

@@ -542,6 +542,78 @@ export type DisconnectEdgeResponse = Message<"camino.DisconnectEdgeResponse"> &
  * Use `create(DisconnectEdgeResponseSchema)` to create a new message.
  */
 export declare const DisconnectEdgeResponseSchema: GenMessage<DisconnectEdgeResponse>;
+/**
+ * @generated from message camino.CollectionEntry
+ */
+export type CollectionEntry = Message<"camino.CollectionEntry"> & {
+    /**
+     * Existing entry identity to preserve; empty allocates a new canonical edge.
+     *
+     * @generated from field: string edge_id = 1;
+     */
+    edgeId: string;
+    /**
+     * @generated from field: string target_object_id = 2;
+     */
+    targetObjectId: string;
+    /**
+     * @generated from field: camino.Value key = 3;
+     */
+    key?: Value | undefined;
+};
+/**
+ * Describes the message camino.CollectionEntry.
+ * Use `create(CollectionEntrySchema)` to create a new message.
+ */
+export declare const CollectionEntrySchema: GenMessage<CollectionEntry>;
+/**
+ * @generated from message camino.ReadCollectionResponse
+ */
+export type ReadCollectionResponse = Message<"camino.ReadCollectionResponse"> & {
+    /**
+     * @generated from field: uint64 revision = 1;
+     */
+    revision: bigint;
+    /**
+     * @generated from field: repeated camino.CollectionEntry entries = 2;
+     */
+    entries: CollectionEntry[];
+};
+/**
+ * Describes the message camino.ReadCollectionResponse.
+ * Use `create(ReadCollectionResponseSchema)` to create a new message.
+ */
+export declare const ReadCollectionResponseSchema: GenMessage<ReadCollectionResponse>;
+/**
+ * @generated from message camino.ReplaceCollectionRequest
+ */
+export type ReplaceCollectionRequest = Message<"camino.ReplaceCollectionRequest"> & {
+    /**
+     * @generated from field: string object_id = 1;
+     */
+    objectId: string;
+    /**
+     * @generated from field: string edge_type_id = 2;
+     */
+    edgeTypeId: string;
+    /**
+     * @generated from field: string projection_id = 3;
+     */
+    projectionId: string;
+    /**
+     * @generated from field: uint64 expected_revision = 4;
+     */
+    expectedRevision: bigint;
+    /**
+     * @generated from field: repeated camino.CollectionEntry entries = 5;
+     */
+    entries: CollectionEntry[];
+};
+/**
+ * Describes the message camino.ReplaceCollectionRequest.
+ * Use `create(ReplaceCollectionRequestSchema)` to create a new message.
+ */
+export declare const ReplaceCollectionRequestSchema: GenMessage<ReplaceCollectionRequest>;
 /**
  * @generated from message camino.ListOpsRequest
  */
@@ -586,6 +658,12 @@ export type WatchObjectRequest = Message<"camino.WatchObjectRequest"> & {
      * @generated from field: bool include_snapshot = 3;
      */
     includeSnapshot: boolean;
+    /**
+     * Managed runtimes must watch only their injected attachments.
+     *
+     * @generated from field: repeated string attachment_ids = 4;
+     */
+    attachmentIds: string[];
 };
 /**
  * Describes the message camino.WatchObjectRequest.
@@ -696,6 +774,14 @@ export type CaminoEdge = Message<"camino.CaminoEdge"> & {
      * @generated from field: string created_at = 9;
      */
     createdAt: string;
+    /**
+     * @generated from field: string first_key_json = 10;
+     */
+    firstKeyJson: string;
+    /**
+     * @generated from field: string second_key_json = 11;
+     */
+    secondKeyJson: string;
 };
 /**
  * Describes the message camino.CaminoEdge.
@@ -824,6 +910,22 @@ export declare const CaminoService: GenService<{
         input: typeof DisconnectEdgeRequestSchema;
         output: typeof DisconnectEdgeResponseSchema;
     };
+    /**
+     * @generated from rpc camino.CaminoService.ReadCollection
+     */
+    readCollection: {
+        methodKind: "unary";
+        input: typeof ResolveEdgeRequestSchema;
+        output: typeof ReadCollectionResponseSchema;
+    };
+    /**
+     * @generated from rpc camino.CaminoService.ReplaceCollection
+     */
+    replaceCollection: {
+        methodKind: "unary";
+        input: typeof ReplaceCollectionRequestSchema;
+        output: typeof ReadCollectionResponseSchema;
+    };
     /**
      * @generated from rpc camino.CaminoService.ListOps
      */

dist/camino/schema_pb.d.ts

@@ -34,6 +34,10 @@ export type AtomConformance = Message<"camino.AtomConformance"> & {
      * @generated from field: string interface_revision_id = 2;
      */
     interfaceRevisionId: string;
+    /**
+     * @generated from field: string conformance_id = 3;
+     */
+    conformanceId: string;
 };
 /**
  * Describes the message camino.AtomConformance.
@@ -68,6 +72,10 @@ export type StateAttachment = Message<"camino.StateAttachment"> & {
      * @generated from field: string default_value_json = 6;
      */
     defaultValueJson: string;
+    /**
+     * @generated from field: string owner_conformance_id = 7;
+     */
+    ownerConformanceId: string;
 };
 /**
  * Describes the message camino.StateAttachment.
@@ -127,6 +135,28 @@ export type EdgeEndpoint = Message<"camino.EdgeEndpoint"> & {
      * @generated from field: bool ordered = 5;
      */
     ordered: boolean;
+    /**
+     * Empty means restrict. Direction is the endpoint being deleted.
+     *
+     * @generated from field: string on_delete = 6;
+     */
+    onDelete: string;
+    /**
+     * @generated from field: bool retain_other = 7;
+     */
+    retainOther: boolean;
+    /**
+     * Empty for sets/lists, otherwise string, boolean, or int64 map keys.
+     *
+     * @generated from field: string key_type = 8;
+     */
+    keyType: string;
+    /**
+     * Explicit read-only dependency injection traversal, not mutation authority.
+     *
+     * @generated from field: bool public_traversal = 9;
+     */
+    publicTraversal: boolean;
 };
 /**
  * Describes the message camino.EdgeEndpoint.
@@ -153,6 +183,10 @@ export type EdgeAttachment = Message<"camino.EdgeAttachment"> & {
      * @generated from field: camino.EdgeEndpoint second = 4;
      */
     second?: EdgeEndpoint | undefined;
+    /**
+     * @generated from field: string owner_conformance_id = 5;
+     */
+    ownerConformanceId: string;
 };
 /**
  * Describes the message camino.EdgeAttachment.

dist/camino/schema_pb.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"schema_pb.d.ts","sourceRoot":"","sources":["../../src/camino/schema_pb.ts"],"names":[],"mappings":"AAIA,OAAO,KAAK,EAAE,OAAO,EAAE,OAAO,EAAE,UAAU,EAAE,MAAM,8BAA8B,CAAC;AAEjF,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,oBAAoB,CAAC;AAElD;;GAEG;AACH,eAAO,MAAM,kBAAkB,EAAE,OACq3C,CAAC;AAEv5C;;GAEG;AACH,MAAM,MAAM,cAAc,GAAG,OAAO,CAAC,uBAAuB,CAAC,GAAG;IAC9D;;OAEG;IACH,MAAM,EAAE,MAAM,CAAC;IAEf;;OAEG;IACH,WAAW,EAAE,MAAM,CAAC;CACrB,CAAC;AAEF;;;GAGG;AACH,eAAO,MAAM,oBAAoB,EAAE,UAAU,CAAC,cAAc,CACxB,CAAC;AAErC;;GAEG;AACH,MAAM,MAAM,eAAe,GAAG,OAAO,CAAC,wBAAwB,CAAC,GAAG;IAChE;;OAEG;IACH,MAAM,EAAE,MAAM,CAAC;IAEf;;OAEG;IACH,mBAAmB,EAAE,MAAM,CAAC;CAC7B,CAAC;AAEF;;;GAGG;AACH,eAAO,MAAM,qBAAqB,EAAE,UAAU,CAAC,eAAe,CAC1B,CAAC;AAErC;;GAEG;AACH,MAAM,MAAM,eAAe,GAAG,OAAO,CAAC,wBAAwB,CAAC,GAAG;IAChE;;OAEG;IACH,MAAM,EAAE,MAAM,CAAC;IAEf;;OAEG;IACH,cAAc,EAAE,MAAM,CAAC;IAEvB;;OAEG;IACH,WAAW,EAAE,MAAM,CAAC;IAEpB;;OAEG;IACH,aAAa,EAAE,MAAM,CAAC;IAEtB;;OAEG;IACH,iBAAiB,EAAE,MAAM,CAAC;IAE1B;;OAEG;IACH,gBAAgB,EAAE,MAAM,CAAC;CAC1B,CAAC;AAEF;;;GAGG;AACH,eAAO,MAAM,qBAAqB,EAAE,UAAU,CAAC,eAAe,CAC1B,CAAC;AAErC;;GAEG;AACH,MAAM,MAAM,kBAAkB,GAAG,OAAO,CAAC,2BAA2B,CAAC,GAAG;IACtE;;OAEG;IACH,IAAI,EAAE;QACJ;;WAEG;QACH,KAAK,EAAE,MAAM,CAAC;QACd,IAAI,EAAE,QAAQ,CAAC;KAChB,GAAG;QACF;;WAEG;QACH,KAAK,EAAE,MAAM,CAAC;QACd,IAAI,EAAE,qBAAqB,CAAC;KAC7B,GAAG;QAAE,IAAI,EAAE,SAAS,CAAC;QAAC,KAAK,CAAC,EAAE,SAAS,CAAA;KAAE,CAAC;CAC5C,CAAC;AAEF;;;GAGG;AACH,eAAO,MAAM,wBAAwB,EAAE,UAAU,CAAC,kBAAkB,CAChC,CAAC;AAErC;;GAEG;AACH,MAAM,MAAM,YAAY,GAAG,OAAO,CAAC,qBAAqB,CAAC,GAAG;IAC1D;;OAEG;IACH,YAAY,EAAE,MAAM,CAAC;IAErB;;OAEG;IACH,WAAW,EAAE,MAAM,CAAC;IAEpB;;OAEG;IACH,UAAU,CAAC,EAAE,kBAAkB,GAAG,SAAS,CAAC;IAE5C;;OAEG;IACH,WAAW,EAAE,WAAW,CAAC;IAEzB;;OAEG;IACH,OAAO,EAAE,OAAO,CAAC;CAClB,CAAC;AAEF;;;GAGG;AACH,eAAO,MAAM,kBAAkB,EAAE,UAAU,CAAC,YAAY,CACpB,CAAC;AAErC;;GAEG;AACH,MAAM,MAAM,cAAc,GAAG,OAAO,CAAC,uBAAuB,CAAC,GAAG;IAC9D;;OAEG;IACH,UAAU,EAAE,MAAM,CAAC;IAEnB;;OAEG;IACH,WAAW,EAAE,MAAM,CAAC;IAEpB;;OAEG;IACH,KAAK,CAAC,EAAE,YAAY,GAAG,SAAS,CAAC;IAEjC;;OAEG;IACH,MAAM,CAAC,EAAE,YAAY,GAAG,SAAS,CAAC;CACnC,CAAC;AAEF;;;GAGG;AACH,eAAO,MAAM,oBAAoB,EAAE,UAAU,CAAC,cAAc,CACxB,CAAC;AAErC;;;;;GAKG;AACH,MAAM,MAAM,eAAe,GAAG,OAAO,CAAC,wBAAwB,CAAC,GAAG;IAChE;;OAEG;IACH,WAAW,EAAE,MAAM,CAAC;IAEpB;;OAEG;IACH,mBAAmB,EAAE,MAAM,CAAC;IAE5B;;OAEG;IACH,KAAK,EAAE,cAAc,EAAE,CAAC;IAExB;;OAEG;IACH,YAAY,EAAE,eAAe,EAAE,CAAC;IAEhC;;OAEG;IACH,MAAM,EAAE,eAAe,EAAE,CAAC;IAE1B;;OAEG;IACH,KAAK,EAAE,cAAc,EAAE,CAAC;CACzB,CAAC;AAEF;;;GAGG;AACH,eAAO,MAAM,qBAAqB,EAAE,UAAU,CAAC,eAAe,CAC1B,CAAC;AAErC;;GAEG;AACH,oBAAY,WAAW;IACrB;;OAEG;IACH,uBAAuB,IAAI;IAE3B;;OAEG;IACH,YAAY,IAAI;IAEhB;;OAEG;IACH,WAAW,IAAI;IAEf;;OAEG;IACH,IAAI,IAAI;IAER;;OAEG;IACH,WAAW,IAAI;CAChB;AAED;;GAEG;AACH,eAAO,MAAM,iBAAiB,EAAE,OAAO,CAAC,WAAW,CAClB,CAAC"}
+{"version":3,"file":"schema_pb.d.ts","sourceRoot":"","sources":["../../src/camino/schema_pb.ts"],"names":[],"mappings":"AAIA,OAAO,KAAK,EAAE,OAAO,EAAE,OAAO,EAAE,UAAU,EAAE,MAAM,8BAA8B,CAAC;AAEjF,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,oBAAoB,CAAC;AAElD;;GAEG;AACH,eAAO,MAAM,kBAAkB,EAAE,OACulD,CAAC;AAEznD;;GAEG;AACH,MAAM,MAAM,cAAc,GAAG,OAAO,CAAC,uBAAuB,CAAC,GAAG;IAC9D;;OAEG;IACH,MAAM,EAAE,MAAM,CAAC;IAEf;;OAEG;IACH,WAAW,EAAE,MAAM,CAAC;CACrB,CAAC;AAEF;;;GAGG;AACH,eAAO,MAAM,oBAAoB,EAAE,UAAU,CAAC,cAAc,CACxB,CAAC;AAErC;;GAEG;AACH,MAAM,MAAM,eAAe,GAAG,OAAO,CAAC,wBAAwB,CAAC,GAAG;IAChE;;OAEG;IACH,MAAM,EAAE,MAAM,CAAC;IAEf;;OAEG;IACH,mBAAmB,EAAE,MAAM,CAAC;IAE5B;;OAEG;IACH,aAAa,EAAE,MAAM,CAAC;CACvB,CAAC;AAEF;;;GAGG;AACH,eAAO,MAAM,qBAAqB,EAAE,UAAU,CAAC,eAAe,CAC1B,CAAC;AAErC;;GAEG;AACH,MAAM,MAAM,eAAe,GAAG,OAAO,CAAC,wBAAwB,CAAC,GAAG;IAChE;;OAEG;IACH,MAAM,EAAE,MAAM,CAAC;IAEf;;OAEG;IACH,cAAc,EAAE,MAAM,CAAC;IAEvB;;OAEG;IACH,WAAW,EAAE,MAAM,CAAC;IAEpB;;OAEG;IACH,aAAa,EAAE,MAAM,CAAC;IAEtB;;OAEG;IACH,iBAAiB,EAAE,MAAM,CAAC;IAE1B;;OAEG;IACH,gBAAgB,EAAE,MAAM,CAAC;IAEzB;;OAEG;IACH,kBAAkB,EAAE,MAAM,CAAC;CAC5B,CAAC;AAEF;;;GAGG;AACH,eAAO,MAAM,qBAAqB,EAAE,UAAU,CAAC,eAAe,CAC1B,CAAC;AAErC;;GAEG;AACH,MAAM,MAAM,kBAAkB,GAAG,OAAO,CAAC,2BAA2B,CAAC,GAAG;IACtE;;OAEG;IACH,IAAI,EAAE;QACJ;;WAEG;QACH,KAAK,EAAE,MAAM,CAAC;QACd,IAAI,EAAE,QAAQ,CAAC;KAChB,GAAG;QACF;;WAEG;QACH,KAAK,EAAE,MAAM,CAAC;QACd,IAAI,EAAE,qBAAqB,CAAC;KAC7B,GAAG;QAAE,IAAI,EAAE,SAAS,CAAC;QAAC,KAAK,CAAC,EAAE,SAAS,CAAA;KAAE,CAAC;CAC5C,CAAC;AAEF;;;GAGG;AACH,eAAO,MAAM,wBAAwB,EAAE,UAAU,CAAC,kBAAkB,CAChC,CAAC;AAErC;;GAEG;AACH,MAAM,MAAM,YAAY,GAAG,OAAO,CAAC,qBAAqB,CAAC,GAAG;IAC1D;;OAEG;IACH,YAAY,EAAE,MAAM,CAAC;IAErB;;OAEG;IACH,WAAW,EAAE,MAAM,CAAC;IAEpB;;OAEG;IACH,UAAU,CAAC,EAAE,kBAAkB,GAAG,SAAS,CAAC;IAE5C;;OAEG;IACH,WAAW,EAAE,WAAW,CAAC;IAEzB;;OAEG;IACH,OAAO,EAAE,OAAO,CAAC;IAEjB;;;;OAIG;IACH,QAAQ,EAAE,MAAM,CAAC;IAEjB;;OAEG;IACH,WAAW,EAAE,OAAO,CAAC;IAErB;;;;OAIG;IACH,OAAO,EAAE,MAAM,CAAC;IAEhB;;;;OAIG;IACH,eAAe,EAAE,OAAO,CAAC;CAC1B,CAAC;AAEF;;;GAGG;AACH,eAAO,MAAM,kBAAkB,EAAE,UAAU,CAAC,YAAY,CACpB,CAAC;AAErC;;GAEG;AACH,MAAM,MAAM,cAAc,GAAG,OAAO,CAAC,uBAAuB,CAAC,GAAG;IAC9D;;OAEG;IACH,UAAU,EAAE,MAAM,CAAC;IAEnB;;OAEG;IACH,WAAW,EAAE,MAAM,CAAC;IAEpB;;OAEG;IACH,KAAK,CAAC,EAAE,YAAY,GAAG,SAAS,CAAC;IAEjC;;OAEG;IACH,MAAM,CAAC,EAAE,YAAY,GAAG,SAAS,CAAC;IAElC;;OAEG;IACH,kBAAkB,EAAE,MAAM,CAAC;CAC5B,CAAC;AAEF;;;GAGG;AACH,eAAO,MAAM,oBAAoB,EAAE,UAAU,CAAC,cAAc,CACxB,CAAC;AAErC;;;;;GAKG;AACH,MAAM,MAAM,eAAe,GAAG,OAAO,CAAC,wBAAwB,CAAC,GAAG;IAChE;;OAEG;IACH,WAAW,EAAE,MAAM,CAAC;IAEpB;;OAEG;IACH,mBAAmB,EAAE,MAAM,CAAC;IAE5B;;OAEG;IACH,KAAK,EAAE,cAAc,EAAE,CAAC;IAExB;;OAEG;IACH,YAAY,EAAE,eAAe,EAAE,CAAC;IAEhC;;OAEG;IACH,MAAM,EAAE,eAAe,EAAE,CAAC;IAE1B;;OAEG;IACH,KAAK,EAAE,cAAc,EAAE,CAAC;CACzB,CAAC;AAEF;;;GAGG;AACH,eAAO,MAAM,qBAAqB,EAAE,UAAU,CAAC,eAAe,CAC1B,CAAC;AAErC;;GAEG;AACH,oBAAY,WAAW;IACrB;;OAEG;IACH,uBAAuB,IAAI;IAE3B;;OAEG;IACH,YAAY,IAAI;IAEhB;;OAEG;IACH,WAAW,IAAI;IAEf;;OAEG;IACH,IAAI,IAAI;IAER;;OAEG;IACH,WAAW,IAAI;CAChB;AAED;;GAEG;AACH,eAAO,MAAM,iBAAiB,EAAE,OAAO,CAAC,WAAW,CAClB,CAAC"}

dist/camino/schema_pb.js

@@ -1,11 +1,11 @@
-// @generated by protoc-gen-es v2.12.1 with parameter "target=ts,import_extension=js"
+// @generated by protoc-gen-es v2.14.1 with parameter "target=ts,import_extension=js"
 // @generated from file camino/schema.proto (package camino, syntax proto3)
 /* eslint-disable */
 import { enumDesc, fileDesc, messageDesc } from "@bufbuild/protobuf/codegenv2";
 /**
  * Describes the file camino/schema.proto.
  */
-export const file_camino_schema = /*@__PURE__*/ fileDesc("ChNjYW1pbm8vc2NoZW1hLnByb3RvEgZjYW1pbm8iNwoOQXRvbURlZmluaXRpb24SDwoHYXRvbV9pZBgBIAEoCRIUCgxkaXNwbGF5X25hbWUYAiABKAkiQQoPQXRvbUNvbmZvcm1hbmNlEg8KB2F0b21faWQYASABKAkSHQoVaW50ZXJmYWNlX3JldmlzaW9uX2lkGAIgASgJIqQBCg9TdGF0ZUF0dGFjaG1lbnQSDwoHc2xvdF9pZBgBIAEoCRIYChBhdHRhY2hlZF9hdG9tX2lkGAIgASgJEhQKDGRpc3BsYXlfbmFtZRgDIAEoCRIXCg92YWx1ZV90eXBlX2pzb24YBCABKAkSGwoTc3RvcmFnZV9wb2xpY3lfanNvbhgFIAEoCRIaChJkZWZhdWx0X3ZhbHVlX2pzb24YBiABKAkiUAoSRW5kcG9pbnRDb25zdHJhaW50EhEKB2F0b21faWQYASABKAlIABIfChVpbnRlcmZhY2VfcmV2aXNpb25faWQYAiABKAlIAEIGCgRraW5kIqYBCgxFZGdlRW5kcG9pbnQSFQoNcHJvamVjdGlvbl9pZBgBIAEoCRIUCgxkaXNwbGF5X25hbWUYAiABKAkSLgoKY29uc3RyYWludBgDIAEoCzIaLmNhbWluby5FbmRwb2ludENvbnN0cmFpbnQSKAoLY2FyZGluYWxpdHkYBCABKA4yEy5jYW1pbm8uQ2FyZGluYWxpdHkSDwoHb3JkZXJlZBgFIAEoCCKHAQoORWRnZUF0dGFjaG1lbnQSFAoMZWRnZV90eXBlX2lkGAEgASgJEhQKDGRpc3BsYXlfbmFtZRgCIAEoCRIjCgVmaXJzdBgDIAEoCzIULmNhbWluby5FZGdlRW5kcG9pbnQSJAoGc2Vjb25kGAQgASgLMhQuY2FtaW5vLkVkZ2VFbmRwb2ludCLsAQoPUGVyc2lzdGVuY2VQbGFuEhQKDHdvcmtzcGFjZV9pZBgBIAEoCRIdChV3b3Jrc3BhY2VfcmV2aXNpb25faWQYAiABKAkSJQoFYXRvbXMYAyADKAsyFi5jYW1pbm8uQXRvbURlZmluaXRpb24SLQoMY29uZm9ybWFuY2VzGAQgAygLMhcuY2FtaW5vLkF0b21Db25mb3JtYW5jZRInCgZzdGF0ZXMYBSADKAsyFy5jYW1pbm8uU3RhdGVBdHRhY2htZW50EiUKBWVkZ2VzGAYgAygLMhYuY2FtaW5vLkVkZ2VBdHRhY2htZW50KmgKC0NhcmRpbmFsaXR5EhsKF0NBUkRJTkFMSVRZX1VOU1BFQ0lGSUVEEAASEAoMT1BUSU9OQUxfT05FEAESDwoLRVhBQ1RMWV9PTkUQAhIICgRNQU5ZEAMSDwoLTUFOWV9VTklRVUUQBGIGcHJvdG8z");
+export const file_camino_schema = /*@__PURE__*/ fileDesc("ChNjYW1pbm8vc2NoZW1hLnByb3RvEgZjYW1pbm8iNwoOQXRvbURlZmluaXRpb24SDwoHYXRvbV9pZBgBIAEoCRIUCgxkaXNwbGF5X25hbWUYAiABKAkiWQoPQXRvbUNvbmZvcm1hbmNlEg8KB2F0b21faWQYASABKAkSHQoVaW50ZXJmYWNlX3JldmlzaW9uX2lkGAIgASgJEhYKDmNvbmZvcm1hbmNlX2lkGAMgASgJIsIBCg9TdGF0ZUF0dGFjaG1lbnQSDwoHc2xvdF9pZBgBIAEoCRIYChBhdHRhY2hlZF9hdG9tX2lkGAIgASgJEhQKDGRpc3BsYXlfbmFtZRgDIAEoCRIXCg92YWx1ZV90eXBlX2pzb24YBCABKAkSGwoTc3RvcmFnZV9wb2xpY3lfanNvbhgFIAEoCRIaChJkZWZhdWx0X3ZhbHVlX2pzb24YBiABKAkSHAoUb3duZXJfY29uZm9ybWFuY2VfaWQYByABKAkiUAoSRW5kcG9pbnRDb25zdHJhaW50EhEKB2F0b21faWQYASABKAlIABIfChVpbnRlcmZhY2VfcmV2aXNpb25faWQYAiABKAlIAEIGCgRraW5kIvsBCgxFZGdlRW5kcG9pbnQSFQoNcHJvamVjdGlvbl9pZBgBIAEoCRIUCgxkaXNwbGF5X25hbWUYAiABKAkSLgoKY29uc3RyYWludBgDIAEoCzIaLmNhbWluby5FbmRwb2ludENvbnN0cmFpbnQSKAoLY2FyZGluYWxpdHkYBCABKA4yEy5jYW1pbm8uQ2FyZGluYWxpdHkSDwoHb3JkZXJlZBgFIAEoCBIRCglvbl9kZWxldGUYBiABKAkSFAoMcmV0YWluX290aGVyGAcgASgIEhAKCGtleV90eXBlGAggASgJEhgKEHB1YmxpY190cmF2ZXJzYWwYCSABKAgipQEKDkVkZ2VBdHRhY2htZW50EhQKDGVkZ2VfdHlwZV9pZBgBIAEoCRIUCgxkaXNwbGF5X25hbWUYAiABKAkSIwoFZmlyc3QYAyABKAsyFC5jYW1pbm8uRWRnZUVuZHBvaW50EiQKBnNlY29uZBgEIAEoCzIULmNhbWluby5FZGdlRW5kcG9pbnQSHAoUb3duZXJfY29uZm9ybWFuY2VfaWQYBSABKAki7AEKD1BlcnNpc3RlbmNlUGxhbhIUCgx3b3Jrc3BhY2VfaWQYASABKAkSHQoVd29ya3NwYWNlX3JldmlzaW9uX2lkGAIgASgJEiUKBWF0b21zGAMgAygLMhYuY2FtaW5vLkF0b21EZWZpbml0aW9uEi0KDGNvbmZvcm1hbmNlcxgEIAMoCzIXLmNhbWluby5BdG9tQ29uZm9ybWFuY2USJwoGc3RhdGVzGAUgAygLMhcuY2FtaW5vLlN0YXRlQXR0YWNobWVudBIlCgVlZGdlcxgGIAMoCzIWLmNhbWluby5FZGdlQXR0YWNobWVudCpoCgtDYXJkaW5hbGl0eRIbChdDQVJESU5BTElUWV9VTlNQRUNJRklFRBAAEhAKDE9QVElPTkFMX09ORRABEg8KC0VYQUNUTFlfT05FEAISCAoETUFOWRADEg8KC01BTllfVU5JUVVFEARiBnByb3RvMw");
 /**
  * Describes the message camino.AtomDefinition.
  * Use `create(AtomDefinitionSchema)` to create a new message.

dist/index.d.ts

@@ -1,5 +1,8 @@
 import http from "node:http";
+import { type QxObjectRef } from "./references.js";
 export * from "./bindings.js";
+export { relationshipMap, relationshipList, relationshipSet } from "./relationships.js";
+export { createMigrationContext, migrationObjectId, serveMigration, type MigrationContext, type MigrationInput, type MigrationOutput, type MigrationEdge } from "./migration.js";
 import { type Client, type ConnectRouter } from "@connectrpc/connect";
 import { CaminoService, type Value } from "./camino/api_pb.js";
 import { OrchestratorRuntime } from "./quixos/orch_pb.js";
@@ -15,9 +18,7 @@ export type RuntimeDependency = {
     attachmentId: string;
     projectionId: string;
 };
-export declare const objectRef: (objectId: string) => {
-    $quixosRef: string;
-};
+export declare const objectRef: (reference: QxObjectRef) => QxObjectRef<string>;
 export declare const liveValue: (value: Value) => {
     $quixosValue: Value;
 };
@@ -35,23 +36,37 @@ export type StatePort<T = unknown> = {
 export type EdgePort = {
     edgeTypeId: string;
     projectionId: string;
-    resolve(): Promise<string[]>;
-    connect(targetObjectId: string): Promise<void>;
-    disconnect(targetObjectId: string): Promise<void>;
+    resolve(): Promise<QxObjectRef[]>;
+    connect(target: QxObjectRef): Promise<void>;
+    disconnect(target: QxObjectRef): Promise<void>;
+    collection(): Promise<RelationshipCollection>;
+    replace(entries: RelationshipEntry[], expectedRevision: bigint): Promise<RelationshipCollection>;
+};
+export type RelationshipEntry<T extends QxObjectRef = QxObjectRef> = {
+    edgeId?: string;
+    target: T;
+    key?: string | boolean | bigint;
+};
+export type RelationshipCollection<T extends QxObjectRef = QxObjectRef> = {
+    revision: bigint;
+    entries: RelationshipEntry<T>[];
 };
 export type InterfacePort = {
-    objectId: string;
+    objectId: QxObjectRef;
     interfaceRevisionId: string;
     invoke(operationId: string, input?: Record<string, unknown>): Promise<unknown>;
     live(operationId: string, input?: Record<string, unknown>): Promise<ReturnType<typeof liveValue>>;
 };
 export type ConstructorPort = {
     atomId: string;
-    construct(input?: Record<string, unknown>): Promise<string>;
+    construct(input?: Record<string, unknown>): Promise<QxObjectRef>;
 };
 export type RuntimePort = StatePort | EdgePort | InterfacePort | ConstructorPort;
 export type RuntimeContext = {
-    objectId: string;
+    /** Cooperative cancellation. Completion is acknowledged only after the handler returns. */
+    signal?: AbortSignal;
+    openSession?: () => Promise<RuntimeSession>;
+    objectId: QxObjectRef;
     input: Record<string, unknown>;
     inputProto: Record<string, Value>;
     ports: ReadonlyMap<string, RuntimePort>;
@@ -60,6 +75,16 @@ export type RuntimeContext = {
     interface(portId: string): InterfacePort;
     constructor(portId: string): ConstructorPort;
 };
+export type RuntimeSession = {
+    id: string;
+    run<T>(work: (context: RuntimeContext) => Promise<T>): Promise<T>;
+    /** Close the external resource first, then close its host retention/session. */
+    close(): Promise<void>;
+};
+export declare class RuntimeAuthorityError extends Error {
+    readonly retryable: boolean;
+    constructor(message: string);
+}
 export declare const createRuntimeContext: (camino: CaminoClient, orch: OrchClient, request: RuntimeRequest) => RuntimeContext;
 export type RuntimeHandler = (context: RuntimeContext) => unknown | Promise<unknown>;
 export type DerivedHandler = {

dist/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,IAAI,MAAM,WAAW,CAAC;AAC7B,cAAc,eAAe,CAAC;AAI9B,OAAO,EAAoC,KAAK,MAAM,EAAE,KAAK,aAAa,EAAE,MAAM,qBAAqB,CAAC;AAExG,OAAO,EACL,aAAa,EAOb,KAAK,KAAK,EACX,MAAM,oBAAoB,CAAC;AAC5B,OAAO,EAAE,mBAAmB,EAAE,MAAM,qBAAqB,CAAC;AAU1D,MAAM,MAAM,YAAY,GAAG,MAAM,CAAC,OAAO,aAAa,CAAC,CAAC;AACxD,MAAM,MAAM,UAAU,GAAG,MAAM,CAAC,OAAO,mBAAmB,CAAC,CAAC;AAE5D,MAAM,MAAM,iBAAiB,GACzB;IAAE,IAAI,EAAE,OAAO,CAAC;IAAC,QAAQ,EAAE,MAAM,CAAC;IAAC,YAAY,EAAE,MAAM,CAAA;CAAE,GACzD;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,QAAQ,EAAE,MAAM,CAAC;IAAC,YAAY,EAAE,MAAM,CAAC;IAAC,YAAY,EAAE,MAAM,CAAA;CAAE,CAAC;AA+BnF,eAAO,MAAM,SAAS,aAAc,MAAM;IAAQ,UAAU;CAAa,CAAC;AAC1E,eAAO,MAAM,SAAS,UAAW,KAAK;IAAQ,YAAY;CAAU,CAAC;AAErE,eAAO,MAAM,cAAc,UAAW,OAAO,KAAG,KAoC/C,CAAC;AAEF,eAAO,MAAM,cAAc,UAAW,KAAK,GAAG,SAAS,KAAG,OAoBzD,CAAC;AAEF,eAAO,MAAM,eAAe,WAAY,MAAM,CAAC,MAAM,EAAE,KAAK,CAAC;;CACmC,CAAC;AAEjG,MAAM,MAAM,SAAS,CAAC,CAAC,GAAG,OAAO,IAAI;IACnC,MAAM,EAAE,MAAM,CAAC;IACf,GAAG,IAAI,OAAO,CAAC,CAAC,CAAC,CAAC;IAClB,IAAI,IAAI,OAAO,CAAC,UAAU,CAAC,OAAO,SAAS,CAAC,CAAC,CAAC;IAC9C,GAAG,CAAC,KAAK,EAAE,CAAC,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;CAC9B,CAAC;AACF,MAAM,MAAM,QAAQ,GAAG;IACrB,UAAU,EAAE,MAAM,CAAC;IACnB,YAAY,EAAE,MAAM,CAAC;IACrB,OAAO,IAAI,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC;IAC7B,OAAO,CAAC,cAAc,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAC/C,UAAU,CAAC,cAAc,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;CACnD,CAAC;AACF,MAAM,MAAM,aAAa,GAAG;IAC1B,QAAQ,EAAE,MAAM,CAAC;IACjB,mBAAmB,EAAE,MAAM,CAAC;IAC5B,MAAM,CAAC,WAAW,EAAE,MAAM,EAAE,KAAK,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;IAC/E,IAAI,CAAC,WAAW,EAAE,MAAM,EAAE,KAAK,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,OAAO,CAAC,UAAU,CAAC,OAAO,SAAS,CAAC,CAAC,CAAC;CACnG,CAAC;AACF,MAAM,MAAM,eAAe,GAAG;IAC5B,MAAM,EAAE,MAAM,CAAC;IACf,SAAS,CAAC,KAAK,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC;CAC7D,CAAC;AACF,MAAM,MAAM,WAAW,GAAG,SAAS,GAAG,QAAQ,GAAG,aAAa,GAAG,eAAe,CAAC;AAEjF,MAAM,MAAM,cAAc,GAAG;IAC3B,QAAQ,EAAE,MAAM,CAAC;IACjB,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAC/B,UAAU,EAAE,MAAM,CAAC,MAAM,EAAE,KAAK,CAAC,CAAC;IAClC,KAAK,EAAE,WAAW,CAAC,MAAM,EAAE,WAAW,CAAC,CAAC;IACxC,KAAK,CAAC,CAAC,GAAG,OAAO,EAAE,MAAM,EAAE,MAAM,GAAG,SAAS,CAAC,CAAC,CAAC,CAAC;IACjD,IAAI,CAAC,MAAM,EAAE,MAAM,GAAG,QAAQ,CAAC;IAC/B,SAAS,CAAC,MAAM,EAAE,MAAM,GAAG,aAAa,CAAC;IACzC,WAAW,CAAC,MAAM,EAAE,MAAM,GAAG,eAAe,CAAC;CAC9C,CAAC;AAOF,eAAO,MAAM,oBAAoB,WACvB,YAAY,QACd,UAAU,WACP,cAAc,KACtB,cA6HF,CAAC;AAEF,MAAM,MAAM,cAAc,GAAG,CAAC,OAAO,EAAE,cAAc,KAAK,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;AACrF,MAAM,MAAM,cAAc,GAAG;IAAE,IAAI,EAAE,SAAS,CAAC;IAAC,GAAG,EAAE,cAAc,CAAA;CAAE,CAAC;AACtE,eAAO,MAAM,OAAO,QAAS,cAAc,KAAG,cAA4C,CAAC;AAyB3F,eAAO,MAAM,0BAA0B,WAAY;IACjD,iBAAiB,EAAE,MAAM,CAAC;IAC1B,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,cAAc,GAAG,cAAc,CAAC,CAAC;IACzD,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,OAAO,CAAC,EAAE,MAAM,CAAC;CAClB,cAsBiB,aAAa,kBA8J9B,CAAC;AAEF,eAAO,MAAM,mBAAmB,WAAY;IAC1C,iBAAiB,EAAE,MAAM,CAAC;IAC1B,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,cAAc,GAAG,cAAc,CAAC,CAAC;CAC1D,yEAaA,CAAC;AACF,KAAK,cAAc,GAAG;IACpB,QAAQ,EAAE,MAAM,CAAC;IACjB,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,KAAK,CAAC,CAAC;IAC7B,YAAY,EAAE,OAAO,qBAAqB,EAAE,kBAAkB,EAAE,CAAC;CAClE,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,IAAI,MAAM,WAAW,CAAC;AAG7B,OAAO,EAA8E,KAAK,WAAW,EAAE,MAAM,iBAAiB,CAAC;AAC/H,cAAc,eAAe,CAAC;AAC9B,OAAO,EAAC,eAAe,EAAE,gBAAgB,EAAE,eAAe,EAAC,MAAM,oBAAoB,CAAC;AAGtF,OAAO,EAAC,sBAAsB,EAAE,iBAAiB,EAAE,cAAc,EAAE,KAAK,gBAAgB,EAAE,KAAK,cAAc,EAAE,KAAK,eAAe,EAAE,KAAK,aAAa,EAAC,MAAM,gBAAgB,CAAC;AAE/K,OAAO,EAAoC,KAAK,MAAM,EAAE,KAAK,aAAa,EAAE,MAAM,qBAAqB,CAAC;AAExG,OAAO,EACL,aAAa,EAOb,KAAK,KAAK,EACX,MAAM,oBAAoB,CAAC;AAC5B,OAAO,EAAE,mBAAmB,EAAE,MAAM,qBAAqB,CAAC;AAU1D,MAAM,MAAM,YAAY,GAAG,MAAM,CAAC,OAAO,aAAa,CAAC,CAAC;AACxD,MAAM,MAAM,UAAU,GAAG,MAAM,CAAC,OAAO,mBAAmB,CAAC,CAAC;AAE5D,MAAM,MAAM,iBAAiB,GACzB;IAAE,IAAI,EAAE,OAAO,CAAC;IAAC,QAAQ,EAAE,MAAM,CAAC;IAAC,YAAY,EAAE,MAAM,CAAA;CAAE,GACzD;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,QAAQ,EAAE,MAAM,CAAC;IAAC,YAAY,EAAE,MAAM,CAAC;IAAC,YAAY,EAAE,MAAM,CAAA;CAAE,CAAC;AA+BnF,eAAO,MAAM,SAAS,cAAe,WAAW,wBAAsD,CAAC;AACvG,eAAO,MAAM,SAAS,UAAW,KAAK;IAAQ,YAAY;CAAU,CAAC;AAErE,eAAO,MAAM,cAAc,UAAW,OAAO,KAAG,KAiC/C,CAAC;AAEF,eAAO,MAAM,cAAc,UAAW,KAAK,GAAG,SAAS,KAAG,OAoBzD,CAAC;AAEF,eAAO,MAAM,eAAe,WAAY,MAAM,CAAC,MAAM,EAAE,KAAK,CAAC;;CACmC,CAAC;AAEjG,MAAM,MAAM,SAAS,CAAC,CAAC,GAAG,OAAO,IAAI;IACnC,MAAM,EAAE,MAAM,CAAC;IACf,GAAG,IAAI,OAAO,CAAC,CAAC,CAAC,CAAC;IAClB,IAAI,IAAI,OAAO,CAAC,UAAU,CAAC,OAAO,SAAS,CAAC,CAAC,CAAC;IAC9C,GAAG,CAAC,KAAK,EAAE,CAAC,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;CAC9B,CAAC;AACF,MAAM,MAAM,QAAQ,GAAG;IACrB,UAAU,EAAE,MAAM,CAAC;IACnB,YAAY,EAAE,MAAM,CAAC;IACrB,OAAO,IAAI,OAAO,CAAC,WAAW,EAAE,CAAC,CAAC;IAClC,OAAO,CAAC,MAAM,EAAE,WAAW,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAC5C,UAAU,CAAC,MAAM,EAAE,WAAW,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAC/C,UAAU,IAAI,OAAO,CAAC,sBAAsB,CAAC,CAAC;IAC9C,OAAO,CAAC,OAAO,EAAE,iBAAiB,EAAE,EAAE,gBAAgB,EAAE,MAAM,GAAG,OAAO,CAAC,sBAAsB,CAAC,CAAC;CAClG,CAAC;AACF,MAAM,MAAM,iBAAiB,CAAC,CAAC,SAAS,WAAW,GAAG,WAAW,IAAI;IAAC,MAAM,CAAC,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,CAAC,CAAC;IAAC,GAAG,CAAC,EAAE,MAAM,GAAG,OAAO,GAAG,MAAM,CAAA;CAAC,CAAC;AACnI,MAAM,MAAM,sBAAsB,CAAC,CAAC,SAAS,WAAW,GAAG,WAAW,IAAI;IAAC,QAAQ,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,iBAAiB,CAAC,CAAC,CAAC,EAAE,CAAA;CAAC,CAAC;AAC9H,MAAM,MAAM,aAAa,GAAG;IAC1B,QAAQ,EAAE,WAAW,CAAC;IACtB,mBAAmB,EAAE,MAAM,CAAC;IAC5B,MAAM,CAAC,WAAW,EAAE,MAAM,EAAE,KAAK,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;IAC/E,IAAI,CAAC,WAAW,EAAE,MAAM,EAAE,KAAK,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,OAAO,CAAC,UAAU,CAAC,OAAO,SAAS,CAAC,CAAC,CAAC;CACnG,CAAC;AACF,MAAM,MAAM,eAAe,GAAG;IAC5B,MAAM,EAAE,MAAM,CAAC;IACf,SAAS,CAAC,KAAK,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,OAAO,CAAC,WAAW,CAAC,CAAC;CAClE,CAAC;AACF,MAAM,MAAM,WAAW,GAAG,SAAS,GAAG,QAAQ,GAAG,aAAa,GAAG,eAAe,CAAC;AAEjF,MAAM,MAAM,cAAc,GAAG;IAC3B,2FAA2F;IAC3F,MAAM,CAAC,EAAE,WAAW,CAAC;IACrB,WAAW,CAAC,EAAE,MAAM,OAAO,CAAC,cAAc,CAAC,CAAC;IAC5C,QAAQ,EAAE,WAAW,CAAC;IACtB,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAC/B,UAAU,EAAE,MAAM,CAAC,MAAM,EAAE,KAAK,CAAC,CAAC;IAClC,KAAK,EAAE,WAAW,CAAC,MAAM,EAAE,WAAW,CAAC,CAAC;IACxC,KAAK,CAAC,CAAC,GAAG,OAAO,EAAE,MAAM,EAAE,MAAM,GAAG,SAAS,CAAC,CAAC,CAAC,CAAC;IACjD,IAAI,CAAC,MAAM,EAAE,MAAM,GAAG,QAAQ,CAAC;IAC/B,SAAS,CAAC,MAAM,EAAE,MAAM,GAAG,aAAa,CAAC;IACzC,WAAW,CAAC,MAAM,EAAE,MAAM,GAAG,eAAe,CAAC;CAC9C,CAAC;AAEF,MAAM,MAAM,cAAc,GAAG;IAC3B,EAAE,EAAE,MAAM,CAAC;IACX,GAAG,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC,OAAO,EAAE,cAAc,KAAK,OAAO,CAAC,CAAC,CAAC,GAAG,OAAO,CAAC,CAAC,CAAC,CAAC;IAClE,gFAAgF;IAChF,KAAK,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC;CACxB,CAAC;AACF,qBAAa,qBAAsB,SAAQ,KAAK;IAC9C,QAAQ,CAAC,SAAS,EAAE,OAAO,CAAC;IAC5B,YAAY,OAAO,EAAE,MAAM,EAAyH;CACrJ;AAOD,eAAO,MAAM,oBAAoB,WACvB,YAAY,QACd,UAAU,WACP,cAAc,KACtB,cA8IF,CAAC;AAEF,MAAM,MAAM,cAAc,GAAG,CAAC,OAAO,EAAE,cAAc,KAAK,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;AACrF,MAAM,MAAM,cAAc,GAAG;IAAE,IAAI,EAAE,SAAS,CAAC;IAAC,GAAG,EAAE,cAAc,CAAA;CAAE,CAAC;AACtE,eAAO,MAAM,OAAO,QAAS,cAAc,KAAG,cAA4C,CAAC;AAyB3F,eAAO,MAAM,0BAA0B,WAAY;IACjD,iBAAiB,EAAE,MAAM,CAAC;IAC1B,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,cAAc,GAAG,cAAc,CAAC,CAAC;IACzD,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,OAAO,CAAC,EAAE,MAAM,CAAC;CAClB,cA8FiB,aAAa,kBA2L9B,CAAC;AAEF,eAAO,MAAM,mBAAmB,WAAY;IAC1C,iBAAiB,EAAE,MAAM,CAAC;IAC1B,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,cAAc,GAAG,cAAc,CAAC,CAAC;CAC1D,yEAaA,CAAC;AACF,KAAK,cAAc,GAAG;IACpB,QAAQ,EAAE,MAAM,CAAC;IACjB,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,KAAK,CAAC,CAAC;IAC7B,YAAY,EAAE,OAAO,qBAAqB,EAAE,kBAAkB,EAAE,CAAC;CAClE,CAAC"}

dist/index.js

@@ -1,7 +1,12 @@
 import http from "node:http";
+import { readFileSync } from "node:fs";
+import { createInvocationRegistry } from "./invocations.js";
+import { isObjectReference, referenceFromWire, referenceToWire, assertReferenceFree } from "./references.js";
 export * from "./bindings.js";
+export { relationshipMap, relationshipList, relationshipSet } from "./relationships.js";
 import { AsyncLocalStorage } from "node:async_hooks";
-import { randomUUID } from "node:crypto";
+import { createHmac, randomBytes, randomUUID, timingSafeEqual } from "node:crypto";
+export { createMigrationContext, migrationObjectId, serveMigration } from "./migration.js";
 import { create, equals } from "@bufbuild/protobuf";
 import { Code, ConnectError, createClient } from "@connectrpc/connect";
 import { connectNodeAdapter, createConnectTransport } from "@connectrpc/connect-node";
@@ -24,9 +29,11 @@ const base64ToBytes = (value) => Buffer.from(value, "base64");
 const isRecord = (value) => Boolean(value) && typeof value === "object" && !Array.isArray(value);
 const isWrappedValue = (value) => isRecord(value) && "$quixosValue" in value &&
     isRecord(value.$quixosValue) && value.$quixosValue.$typeName === "camino.Value";
-export const objectRef = (objectId) => ({ $quixosRef: objectId });
+export const objectRef = (reference) => { referenceToWire(reference); return reference; };
 export const liveValue = (value) => ({ $quixosValue: value });
 export const jsToProtoValue = (value) => {
+    if (isObjectReference(value))
+        return create(ValueSchema, { kind: { case: "refValue", value: create(RefValueSchema, { objectId: referenceToWire(value) }) } });
     if (isWrappedValue(value))
         return value.$quixosValue;
     if (value === null || value === undefined) {
@@ -47,11 +54,8 @@ export const jsToProtoValue = (value) => {
             kind: { case: "listValue", value: create(ListValueSchema, { values: value.map(jsToProtoValue) }) },
         });
     }
-    if (isRecord(value) && typeof value.$quixosRef === "string") {
-        return create(ValueSchema, {
-            kind: { case: "refValue", value: create(RefValueSchema, { objectId: value.$quixosRef }) },
-        });
-    }
+    if (isRecord(value) && "$quixosRef" in value)
+        throw new Error("Raw ID wrappers are not object references");
     if (isRecord(value) && typeof value.$quixosCrdtType === "string" &&
         typeof value.$quixosCrdtPayload === "string") {
         return create(ValueSchema, {
@@ -79,7 +83,7 @@ export const protoValueToJs = (value) => {
         case "stringValue":
         case "integerValue": return value.kind.value;
         case "bytesValue": return bytesToBase64(value.kind.value);
-        case "refValue": return value.kind.value.objectId;
+        case "refValue": return referenceFromWire(value.kind.value.objectId);
         case "listValue": return value.kind.value.values.map(protoValueToJs);
         case "objectValue": return Object.fromEntries(Object.entries(value.kind.value.fields).map(([key, entry]) => [key, protoValueToJs(entry)]));
         case "crdtValue": return {
@@ -90,6 +94,10 @@ export const protoValueToJs = (value) => {
     }
 };
 export const protoFieldsToJs = (fields) => Object.fromEntries(Object.entries(fields).map(([key, value]) => [key, protoValueToJs(value)]));
+export class RuntimeAuthorityError extends Error {
+    retryable;
+    constructor(message) { super(message); this.name = "RuntimeAuthorityError"; this.retryable = /WORKSPACE_FENCED|STALE_EPOCH/.test(message); }
+}
 const targetForEdge = (edge, projectionId) => edge.firstProjectionId === projectionId ? edge.secondObjectId : edge.firstObjectId;
 export const createRuntimeContext = (camino, orch, request) => {
     const ports = new Map();
@@ -112,6 +120,7 @@ export const createRuntimeContext = (camino, orch, request) => {
                         return liveValue(value.value);
                     },
                     async set(value) {
+                        assertReferenceFree(isWrappedValue(value) ? protoValueToJs(value.$quixosValue) : value);
                         await camino.writeState({ objectId: dependencyObjectId, slotId, value: jsToProtoValue(value) });
                     },
                 };
@@ -121,18 +130,34 @@ export const createRuntimeContext = (camino, orch, request) => {
             case "edge": {
                 const { edgeTypeId, projectionId } = dependency.binding.value;
                 const dependencyObjectId = dependency.objectId || request.objectId;
+                const collectionResult = (response) => ({ revision: response.revision,
+                    entries: response.entries.map((entry) => ({ edgeId: entry.edgeId, target: referenceFromWire(entry.targetObjectId),
+                        ...(entry.key ? { key: entry.key.kind.case === "integerValue" ? BigInt(entry.key.kind.value) : protoValueToJs(entry.key) } : {}) })) });
                 const edge = {
                     edgeTypeId,
                     projectionId,
+                    async collection() {
+                        await recordDependency({ kind: "edge", objectId: dependencyObjectId, attachmentId: edgeTypeId, projectionId });
+                        return collectionResult(await camino.readCollection({ objectId: dependencyObjectId, edgeTypeId, projectionId }));
+                    },
+                    async replace(entries, expectedRevision) {
+                        return collectionResult(await camino.replaceCollection({ objectId: dependencyObjectId, edgeTypeId, projectionId, expectedRevision,
+                            entries: entries.map((entry) => {
+                                assertReferenceFree(entry.key);
+                                return { edgeId: entry.edgeId ?? "", targetObjectId: referenceToWire(entry.target), key: entry.key === undefined ? undefined : jsToProtoValue(entry.key) };
+                            }) }));
+                    },
                     async resolve() {
                         await recordDependency({ kind: "edge", objectId: dependencyObjectId, attachmentId: edgeTypeId, projectionId });
                         const result = await camino.resolveEdge({ objectId: dependencyObjectId, edgeTypeId, projectionId });
-                        return result.edges.map((entry) => targetForEdge(entry, projectionId));
+                        return result.edges.map((entry) => referenceFromWire(targetForEdge(entry, projectionId)));
                     },
-                    async connect(targetObjectId) {
+                    async connect(target) {
+                        const targetObjectId = referenceToWire(target);
                         await camino.connectEdge({ objectId: dependencyObjectId, edgeTypeId, projectionId, targetObjectId });
                     },
-                    async disconnect(targetObjectId) {
+                    async disconnect(target) {
+                        const targetObjectId = referenceToWire(target);
                         const result = await camino.resolveEdge({ objectId: dependencyObjectId, edgeTypeId, projectionId });
                         for (const entry of result.edges) {
                             if (targetForEdge(entry, projectionId) === targetObjectId)
@@ -174,7 +199,7 @@ export const createRuntimeContext = (camino, orch, request) => {
                     return response.result;
                 };
                 const capability = {
-                    objectId: dependencyObjectId,
+                    objectId: referenceFromWire(dependencyObjectId),
                     interfaceRevisionId,
                     async invoke(operationId, input = {}) {
                         return protoValueToJs(await invoke(operationId, input));
@@ -200,7 +225,7 @@ export const createRuntimeContext = (camino, orch, request) => {
                         });
                         if (!response.object)
                             throw new Error(`Constructor ${atomId} returned no object`);
-                        return response.object.id;
+                        return referenceFromWire(response.object.id);
                     },
                 };
                 ports.set(dependency.portId, constructor);
@@ -214,7 +239,7 @@ export const createRuntimeContext = (camino, orch, request) => {
         return port;
     };
     return {
-        objectId: request.objectId,
+        objectId: referenceFromWire(request.objectId),
         input: protoFieldsToJs(request.input),
         inputProto: request.input,
         ports,
@@ -238,9 +263,12 @@ const protoDependencies = (dependencies) => dependencies.map((entry) => create(D
     projectionId: entry.kind === "edge" ? entry.projectionId : "",
 }));
 export const createPackageRuntimeRoutes = (config) => {
+    const invocations = createInvocationRegistry();
     const headers = {};
-    if (process.env.CAMINO_RUNTIME_AUTH_TOKEN) {
-        headers["x-camino-runtime-token"] = process.env.CAMINO_RUNTIME_AUTH_TOKEN;
+    const processToken = process.env.CAMINO_RUNTIME_AUTH_TOKEN ?? (process.env.CAMINO_RUNTIME_AUTH_TOKEN_FILE
+        ? readFileSync(process.env.CAMINO_RUNTIME_AUTH_TOKEN_FILE, "utf8").trim() : "");
+    if (processToken) {
+        headers["x-camino-runtime-token"] = processToken;
     }
     else if (process.env.CAMINO_RUNTIME_AUTH_REQUIRED === "1") {
         throw new Error("CAMINO_RUNTIME_AUTH_TOKEN is required");
@@ -259,19 +287,115 @@ export const createPackageRuntimeRoutes = (config) => {
         baseUrl: config.orchUrl ?? process.env.QUIXOS_ORCH_URL ?? "http://127.0.0.1:7311",
         httpVersion: "1.1",
     }));
+    const authenticateInstance = (header) => {
+        if (!process.env.QUIXOS_RUNTIME_INSTANCE_ID)
+            return; // standalone development ABI
+        const supplied = Buffer.from(header.get("x-quixos-instance-token") ?? "");
+        const expected = Buffer.from(processToken);
+        if (!expected.length || supplied.length !== expected.length || !timingSafeEqual(supplied, expected)) {
+            throw new ConnectError("Invalid runtime instance credential", Code.Unauthenticated);
+        }
+    };
+    const clientsFor = (request) => {
+        const context = request.context;
+        if (process.env.QUIXOS_RUNTIME_INSTANCE_ID && (!context?.grant || context.instanceId !== process.env.QUIXOS_RUNTIME_INSTANCE_ID || !context.workspaceEpoch)) {
+            throw new ConnectError("Managed invocation requires an exact instance and epoch grant", Code.Unauthenticated);
+        }
+        if (!context?.grant)
+            return { camino, orch };
+        const transport = (url) => createConnectTransport({ baseUrl: url, httpVersion: "1.1", interceptors: [(next) => async (call) => {
+                    call.header.set("x-quixos-invocation-grant", context.grant);
+                    call.header.set("x-camino-runtime-token", processToken);
+                    return next(call);
+                }] });
+        return {
+            camino: createClient(CaminoService, transport(config.caminoUrl ?? process.env.CAMINO_URL ?? "http://127.0.0.1:7310")),
+            orch: createClient(OrchestratorRuntime, transport(config.orchUrl ?? process.env.QUIXOS_ORCH_URL ?? "http://127.0.0.1:7311")),
+        };
+    };
+    const runtimeControl = async (operation, input) => {
+        const response = await fetch(`${config.caminoUrl ?? process.env.CAMINO_URL ?? "http://127.0.0.1:7310"}/__runtime/${operation}`, {
+            method: "POST", headers: { "content-type": "application/json", "x-camino-runtime-token": processToken }, body: JSON.stringify(input), signal: AbortSignal.timeout(10_000),
+        });
+        const value = await response.json();
+        if (!response.ok)
+            throw new RuntimeAuthorityError(value.error ?? "Runtime authority request failed");
+        return value;
+    };
+    const attachSessions = (runtimeContext, request) => {
+        if (!request.context?.grant || !request.context.ownerConformanceId)
+            return;
+        runtimeContext.openSession = async () => {
+            const ownerId = request.context.ownerConformanceId;
+            const registration = { grant: request.context.grant, objectId: request.objectId, ownerId,
+                sessionId: `session:${randomBytes(16).toString("hex")}`, token: randomBytes(32).toString("base64url") };
+            const register = () => runtimeControl("register-session", registration);
+            const registered = await register().catch((error) => {
+                // Retry a transport/lost-response failure with exactly the same identity.
+                // Admission/authority errors are definitive and must not be retried here.
+                if (error instanceof RuntimeAuthorityError)
+                    throw error;
+                return register();
+            });
+            let closed = false;
+            return {
+                id: registered.sessionId,
+                async run(work) {
+                    if (closed)
+                        throw new RuntimeAuthorityError("SESSION_CLOSED");
+                    // Acquisition happens before user code. A fence failure can be retried
+                    // by the caller without replaying a side-effecting callback.
+                    const grant = await runtimeControl("acquire-session", registered);
+                    const execution = invocations.begin(grant.invocationId);
+                    const sessionRequest = { ...request, context: { grant: grant.grant, instanceId: grant.instanceId, workspaceEpoch: grant.epoch } };
+                    const clients = clientsFor(sessionRequest);
+                    const context = createRuntimeContext(clients.camino, clients.orch, sessionRequest);
+                    context.signal = execution.signal;
+                    try {
+                        return await work(context);
+                    }
+                    finally {
+                        execution.finish();
+                        await runtimeControl("complete-invocation", { invocationId: grant.invocationId }).catch((error) => console.error("Session completion will be reconciled by the host", error));
+                    }
+                },
+                async close() { await runtimeControl("close-session", registered); closed = true; },
+            };
+        };
+    };
     return (router) => router.service(PackageRuntime, {
-        handshake: () => create(HandshakeResponseSchema, {
+        handshake: (request) => create(HandshakeResponseSchema, {
             packageRevisionId: config.packageRevisionId,
             runtimeProtocolVersion: "quixos-capabilities-v1",
             exportIds: Object.keys(config.exports),
+            capabilities: ["invocation-completion-v1", "instance-authentication-v1", "epoch-grants-v1"],
+            instanceId: process.env.QUIXOS_RUNTIME_INSTANCE_ID ?? "",
+            authenticationProof: request.nonce && processToken ? createHmac("sha256", processToken)
+                .update(JSON.stringify([request.nonce, process.env.QUIXOS_RUNTIME_INSTANCE_ID ?? "", config.packageRevisionId]))
+                .digest("hex") : "",
         }),
-        invoke: async (request) => {
+        getInvocationStatus: (request, context) => {
+            authenticateInstance(context.requestHeader);
+            return invocations.status(request.invocationId);
+        },
+        cancelInvocation: (request, context) => {
+            authenticateInstance(context.requestHeader);
+            return invocations.cancel(request.invocationId);
+        },
+        invoke: async (request, context) => {
+            authenticateInstance(context.requestHeader);
+            const { camino, orch } = clientsFor(request);
             const exportId = request.export?.exportId;
             const handler = exportId ? config.exports[exportId] : undefined;
             if (!handler)
                 throw new ConnectError(`Unknown export ${exportId ?? ""}`, Code.NotFound);
+            const execution = invocations.begin(request.invocationId || (process.env.QUIXOS_RUNTIME_INSTANCE_ID ? "" : randomUUID()));
             try {
-                const result = await evaluate(handler, createRuntimeContext(camino, orch, request));
+                const runtimeContext = createRuntimeContext(camino, orch, request);
+                attachSessions(runtimeContext, request);
+                runtimeContext.signal = AbortSignal.any([context.signal, execution.signal]);
+                const result = await evaluate(handler, runtimeContext);
+                execution.finish();
                 return create(InvokeResponseSchema, {
                     ok: true,
                     result: result.value,
@@ -279,6 +403,7 @@ export const createPackageRuntimeRoutes = (config) => {
                 });
             }
             catch (error) {
+                execution.finish(true);
                 return create(InvokeResponseSchema, {
                     ok: false,
                     error: error instanceof Error ? error.message : String(error),
@@ -286,130 +411,141 @@ export const createPackageRuntimeRoutes = (config) => {
             }
         },
         watch: async function* (request, context) {
+            authenticateInstance(context.requestHeader);
+            const { camino, orch } = clientsFor(request);
             const exportId = request.export?.exportId;
             const handler = exportId ? config.exports[exportId] : undefined;
             if (!handler || !isDerived(handler)) {
                 throw new ConnectError(`Export ${exportId ?? ""} is not derived`, Code.FailedPrecondition);
             }
-            const watchId = `watch:${randomUUID()}`;
-            const runtimeContext = createRuntimeContext(camino, orch, request);
-            const subscriptions = new Map();
-            const establishing = new Map();
-            let subscriptionEpoch = 0;
-            const ensureSubscription = async (dependency) => {
-                const key = dependencyKey(dependency);
-                if (subscriptions.has(key))
-                    return;
-                const pending = establishing.get(key);
-                if (pending)
-                    return await pending;
-                const establish = (async () => {
-                    const controller = new AbortController();
-                    const stream = camino.watchObject({ objectId: dependency.objectId, includeSnapshot: true }, { signal: controller.signal })[Symbol.asyncIterator]();
+            const execution = invocations.begin(request.invocationId || (process.env.QUIXOS_RUNTIME_INSTANCE_ID ? "" : randomUUID()));
+            const signal = AbortSignal.any([context.signal, execution.signal]);
+            try {
+                const watchId = `watch:${randomUUID()}`;
+                const runtimeContext = createRuntimeContext(camino, orch, request);
+                attachSessions(runtimeContext, request);
+                runtimeContext.signal = signal;
+                const subscriptions = new Map();
+                const establishing = new Map();
+                let subscriptionEpoch = 0;
+                const ensureSubscription = async (dependency) => {
+                    const key = dependencyKey(dependency);
+                    if (subscriptions.has(key))
+                        return;
+                    const pending = establishing.get(key);
+                    if (pending)
+                        return await pending;
+                    const establish = (async () => {
+                        const controller = new AbortController();
+                        const stream = camino.watchObject({ objectId: dependency.objectId, includeSnapshot: true, attachmentIds: request.context?.grant ? [dependency.attachmentId] : [] }, { signal: controller.signal })[Symbol.asyncIterator]();
+                        try {
+                            // Camino subscribes before producing the snapshot, so once this
+                            // resolves the following state/edge read cannot race the stream.
+                            const snapshot = await stream.next();
+                            if (snapshot.done)
+                                throw new Error(`Dependency stream ${key} ended during setup`);
+                            const waitNext = () => stream.next().then((result) => ({ key, done: Boolean(result.done) }), (error) => ({ key, done: true, error }));
+                            const subscription = {
+                                dependency,
+                                controller,
+                                waitNext,
+                                next: Promise.resolve({ key, done: false }),
+                            };
+                            subscription.next = waitNext();
+                            subscriptions.set(key, subscription);
+                            subscriptionEpoch += 1;
+                        }
+                        catch (error) {
+                            controller.abort();
+                            throw error;
+                        }
+                    })();
+                    establishing.set(key, establish);
                     try {
-                        // Camino subscribes before producing the snapshot, so once this
-                        // resolves the following state/edge read cannot race the stream.
-                        const snapshot = await stream.next();
-                        if (snapshot.done)
-                            throw new Error(`Dependency stream ${key} ended during setup`);
-                        const waitNext = () => stream.next().then((result) => ({ key, done: Boolean(result.done) }), (error) => ({ key, done: true, error }));
-                        const subscription = {
-                            dependency,
-                            controller,
-                            waitNext,
-                            next: Promise.resolve({ key, done: false }),
-                        };
-                        subscription.next = waitNext();
-                        subscriptions.set(key, subscription);
-                        subscriptionEpoch += 1;
+                        await establish;
                     }
-                    catch (error) {
-                        controller.abort();
-                        throw error;
+                    finally {
+                        establishing.delete(key);
                     }
-                })();
-                establishing.set(key, establish);
+                };
+                const abortAll = () => {
+                    for (const subscription of subscriptions.values()) {
+                        subscription.controller.abort();
+                    }
+                };
+                signal.addEventListener("abort", abortAll, { once: true });
+                const evaluateWithStableSubscriptions = async () => {
+                    // A direct state/edge port records its dependency before reading it,
+                    // but a nested interface invocation can only report its transitive
+                    // dependencies after that invocation returns. Once a new dependency
+                    // stream is established, evaluate again so every read contributing to
+                    // the emitted value happened after its stream became live.
+                    for (let pass = 0; pass < 32; pass += 1) {
+                        const before = subscriptionEpoch;
+                        const result = await evaluate(handler, runtimeContext, ensureSubscription);
+                        if (subscriptionEpoch === before)
+                            return result;
+                    }
+                    throw new Error("Derived dependency discovery did not stabilize after 32 passes");
+                };
                 try {
-                    await establish;
+                    let current = await evaluateWithStableSubscriptions();
+                    yield create(WatchEventSchema, {
+                        watchId,
+                        value: current.value,
+                        dependencies: protoDependencies(current.dependencies),
+                        initial: true,
+                    });
+                    const abort = new Promise((resolve) => {
+                        if (signal.aborted)
+                            resolve("abort");
+                        else
+                            signal.addEventListener("abort", () => resolve("abort"), { once: true });
+                    });
+                    while (!signal.aborted) {
+                        if (subscriptions.size === 0) {
+                            await abort;
+                            break;
+                        }
+                        const outcome = await Promise.race([
+                            ...[...subscriptions.values()].map((entry) => entry.next),
+                            abort,
+                        ]);
+                        if (outcome === "abort")
+                            break;
+                        const subscription = subscriptions.get(outcome.key);
+                        if (!subscription)
+                            continue;
+                        if (outcome.error)
+                            throw outcome.error;
+                        if (outcome.done)
+                            throw new Error(`Dependency stream ${outcome.key} ended unexpectedly`);
+                        subscription.next = subscription.waitNext();
+                        const updated = await evaluateWithStableSubscriptions();
+                        const active = new Set(updated.dependencies.map(dependencyKey));
+                        for (const [key, entry] of subscriptions) {
+                            if (!active.has(key)) {
+                                entry.controller.abort();
+                                subscriptions.delete(key);
+                            }
+                        }
+                        if (!equals(ValueSchema, current.value, updated.value)) {
+                            yield create(WatchEventSchema, {
+                                watchId,
+                                value: updated.value,
+                                dependencies: protoDependencies(updated.dependencies),
+                            });
+                        }
+                        current = updated;
+                    }
                 }
                 finally {
-                    establishing.delete(key);
-                }
-            };
-            const abortAll = () => {
-                for (const subscription of subscriptions.values()) {
-                    subscription.controller.abort();
-                }
-            };
-            context.signal.addEventListener("abort", abortAll, { once: true });
-            const evaluateWithStableSubscriptions = async () => {
-                // A direct state/edge port records its dependency before reading it,
-                // but a nested interface invocation can only report its transitive
-                // dependencies after that invocation returns. Once a new dependency
-                // stream is established, evaluate again so every read contributing to
-                // the emitted value happened after its stream became live.
-                for (let pass = 0; pass < 32; pass += 1) {
-                    const before = subscriptionEpoch;
-                    const result = await evaluate(handler, runtimeContext, ensureSubscription);
-                    if (subscriptionEpoch === before)
-                        return result;
-                }
-                throw new Error("Derived dependency discovery did not stabilize after 32 passes");
-            };
-            let current = await evaluateWithStableSubscriptions();
-            yield create(WatchEventSchema, {
-                watchId,
-                value: current.value,
-                dependencies: protoDependencies(current.dependencies),
-                initial: true,
-            });
-            const abort = new Promise((resolve) => {
-                if (context.signal.aborted)
-                    resolve("abort");
-                else
-                    context.signal.addEventListener("abort", () => resolve("abort"), { once: true });
-            });
-            try {
-                while (!context.signal.aborted) {
-                    if (subscriptions.size === 0) {
-                        await abort;
-                        break;
-                    }
-                    const outcome = await Promise.race([
-                        ...[...subscriptions.values()].map((entry) => entry.next),
-                        abort,
-                    ]);
-                    if (outcome === "abort")
-                        break;
-                    const subscription = subscriptions.get(outcome.key);
-                    if (!subscription)
-                        continue;
-                    if (outcome.error)
-                        throw outcome.error;
-                    if (outcome.done)
-                        throw new Error(`Dependency stream ${outcome.key} ended unexpectedly`);
-                    subscription.next = subscription.waitNext();
-                    const updated = await evaluateWithStableSubscriptions();
-                    const active = new Set(updated.dependencies.map(dependencyKey));
-                    for (const [key, entry] of subscriptions) {
-                        if (!active.has(key)) {
-                            entry.controller.abort();
-                            subscriptions.delete(key);
-                        }
-                    }
-                    if (!equals(ValueSchema, current.value, updated.value)) {
-                        yield create(WatchEventSchema, {
-                            watchId,
-                            value: updated.value,
-                            dependencies: protoDependencies(updated.dependencies),
-                        });
-                    }
-                    current = updated;
+                    signal.removeEventListener("abort", abortAll);
+                    abortAll();
                 }
             }
             finally {
-                context.signal.removeEventListener("abort", abortAll);
-                abortAll();
+                execution.finish();
             }
         },
     });

dist/invocations.d.ts

@@ -0,0 +1,16 @@
+/** Execution completion, not HTTP disconnection, is the drain boundary. */
+export declare const createInvocationRegistry: () => {
+    begin(id: string): {
+        signal: AbortSignal;
+        finish(failed?: boolean): void;
+    };
+    status(id: string): {
+        invocationId: string;
+        state: string;
+    };
+    cancel(id: string): {
+        invocationId: string;
+        state: string;
+    };
+};
+//# sourceMappingURL=invocations.d.ts.map

dist/invocations.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"invocations.d.ts","sourceRoot":"","sources":["../src/invocations.ts"],"names":[],"mappings":"AAAA,2EAA2E;AAC3E,eAAO,MAAM,wBAAwB;IAGjC,KAAK,KAAK,MAAM;QAOL,MAAM;QAA2B,MAAM;;IAElD,MAAM,KAAK,MAAM;QAAa,YAAY;QAAM,KAAK;;IACrD,MAAM,KAAK,MAAM;;;;CASpB,CAAC"}

dist/invocations.js

@@ -0,0 +1,26 @@
+/** Execution completion, not HTTP disconnection, is the drain boundary. */
+export const createInvocationRegistry = () => {
+    const entries = new Map();
+    return {
+        begin(id) {
+            if (!id || entries.has(id))
+                throw new Error("Invocation ID is missing or already used; invocations are never replayed implicitly");
+            // Completed identities remain until process retirement. A bounded process
+            // may reject new work; it must not evict and accidentally replay a call.
+            if (entries.size >= 100_000)
+                throw new Error("Invocation registry full; explicit runtime retirement required");
+            const entry = { state: "running", controller: new AbortController() };
+            entries.set(id, entry);
+            return { signal: entry.controller.signal, finish(failed = false) { entry.state = failed ? "failed" : "completed"; } };
+        },
+        status(id) { return { invocationId: id, state: entries.get(id)?.state ?? "unknown" }; },
+        cancel(id) {
+            const entry = entries.get(id);
+            if (entry && ["running", "cancellation-requested"].includes(entry.state)) {
+                entry.state = "cancellation-requested";
+                entry.controller.abort();
+            }
+            return this.status(id);
+        },
+    };
+};

dist/migration.d.ts

@@ -0,0 +1,72 @@
+export type MigrationInput = {
+    schemaVersion: 1;
+    executionId: string;
+    exportId: string;
+    ports: {
+        name: string;
+        binding: string;
+        view: "old" | "new";
+        access: ("read" | "write" | "create" | "edge")[];
+        atomId?: string;
+        attachedAtomId?: string;
+        defaultValue?: unknown;
+        states?: {
+            objectId: string;
+            value: unknown;
+        }[];
+        edges?: MigrationEdge[];
+    }[];
+};
+export type MigrationEdge = {
+    id: string;
+    edgeTypeId: string;
+    firstObjectId: string;
+    secondObjectId: string;
+    firstProjectionId: string;
+    secondProjectionId: string;
+    firstOrdinal?: number;
+    secondOrdinal?: number;
+    firstKeyJson?: string;
+    secondKeyJson?: string;
+};
+export type MigrationOutput = {
+    schemaVersion: 1;
+    executionId: string;
+    writes: {
+        port: string;
+        objectId: string;
+        value: unknown;
+    }[];
+    creates: {
+        port: string;
+        logicalKey: string;
+        objectId: string;
+    }[];
+    edgeReplacements: {
+        port: string;
+        edges: MigrationEdge[];
+    }[];
+};
+export type MigrationContext = {
+    enumerate(port: string): {
+        objectId: string;
+        value: unknown;
+    }[];
+    read(port: string, objectId: string): unknown;
+    write(port: string, objectId: string, value: unknown): void;
+    create(port: string, logicalKey: string): string;
+    edges(port: string): MigrationEdge[];
+    replaceEdges(port: string, edges: MigrationEdge[]): void;
+};
+export declare const migrationObjectId: (executionId: string, port: string, logicalKey: string) => string;
+/** No ordinary RuntimeContext or network/database clients are supplied here.
+ * Process isolation belongs to the host, not this convenience API. */
+export declare const createMigrationContext: (input: MigrationInput) => {
+    context: MigrationContext;
+    result: () => MigrationOutput;
+};
+/** Entrypoint for an immutable package's dedicated bin/migrate executable.
+ * stdout is protocol-only; send diagnostics to stderr. The host independently
+ * validates every write, helper identity, contract, and completion receipt. */
+export declare const serveMigration: (exports: Record<string, (context: MigrationContext) => void | Promise<void>>) => Promise<void>;
+//# sourceMappingURL=migration.d.ts.map

dist/migration.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"migration.d.ts","sourceRoot":"","sources":["../src/migration.ts"],"names":[],"mappings":"AAEA,MAAM,MAAM,cAAc,GAAG;IAC3B,aAAa,EAAE,CAAC,CAAC;IAAC,WAAW,EAAE,MAAM,CAAC;IAAC,QAAQ,EAAE,MAAM,CAAC;IACxD,KAAK,EAAE;QAAC,IAAI,EAAE,MAAM,CAAC;QAAC,OAAO,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,KAAK,GAAG,KAAK,CAAC;QAAC,MAAM,EAAE,CAAC,MAAM,GAAG,OAAO,GAAG,QAAQ,GAAG,MAAM,CAAC,EAAE,CAAC;QAAC,MAAM,CAAC,EAAE,MAAM,CAAC;QAC5H,cAAc,CAAC,EAAE,MAAM,CAAC;QAAC,YAAY,CAAC,EAAE,OAAO,CAAC;QAChD,MAAM,CAAC,EAAE;YAAC,QAAQ,EAAE,MAAM,CAAC;YAAC,KAAK,EAAE,OAAO,CAAA;SAAC,EAAE,CAAC;QAAC,KAAK,CAAC,EAAE,aAAa,EAAE,CAAA;KAAC,EAAE,CAAC;CAC7E,CAAC;AACF,MAAM,MAAM,aAAa,GAAG;IAAC,EAAE,EAAE,MAAM,CAAC;IAAC,UAAU,EAAE,MAAM,CAAC;IAAC,aAAa,EAAE,MAAM,CAAC;IAAC,cAAc,EAAE,MAAM,CAAC;IAAC,iBAAiB,EAAE,MAAM,CAAC;IAAC,kBAAkB,EAAE,MAAM,CAAC;IAAC,YAAY,CAAC,EAAE,MAAM,CAAC;IAAC,aAAa,CAAC,EAAE,MAAM,CAAC;IAAC,YAAY,CAAC,EAAE,MAAM,CAAC;IAAC,aAAa,CAAC,EAAE,MAAM,CAAA;CAAC,CAAC;AACjQ,MAAM,MAAM,eAAe,GAAG;IAAC,aAAa,EAAE,CAAC,CAAC;IAAC,WAAW,EAAE,MAAM,CAAC;IACnE,MAAM,EAAE;QAAC,IAAI,EAAE,MAAM,CAAC;QAAC,QAAQ,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,OAAO,CAAA;KAAC,EAAE,CAAC;IAC3D,OAAO,EAAE;QAAC,IAAI,EAAE,MAAM,CAAC;QAAC,UAAU,EAAE,MAAM,CAAC;QAAC,QAAQ,EAAE,MAAM,CAAA;KAAC,EAAE,CAAC;IAChE,gBAAgB,EAAE;QAAC,IAAI,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,aAAa,EAAE,CAAA;KAAC,EAAE,CAAA;CAAC,CAAC;AAC9D,MAAM,MAAM,gBAAgB,GAAG;IAC7B,SAAS,CAAC,IAAI,EAAE,MAAM,GAAG;QAAC,QAAQ,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,OAAO,CAAA;KAAC,EAAE,CAAC;IAC9D,IAAI,CAAC,IAAI,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC;IAC9C,KAAK,CAAC,IAAI,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,KAAK,EAAE,OAAO,GAAG,IAAI,CAAC;IAC5D,MAAM,CAAC,IAAI,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,GAAG,MAAM,CAAC;IACjD,KAAK,CAAC,IAAI,EAAE,MAAM,GAAG,aAAa,EAAE,CAAC;IACrC,YAAY,CAAC,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,aAAa,EAAE,GAAG,IAAI,CAAC;CAC1D,CAAC;AACF,eAAO,MAAM,iBAAiB,gBAAiB,MAAM,QAAQ,MAAM,cAAc,MAAM,WACwB,CAAC;AAEhH;sEACsE;AACtE,eAAO,MAAM,sBAAsB,UAAW,cAAc;;;CAgD3D,CAAC;AAEF;;+EAE+E;AAC/E,eAAO,MAAM,cAAc,YAAmB,MAAM,CAAC,MAAM,EAAE,CAAC,OAAO,EAAE,gBAAgB,KAAK,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC,kBAehH,CAAC"}

dist/migration.js

@@ -0,0 +1,93 @@
+import { createHash } from "node:crypto";
+export const migrationObjectId = (executionId, port, logicalKey) => `obj:migration:${createHash("sha256").update(JSON.stringify([executionId, port, logicalKey])).digest("hex")}`;
+/** No ordinary RuntimeContext or network/database clients are supplied here.
+ * Process isolation belongs to the host, not this convenience API. */
+export const createMigrationContext = (input) => {
+    if (input.schemaVersion !== 1 || !input.executionId || new Set(input.ports.map((entry) => entry.name)).size !== input.ports.length)
+        throw new Error("Invalid migration input");
+    const output = { schemaVersion: 1, executionId: input.executionId, writes: [], creates: [], edgeReplacements: [] };
+    const port = (name, access) => {
+        const selected = input.ports.find((entry) => entry.name === name);
+        if (!selected?.access.includes(access) || (selected.view === "old" && access !== "read"))
+            throw new Error(`Migration port ${name} does not grant ${access}`);
+        return selected;
+    };
+    const context = {
+        enumerate(name) {
+            const selected = port(name, "read"), states = structuredClone(selected.states ?? []);
+            if (selected.view === "new" && Object.hasOwn(selected, "defaultValue"))
+                for (const helper of output.creates) {
+                    if (input.ports.find((entry) => entry.name === helper.port)?.atomId === selected.attachedAtomId && !states.some((entry) => entry.objectId === helper.objectId))
+                        states.push({ objectId: helper.objectId, value: structuredClone(selected.defaultValue) });
+                }
+            if (selected.view === "new")
+                for (const write of output.writes) {
+                    if (input.ports.find((entry) => entry.name === write.port)?.binding !== selected.binding)
+                        continue;
+                    const existing = states.findIndex((entry) => entry.objectId === write.objectId), entry = { objectId: write.objectId, value: structuredClone(write.value) };
+                    if (existing < 0)
+                        states.push(entry);
+                    else
+                        states[existing] = entry;
+                }
+            return states.sort((a, b) => a.objectId < b.objectId ? -1 : a.objectId > b.objectId ? 1 : 0);
+        },
+        read(name, objectId) { return context.enumerate(name).find((entry) => entry.objectId === objectId)?.value; },
+        write(name, objectId, value) {
+            port(name, "write");
+            const previous = output.writes.findIndex((entry) => entry.port === name && entry.objectId === objectId);
+            const entry = { port: name, objectId, value: structuredClone(value) };
+            if (previous < 0)
+                output.writes.push(entry);
+            else
+                output.writes[previous] = entry;
+        },
+        create(name, logicalKey) {
+            port(name, "create");
+            if (!logicalKey || logicalKey.length > 1024)
+                throw new Error("Migration creation requires a bounded stable logical key");
+            const objectId = migrationObjectId(input.executionId, name, logicalKey);
+            if (!output.creates.some((entry) => entry.objectId === objectId))
+                output.creates.push({ port: name, logicalKey, objectId });
+            return objectId;
+        },
+        edges(name) {
+            const selected = port(name, "read");
+            const replacement = selected.view === "new" ? output.edgeReplacements.find((entry) => input.ports.find((candidate) => candidate.name === entry.port)?.binding === selected.binding) : undefined;
+            return structuredClone(replacement?.edges ?? selected.edges ?? []);
+        },
+        replaceEdges(name, edges) {
+            port(name, "edge");
+            const previous = output.edgeReplacements.findIndex((entry) => entry.port === name);
+            const entry = { port: name, edges: structuredClone(edges) };
+            if (previous < 0)
+                output.edgeReplacements.push(entry);
+            else
+                output.edgeReplacements[previous] = entry;
+        },
+    };
+    return { context, result: () => structuredClone(output) };
+};
+/** Entrypoint for an immutable package's dedicated bin/migrate executable.
+ * stdout is protocol-only; send diagnostics to stderr. The host independently
+ * validates every write, helper identity, contract, and completion receipt. */
+export const serveMigration = async (exports) => {
+    const chunks = [];
+    let bytes = 0;
+    for await (const chunk of process.stdin) {
+        bytes += chunk.length;
+        if (bytes > 16 * 1024 * 1024)
+            throw new Error("Migration input exceeds 16 MiB");
+        chunks.push(Buffer.from(chunk));
+    }
+    const input = JSON.parse(Buffer.concat(chunks).toString("utf8"));
+    const implementation = Object.hasOwn(exports, input.exportId) ? exports[input.exportId] : undefined;
+    if (!implementation)
+        throw new Error("Unknown migration export");
+    const execution = createMigrationContext(input);
+    await implementation(execution.context);
+    const result = JSON.stringify(execution.result());
+    if (Buffer.byteLength(result) > 16 * 1024 * 1024)
+        throw new Error("Migration output exceeds 16 MiB");
+    process.stdout.write(`${result}\n`);
+};

dist/quixos/orch_pb.js

@@ -1,4 +1,4 @@
-// @generated by protoc-gen-es v2.12.1 with parameter "target=ts,import_extension=js"
+// @generated by protoc-gen-es v2.14.1 with parameter "target=ts,import_extension=js"
 // @generated from file quixos/orch.proto (package quixos.orch, syntax proto3)
 /* eslint-disable */
 import { fileDesc, messageDesc, serviceDesc } from "@bufbuild/protobuf/codegenv2";

dist/quixos/package_pb.js

@@ -1,4 +1,4 @@
-// @generated by protoc-gen-es v2.12.1 with parameter "target=ts,import_extension=js"
+// @generated by protoc-gen-es v2.14.1 with parameter "target=ts,import_extension=js"
 // @generated from file quixos/package.proto (package quixos, syntax proto3)
 /* eslint-disable */
 import { fileDesc, messageDesc } from "@bufbuild/protobuf/codegenv2";

dist/quixos/refs_pb.js

@@ -1,4 +1,4 @@
-// @generated by protoc-gen-es v2.12.1 with parameter "target=ts,import_extension=js"
+// @generated by protoc-gen-es v2.14.1 with parameter "target=ts,import_extension=js"
 // @generated from file quixos/refs.proto (package quixos, syntax proto3)
 /* eslint-disable */
 import { fileDesc, messageDesc } from "@bufbuild/protobuf/codegenv2";

dist/quixos/runtime_pb.d.ts

@@ -14,6 +14,10 @@ export type HandshakeRequest = Message<"quixos.runtime.HandshakeRequest"> & {
      * @generated from field: string orch_protocol_version = 1;
      */
     orchProtocolVersion: string;
+    /**
+     * @generated from field: string nonce = 2;
+     */
+    nonce: string;
 };
 /**
  * Describes the message quixos.runtime.HandshakeRequest.
@@ -36,12 +40,94 @@ export type HandshakeResponse = Message<"quixos.runtime.HandshakeResponse"> & {
      * @generated from field: repeated string export_ids = 3;
      */
     exportIds: string[];
+    /**
+     * @generated from field: string instance_id = 4;
+     */
+    instanceId: string;
+    /**
+     * @generated from field: string authentication_proof = 5;
+     */
+    authenticationProof: string;
+    /**
+     * @generated from field: repeated string capabilities = 6;
+     */
+    capabilities: string[];
 };
 /**
  * Describes the message quixos.runtime.HandshakeResponse.
  * Use `create(HandshakeResponseSchema)` to create a new message.
  */
 export declare const HandshakeResponseSchema: GenMessage<HandshakeResponse>;
+/**
+ * @generated from message quixos.runtime.InvocationContext
+ */
+export type InvocationContext = Message<"quixos.runtime.InvocationContext"> & {
+    /**
+     * @generated from field: string workspace_epoch = 1;
+     */
+    workspaceEpoch: string;
+    /**
+     * @generated from field: string instance_id = 2;
+     */
+    instanceId: string;
+    /**
+     * @generated from field: string binding_digest = 3;
+     */
+    bindingDigest: string;
+    /**
+     * @generated from field: string grant = 4;
+     */
+    grant: string;
+    /**
+     * @generated from field: string session_id = 5;
+     */
+    sessionId: string;
+    /**
+     * Host-selected owner; packages must not invent workspace-local ownership.
+     *
+     * @generated from field: string owner_conformance_id = 6;
+     */
+    ownerConformanceId: string;
+};
+/**
+ * Describes the message quixos.runtime.InvocationContext.
+ * Use `create(InvocationContextSchema)` to create a new message.
+ */
+export declare const InvocationContextSchema: GenMessage<InvocationContext>;
+/**
+ * @generated from message quixos.runtime.InvocationControlRequest
+ */
+export type InvocationControlRequest = Message<"quixos.runtime.InvocationControlRequest"> & {
+    /**
+     * @generated from field: string invocation_id = 1;
+     */
+    invocationId: string;
+};
+/**
+ * Describes the message quixos.runtime.InvocationControlRequest.
+ * Use `create(InvocationControlRequestSchema)` to create a new message.
+ */
+export declare const InvocationControlRequestSchema: GenMessage<InvocationControlRequest>;
+/**
+ * @generated from message quixos.runtime.InvocationStatus
+ */
+export type InvocationStatus = Message<"quixos.runtime.InvocationStatus"> & {
+    /**
+     * @generated from field: string invocation_id = 1;
+     */
+    invocationId: string;
+    /**
+     * unknown, running, cancellation-requested, completed, failed
+     *
+     * @generated from field: string state = 2;
+     */
+    state: string;
+};
+/**
+ * Describes the message quixos.runtime.InvocationStatus.
+ * Use `create(InvocationStatusSchema)` to create a new message.
+ */
+export declare const InvocationStatusSchema: GenMessage<InvocationStatus>;
 /**
  * @generated from message quixos.runtime.InvokeRequest
  */
@@ -68,6 +154,10 @@ export type InvokeRequest = Message<"quixos.runtime.InvokeRequest"> & {
      * @generated from field: repeated quixos.InjectedDependency dependencies = 5;
      */
     dependencies: InjectedDependency[];
+    /**
+     * @generated from field: quixos.runtime.InvocationContext context = 6;
+     */
+    context?: InvocationContext | undefined;
 };
 /**
  * Describes the message quixos.runtime.InvokeRequest.
@@ -126,6 +216,10 @@ export type WatchRequest = Message<"quixos.runtime.WatchRequest"> & {
      * @generated from field: repeated quixos.InjectedDependency dependencies = 5;
      */
     dependencies: InjectedDependency[];
+    /**
+     * @generated from field: quixos.runtime.InvocationContext context = 6;
+     */
+    context?: InvocationContext | undefined;
 };
 /**
  * Describes the message quixos.runtime.WatchRequest.
@@ -216,5 +310,21 @@ export declare const PackageRuntime: GenService<{
         input: typeof WatchRequestSchema;
         output: typeof WatchEventSchema;
     };
+    /**
+     * @generated from rpc quixos.runtime.PackageRuntime.GetInvocationStatus
+     */
+    getInvocationStatus: {
+        methodKind: "unary";
+        input: typeof InvocationControlRequestSchema;
+        output: typeof InvocationStatusSchema;
+    };
+    /**
+     * @generated from rpc quixos.runtime.PackageRuntime.CancelInvocation
+     */
+    cancelInvocation: {
+        methodKind: "unary";
+        input: typeof InvocationControlRequestSchema;
+        output: typeof InvocationStatusSchema;
+    };
 }>;
 //# sourceMappingURL=runtime_pb.d.ts.map

dist/quixos/runtime_pb.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"runtime_pb.d.ts","sourceRoot":"","sources":["../../src/quixos/runtime_pb.ts"],"names":[],"mappings":"AAIA,OAAO,KAAK,EAAE,OAAO,EAAE,UAAU,EAAE,UAAU,EAAE,MAAM,8BAA8B,CAAC;AAEpF,OAAO,KAAK,EAAE,KAAK,EAAE,MAAM,qBAAqB,CAAC;AAEjD,OAAO,KAAK,EAAE,kBAAkB,EAAE,gBAAgB,EAAE,MAAM,cAAc,CAAC;AAEzE,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,oBAAoB,CAAC;AAElD;;GAEG;AACH,eAAO,MAAM,mBAAmB,EAAE,OACizD,CAAC;AAEp1D;;GAEG;AACH,MAAM,MAAM,gBAAgB,GAAG,OAAO,CAAC,iCAAiC,CAAC,GAAG;IAC1E;;OAEG;IACH,mBAAmB,EAAE,MAAM,CAAC;CAC7B,CAAC;AAEF;;;GAGG;AACH,eAAO,MAAM,sBAAsB,EAAE,UAAU,CAAC,gBAAgB,CAC3B,CAAC;AAEtC;;GAEG;AACH,MAAM,MAAM,iBAAiB,GAAG,OAAO,CAAC,kCAAkC,CAAC,GAAG;IAC5E;;OAEG;IACH,iBAAiB,EAAE,MAAM,CAAC;IAE1B;;OAEG;IACH,sBAAsB,EAAE,MAAM,CAAC;IAE/B;;OAEG;IACH,SAAS,EAAE,MAAM,EAAE,CAAC;CACrB,CAAC;AAEF;;;GAGG;AACH,eAAO,MAAM,uBAAuB,EAAE,UAAU,CAAC,iBAAiB,CAC7B,CAAC;AAEtC;;GAEG;AACH,MAAM,MAAM,aAAa,GAAG,OAAO,CAAC,8BAA8B,CAAC,GAAG;IACpE;;OAEG;IACH,YAAY,EAAE,MAAM,CAAC;IAErB;;OAEG;IACH,MAAM,CAAC,EAAE,gBAAgB,GAAG,SAAS,CAAC;IAEtC;;OAEG;IACH,QAAQ,EAAE,MAAM,CAAC;IAEjB;;OAEG;IACH,KAAK,EAAE;QAAE,CAAC,GAAG,EAAE,MAAM,GAAG,KAAK,CAAA;KAAE,CAAC;IAEhC;;OAEG;IACH,YAAY,EAAE,kBAAkB,EAAE,CAAC;CACpC,CAAC;AAEF;;;GAGG;AACH,eAAO,MAAM,mBAAmB,EAAE,UAAU,CAAC,aAAa,CACrB,CAAC;AAEtC;;GAEG;AACH,MAAM,MAAM,cAAc,GAAG,OAAO,CAAC,+BAA+B,CAAC,GAAG;IACtE;;OAEG;IACH,EAAE,EAAE,OAAO,CAAC;IAEZ;;OAEG;IACH,MAAM,CAAC,EAAE,KAAK,GAAG,SAAS,CAAC;IAE3B;;OAEG;IACH,KAAK,EAAE,MAAM,CAAC;IAEd;;OAEG;IACH,YAAY,EAAE,iBAAiB,EAAE,CAAC;CACnC,CAAC;AAEF;;;GAGG;AACH,eAAO,MAAM,oBAAoB,EAAE,UAAU,CAAC,cAAc,CACvB,CAAC;AAEtC;;GAEG;AACH,MAAM,MAAM,YAAY,GAAG,OAAO,CAAC,6BAA6B,CAAC,GAAG;IAClE;;OAEG;IACH,YAAY,EAAE,MAAM,CAAC;IAErB;;OAEG;IACH,MAAM,CAAC,EAAE,gBAAgB,GAAG,SAAS,CAAC;IAEtC;;OAEG;IACH,QAAQ,EAAE,MAAM,CAAC;IAEjB;;OAEG;IACH,KAAK,EAAE;QAAE,CAAC,GAAG,EAAE,MAAM,GAAG,KAAK,CAAA;KAAE,CAAC;IAEhC;;OAEG;IACH,YAAY,EAAE,kBAAkB,EAAE,CAAC;CACpC,CAAC;AAEF;;;GAGG;AACH,eAAO,MAAM,kBAAkB,EAAE,UAAU,CAAC,YAAY,CACnB,CAAC;AAEtC;;GAEG;AACH,MAAM,MAAM,iBAAiB,GAAG,OAAO,CAAC,kCAAkC,CAAC,GAAG;IAC5E;;OAEG;IACH,IAAI,EAAE,MAAM,CAAC;IAEb;;OAEG;IACH,QAAQ,EAAE,MAAM,CAAC;IAEjB;;OAEG;IACH,YAAY,EAAE,MAAM,CAAC;IAErB;;OAEG;IACH,YAAY,EAAE,MAAM,CAAC;CACtB,CAAC;AAEF;;;GAGG;AACH,eAAO,MAAM,uBAAuB,EAAE,UAAU,CAAC,iBAAiB,CAC7B,CAAC;AAEtC;;GAEG;AACH,MAAM,MAAM,UAAU,GAAG,OAAO,CAAC,2BAA2B,CAAC,GAAG;IAC9D;;OAEG;IACH,OAAO,EAAE,MAAM,CAAC;IAEhB;;OAEG;IACH,KAAK,CAAC,EAAE,KAAK,GAAG,SAAS,CAAC;IAE1B;;OAEG;IACH,YAAY,EAAE,iBAAiB,EAAE,CAAC;IAElC;;OAEG;IACH,KAAK,EAAE,MAAM,CAAC;IAEd;;OAEG;IACH,OAAO,EAAE,OAAO,CAAC;CAClB,CAAC;AAEF;;;GAGG;AACH,eAAO,MAAM,gBAAgB,EAAE,UAAU,CAAC,UAAU,CACf,CAAC;AAEtC;;GAEG;AACH,eAAO,MAAM,cAAc,EAAE,UAAU,CAAC;IACtC;;OAEG;IACH,SAAS,EAAE;QACT,UAAU,EAAE,OAAO,CAAC;QACpB,KAAK,EAAE,OAAO,sBAAsB,CAAC;QACrC,MAAM,EAAE,OAAO,uBAAuB,CAAC;KACxC,CAAC;IACF;;OAEG;IACH,MAAM,EAAE;QACN,UAAU,EAAE,OAAO,CAAC;QACpB,KAAK,EAAE,OAAO,mBAAmB,CAAC;QAClC,MAAM,EAAE,OAAO,oBAAoB,CAAC;KACrC,CAAC;IACF;;OAEG;IACH,KAAK,EAAE;QACL,UAAU,EAAE,kBAAkB,CAAC;QAC/B,KAAK,EAAE,OAAO,kBAAkB,CAAC;QACjC,MAAM,EAAE,OAAO,gBAAgB,CAAC;KACjC,CAAC;CACH,CACoC,CAAC"}
+{"version":3,"file":"runtime_pb.d.ts","sourceRoot":"","sources":["../../src/quixos/runtime_pb.ts"],"names":[],"mappings":"AAIA,OAAO,KAAK,EAAE,OAAO,EAAE,UAAU,EAAE,UAAU,EAAE,MAAM,8BAA8B,CAAC;AAEpF,OAAO,KAAK,EAAE,KAAK,EAAE,MAAM,qBAAqB,CAAC;AAEjD,OAAO,KAAK,EAAE,kBAAkB,EAAE,gBAAgB,EAAE,MAAM,cAAc,CAAC;AAEzE,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,oBAAoB,CAAC;AAElD;;GAEG;AACH,eAAO,MAAM,mBAAmB,EAAE,OACypF,CAAC;AAE5rF;;GAEG;AACH,MAAM,MAAM,gBAAgB,GAAG,OAAO,CAAC,iCAAiC,CAAC,GAAG;IAC1E;;OAEG;IACH,mBAAmB,EAAE,MAAM,CAAC;IAE5B;;OAEG;IACH,KAAK,EAAE,MAAM,CAAC;CACf,CAAC;AAEF;;;GAGG;AACH,eAAO,MAAM,sBAAsB,EAAE,UAAU,CAAC,gBAAgB,CAC3B,CAAC;AAEtC;;GAEG;AACH,MAAM,MAAM,iBAAiB,GAAG,OAAO,CAAC,kCAAkC,CAAC,GAAG;IAC5E;;OAEG;IACH,iBAAiB,EAAE,MAAM,CAAC;IAE1B;;OAEG;IACH,sBAAsB,EAAE,MAAM,CAAC;IAE/B;;OAEG;IACH,SAAS,EAAE,MAAM,EAAE,CAAC;IAEpB;;OAEG;IACH,UAAU,EAAE,MAAM,CAAC;IAEnB;;OAEG;IACH,mBAAmB,EAAE,MAAM,CAAC;IAE5B;;OAEG;IACH,YAAY,EAAE,MAAM,EAAE,CAAC;CACxB,CAAC;AAEF;;;GAGG;AACH,eAAO,MAAM,uBAAuB,EAAE,UAAU,CAAC,iBAAiB,CAC7B,CAAC;AAEtC;;GAEG;AACH,MAAM,MAAM,iBAAiB,GAAG,OAAO,CAAC,kCAAkC,CAAC,GAAG;IAC5E;;OAEG;IACH,cAAc,EAAE,MAAM,CAAC;IAEvB;;OAEG;IACH,UAAU,EAAE,MAAM,CAAC;IAEnB;;OAEG;IACH,aAAa,EAAE,MAAM,CAAC;IAEtB;;OAEG;IACH,KAAK,EAAE,MAAM,CAAC;IAEd;;OAEG;IACH,SAAS,EAAE,MAAM,CAAC;IAElB;;;;OAIG;IACH,kBAAkB,EAAE,MAAM,CAAC;CAC5B,CAAC;AAEF;;;GAGG;AACH,eAAO,MAAM,uBAAuB,EAAE,UAAU,CAAC,iBAAiB,CAC7B,CAAC;AAEtC;;GAEG;AACH,MAAM,MAAM,wBAAwB,GAAG,OAAO,CAAC,yCAAyC,CAAC,GAAG;IAC1F;;OAEG;IACH,YAAY,EAAE,MAAM,CAAC;CACtB,CAAC;AAEF;;;GAGG;AACH,eAAO,MAAM,8BAA8B,EAAE,UAAU,CAAC,wBAAwB,CAC3C,CAAC;AAEtC;;GAEG;AACH,MAAM,MAAM,gBAAgB,GAAG,OAAO,CAAC,iCAAiC,CAAC,GAAG;IAC1E;;OAEG;IACH,YAAY,EAAE,MAAM,CAAC;IAErB;;;;OAIG;IACH,KAAK,EAAE,MAAM,CAAC;CACf,CAAC;AAEF;;;GAGG;AACH,eAAO,MAAM,sBAAsB,EAAE,UAAU,CAAC,gBAAgB,CAC3B,CAAC;AAEtC;;GAEG;AACH,MAAM,MAAM,aAAa,GAAG,OAAO,CAAC,8BAA8B,CAAC,GAAG;IACpE;;OAEG;IACH,YAAY,EAAE,MAAM,CAAC;IAErB;;OAEG;IACH,MAAM,CAAC,EAAE,gBAAgB,GAAG,SAAS,CAAC;IAEtC;;OAEG;IACH,QAAQ,EAAE,MAAM,CAAC;IAEjB;;OAEG;IACH,KAAK,EAAE;QAAE,CAAC,GAAG,EAAE,MAAM,GAAG,KAAK,CAAA;KAAE,CAAC;IAEhC;;OAEG;IACH,YAAY,EAAE,kBAAkB,EAAE,CAAC;IAEnC;;OAEG;IACH,OAAO,CAAC,EAAE,iBAAiB,GAAG,SAAS,CAAC;CACzC,CAAC;AAEF;;;GAGG;AACH,eAAO,MAAM,mBAAmB,EAAE,UAAU,CAAC,aAAa,CACrB,CAAC;AAEtC;;GAEG;AACH,MAAM,MAAM,cAAc,GAAG,OAAO,CAAC,+BAA+B,CAAC,GAAG;IACtE;;OAEG;IACH,EAAE,EAAE,OAAO,CAAC;IAEZ;;OAEG;IACH,MAAM,CAAC,EAAE,KAAK,GAAG,SAAS,CAAC;IAE3B;;OAEG;IACH,KAAK,EAAE,MAAM,CAAC;IAEd;;OAEG;IACH,YAAY,EAAE,iBAAiB,EAAE,CAAC;CACnC,CAAC;AAEF;;;GAGG;AACH,eAAO,MAAM,oBAAoB,EAAE,UAAU,CAAC,cAAc,CACvB,CAAC;AAEtC;;GAEG;AACH,MAAM,MAAM,YAAY,GAAG,OAAO,CAAC,6BAA6B,CAAC,GAAG;IAClE;;OAEG;IACH,YAAY,EAAE,MAAM,CAAC;IAErB;;OAEG;IACH,MAAM,CAAC,EAAE,gBAAgB,GAAG,SAAS,CAAC;IAEtC;;OAEG;IACH,QAAQ,EAAE,MAAM,CAAC;IAEjB;;OAEG;IACH,KAAK,EAAE;QAAE,CAAC,GAAG,EAAE,MAAM,GAAG,KAAK,CAAA;KAAE,CAAC;IAEhC;;OAEG;IACH,YAAY,EAAE,kBAAkB,EAAE,CAAC;IAEnC;;OAEG;IACH,OAAO,CAAC,EAAE,iBAAiB,GAAG,SAAS,CAAC;CACzC,CAAC;AAEF;;;GAGG;AACH,eAAO,MAAM,kBAAkB,EAAE,UAAU,CAAC,YAAY,CACnB,CAAC;AAEtC;;GAEG;AACH,MAAM,MAAM,iBAAiB,GAAG,OAAO,CAAC,kCAAkC,CAAC,GAAG;IAC5E;;OAEG;IACH,IAAI,EAAE,MAAM,CAAC;IAEb;;OAEG;IACH,QAAQ,EAAE,MAAM,CAAC;IAEjB;;OAEG;IACH,YAAY,EAAE,MAAM,CAAC;IAErB;;OAEG;IACH,YAAY,EAAE,MAAM,CAAC;CACtB,CAAC;AAEF;;;GAGG;AACH,eAAO,MAAM,uBAAuB,EAAE,UAAU,CAAC,iBAAiB,CAC7B,CAAC;AAEtC;;GAEG;AACH,MAAM,MAAM,UAAU,GAAG,OAAO,CAAC,2BAA2B,CAAC,GAAG;IAC9D;;OAEG;IACH,OAAO,EAAE,MAAM,CAAC;IAEhB;;OAEG;IACH,KAAK,CAAC,EAAE,KAAK,GAAG,SAAS,CAAC;IAE1B;;OAEG;IACH,YAAY,EAAE,iBAAiB,EAAE,CAAC;IAElC;;OAEG;IACH,KAAK,EAAE,MAAM,CAAC;IAEd;;OAEG;IACH,OAAO,EAAE,OAAO,CAAC;CAClB,CAAC;AAEF;;;GAGG;AACH,eAAO,MAAM,gBAAgB,EAAE,UAAU,CAAC,UAAU,CACf,CAAC;AAEtC;;GAEG;AACH,eAAO,MAAM,cAAc,EAAE,UAAU,CAAC;IACtC;;OAEG;IACH,SAAS,EAAE;QACT,UAAU,EAAE,OAAO,CAAC;QACpB,KAAK,EAAE,OAAO,sBAAsB,CAAC;QACrC,MAAM,EAAE,OAAO,uBAAuB,CAAC;KACxC,CAAC;IACF;;OAEG;IACH,MAAM,EAAE;QACN,UAAU,EAAE,OAAO,CAAC;QACpB,KAAK,EAAE,OAAO,mBAAmB,CAAC;QAClC,MAAM,EAAE,OAAO,oBAAoB,CAAC;KACrC,CAAC;IACF;;OAEG;IACH,KAAK,EAAE;QACL,UAAU,EAAE,kBAAkB,CAAC;QAC/B,KAAK,EAAE,OAAO,kBAAkB,CAAC;QACjC,MAAM,EAAE,OAAO,gBAAgB,CAAC;KACjC,CAAC;IACF;;OAEG;IACH,mBAAmB,EAAE;QACnB,UAAU,EAAE,OAAO,CAAC;QACpB,KAAK,EAAE,OAAO,8BAA8B,CAAC;QAC7C,MAAM,EAAE,OAAO,sBAAsB,CAAC;KACvC,CAAC;IACF;;OAEG;IACH,gBAAgB,EAAE;QAChB,UAAU,EAAE,OAAO,CAAC;QACpB,KAAK,EAAE,OAAO,8BAA8B,CAAC;QAC7C,MAAM,EAAE,OAAO,sBAAsB,CAAC;KACvC,CAAC;CACH,CACoC,CAAC"}

dist/quixos/runtime_pb.js

@@ -1,4 +1,4 @@
-// @generated by protoc-gen-es v2.12.1 with parameter "target=ts,import_extension=js"
+// @generated by protoc-gen-es v2.14.1 with parameter "target=ts,import_extension=js"
 // @generated from file quixos/runtime.proto (package quixos.runtime, syntax proto3)
 /* eslint-disable */
 import { fileDesc, messageDesc, serviceDesc } from "@bufbuild/protobuf/codegenv2";
@@ -7,7 +7,7 @@ import { file_quixos_refs } from "./refs_pb.js";
 /**
  * Describes the file quixos/runtime.proto.
  */
-export const file_quixos_runtime = /*@__PURE__*/ fileDesc("ChRxdWl4b3MvcnVudGltZS5wcm90bxIOcXVpeG9zLnJ1bnRpbWUiMQoQSGFuZHNoYWtlUmVxdWVzdBIdChVvcmNoX3Byb3RvY29sX3ZlcnNpb24YASABKAkiZgoRSGFuZHNoYWtlUmVzcG9uc2USGwoTcGFja2FnZV9yZXZpc2lvbl9pZBgBIAEoCRIgChhydW50aW1lX3Byb3RvY29sX3ZlcnNpb24YAiABKAkSEgoKZXhwb3J0X2lkcxgDIAMoCSKLAgoNSW52b2tlUmVxdWVzdBIVCg1pbnZvY2F0aW9uX2lkGAEgASgJEigKBmV4cG9ydBgCIAEoCzIYLnF1aXhvcy5QYWNrYWdlRXhwb3J0UmVmEhEKCW9iamVjdF9pZBgDIAEoCRI3CgVpbnB1dBgEIAMoCzIoLnF1aXhvcy5ydW50aW1lLkludm9rZVJlcXVlc3QuSW5wdXRFbnRyeRIwCgxkZXBlbmRlbmNpZXMYBSADKAsyGi5xdWl4b3MuSW5qZWN0ZWREZXBlbmRlbmN5GjsKCklucHV0RW50cnkSCwoDa2V5GAEgASgJEhwKBXZhbHVlGAIgASgLMg0uY2FtaW5vLlZhbHVlOgI4ASKDAQoOSW52b2tlUmVzcG9uc2USCgoCb2sYASABKAgSHQoGcmVzdWx0GAIgASgLMg0uY2FtaW5vLlZhbHVlEg0KBWVycm9yGAMgASgJEjcKDGRlcGVuZGVuY2llcxgEIAMoCzIhLnF1aXhvcy5ydW50aW1lLkRlcml2ZWREZXBlbmRlbmN5IokCCgxXYXRjaFJlcXVlc3QSFQoNaW52b2NhdGlvbl9pZBgBIAEoCRIoCgZleHBvcnQYAiABKAsyGC5xdWl4b3MuUGFja2FnZUV4cG9ydFJlZhIRCglvYmplY3RfaWQYAyABKAkSNgoFaW5wdXQYBCADKAsyJy5xdWl4b3MucnVudGltZS5XYXRjaFJlcXVlc3QuSW5wdXRFbnRyeRIwCgxkZXBlbmRlbmNpZXMYBSADKAsyGi5xdWl4b3MuSW5qZWN0ZWREZXBlbmRlbmN5GjsKCklucHV0RW50cnkSCwoDa2V5GAEgASgJEhwKBXZhbHVlGAIgASgLMg0uY2FtaW5vLlZhbHVlOgI4ASJiChFEZXJpdmVkRGVwZW5kZW5jeRIMCgRraW5kGAEgASgJEhEKCW9iamVjdF9pZBgCIAEoCRIVCg1hdHRhY2htZW50X2lkGAMgASgJEhUKDXByb2plY3Rpb25faWQYBCABKAkilQEKCldhdGNoRXZlbnQSEAoId2F0Y2hfaWQYASABKAkSHAoFdmFsdWUYAiABKAsyDS5jYW1pbm8uVmFsdWUSNwoMZGVwZW5kZW5jaWVzGAMgAygLMiEucXVpeG9zLnJ1bnRpbWUuRGVyaXZlZERlcGVuZGVuY3kSDQoFZXJyb3IYBCABKAkSDwoHaW5pdGlhbBgFIAEoCDLwAQoOUGFja2FnZVJ1bnRpbWUSUAoJSGFuZHNoYWtlEiAucXVpeG9zLnJ1bnRpbWUuSGFuZHNoYWtlUmVxdWVzdBohLnF1aXhvcy5ydW50aW1lLkhhbmRzaGFrZVJlc3BvbnNlEkcKBkludm9rZRIdLnF1aXhvcy5ydW50aW1lLkludm9rZVJlcXVlc3QaHi5xdWl4b3MucnVudGltZS5JbnZva2VSZXNwb25zZRJDCgVXYXRjaBIcLnF1aXhvcy5ydW50aW1lLldhdGNoUmVxdWVzdBoaLnF1aXhvcy5ydW50aW1lLldhdGNoRXZlbnQwAWIGcHJvdG8z", [file_camino_api, file_quixos_refs]);
+export const file_quixos_runtime = /*@__PURE__*/ fileDesc("ChRxdWl4b3MvcnVudGltZS5wcm90bxIOcXVpeG9zLnJ1bnRpbWUiQAoQSGFuZHNoYWtlUmVxdWVzdBIdChVvcmNoX3Byb3RvY29sX3ZlcnNpb24YASABKAkSDQoFbm9uY2UYAiABKAkirwEKEUhhbmRzaGFrZVJlc3BvbnNlEhsKE3BhY2thZ2VfcmV2aXNpb25faWQYASABKAkSIAoYcnVudGltZV9wcm90b2NvbF92ZXJzaW9uGAIgASgJEhIKCmV4cG9ydF9pZHMYAyADKAkSEwoLaW5zdGFuY2VfaWQYBCABKAkSHAoUYXV0aGVudGljYXRpb25fcHJvb2YYBSABKAkSFAoMY2FwYWJpbGl0aWVzGAYgAygJIpoBChFJbnZvY2F0aW9uQ29udGV4dBIXCg93b3Jrc3BhY2VfZXBvY2gYASABKAkSEwoLaW5zdGFuY2VfaWQYAiABKAkSFgoOYmluZGluZ19kaWdlc3QYAyABKAkSDQoFZ3JhbnQYBCABKAkSEgoKc2Vzc2lvbl9pZBgFIAEoCRIcChRvd25lcl9jb25mb3JtYW5jZV9pZBgGIAEoCSIxChhJbnZvY2F0aW9uQ29udHJvbFJlcXVlc3QSFQoNaW52b2NhdGlvbl9pZBgBIAEoCSI4ChBJbnZvY2F0aW9uU3RhdHVzEhUKDWludm9jYXRpb25faWQYASABKAkSDQoFc3RhdGUYAiABKAkivwIKDUludm9rZVJlcXVlc3QSFQoNaW52b2NhdGlvbl9pZBgBIAEoCRIoCgZleHBvcnQYAiABKAsyGC5xdWl4b3MuUGFja2FnZUV4cG9ydFJlZhIRCglvYmplY3RfaWQYAyABKAkSNwoFaW5wdXQYBCADKAsyKC5xdWl4b3MucnVudGltZS5JbnZva2VSZXF1ZXN0LklucHV0RW50cnkSMAoMZGVwZW5kZW5jaWVzGAUgAygLMhoucXVpeG9zLkluamVjdGVkRGVwZW5kZW5jeRIyCgdjb250ZXh0GAYgASgLMiEucXVpeG9zLnJ1bnRpbWUuSW52b2NhdGlvbkNvbnRleHQaOwoKSW5wdXRFbnRyeRILCgNrZXkYASABKAkSHAoFdmFsdWUYAiABKAsyDS5jYW1pbm8uVmFsdWU6AjgBIoMBCg5JbnZva2VSZXNwb25zZRIKCgJvaxgBIAEoCBIdCgZyZXN1bHQYAiABKAsyDS5jYW1pbm8uVmFsdWUSDQoFZXJyb3IYAyABKAkSNwoMZGVwZW5kZW5jaWVzGAQgAygLMiEucXVpeG9zLnJ1bnRpbWUuRGVyaXZlZERlcGVuZGVuY3kivQIKDFdhdGNoUmVxdWVzdBIVCg1pbnZvY2F0aW9uX2lkGAEgASgJEigKBmV4cG9ydBgCIAEoCzIYLnF1aXhvcy5QYWNrYWdlRXhwb3J0UmVmEhEKCW9iamVjdF9pZBgDIAEoCRI2CgVpbnB1dBgEIAMoCzInLnF1aXhvcy5ydW50aW1lLldhdGNoUmVxdWVzdC5JbnB1dEVudHJ5EjAKDGRlcGVuZGVuY2llcxgFIAMoCzIaLnF1aXhvcy5JbmplY3RlZERlcGVuZGVuY3kSMgoHY29udGV4dBgGIAEoCzIhLnF1aXhvcy5ydW50aW1lLkludm9jYXRpb25Db250ZXh0GjsKCklucHV0RW50cnkSCwoDa2V5GAEgASgJEhwKBXZhbHVlGAIgASgLMg0uY2FtaW5vLlZhbHVlOgI4ASJiChFEZXJpdmVkRGVwZW5kZW5jeRIMCgRraW5kGAEgASgJEhEKCW9iamVjdF9pZBgCIAEoCRIVCg1hdHRhY2htZW50X2lkGAMgASgJEhUKDXByb2plY3Rpb25faWQYBCABKAkilQEKCldhdGNoRXZlbnQSEAoId2F0Y2hfaWQYASABKAkSHAoFdmFsdWUYAiABKAsyDS5jYW1pbm8uVmFsdWUSNwoMZGVwZW5kZW5jaWVzGAMgAygLMiEucXVpeG9zLnJ1bnRpbWUuRGVyaXZlZERlcGVuZGVuY3kSDQoFZXJyb3IYBCABKAkSDwoHaW5pdGlhbBgFIAEoCDKzAwoOUGFja2FnZVJ1bnRpbWUSUAoJSGFuZHNoYWtlEiAucXVpeG9zLnJ1bnRpbWUuSGFuZHNoYWtlUmVxdWVzdBohLnF1aXhvcy5ydW50aW1lLkhhbmRzaGFrZVJlc3BvbnNlEkcKBkludm9rZRIdLnF1aXhvcy5ydW50aW1lLkludm9rZVJlcXVlc3QaHi5xdWl4b3MucnVudGltZS5JbnZva2VSZXNwb25zZRJDCgVXYXRjaBIcLnF1aXhvcy5ydW50aW1lLldhdGNoUmVxdWVzdBoaLnF1aXhvcy5ydW50aW1lLldhdGNoRXZlbnQwARJhChNHZXRJbnZvY2F0aW9uU3RhdHVzEigucXVpeG9zLnJ1bnRpbWUuSW52b2NhdGlvbkNvbnRyb2xSZXF1ZXN0GiAucXVpeG9zLnJ1bnRpbWUuSW52b2NhdGlvblN0YXR1cxJeChBDYW5jZWxJbnZvY2F0aW9uEigucXVpeG9zLnJ1bnRpbWUuSW52b2NhdGlvbkNvbnRyb2xSZXF1ZXN0GiAucXVpeG9zLnJ1bnRpbWUuSW52b2NhdGlvblN0YXR1c2IGcHJvdG8z", [file_camino_api, file_quixos_refs]);
 /**
  * Describes the message quixos.runtime.HandshakeRequest.
  * Use `create(HandshakeRequestSchema)` to create a new message.
@@ -18,31 +18,46 @@ export const HandshakeRequestSchema = /*@__PURE__*/ messageDesc(file_quixos_runt
  * Use `create(HandshakeResponseSchema)` to create a new message.
  */
 export const HandshakeResponseSchema = /*@__PURE__*/ messageDesc(file_quixos_runtime, 1);
+/**
+ * Describes the message quixos.runtime.InvocationContext.
+ * Use `create(InvocationContextSchema)` to create a new message.
+ */
+export const InvocationContextSchema = /*@__PURE__*/ messageDesc(file_quixos_runtime, 2);
+/**
+ * Describes the message quixos.runtime.InvocationControlRequest.
+ * Use `create(InvocationControlRequestSchema)` to create a new message.
+ */
+export const InvocationControlRequestSchema = /*@__PURE__*/ messageDesc(file_quixos_runtime, 3);
+/**
+ * Describes the message quixos.runtime.InvocationStatus.
+ * Use `create(InvocationStatusSchema)` to create a new message.
+ */
+export const InvocationStatusSchema = /*@__PURE__*/ messageDesc(file_quixos_runtime, 4);
 /**
  * Describes the message quixos.runtime.InvokeRequest.
  * Use `create(InvokeRequestSchema)` to create a new message.
  */
-export const InvokeRequestSchema = /*@__PURE__*/ messageDesc(file_quixos_runtime, 2);
+export const InvokeRequestSchema = /*@__PURE__*/ messageDesc(file_quixos_runtime, 5);
 /**
  * Describes the message quixos.runtime.InvokeResponse.
  * Use `create(InvokeResponseSchema)` to create a new message.
  */
-export const InvokeResponseSchema = /*@__PURE__*/ messageDesc(file_quixos_runtime, 3);
+export const InvokeResponseSchema = /*@__PURE__*/ messageDesc(file_quixos_runtime, 6);
 /**
  * Describes the message quixos.runtime.WatchRequest.
  * Use `create(WatchRequestSchema)` to create a new message.
  */
-export const WatchRequestSchema = /*@__PURE__*/ messageDesc(file_quixos_runtime, 4);
+export const WatchRequestSchema = /*@__PURE__*/ messageDesc(file_quixos_runtime, 7);
 /**
  * Describes the message quixos.runtime.DerivedDependency.
  * Use `create(DerivedDependencySchema)` to create a new message.
  */
-export const DerivedDependencySchema = /*@__PURE__*/ messageDesc(file_quixos_runtime, 5);
+export const DerivedDependencySchema = /*@__PURE__*/ messageDesc(file_quixos_runtime, 8);
 /**
  * Describes the message quixos.runtime.WatchEvent.
  * Use `create(WatchEventSchema)` to create a new message.
  */
-export const WatchEventSchema = /*@__PURE__*/ messageDesc(file_quixos_runtime, 6);
+export const WatchEventSchema = /*@__PURE__*/ messageDesc(file_quixos_runtime, 9);
 /**
  * @generated from service quixos.runtime.PackageRuntime
  */

dist/references.d.ts

@@ -0,0 +1,14 @@
+declare const referenceBrand: unique symbol;
+export interface QxObjectRef<Identity extends string = string> {
+    readonly [referenceBrand]: {
+        readonly [K in Identity]: true;
+    };
+    equals(other: QxObjectRef<string>): boolean;
+}
+export declare const isObjectReference: (value: unknown) => value is QxObjectRef;
+/** Internal transport boundary; intentionally not exported from the SDK entry. */
+export declare const referenceFromWire: (id: string) => QxObjectRef;
+export declare const referenceToWire: (value: unknown) => string;
+export declare const assertReferenceFree: (value: unknown, seen?: Set<object>) => void;
+export {};
+//# sourceMappingURL=references.d.ts.map

dist/references.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"references.d.ts","sourceRoot":"","sources":["../src/references.ts"],"names":[],"mappings":"AAGA,OAAO,CAAC,MAAM,cAAc,EAAE,OAAO,MAAM,CAAC;AAC5C,MAAM,WAAW,WAAW,CAAC,QAAQ,SAAS,MAAM,GAAG,MAAM;IAC3D,QAAQ,CAAC,CAAC,cAAc,CAAC,EAAE;QAAC,QAAQ,EAAE,CAAC,IAAI,QAAQ,GAAG,IAAI;KAAC,CAAC;IAC5D,MAAM,CAAC,KAAK,EAAE,WAAW,CAAC,MAAM,CAAC,GAAG,OAAO,CAAC;CAC7C;AAQD,eAAO,MAAM,iBAAiB,UAAW,OAAO,KAAG,KAAK,IAAI,WACU,CAAC;AAEvE,kFAAkF;AAClF,eAAO,MAAM,iBAAiB,OAAQ,MAAM,KAAG,WAG9C,CAAC;AACF,eAAO,MAAM,eAAe,UAAW,OAAO,KAAG,MAGhD,CAAC;AACF,eAAO,MAAM,mBAAmB,UAAW,OAAO,yBAA6B,IAO9E,CAAC"}

dist/references.js

@@ -0,0 +1,35 @@
+/** Opaque runtime identity. The wire codec, never ordinary package state, owns
+ * the raw ID. These handles do not themselves confer authority or a lease. */
+const identities = new WeakMap();
+class Reference {
+    constructor(id) { identities.set(this, id); Object.freeze(this); }
+    equals(other) { return isObjectReference(other) && identities.get(this) === identities.get(other); }
+    toJSON() { throw new Error("Object references cannot be serialized into ordinary data"); }
+    toString() { throw new Error("Object references cannot be coerced to strings"); }
+    [Symbol.toPrimitive]() { throw new Error("Object references cannot be coerced to scalar values"); }
+}
+export const isObjectReference = (value) => typeof value === "object" && value !== null && identities.has(value);
+/** Internal transport boundary; intentionally not exported from the SDK entry. */
+export const referenceFromWire = (id) => {
+    if (typeof id !== "string" || !id)
+        throw new Error("Missing object reference identity");
+    return new Reference(id);
+};
+export const referenceToWire = (value) => {
+    if (!isObjectReference(value))
+        throw new Error("Expected an opaque object reference, not a raw ID");
+    return identities.get(value);
+};
+export const assertReferenceFree = (value, seen = new Set()) => {
+    if (!value || typeof value !== "object")
+        return;
+    if (isObjectReference(value))
+        throw new Error("Managed references belong in declared RPC references or graph relationships, not ordinary state/messages");
+    if (seen.has(value))
+        throw new Error("Cyclic ordinary data");
+    seen.add(value);
+    if (!(value instanceof Uint8Array))
+        for (const child of Object.values(value))
+            assertReferenceFree(child, seen);
+    seen.delete(value);
+};

dist/relationships.d.ts

@@ -0,0 +1,30 @@
+import type { QxObjectRef } from "./references.js";
+import type { RelationshipCollection, RelationshipEntry } from "./index.js";
+type Key = string | boolean | bigint;
+type Port<T extends QxObjectRef> = {
+    collection(): Promise<RelationshipCollection<T>>;
+    replace(entries: RelationshipEntry<T>[], expectedRevision: bigint): Promise<RelationshipCollection<T>>;
+};
+/** Helpers never retry a failed CAS or silently overwrite concurrent edits. */
+export declare const relationshipMap: <T extends QxObjectRef, K extends Key = Key>(port: Port<T>) => {
+    read: () => Promise<RelationshipCollection<T>>;
+    get(key: K): Promise<{
+        revision: bigint;
+        value: T | undefined;
+    }>;
+    set(key: K, target: T, expectedRevision: bigint): Promise<RelationshipCollection<T>>;
+    delete(key: K, expectedRevision: bigint): Promise<RelationshipCollection<T>>;
+};
+export declare const relationshipList: <T extends QxObjectRef>(port: Port<T>) => {
+    read: () => Promise<RelationshipCollection<T>>;
+    insert(index: number, target: T, expectedRevision: bigint): Promise<RelationshipCollection<T>>;
+    move(edgeId: string, index: number, expectedRevision: bigint): Promise<RelationshipCollection<T>>;
+    delete(edgeId: string, expectedRevision: bigint): Promise<RelationshipCollection<T>>;
+};
+export declare const relationshipSet: <T extends QxObjectRef>(port: Port<T>) => {
+    read: () => Promise<RelationshipCollection<T>>;
+    add(target: T, expectedRevision: bigint): Promise<RelationshipCollection<T>>;
+    delete(target: T, expectedRevision: bigint): Promise<RelationshipCollection<T>>;
+};
+export {};
+//# sourceMappingURL=relationships.d.ts.map

dist/relationships.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"relationships.d.ts","sourceRoot":"","sources":["../src/relationships.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAC,WAAW,EAAC,MAAM,iBAAiB,CAAC;AACjD,OAAO,KAAK,EAAC,sBAAsB,EAAE,iBAAiB,EAAC,MAAM,YAAY,CAAC;AAC1E,KAAK,GAAG,GAAG,MAAM,GAAG,OAAO,GAAG,MAAM,CAAC;AACrC,KAAK,IAAI,CAAC,CAAC,SAAS,WAAW,IAAI;IAAC,UAAU,IAAI,OAAO,CAAC,sBAAsB,CAAC,CAAC,CAAC,CAAC,CAAC;IAAC,OAAO,CAAC,OAAO,EAAE,iBAAiB,CAAC,CAAC,CAAC,EAAE,EAAE,gBAAgB,EAAE,MAAM,GAAG,OAAO,CAAC,sBAAsB,CAAC,CAAC,CAAC,CAAC,CAAA;CAAC,CAAC;AAM9L,+EAA+E;AAC/E,eAAO,MAAM,eAAe,GAAI,CAAC,SAAS,WAAW,EAAE,CAAC,SAAS,GAAG,GAAG,GAAG,QAAQ,IAAI,CAAC,CAAC,CAAC;IACvF,IAAI;IACE,GAAG,MAAM,CAAC;;;;IACV,GAAG,MAAM,CAAC,UAAU,CAAC,oBAAoB,MAAM;IAO/C,MAAM,MAAM,CAAC,oBAAoB,MAAM;CAI7C,CAAC;AACH,eAAO,MAAM,gBAAgB,GAAI,CAAC,SAAS,WAAW,QAAQ,IAAI,CAAC,CAAC,CAAC;IACnE,IAAI;IACE,MAAM,QAAQ,MAAM,UAAU,CAAC,oBAAoB,MAAM;IAMzD,IAAI,SAAS,MAAM,SAAS,MAAM,oBAAoB,MAAM;IAQ5D,MAAM,SAAS,MAAM,oBAAoB,MAAM;CAKrD,CAAC;AACH,eAAO,MAAM,eAAe,GAAI,CAAC,SAAS,WAAW,QAAQ,IAAI,CAAC,CAAC,CAAC;IAClE,IAAI;IACE,GAAG,SAAS,CAAC,oBAAoB,MAAM;IAKvC,MAAM,SAAS,CAAC,oBAAoB,MAAM;CAIhD,CAAC"}

dist/relationships.js

@@ -0,0 +1,60 @@
+const checked = async (port, revision) => {
+    const snapshot = await port.collection();
+    if (snapshot.revision !== revision)
+        throw new Error("STALE_COLLECTION_REVISION");
+    return snapshot;
+};
+/** Helpers never retry a failed CAS or silently overwrite concurrent edits. */
+export const relationshipMap = (port) => ({
+    read: () => port.collection(),
+    async get(key) { const snapshot = await port.collection(); return { revision: snapshot.revision, value: snapshot.entries.find((entry) => entry.key === key)?.target }; },
+    async set(key, target, expectedRevision) {
+        const snapshot = await checked(port, expectedRevision);
+        const entries = snapshot.entries.filter((entry) => entry.key !== key);
+        const existing = snapshot.entries.find((entry) => entry.key === key && entry.target.equals(target));
+        entries.push(existing ?? { key, target });
+        return port.replace(entries, expectedRevision);
+    },
+    async delete(key, expectedRevision) {
+        const snapshot = await checked(port, expectedRevision);
+        return port.replace(snapshot.entries.filter((entry) => entry.key !== key), expectedRevision);
+    },
+});
+export const relationshipList = (port) => ({
+    read: () => port.collection(),
+    async insert(index, target, expectedRevision) {
+        const snapshot = await checked(port, expectedRevision);
+        if (!Number.isSafeInteger(index) || index < 0 || index > snapshot.entries.length)
+            throw new Error("List index out of bounds");
+        snapshot.entries.splice(index, 0, { target });
+        return port.replace(snapshot.entries, expectedRevision);
+    },
+    async move(edgeId, index, expectedRevision) {
+        const snapshot = await checked(port, expectedRevision);
+        const prior = snapshot.entries.findIndex((entry) => entry.edgeId === edgeId);
+        if (prior < 0 || !Number.isSafeInteger(index) || index < 0 || index >= snapshot.entries.length)
+            throw new Error("Unknown list entry or invalid index");
+        const [entry] = snapshot.entries.splice(prior, 1);
+        snapshot.entries.splice(index, 0, entry);
+        return port.replace(snapshot.entries, expectedRevision);
+    },
+    async delete(edgeId, expectedRevision) {
+        const snapshot = await checked(port, expectedRevision);
+        if (!snapshot.entries.some((entry) => entry.edgeId === edgeId))
+            throw new Error("Unknown list entry");
+        return port.replace(snapshot.entries.filter((entry) => entry.edgeId !== edgeId), expectedRevision);
+    },
+});
+export const relationshipSet = (port) => ({
+    read: () => port.collection(),
+    async add(target, expectedRevision) {
+        const snapshot = await checked(port, expectedRevision);
+        if (snapshot.entries.some((entry) => entry.target.equals(target)))
+            return snapshot;
+        return port.replace([...snapshot.entries, { target }], expectedRevision);
+    },
+    async delete(target, expectedRevision) {
+        const snapshot = await checked(port, expectedRevision);
+        return port.replace(snapshot.entries.filter((entry) => !entry.target.equals(target)), expectedRevision);
+    },
+});